找回密码
 注册

QQ登录

只需一步,快速开始

About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>
4 f! |  F1 G( ^$ L4 ^! Y<TBODY>( ^; d: E( Q7 _' h
<TR>. J$ y8 l) u+ B
<TD><PRE>Method 01
" ~9 w' U7 _! P) x+ e=========) u* k+ l/ E2 u: a
. Y8 I, K' i. Y& k" _$ d7 q+ Z+ ^
This method of detection of SoftICE (as well as the following one) is
, m1 P& [- K5 i: B! y5 bused by the majority of packers/encryptors found on Internet.! j$ c5 U. D* I1 y. k* R
It seeks the signature of BoundsChecker in SoftICE: n- Q; y! ?# \$ L* |, ~

. A% y: X; i/ X$ Q    mov     ebp, 04243484Bh        ; 'BCHK'$ e' i/ }% @/ a, \
    mov     ax, 04h
3 h& {: [& i& a9 C    int     3      
( p- p" Z8 k( x' _; s$ o/ H    cmp     al,4
/ K% r5 c9 D# b* k    jnz     SoftICE_Detected  C" K' g$ O4 r
: P8 J" t- F7 B  D) `
___________________________________________________________________________
2 {0 q- _: H) r7 X/ L' W
  H6 e# ?9 j+ @4 IMethod 02
. `8 {0 M* W+ t3 p=========
% j2 S/ h0 R( g$ z  Z- M- ~5 H6 V# v0 D7 a- y7 l4 G
Still a method very much used (perhaps the most frequent one).  It is used# A3 {: h% K7 M( ?8 d8 I$ \3 E. c
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,4 S% F1 B! |/ n# E$ |# b
or execute SoftICE commands...
% I7 ^  T. g) J4 xIt is also used to crash SoftICE and to force it to execute any commands! |' x) ?* I- ^2 f' f4 D! g
(HBOOT...) :-((  
$ E% z& I# b- I  g' ]# \7 z1 J+ l5 b" {, U
Here is a quick description:
. X" J) W; K, {; ~1 B-AX = 0910h   (Display string in SIce windows)6 ~( Q) h8 R4 O$ h
-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)& a& v/ t3 w9 B! S1 P# J
-AX = 0912h   (Get breakpoint infos). {/ v4 |/ b  m
-AX = 0913h   (Set Sice breakpoints), S1 k; }8 X) b: m
-AX = 0914h   (Remove SIce breakoints). w3 J& |1 Z/ f- T6 Z
! Y1 K- i# l* T& ]
Each time you'll meet this trick, you'll see:
( I1 d/ l0 z3 `( S" D" d0 ^-SI = 4647h
9 C; O  B, k$ w1 x9 r1 T-DI = 4A4Dh4 J' M& n# y& D4 Y' j7 z
Which are the 'magic values' used by SoftIce.
# w8 l' a% z1 X6 Z3 d" sFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.
7 h$ h" t) Y4 N) |% n3 g3 G# m8 J& N& L& H
Here is one example from the file "Haspinst.exe" which is the dongle HASP
' [4 h8 h, \3 a: zEnvelope utility use to protect DOS applications:+ e: o" ]* I; l- U* O* Y8 D

6 N* F- d) }! w6 @5 j9 v
2 C7 A# T7 l8 a, d( u1 s, b* T4C19:0095   MOV    AX,0911  ; execute command.
+ L& t7 Y- N6 G5 O+ v. \. N4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).8 \$ x' i, x: X8 H
4C19:009A   MOV    SI,4647  ; 1st magic value.' V) X8 W& p* i) ^
4C19:009D   MOV    DI,4A4D  ; 2nd magic value.& Y. M6 d, Z1 D- E: g: ]7 a, e2 O$ K/ E
4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
0 A, y% s- r1 W5 C" |; \+ x4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute
1 w/ a9 Z7 t$ J* V+ {. H# h4C19:00A4   INC    CX. S& q4 x; I3 A! l" i* u
4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute
' y( K; j* E/ m) Z& N9 n) `4C19:00A8   JB     0095     ; 6 different commands.
1 z/ ]* j# p4 J) {' p* K3 U* }) L4C19:00AA   JMP    0002     ; Bad_Guy jmp back.
1 X- \% ?% N* C0 R4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)" B) C4 S: E& G1 L1 c
. T9 V) j  B/ v9 [& g
The program will execute 6 different SIce commands located at ds:dx, which3 N7 s. [# R) M0 Y( z4 p2 d
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
. [5 x9 x8 A8 J
7 W1 _& R/ \6 i4 K- a' Z* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
% s0 S% ~) X% u8 M" Q6 m7 Q___________________________________________________________________________
; C8 _% Z5 I  z
, k  {& b( u" w) N
- Q$ f% f/ q' d& e: P2 oMethod 03- c% _% t6 \8 T+ f8 D
=========
/ N! i5 ^% U9 h5 \# a; }
" S+ p+ w! X$ gLess used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
/ `- U+ a% C* ^3 e( C4 a(API Get entry point)
# v' c" b" H" u        
! \* j$ [9 s2 |3 J- |# A8 |5 @% M/ e+ V0 d
    xor     di,di
5 g5 ~8 U8 }+ n: a8 u1 B    mov     es,di
" I" H6 {% @& L& ?! ]    mov     ax, 1684h       & S% t# s$ ~1 O; X+ ^$ t+ i! x
    mov     bx, 0202h       ; VxD ID of winice
, c/ B# }6 F9 w    int     2Fh
3 U+ C+ Z# q. N9 G. j+ c$ E    mov     ax, es          ; ES:DI -&gt; VxD API entry point
* {8 z$ [8 l: x* r7 w    add     ax, di/ F$ N. P$ m6 J% m' g" U3 o6 \
    test    ax,ax+ [( ~) Z" E* P8 \8 J: [5 Q
    jnz     SoftICE_Detected
+ s9 X# ?8 ]' m9 p/ \" A) l- _" V
___________________________________________________________________________
+ k' \0 \, W7 M! X7 q% R. Q4 {. [- w( C/ L4 x
Method 04/ f" H; X4 B) H( o" Y6 F! Y# Z
=========
9 L9 p8 `/ I0 z3 ?0 d' z3 x3 ~: x6 q
Method identical to the preceding one except that it seeks the ID of SoftICE
2 k5 U7 @5 i: j3 n  v+ h1 bGFX VxD.
4 W6 n) F# g' |7 I- ?& S7 u2 ?: `! }" N
    xor     di,di
' l8 _% @2 D9 q2 c8 V3 Y% b9 J! y    mov     es,di; B2 h. `* P1 U1 M) w' O  O% j
    mov     ax, 1684h      
# Q9 w0 `9 |, ^3 B    mov     bx, 7a5Fh       ; VxD ID of SIWVID5 |/ d) M! e% H* x$ T
    int     2fh7 ~; F, ?8 d. O
    mov     ax, es          ; ES:DI -&gt; VxD API entry point
. {6 ^: A" M# @2 v; Z6 k0 x    add     ax, di+ R7 [- `! x3 S" k: L
    test    ax,ax9 |! L4 F) d. q& d
    jnz     SoftICE_Detected# G5 l2 K; p- ?- E8 e
! @! n' M! z  T0 H8 {+ V3 E
__________________________________________________________________________
- P& C- j0 y3 ~1 @$ P( m) Z4 [! m1 M! i# D" R! b& |

2 {% [9 I( ~# f3 A+ Q  gMethod 05. O1 r" N; v" Z1 ~$ b
=========1 T$ z( a7 `: U; j- `5 s3 x) `4 `9 w
3 W; |4 T' f3 ^. s
Method seeking the 'magic number' 0F386h returned (in ax) by all system
& D/ G! d7 b, Jdebugger. It calls the int 41h, function 4Fh.3 n1 \6 M* ]+ E- s, {2 N
There are several alternatives.  
! v2 q6 U1 a8 r  x9 w
4 a. X- Z1 v. F6 [1 F$ V* {The following one is the simplest:! T4 \: [; |2 N, r
( t" X3 p; K6 X! t$ i
    mov     ax,4fh9 ~3 c- q. q: C
    int     41h: C% i3 ~% b$ s: U- u* Y1 p
    cmp     ax, 0F386
7 _+ [. m0 v" r/ X# k% d5 l    jz      SoftICE_detected7 k, U7 @+ ?0 \- P! x

" ?/ S* I* Z4 s
! M, X9 K$ [  G; U/ VNext method as well as the following one are 2 examples from Stone's & z0 R- b: Z1 I5 I% R& Z- _
"stn-wid.zip" (www.cracking.net):
- B* j$ {: ]9 y) B7 v; k
$ c( @$ C' N5 q4 m" M    mov     bx, cs
$ n# P  O: E5 O* k6 q; d    lea     dx, int41handler2
) I* I' z: C$ s    xchg    dx, es:[41h*4]& U8 q  A# A  i: l3 o
    xchg    bx, es:[41h*4+2]
+ y7 s8 ^1 A0 o( o    mov     ax,4fh- V/ O# O- W9 A3 N5 {6 d1 H
    int     41h$ S' S2 ~7 f% ^/ o: ~9 R6 V8 ~* b
    xchg    dx, es:[41h*4]" e, Y7 W- ^0 i* k6 o8 z; M  ]( V
    xchg    bx, es:[41h*4+2]- v/ k- b- |5 i  I/ G# g
    cmp     ax, 0f386h
' ~; g, ~) F$ l* W    jz      SoftICE_detected
# ~5 }0 P; e" R4 ]9 k/ q2 w
4 E9 ]. ]) r  H* I( F: Lint41handler2 PROC0 @! @2 W. ^/ N, A
    iret* Y7 ]0 @7 P, u; ?2 c
int41handler2 ENDP
9 _7 A1 E* X1 T9 k8 B$ s5 @- J9 w8 J5 f2 c5 z. Q

& E% m7 v$ \% o" V3 t& O, u  e; Z_________________________________________________________________________
+ j+ n1 T( o# a3 @- a2 {* ^' p: e$ I: A/ a6 x9 p

9 J5 T" G+ b% H' [- a" J( CMethod 06
5 T6 {" l& z1 `' r# t% s9 U=========. H, x7 t/ l2 w  j1 f- g2 D
' N0 d+ N2 j: X
" u) U, H6 `: I
2nd method similar to the preceding one but more difficult to detect:
4 M& e9 ^, }8 y$ _
4 z* K0 Z4 E) m! V& E( k0 A, B( W. g! ^3 Q5 s
int41handler PROC2 n9 E) B, E* L1 e. F
    mov     cl,al
/ ^2 w' ]9 m1 J8 P# `- Y9 B    iret) {; ~8 \0 m5 {
int41handler ENDP5 f( E  a8 S) `

9 {; o/ D2 Z$ x: y# N* r, Q, B/ o$ S
    xor     ax,ax
- K6 y1 X% g1 W( j    mov     es,ax
" p! i# _" N5 Q4 @. k    mov     bx, cs/ y- [5 ~0 [$ y* A8 Z0 N# C
    lea     dx, int41handler
1 z, V* z3 ]8 y& q    xchg    dx, es:[41h*4]
- w# ?5 z( U0 ?) Y    xchg    bx, es:[41h*4+2]
/ |. ^7 M" o* T3 Y9 e4 r! L    in      al, 40h4 m9 M! C# u) g# T
    xor     cx,cx5 h# r$ f" l  }; k
    int     41h
6 @  F1 k0 @9 Q# T7 b- \    xchg    dx, es:[41h*4], t% Z( h0 t: u& ?" \! |. n& \
    xchg    bx, es:[41h*4+2]3 @, `9 f5 b) e7 ~( H
    cmp     cl,al
2 h1 L# O9 B1 @, Z0 O* n2 G- O. q8 w% _    jnz     SoftICE_detected
- l5 A) [% p# A+ I$ i  V
- |" |5 z2 F! c4 r$ F_________________________________________________________________________/ U, U+ B5 c9 k

; M' J2 h- L6 [" o7 w7 BMethod 07
( I; _0 j+ ~" M) H3 V=========5 B/ F+ }  S: O& H4 U
  j! I) o) X! h: T
Method of detection of the WinICE handler in the int68h (V86)+ F+ I( \& _6 R
% Q: @' h$ r( Y! u
    mov     ah,43h8 ~" n, P/ |/ ^$ ]( S% Q* g. E2 c7 \
    int     68h5 k$ h3 ^/ N' ^/ b+ p& s
    cmp     ax,0F386h
; H* h6 u1 ]7 p8 ~    jz      SoftICE_Detected/ Y# z3 Y9 n; A, v4 K" D$ E8 I

! Z. w" R; h. S8 O# K8 b1 Q/ q+ M( J# i' i, n; ]
=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
& [" n8 [2 R% |& o. I' l% S   app like this:
: E$ z: L% s4 G) I3 E8 h* q4 P3 r1 ^5 ^0 k7 @/ ]& C) D9 t
   BPX exec_int if ax==68
) W( m8 F5 j( q: c, x. `   (function called is located at byte ptr [ebp+1Dh] and client eip is1 V; Q  s1 I2 V2 N8 `% g1 u1 N
   located at [ebp+48h] for 32Bit apps)0 z7 b$ E9 X! a, J( g9 h
__________________________________________________________________________# C) h7 t& y, F' p) V
2 i4 E4 }! Y( G) l9 Y3 k

. B5 N: W- a' q. cMethod 083 e1 X, c3 {! ]) W  F# N6 Z2 ?
=========
5 s# c; [7 F+ I* i  b; N8 @7 L
! k' K8 q1 H' s4 y& p9 ~& C" bIt is not a method of detection of SoftICE but a possibility to crash the
& i# @3 C! q4 G( nsystem by intercepting int 01h and int 03h and redirecting them to another
  [* f, I2 p- @0 wroutine.# l( y1 {( N+ h/ B. F
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
7 ^5 |' m" x, N7 ?to the new routine to execute (hangs computer...)  N  ?" D  B9 y  a; `+ R6 ]( X

( B7 |  ^1 R" ?    mov     ah, 25h
! u+ p; \2 e/ v& w* s    mov     al, Int_Number (01h or 03h)
! f- h/ J! h; t    mov     dx, offset New_Int_Routine
. J8 I8 w- \) v, |    int     21h
: ?/ `( t; N: j* ^7 P6 [! o7 e. D
# Q8 A8 I; b: K; w3 S4 J! S5 i__________________________________________________________________________
0 c* T8 E- Y1 B. _) w% l0 ?3 \/ r, f( H2 ~
Method 096 g5 B) `0 \* h5 r8 k' L: k
=========
. V# K! {  n6 @+ E! h& Y/ u6 Z6 F/ }+ ?4 C- i: S6 T4 x- g8 y
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only0 ?7 F8 [, r2 B
performed in ring0 (VxD or a ring3 app using the VxdCall).% g, ?. n% ]* P8 X* Z" ~9 p4 Y
The Get_DDB service is used to determine whether or not a VxD is installed  u/ E7 R. L* `. ^! ^( a& j/ a
for the specified device and returns a Device Description Block (in ecx) for
0 r& O' \7 w7 l0 L  j+ B: T+ Zthat device if it is installed.
. P# L" m" F/ r# K8 U4 v; W0 E7 C6 o4 E# s# i7 u+ L$ e2 E1 d/ }
   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID& N! v1 x0 b2 `! ~/ Q" f
   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
; t) q0 Z* _( d8 ~1 R& P   VMMCall Get_DDB2 D$ S/ U2 z1 M1 F% ]& y! P( ^4 Q
   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed
+ G* y, B1 [: T: E2 h
" ]9 W7 O: E# t4 _' d6 h% T5 uNote as well that you can easily detect this method with SoftICE:1 P, B+ `, V! x+ j6 v
   bpx Get_DDB if ax==0202 || ax==7a5fh
7 R# b# `% t) P+ A7 m
) }# K5 @4 D; {__________________________________________________________________________. l: i3 z8 U- k
4 H/ `( g' Q$ H5 l; o" H
Method 10# N6 N: ^8 S, u2 j! s/ m" a
=========
6 g' @+ r  F1 Y7 w* w2 p+ c/ `% _( i
=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with1 [- s* K7 C/ ~
  SoftICE while the option is enable!!: n: o" q" B7 J% t6 G, S
7 W) X( x* @8 e- P
This trick is very efficient:
; |" e5 |0 v$ Iby checking the Debug Registers, you can detect if SoftICE is loaded9 t' v/ i3 P4 u7 W# @. D' k! Q
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if0 M4 \- |( ^- L; S' p+ |
there are some memory breakpoints set (dr0 to dr3) simply by reading their, R$ w+ w" x4 v% F
value (in ring0 only). Values can be manipulated and or changed as well9 \2 H( }" L+ k$ y8 K# T
(clearing BPMs for instance)
1 H( ?+ U+ c, S+ `( g$ Y% F2 B$ S) u
__________________________________________________________________________+ o0 J! `$ \# p* r; ~0 e
0 P* c! O( \1 m# G) P
Method 11
$ H$ Z) e1 y. M1 c( t" F=========
/ S2 o1 ~- \, V1 o0 M3 L- ^. `9 I# v: ^" y* }4 ]
This method is most known as 'MeltICE' because it has been freely distributed
) N4 U2 A$ T  q5 pvia www.winfiles.com. However it was first used by NuMega people to allow# ]/ K% e3 U" f: A8 L
Symbol Loader to check if SoftICE was active or not (the code is located
* {3 o: s: ?$ C4 Ginside nmtrans.dll).7 P! |. G& Y+ A, z& c$ ?/ {

* E* B1 N7 ?/ C- Z0 mThe way it works is very simple:
3 l/ s- d2 C" p8 @) R9 IIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
1 T1 n1 M8 X) [8 Q4 B. p1 zWinNT) with the CreateFileA API.
3 L0 K$ X7 z# |5 i8 a+ b' N& H- Q0 y4 i) z; n* Q$ [
Here is a sample (checking for 'SICE'):  o* j; ?- \! |7 F" E! z

6 H) |! c6 Y$ K' ^; a' Y, w' ?BOOL IsSoftIce95Loaded()8 ?6 s5 q3 X6 ]- n2 b
{# T1 f. n6 V! C/ @" {
   HANDLE hFile;  2 d; T+ y/ @! {$ Z# i1 j
   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,% p' q; N- R* w5 I- Q- t) X
                      FILE_SHARE_READ | FILE_SHARE_WRITE,
& f! k: T* @# h, Y* D                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
; ~/ o: N: g4 Z$ ^# `% I   if( hFile != INVALID_HANDLE_VALUE )
8 d' E4 D, k! j6 b5 ]3 v   {
" M$ h$ D- T9 N4 @! v& Z$ i1 m      CloseHandle(hFile);
8 R0 M7 Z$ n+ X9 _  P% k      return TRUE;8 q! M+ w: w; [
   }
) F3 z  Z3 `/ W5 ?, `. j   return FALSE;$ a3 C- q  I! J# o/ T8 A
}
) ^, |4 x) a/ K! [6 o1 E" N, O! ^
Although this trick calls the CreateFileA function, don't even expect to be' C8 e2 X; ^  K) J
able to intercept it by installing a IFS hook: it will not work, no way!
% O# C; R' o! b7 p! S1 x2 B9 [In fact, after the call to CreateFileA it will get through VWIN32 0x001F
( {3 U' T: m6 D; ?service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
3 U+ E' l4 z9 e6 Nand then browse the DDB list until it find the VxD and its DDB_Control_Proc9 |* b2 T5 b! U: u$ Q# b% w$ ]% f3 {
field.
, W) x. n$ c% s7 o% q2 UIn fact, its purpose is not to load/unload VxDs but only to send a - l. |% U5 R& u5 M# J
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
$ J8 a/ h8 I: D  i1 eto the VxD Control_Dispatch proc (how the hell a shareware soft could try4 g& L# V4 Q' R( Q! K  g
to load/unload a non-dynamically loadable driver such as SoftICE ;-).- ~" `$ n/ W" B' \
If the VxD is loaded, it will always clear eax and the Carry flag to allow/ ]7 H# p7 L* O3 x
its handle to be opened and then, will be detected.
' r. x! h0 Y0 e0 B# JYou can check that simply by hooking Winice.exe control proc entry point. ], H( ?, C0 V, C
while running MeltICE.
- n7 y1 R/ z  R
: c5 S3 k9 e8 E. Y0 n) g3 ?  D! s% C; @1 W
  00401067:  push      00402025    ; \\.\SICE
  N& R" v9 q$ u8 m1 p! w  0040106C:  call      CreateFileA
" i/ a! ]+ R8 Y8 o' Z  00401071:  cmp       eax,-001
# Q4 Z# j2 W; X5 v3 T; S  00401074:  je        00401091& X0 f! p9 {( g) u$ ]

2 }6 o2 x$ g1 w0 s9 e! S% \
! Z# ~% n3 Y7 E# _$ ]! WThere could be hundreds of BPX you could use to detect this trick.
! a0 i. L1 Q$ r/ r! S4 w-The most classical one is:4 G2 [0 L1 @# F
  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||
5 V$ J8 e4 z; G" k! h    *(esp-&gt;4+4)=='NTIC'
. l9 p* o2 d- h! c, M' T) [3 k
- z% m9 r6 N8 u0 ?% B3 I  U5 n% H-The most exotic ones (could be very slooooow :-(
. D( J9 [" d: P. v1 W5 s# [" G% e5 X   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  : M' L4 i; w) S/ e+ `
     ;will break 3 times :-(
& d7 [+ q+ O0 d; X) `' v
0 Q9 A) h/ W  R$ W! E2 q* S-or (a bit) faster:
+ x- u0 B" E: k, @' D   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
; S( G- S$ O+ X0 ~/ U
2 B6 _( {8 u* Q' _8 u5 d) _   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  
2 S$ p, O/ O8 T  \- G" x$ z     ;will break 3 times :-(
2 v3 W) A$ {8 {; [
9 O1 H8 |% I' p-Much faster:. {( [* j' @% u  q  B& D! V
   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'
1 Y$ ^; T9 B, b. B+ D# z0 v9 W' j# Q
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
6 N6 j9 t8 O! d8 o/ V* lfunction to do the same job:: [7 ?# s5 z( X" d7 a" j
4 N# g+ g- A& y0 ~! N
   push    00                        ; OF_READ: H# w- ~& j# |3 \* H' Q  e! m2 r
   mov     eax,[00656634]            ; '\\.\SICE',02 S9 c* M5 `4 Q5 |
   push    eax. C/ e5 p- N% z6 N3 D2 G
   call    KERNEL32!_lopen
6 q% A% k1 \- ~" _1 l' g* M   inc     eax2 L0 o9 H2 ~  B' G
   jnz     00650589                  ; detected' e+ D+ _6 a3 l! |) `; \0 z1 M
   push    00                        ; OF_READ
0 x- @: f! R; y" {7 d   mov     eax,[00656638]            ; '\\.\SICE'& Y! n+ I' ~  m5 @2 _' `6 ]
   push    eax
3 k: l; _0 U# L" d! n   call    KERNEL32!_lopen
( G, w2 H, i3 T$ V   inc     eax7 a7 s% o; I7 U% C; t' o3 O1 U
   jz      006505ae                  ; not detected
+ p4 o4 k; `& q# ]" b* C  _! x: ]" [3 H6 Z/ y" q1 ^% ?& P

: o. F$ _8 g1 j, J9 K# k2 Y__________________________________________________________________________
9 l8 \6 ?* }# W7 R; y
3 ], i; l/ K& t: i. sMethod 12
# C: J: [/ k5 ~  g: u# ~=========' l% V% }6 H5 P" d4 \, g- j
  p# E7 I" Z; c  H" P9 M3 I
This trick is similar to int41h/4fh Debugger installation check (code 05
2 v6 t2 F! }$ Z7 h- @&amp; 06) but very limited because it's only available for Win95/98 (not NT)% o. `! P7 U. x3 s4 Y2 _) u
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.& }, N4 Y( A! r* E. U
3 `0 f$ ?" G, n# s. A$ r7 Z2 ^
   push  0000004fh         ; function 4fh$ p$ r: o8 K$ Z) |/ I1 w; G
   push  002a002ah         ; high word specifies which VxD (VWIN32)
* r% C7 @+ U7 O- ?+ E                           ; low word specifies which service
' b; {6 h" k9 F; X* G                             (VWIN32_Int41Dispatch)4 W5 \: p- H* A% H
   call  Kernel32!ORD_001  ; VxdCall
( k5 X2 ~  Y. @' A0 Z. O  @   cmp   ax, 0f386h        ; magic number returned by system debuggers
' o1 q; v. Z1 G" x6 Q6 `   jz    SoftICE_detected
9 p, }9 V9 H. P- x# y8 S" r  ]8 ]! S# d/ _
Here again, several ways to detect it:$ K0 {8 |! q: g! X" ~

, ~+ _! v4 [6 i& G, z: f    BPINT 41 if ax==4f
9 I" K0 ?9 y2 Z5 o
; E. z* ^- Q! n    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one2 Y7 @( ~/ v( X1 _1 X1 I# K* `

8 w9 k+ j4 K6 I  x- p. r    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A) U% T2 K" m2 z2 @
; q) O- b1 R+ W1 s( B: q% I
    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!8 O7 q8 Y$ ~, V& j3 q4 s8 c- l
. b4 i4 r# {% x3 C
__________________________________________________________________________
# d# k. p6 t3 ~8 W6 f+ L3 G  [
, K- a/ L& }: t# B1 d; y6 ?- uMethod 13' Z$ h: C0 W' S) ?2 E
=========7 G& I0 u5 M* {/ Y: R' w4 h
/ f+ h& C3 a. N1 x* o
Not a real method of detection, but a good way to know if SoftICE is9 ?* e( o' a) ~. T6 _2 c* f
installed on a computer and to locate its installation directory.# x: S. I' j  Z# p4 G9 R; ?
It is used by few softs which access the following registry keys (usually #2) :1 P" s6 l; R5 u8 C& Z% Q8 F, D

" {, ^8 x! q+ f* p: k) C! H4 p. C( `-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
1 v" Y4 [" }3 s; Z' O1 \6 @\Uninstall\SoftICE% h4 a4 y* z% ~8 }. C5 n2 \+ c
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE/ K4 K6 k2 r- T+ P/ u+ ~
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion; f+ r' W" q- U$ U
\App Paths\Loader32.Exe
3 j+ ?/ U1 U- y2 o) Y2 @3 w* o9 X. B
2 L& _; _9 u2 d! B- g
Note that some nasty apps could then erase all files from SoftICE directory
: w6 x2 G* M1 c% ~( h) O(I faced that once :-(
' O  S" }1 l; i
7 ^8 Y" W  k! ?' ]Useful breakpoint to detect it:) \0 L# d  P1 z& i9 W

$ Z/ A9 _* P9 T, A) H  A3 Q, k5 @* E3 ^     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'
+ U! s0 K( Z/ N: Y; F! [
" U& T5 Q# G. ]__________________________________________________________________________
2 g' L8 J5 w8 M
5 R, j7 e4 P$ t, A, Z% ?' T% H2 H& T1 w3 z4 J/ I
Method 14 $ E+ {! ^! h" ?5 L  E0 l# Q
=========1 K4 |7 M& p7 S& F+ h: F
, S) b, `/ {( y
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
- h# L7 t" d* i0 mis to determines whether a debugger is running on your system (ring0 only).
+ S3 O# D' B. n5 B/ G. A' c5 X' O: `
   VMMCall Test_Debug_Installed
+ a$ P1 c7 q8 @" h6 \   je      not_installed
! t7 o. F& i; g6 s$ U
$ g" K% r& L$ |; n7 f# \This service just checks a flag.
4 `5 e  l" r3 G* H* E2 c( X</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

QQ|本地广告联系: QQ:905790666 TEL:13176190456|Archiver|手机版|小黑屋|汶上信息港 ( 鲁ICP备19052200号-1 )

GMT+8, 2026-8-15 15:28

Powered by Discuz! X5.0

© 2001-2026 Discuz! Team.

快速回复 返回顶部 返回列表