About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>5 i/ e- n8 ^" Q6 k/ U$ ^: h% g# }
<TBODY>- |5 _& h4 s. K, O* h
<TR>) m, @" C$ c2 b2 j% ^5 t* f
<TD><PRE>Method 01
$ m8 O. v/ P" u( X7 A7 e9 n=========
' ]. B8 E1 @4 Z2 R7 j
; l& L% [2 I3 g" n# v8 B4 DThis method of detection of SoftICE (as well as the following one) is
9 H8 _5 X, p" Y7 Uused by the majority of packers/encryptors found on Internet.. p0 s/ p4 q' G7 u5 q
It seeks the signature of BoundsChecker in SoftICE
5 d4 i/ h; Y9 \8 J: A
, P4 ~5 S& b8 g8 Y/ q    mov     ebp, 04243484Bh        ; 'BCHK'" n% o) T3 F. j. Q9 [8 A* J) ?+ Z9 n
    mov     ax, 04h6 e( w8 a9 r* c" Y/ s% I
    int     3      
" e4 I1 ?+ m. \9 v$ v1 D8 Q    cmp     al,4
8 G+ ^5 M4 w1 R6 N. b5 m    jnz     SoftICE_Detected% _# M* L6 \3 A+ e8 `! ~/ c
% o3 M  X5 m4 V
___________________________________________________________________________: a' _1 e4 B7 m4 X3 m: a

, T2 i9 I/ `! }; A' oMethod 02
* _% ]! v+ O0 y, W! E0 u& g( _=========* U3 z* a# o7 d2 I0 a# Y: |# q

; V' |7 G; ?; F' [+ c. dStill a method very much used (perhaps the most frequent one).  It is used
& M; q/ C- t4 n) l/ \2 W  Yto get SoftICE 'Back Door commands' which gives infos on Breakpoints,! F# ?7 s. }; J1 o. e
or execute SoftICE commands...
4 ~; b0 B, ^: ?) AIt is also used to crash SoftICE and to force it to execute any commands
) i8 b: g2 n( P  D* v4 ~5 R(HBOOT...) :-((  4 ?. P! R' D# {, k3 X. x
! @2 E( l/ _+ s+ J/ A. l
Here is a quick description:
, d% p6 k6 l  Y0 c$ B-AX = 0910h   (Display string in SIce windows)
; t$ J9 B/ l* z* K8 m( H5 i4 B-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)
. m2 F* P- u; h2 G$ R" ~- z0 g0 q  N-AX = 0912h   (Get breakpoint infos)
3 ~; O- T' ^$ w, N/ f% j( m-AX = 0913h   (Set Sice breakpoints)/ h8 u+ K" p' _' {
-AX = 0914h   (Remove SIce breakoints)
9 N, l; r! V$ e  q, F2 K# G6 w" Q) g+ _
Each time you'll meet this trick, you'll see:- y8 [& J- Z8 D$ h5 ~9 f
-SI = 4647h# `) y* M9 @  C; }% a  c
-DI = 4A4Dh' }$ X2 s6 ?. v; U
Which are the 'magic values' used by SoftIce.) @: p2 \2 B; i+ b
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.2 ?. p" w! \" F- u& V2 q
& _" L" F: D. Y9 Z. r) r- h' |
Here is one example from the file "Haspinst.exe" which is the dongle HASP
' w; e! n( e: i: y4 |6 x. PEnvelope utility use to protect DOS applications:
2 I! L: D- q8 P, }  }& _0 K% g6 _8 [* Y# W2 m# N

6 s" z% p! C" w2 q4C19:0095   MOV    AX,0911  ; execute command.
! i5 l, p  n& J! P/ b  M. I4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).
( W: F6 j% k) ~4 A4 {. B4C19:009A   MOV    SI,4647  ; 1st magic value.
" [1 p# H! Y. l. ]# A! T4C19:009D   MOV    DI,4A4D  ; 2nd magic value.5 W5 G% f$ @$ Z) g% Q1 l$ b  S
4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)7 Z) X: w* U! x3 p
4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute7 k! {$ s! ]- t; }! ^& T9 P# }
4C19:00A4   INC    CX
* C( x1 ^, F* U4 K) D7 N. A2 U/ f4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute7 Z2 Z3 r9 T7 l% V8 `
4C19:00A8   JB     0095     ; 6 different commands.* R0 H1 u$ k1 }* M8 p3 a. `
4C19:00AA   JMP    0002     ; Bad_Guy jmp back.
6 o* t! a$ x1 O" s5 e) v7 O/ Z4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)6 O5 Y$ L" N0 t* V
: f* H+ p; B$ q6 f/ E# X# m. Y& e
The program will execute 6 different SIce commands located at ds:dx, which0 U0 V( Z; p' z: T% s
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.; b; ?  K8 P  r$ o4 ~' Y, ?
6 m5 r2 R: w- B6 G4 j; l; y
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
* q5 O( G; D, ?8 d; n0 q/ {- H___________________________________________________________________________
+ m/ j: r0 y$ S" _
1 I1 e! K, |) T, O" O! X' A3 x/ Q8 V1 z& X, S+ R
Method 03( L+ I. I5 [+ ~7 n, Y0 }. q
=========) S9 Q1 X; j* S7 D9 R2 x
& G% f) b) f$ P2 v5 e. U
Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
5 Q# Z* G. w! ?$ _& ~1 o0 e(API Get entry point)
7 o6 [* d, w5 _0 ?4 p: [9 c- w4 A          q: |& b& u& z( ~, c  F5 c. V; I: T

' }- S/ m" n& i6 ]    xor     di,di% v. E, `9 l: x8 A4 }5 W5 W& a
    mov     es,di8 F+ ~( N2 C1 Y
    mov     ax, 1684h       - @  [& F2 y$ R+ a+ _) H
    mov     bx, 0202h       ; VxD ID of winice
7 V" c! Z8 c( q) k# S    int     2Fh
$ k# @' v; M: K6 h1 K6 H" z* k1 A    mov     ax, es          ; ES:DI -&gt; VxD API entry point
  R0 H6 d. K3 ?2 c    add     ax, di+ f8 g6 Z# m, q* C
    test    ax,ax( h9 f  h% }: G+ l; w% d6 b
    jnz     SoftICE_Detected, t" c- X4 _- j+ |/ z
4 g4 l7 d/ T+ q+ A4 G# u9 L) N
___________________________________________________________________________% j! u5 k1 @2 L3 u  G/ h) ~: P/ X, s
4 d$ t9 |. i/ r8 Y) y$ o
Method 04
& k* l$ z5 m. ~( j- B, Z, L: V' |=========
0 p% }2 K. J- ^# R. W
9 ^2 h! Q  X, LMethod identical to the preceding one except that it seeks the ID of SoftICE
5 m& K) x! ^! N3 j& U' T* XGFX VxD.0 u) j' X$ q/ u* [+ U
1 D" O  k! o8 B+ @
    xor     di,di
2 l% q2 f, o& J% g    mov     es,di
* y- Y% m) p, k' a2 F7 u% `4 x    mov     ax, 1684h      
1 u8 M& A8 P/ M: n& j    mov     bx, 7a5Fh       ; VxD ID of SIWVID0 C+ o1 E5 {4 e# n
    int     2fh
8 w6 ~$ s% V5 _- y* U' O# {/ f    mov     ax, es          ; ES:DI -&gt; VxD API entry point
: ~! @' H: S; r4 A8 l; K. F4 M0 x    add     ax, di( C, v, @; v. s4 Q% X1 L7 f
    test    ax,ax& T8 u# W9 H6 k6 U: q2 t
    jnz     SoftICE_Detected. |- l  C4 ^6 Y  [% g5 c3 v7 v& F

1 t) k: `+ k9 G% F$ {. W& G  N: [__________________________________________________________________________8 s6 @, W7 b$ g& L3 u! V

. \1 G' n4 F! S+ j/ C$ M$ W; r' O- Z! u9 R4 x7 s! [
Method 05% v* |0 f# d$ I+ G
=========/ h7 m; K; q# Q2 ^# N; U- k
. W/ }% e3 i$ |( D
Method seeking the 'magic number' 0F386h returned (in ax) by all system
& e5 L; l: [( r5 g, gdebugger. It calls the int 41h, function 4Fh.. E3 }) W' ^6 |* V( q  ~2 j* y4 z
There are several alternatives.  
  I, l3 V3 a6 g0 u2 N
6 z! n, z3 ~: ~  u2 yThe following one is the simplest:/ f  Q. F/ s/ T+ \8 ^8 F

. z5 ]$ ]8 x9 [5 u    mov     ax,4fh, b8 W7 |2 {: D1 M
    int     41h; `, e4 \# B  R0 p$ |' H
    cmp     ax, 0F386& V* F& I" N3 B
    jz      SoftICE_detected1 @% e. h6 Z* z! O& [' ~: l

& _+ Y5 `7 ~- \* i6 B7 g7 W2 j" d2 K5 `. ?* V+ e( N
Next method as well as the following one are 2 examples from Stone's 8 `  H5 Z/ A0 W
"stn-wid.zip" (www.cracking.net):+ S1 n5 H  P8 k) J
  H( {' o! s9 l: {9 I7 R
    mov     bx, cs
0 d0 e0 D0 J: d6 z" c. {# a    lea     dx, int41handler2
6 ^7 d9 n8 L% E! E9 c2 b' H    xchg    dx, es:[41h*4]
4 ~+ `( }$ K' f5 w6 S+ ]    xchg    bx, es:[41h*4+2]5 }' y1 z6 F8 a% m
    mov     ax,4fh; o( n+ Y) o! L+ O8 [
    int     41h
/ U" a7 W. ^  T5 C% d& m    xchg    dx, es:[41h*4]9 V' e. Y5 N# _
    xchg    bx, es:[41h*4+2]
3 K5 A5 c2 `1 }( _: w% g: y* D  x    cmp     ax, 0f386h0 Q: R  _9 i* C+ R" A2 x: a& c
    jz      SoftICE_detected0 I5 ?8 T* ^7 @0 }' b( G1 A* @

- ~8 R  R$ E' N3 x/ M* bint41handler2 PROC4 N% Y/ p% V3 Q( x% t
    iret
5 [; o& b3 \2 g2 Y9 }+ z3 @int41handler2 ENDP
+ s1 G9 v% y3 D6 I9 ]; M4 p+ T. `$ R9 p9 d& D
- v( Q' Q+ s+ R; P; \# g: {, _
_________________________________________________________________________" ^0 p& _. m9 l) B5 \, b
/ @- a) Q- E  G7 S! s

/ H- |- @  w; {, p3 r. i" HMethod 06; Q! Z% \" g3 ^! G
=========5 h: ^: z8 H6 Z; r
# n1 N0 U* L, q5 T( T2 e
: x# {4 b/ h" y( ]
2nd method similar to the preceding one but more difficult to detect:
& F: V  c; n5 g" c3 F
* ^" V- t/ ^* e3 I- n( d' f% m. N% V) Y3 Z
int41handler PROC3 E$ z8 D2 Z' K0 @& a
    mov     cl,al
& P9 J& D" N2 }" O0 B( h    iret0 t' D$ ?2 @, j
int41handler ENDP
0 F1 O4 b' m2 u4 y' `& H
) n8 `! v; A, r! ]8 ~  o7 p2 g' j5 l$ v) `6 T) d% V7 @
    xor     ax,ax
- |% V& i3 T0 M, v3 \' A    mov     es,ax& E, n5 c: V) g0 j" v' E! J  q3 G
    mov     bx, cs$ K8 `3 v7 M4 t5 p- ~
    lea     dx, int41handler
" h2 d* f) c9 K  B' @3 P2 n2 e7 u    xchg    dx, es:[41h*4]
: P4 T$ Z7 _1 {, a  \1 f    xchg    bx, es:[41h*4+2]- e( z3 C' G. `
    in      al, 40h
6 d% J: f; B0 H1 K* \3 a% O  s    xor     cx,cx; d- ?& A' U8 Y
    int     41h
0 G% H9 L& p" Y) W$ D3 u    xchg    dx, es:[41h*4]
, m9 b, N0 t" ?0 E9 t+ P    xchg    bx, es:[41h*4+2]
6 F4 `: E8 e; e' b! g    cmp     cl,al
! |- d& o4 a0 g) m  N7 c& H    jnz     SoftICE_detected
  t# ?3 s4 V+ S' f) a) S0 z3 _, i! i% p& Z6 `/ \6 M9 P4 y
_________________________________________________________________________
# X- b- j6 G5 i' v- ~- U4 W1 i1 }7 F* }3 T( S
Method 07$ W8 J) I/ y; ]7 n1 v
=========5 M. ?0 y. x8 q$ m- B, A& x2 o4 e- S
, x& h4 M# x9 T, ~" Z- h4 v
Method of detection of the WinICE handler in the int68h (V86)  v  }- t% G! u3 j

) u( B* H8 y* N2 c- M    mov     ah,43h/ _" ?: v" q% a0 r; f# z8 y/ J' }
    int     68h
$ m) ~6 L7 h7 V' |) t    cmp     ax,0F386h' ^% ?: W1 `. o$ c, h- H
    jz      SoftICE_Detected" q( b  S7 _- ~5 w

; x/ W% }. B+ J* s! n3 e  Z4 p& z* p9 J
=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
& t9 R1 C, w" E9 W* W- o  Y   app like this:1 B* H( c: Y; s- R! [8 w( B" s
( j% z) v# X3 d4 j  H6 f
   BPX exec_int if ax==680 @8 N0 Q+ Y; c* n. |! S
   (function called is located at byte ptr [ebp+1Dh] and client eip is
* [( r: ~: T2 a/ r  Y  v* C   located at [ebp+48h] for 32Bit apps)
9 ^# G$ `% M0 E5 i- z7 k) \  \/ O__________________________________________________________________________
1 Q0 _" L  r6 M+ U8 s0 W$ x) I0 m7 l3 |2 v2 t
* v' _) l$ i6 [  D  `" }" v
Method 08
3 }  O/ p8 H6 M! q, ~2 J/ I4 r; J=========
1 ?* Y' w; c, p4 _1 ^2 r- o; b! ^1 R. g/ X3 k# T( W
It is not a method of detection of SoftICE but a possibility to crash the8 t  O, z- K5 H* z3 X: d4 @9 i
system by intercepting int 01h and int 03h and redirecting them to another! u0 O: q* Z6 s$ |* q' V. P0 r
routine.# J7 N6 M' v( J1 q4 B, j8 B+ ~' s$ c
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points3 X( O; S6 @& C9 H6 N+ s
to the new routine to execute (hangs computer...)/ z$ y! }9 Z' s& {* N' w

' L( O& [! C8 w% f; O    mov     ah, 25h$ l3 Q2 H0 h% I" C
    mov     al, Int_Number (01h or 03h)
; q' Q; u0 F5 k* v# P4 K    mov     dx, offset New_Int_Routine, P. I- p# r1 r8 p$ [% L! v
    int     21h
% C- i& L& Q% S& C8 A9 R4 g/ n7 }: y! u. T
__________________________________________________________________________
$ F2 ?/ C( N8 @# G2 K
2 |9 k& c- [3 S+ ^. p8 k& LMethod 09
7 {" K) W: a  i8 Y4 `=========
9 _# `( Z7 y; K* l8 o8 E1 k( _! s3 F  ~' d
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only% ]. I7 |: n5 O; ^; ^8 ]
performed in ring0 (VxD or a ring3 app using the VxdCall).
; o8 b$ y9 T) H; xThe Get_DDB service is used to determine whether or not a VxD is installed' ^  J5 O2 u, E* \
for the specified device and returns a Device Description Block (in ecx) for
) e7 l# U9 E5 f) m1 n1 Gthat device if it is installed.
0 W5 j, Y- r, {4 f. H0 H! g! A. V# T& W5 r
   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID! u: A: h; b4 E3 x1 C
   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
0 E2 \% H4 D4 V  f+ F3 R   VMMCall Get_DDB
$ a8 t' \# Y! R4 q& o7 E3 g& U   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed
- `% F( B" Q. F
* L: a- G* k0 {. x; C# ^  y& tNote as well that you can easily detect this method with SoftICE:9 g) ?& [) S6 W% S7 P; B
   bpx Get_DDB if ax==0202 || ax==7a5fh* Y& w/ J0 g* U, `8 H, t/ t( G

7 {1 C$ b) O8 l1 Q/ J__________________________________________________________________________  n& i) b$ f% b& \
% D4 k' s3 h; H; `
Method 101 c' K9 S4 f2 m$ ~
=========7 {4 n- J+ l# e1 B/ f

9 v) d! M3 o2 N$ Z=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with
- C6 R# K2 K( V: x* c( {' U) C  SoftICE while the option is enable!!! C, U% o6 a0 v1 X+ X2 t* ?- H; ~

# ]. `: O/ e5 R! `6 SThis trick is very efficient:" V, w  B( ], y; C
by checking the Debug Registers, you can detect if SoftICE is loaded: A3 I/ V9 Y3 Q6 o9 ~! t2 _' Z
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if! o4 B3 L' X, [! v' p' O5 u
there are some memory breakpoints set (dr0 to dr3) simply by reading their1 {' o/ V5 w: B" E# k- @, q
value (in ring0 only). Values can be manipulated and or changed as well
; G9 m4 H# A& e9 U' R(clearing BPMs for instance)
7 R4 \4 p& ~; Y- ]6 b  V5 U8 }- q& s1 d- `2 e
__________________________________________________________________________8 C1 X' P7 {* N# {: s

, L8 Q2 U) N: w! K# b& M+ p! o) S. OMethod 11# @; w0 i) U, S* q, c- r- ~6 E, X
=========2 k: Y* A& m/ o! i9 D

# G* @. h  a: e3 A$ \; U0 lThis method is most known as 'MeltICE' because it has been freely distributed
0 ^; i. Y/ y8 ~* @  u2 H. P5 L% Xvia www.winfiles.com. However it was first used by NuMega people to allow
5 F) M2 f3 k. Z  v* _7 R; `( fSymbol Loader to check if SoftICE was active or not (the code is located
4 x( p4 ?: ?1 H; `inside nmtrans.dll).
, V2 d2 F  J- y+ `4 w0 e( F4 S, H8 t5 l
The way it works is very simple:( G" d% D* W: R$ ^1 J( Q
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for$ }# V5 `* x/ {4 [9 V9 S; ~
WinNT) with the CreateFileA API.
. E7 D! N% X6 z1 H8 g6 y* s# g8 [4 G
Here is a sample (checking for 'SICE'):  i1 h4 |0 \' y- ~" {9 _' s/ ^

& z- N& a7 E/ \  V8 [7 hBOOL IsSoftIce95Loaded()/ e1 d7 M( _4 v# ~: Y' K) o: C6 e, i
{" F" N; j1 J- {
   HANDLE hFile;  6 Q2 t+ f3 H4 |) B0 j# e
   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
% d4 }8 o+ |  d) E, m- l                      FILE_SHARE_READ | FILE_SHARE_WRITE,
  V, @8 T& F; Z% w                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);+ ?6 @, d7 b+ Q; O+ @8 ~# Z$ ~
   if( hFile != INVALID_HANDLE_VALUE )
' s& F2 L  T- T: J3 Q3 ]  U   {% y; |+ h4 J7 S0 R# m: f# E
      CloseHandle(hFile);
6 N7 ~: \+ ?* {6 T6 W      return TRUE;
  {+ S% A- o1 B6 j  P7 U+ a2 W   }* z( B  b, x3 [: Q" }
   return FALSE;) p) d( q5 v  D% E- S" R2 `
}4 x$ Z% R0 o: j

9 V4 ?- [6 c; O; X3 s! z7 z- k. uAlthough this trick calls the CreateFileA function, don't even expect to be
$ x5 |$ e0 n: r, `! E% table to intercept it by installing a IFS hook: it will not work, no way!/ C( G  _; K3 c/ @3 B; ~
In fact, after the call to CreateFileA it will get through VWIN32 0x001F, i1 B+ w$ u: l* B/ ^% E
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
7 z* Z2 @  }* n/ c* \and then browse the DDB list until it find the VxD and its DDB_Control_Proc
3 t/ C: C: ?- ?field.8 u  k! W& t* X2 t; p: A& b
In fact, its purpose is not to load/unload VxDs but only to send a ! h) r% V' E8 [
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)# D$ O1 E% r  F5 \2 J0 }
to the VxD Control_Dispatch proc (how the hell a shareware soft could try* a$ t( q, `8 R+ n1 w5 H' W* X
to load/unload a non-dynamically loadable driver such as SoftICE ;-).
4 c& o' V3 N- k6 h5 {If the VxD is loaded, it will always clear eax and the Carry flag to allow2 n$ f: L/ k9 m5 {% V/ K
its handle to be opened and then, will be detected./ m7 I  Q; Y) a8 ^' F! R
You can check that simply by hooking Winice.exe control proc entry point
3 ^; a7 v! z! k6 `+ h5 J  q" u+ g; dwhile running MeltICE.
" q7 ?3 m( z+ r3 k
( d  R! Z# H" }+ N" j3 ~* L) g6 [! c# G3 Q
  00401067:  push      00402025    ; \\.\SICE' J  ^) S2 z2 o* W1 R+ m
  0040106C:  call      CreateFileA( q3 T6 ~+ l4 b' d2 c0 K
  00401071:  cmp       eax,-001
% Y- w. ]: t6 D5 v  00401074:  je        004010917 S2 T5 ]6 P2 I/ p2 {* s

1 \# t3 G( M$ `: s% f$ F+ o% c3 B1 A, ~. m
There could be hundreds of BPX you could use to detect this trick.
) o* K4 Q6 h6 n-The most classical one is:
) ~- |  p( n* [" a+ Q  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||4 [& W, Z% i9 M  N+ R
    *(esp-&gt;4+4)=='NTIC'
, Y( z# m/ y! e1 x
  p9 h! S5 o" n1 N5 ]-The most exotic ones (could be very slooooow :-(
# f. o! ^! N" ^3 y: V( K   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
: ^$ c, B: D5 y     ;will break 3 times :-(
! H& ?2 N1 l* \# [' W% F* `8 D/ J+ O
. y7 c. z0 s7 g2 @  W-or (a bit) faster:
( G0 F; A1 Y* o8 S: c7 I( {   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')5 f: E  Q$ H4 |/ l
! O$ R3 h, {9 B( x% d5 D
   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  : i5 R  X7 p, w- Z
     ;will break 3 times :-(/ ^; P- m4 _, c: T1 R! ?
; L; H/ l3 `& [- X. k; x. [& W8 F. Y
-Much faster:
: i3 |3 R$ _8 r$ t  Q   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'
- @& W8 K7 z9 z- R% a. ~9 q: ?7 T! S9 Y* b, E; Z$ A* @: w
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen, X8 v* n: J2 |+ \8 t
function to do the same job:2 Y8 `6 s: P& X4 K7 a& o+ \# \

9 o. U' e8 N1 i  i3 B. ]) k$ c   push    00                        ; OF_READ
1 t( S5 g; y$ M8 a! M, G# x   mov     eax,[00656634]            ; '\\.\SICE',0
0 `, P: @$ {8 u' x" ~* j/ e3 O   push    eax
) {3 F1 h- E) S0 |8 J( I* A% M   call    KERNEL32!_lopen, @& A+ @" @0 x! C3 ?
   inc     eax
( f0 L; x( ?) S   jnz     00650589                  ; detected
& }6 E; f# `2 A! o5 ~4 E   push    00                        ; OF_READ1 F& t: R4 N6 Q0 O" [: P& ]
   mov     eax,[00656638]            ; '\\.\SICE'# r8 l1 C4 D- z% K6 m, T+ k
   push    eax
+ ?* ]3 }: h+ ], g" {$ o' V( a& Q- q   call    KERNEL32!_lopen2 O) F9 O; N5 z6 d6 d
   inc     eax$ v( j3 Q/ H# X; n
   jz      006505ae                  ; not detected
5 _: S  B( @3 v( r' C" Y4 P" I6 g2 o2 e1 C6 u; o
/ Y( @$ I" ?: J6 D8 N8 f$ E
__________________________________________________________________________
, _# \2 K  r2 I7 ?) f
& n. |9 ]/ s) ^5 UMethod 12
0 z1 M& X2 F1 v7 b=========5 _  u5 W' H/ d* V) Z! k

. H9 n7 s: X7 ^This trick is similar to int41h/4fh Debugger installation check (code 05
. F# B( k7 U+ R2 o1 ^&amp; 06) but very limited because it's only available for Win95/98 (not NT)8 s8 p  W/ }) [. Q, r
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.9 B1 h; w2 u# f$ H2 s- F
  X7 s0 \8 L$ d1 A( S" l: q" l
   push  0000004fh         ; function 4fh
  l+ R2 Z3 C: V3 x   push  002a002ah         ; high word specifies which VxD (VWIN32)8 X, }6 ?  r; F' Z& |+ G+ m
                           ; low word specifies which service# X4 Z8 L+ V) e( E, D
                             (VWIN32_Int41Dispatch)6 E0 L- F. y) t; p
   call  Kernel32!ORD_001  ; VxdCall. X9 b1 z  e! q8 [3 i$ t: t
   cmp   ax, 0f386h        ; magic number returned by system debuggers' K7 k4 w  [6 Y% z4 E
   jz    SoftICE_detected
( z6 Z- B% F" Y3 U1 a& x  g6 F! h8 }
Here again, several ways to detect it:
$ [. O& X. U8 Q8 h" ]7 t- S+ B0 D: T+ _. e9 w
    BPINT 41 if ax==4f
( e- d4 u, O3 t0 b
0 F) e4 _( y2 }3 C    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one# J3 _+ F" s/ ^4 w' {6 {

; Y; O5 k9 O; Z* \4 s    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A* p: C, ]" S7 o2 j

4 P3 t1 g. w+ ]) g$ d! [% E    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!7 Q) Y' y' v- a/ c+ E, `, d# m
- x% J" M8 R# j8 z& ?8 X+ n
__________________________________________________________________________
3 ^+ K* A( X, Z) m! \$ K- M2 M0 Q5 G2 `: K4 y, f
Method 13) d" Y8 M( e8 C
=========( `4 i2 v1 W. e1 ]0 ~
  H# A; _! A( u% H% V$ M; g
Not a real method of detection, but a good way to know if SoftICE is
3 ]5 {( C' R, jinstalled on a computer and to locate its installation directory.
. x# i: v& \7 qIt is used by few softs which access the following registry keys (usually #2) :+ y  w7 \- z' X
; w: g! Y0 D: q. {6 V+ p  p% G
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion: i' D5 T. n6 z
\Uninstall\SoftICE: s) X1 R) j/ ~) p
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
4 J2 B. }9 {% D3 s+ T-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
- U+ B' ~' h$ Y$ I7 c\App Paths\Loader32.Exe
  n+ _1 C  e- Z
: _5 Y( u4 y: L4 _) C+ I, Q
/ M) Q7 N6 c. g( d. l; N* Y/ Z' m- SNote that some nasty apps could then erase all files from SoftICE directory
6 R: }2 a% T6 k; y(I faced that once :-(
5 N6 r5 Z0 ]5 L
. ^, ^0 U6 \2 ?" N" \0 D4 V7 VUseful breakpoint to detect it:
. t  k% v, t* ~, P0 [. N$ s# ]. O- Z+ f4 h) n
     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE', [% D: Z; t0 C  |5 [+ M( r

! u2 N! f0 ?1 s/ D+ o8 W__________________________________________________________________________
+ {7 q2 Q/ ^" m; b% U5 L  o& ]

7 M# _2 j. N) f, [5 bMethod 14
, G7 O) p( M2 U6 Z=========" a4 V1 Y3 B, z# q/ @
* G: r9 v$ i9 q) N' P0 s6 X
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose0 [9 L/ T8 L  x- d; K
is to determines whether a debugger is running on your system (ring0 only).3 e( Y' N5 S- e! ]$ J, v
3 x! b7 P9 e) C4 X( T7 [- R
   VMMCall Test_Debug_Installed
1 F$ I8 p7 ^' L+ v+ e+ }   je      not_installed
0 u  y! n5 E( h. N% A# d
4 {! T8 D* H6 Z* S% k  [% R* KThis service just checks a flag.
; G2 `! g: b5 }+ y; o$ ?8 E& W! k</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

关注公众号

相关侵权、举报、投诉及建议等,请发 E-mail:admin@discuz.vip

Powered by Discuz! X5.0 © 2001-2026 Discuz! Team.|鲁ICP备19052200号-1

在本版发帖
关注公众号
QQ客服返回顶部