About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>
% h9 C% f. C1 b4 I: g; ?<TBODY>" `7 {" r: F- Y# m1 y# W
<TR>' L+ q; w1 |9 [; h5 a
<TD><PRE>Method 01
' P3 b/ Q" r& d9 x7 }7 M/ m=========+ W* I8 ]: x1 W; X' u, S5 m

- v  \$ E( \0 F3 ]; c) p- f4 bThis method of detection of SoftICE (as well as the following one) is* x7 b/ }6 i: L6 l" _& ^
used by the majority of packers/encryptors found on Internet.: s5 M( B" E+ R6 s% ^# l
It seeks the signature of BoundsChecker in SoftICE
  x, @6 p* t7 U6 Y+ h2 o' Q( V
( ?# j/ Q$ O4 x$ n    mov     ebp, 04243484Bh        ; 'BCHK'
8 o6 W6 M8 V( v/ o    mov     ax, 04h
- _4 D; M6 v& g( y0 Y7 \6 i3 U8 O    int     3      
3 d/ S) B; f: m3 l" d' ~    cmp     al,4
; k' N+ z7 W; i; h, e! [  G8 s: V    jnz     SoftICE_Detected* E! L( z5 v# ^$ K$ d8 C- }+ M0 {1 `6 D

/ ]: k0 T1 W, q$ Q___________________________________________________________________________% l9 M: I8 p) M9 Y8 i
; m  i8 N; W' C; o2 q2 e9 m
Method 02
8 M. c/ g- C& P0 x$ x=========6 z/ u5 C% C* F  T2 A
5 }) T: x: n  \
Still a method very much used (perhaps the most frequent one).  It is used9 M. g1 i! @2 q/ d
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,. D1 ^4 h9 c& M% S% H
or execute SoftICE commands...
) s1 `+ w5 o9 I0 R( d8 `: LIt is also used to crash SoftICE and to force it to execute any commands" Q" V3 `9 g$ }
(HBOOT...) :-((  # |, }5 y- X1 M* L( @

8 @! |& P% B6 K2 A' Y/ v8 F+ fHere is a quick description:
7 M2 J; P6 K+ Y# Y% [-AX = 0910h   (Display string in SIce windows)
; j* N6 a2 P$ o! w-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx); O9 v/ p4 g5 N! i" W/ z- N+ P/ l
-AX = 0912h   (Get breakpoint infos)0 e4 [0 z" S: \
-AX = 0913h   (Set Sice breakpoints)+ G" G0 }! m8 Y# }6 I: ~
-AX = 0914h   (Remove SIce breakoints), i8 x. j% C8 I3 H4 N3 D5 B

" r9 O' r2 U7 f/ O7 T5 NEach time you'll meet this trick, you'll see:3 U. ~1 l/ B% K6 T) L4 ^3 ?
-SI = 4647h
$ \6 F1 c8 I$ B2 Y- o0 U; Y& ~-DI = 4A4Dh
2 z3 ~9 `* v/ |# z7 d$ c( vWhich are the 'magic values' used by SoftIce.
$ ?5 r- b( g! Q& ?For more informations, see "Ralf Brown Interrupt list" chapter int 03h.
, h/ O, J$ ^+ Z1 r$ L7 P0 o& b5 O0 M$ d
Here is one example from the file "Haspinst.exe" which is the dongle HASP
1 i0 ?. b7 h6 l; X/ }$ S7 pEnvelope utility use to protect DOS applications:6 i3 ]* P# W# t4 f0 q; c$ N* `) `+ n
7 ^) g1 U' S5 W: G

1 `0 O  c3 k2 M( W4C19:0095   MOV    AX,0911  ; execute command.
( x3 T$ a$ [1 k" }2 w7 X# M0 F4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).
# Z0 Y* s6 H; ^1 i- v: [4C19:009A   MOV    SI,4647  ; 1st magic value.
. h9 U9 U# f2 E9 d8 d4C19:009D   MOV    DI,4A4D  ; 2nd magic value.
# C6 m9 ^, W6 I7 D5 U4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)3 j" F7 Z" w' s8 h
4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute
4 j" @# c2 R! M. d$ ^4C19:00A4   INC    CX/ S1 L" ~5 Z. @) E
4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute/ A- O+ |6 K9 B/ g* R
4C19:00A8   JB     0095     ; 6 different commands.1 f3 N6 y6 H& F, J
4C19:00AA   JMP    0002     ; Bad_Guy jmp back.# H; M! ~( r& M$ K& }- {) j9 ?+ V
4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)
& q& L1 U% l, p7 k# ?  K% X' G' S1 y+ `# f' B
The program will execute 6 different SIce commands located at ds:dx, which
/ y  Q. T; `! v8 _+ kare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
1 A! G8 V5 l2 S: N2 P
! a& |. {" w8 Z, M9 t& w# A* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
, F+ M2 @! M" H* r/ q( C& a___________________________________________________________________________. c6 v9 c8 Q/ T2 d' ^% _
: G7 M/ l* M( a' B. C0 u- A4 R8 x% k
/ W# o4 c  h1 e6 B6 V
Method 030 D+ w3 |2 q' Y0 ]; D0 H
=========
9 J! `" e/ M( ?! M
9 d1 E5 L' C* P7 y. n% lLess used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
9 B/ l  P& |$ K# {% c- Q(API Get entry point)4 s" K% o4 j# |. C" c* T( f! I
        5 \. c: x; E! V9 d- z- ^: a

- y6 i% d! S& C    xor     di,di
2 p8 \' U# w' T8 T* K    mov     es,di; ]& l& V# o+ [6 A5 A/ N' U& b$ O
    mov     ax, 1684h      
5 K8 Q, D# f% O2 J5 n# z    mov     bx, 0202h       ; VxD ID of winice
0 b4 e, s) s% y# H( g% G    int     2Fh- f/ s, w7 c0 F
    mov     ax, es          ; ES:DI -&gt; VxD API entry point( W! H/ l! y* E5 C( F
    add     ax, di
+ Y- w9 r8 j0 d' D# g: I    test    ax,ax# ]/ S2 H& ]. g0 I
    jnz     SoftICE_Detected4 v9 Z$ \4 j0 e9 Q% G0 n
0 P" @; }  I1 u) Q9 c0 V% v+ U  p
___________________________________________________________________________# [9 G" v  J8 L# ]: u8 `# A  a
5 _( J4 ~5 e% v2 A4 k9 o& ^
Method 04
  n9 p( D# p  R( F/ E$ D) n$ {=========  }. i8 a& ~' f9 E9 n, C) ?

0 F5 O0 t, m5 |" y0 m9 @Method identical to the preceding one except that it seeks the ID of SoftICE: b" k3 a0 b) m' Q9 p5 F
GFX VxD.1 }4 j) K, w, E3 d( L5 ^
. [* G( [4 J4 ~$ q; x% H
    xor     di,di$ q2 }2 o. h6 v& q1 B
    mov     es,di9 m0 `5 c) b1 o
    mov     ax, 1684h       7 T4 g+ e. J$ p; p+ D
    mov     bx, 7a5Fh       ; VxD ID of SIWVID$ Y: y; X  J' e: E5 A, n  N
    int     2fh
: D: n# K$ t! R* t    mov     ax, es          ; ES:DI -&gt; VxD API entry point
1 B4 z2 b0 w, [    add     ax, di
; G# B9 d& @- i$ l' h& |7 z( g    test    ax,ax1 w# b: X. c3 `
    jnz     SoftICE_Detected
5 O# P0 I/ q0 M) p1 [3 i
0 o1 M/ S3 o2 d" |__________________________________________________________________________
' K5 X, t. r% r8 f* N! ^, _0 v9 b$ S" E) ?* B

( m. Q5 e7 }! `  Y, U) nMethod 05
! j' f) p/ T( w=========
4 G3 U, Q2 |+ Z7 S( `  r! k# S! Q! {) \8 ]
Method seeking the 'magic number' 0F386h returned (in ax) by all system* n. ]5 `  X% [2 o- I! i
debugger. It calls the int 41h, function 4Fh.
- E; m/ E  z( G( hThere are several alternatives.  
! Q7 w0 Y+ S! r: A2 K1 D8 Y+ V2 g( m. R, K- A
The following one is the simplest:: V. w' E9 d1 y& t) _! d

& c8 y% p( B2 K" F    mov     ax,4fh  `% x+ Q4 h" f  U* g: q0 g
    int     41h
. S9 [: f2 U. R) u! Y    cmp     ax, 0F386( ~: a: Z2 \- {3 {; r" O9 a4 V  [
    jz      SoftICE_detected
- l5 J" X& K3 E  p5 j+ N+ m% l+ \3 b' a! c9 U1 V3 Y

* _/ e+ }& {2 u3 A- U' t' JNext method as well as the following one are 2 examples from Stone's $ W5 z) u4 N% w  V  ]
"stn-wid.zip" (www.cracking.net):7 k; K# x/ C, [  ^  [" `
) x* V8 I0 S7 G. F* H5 I9 B
    mov     bx, cs  i, d4 i! v& a2 U. M
    lea     dx, int41handler2; L, N# i2 P) [1 j% j- ]0 @# A
    xchg    dx, es:[41h*4]
! E" z( I& W+ Q2 k# k8 u- w! b    xchg    bx, es:[41h*4+2]! Y; _# Y  M* e% x! h
    mov     ax,4fh/ \7 e/ n! J6 j8 L2 U
    int     41h
. }4 M& F8 ?& a) R$ X/ N: V/ \    xchg    dx, es:[41h*4]
" P. q7 E" T2 o% f1 z6 Y8 s    xchg    bx, es:[41h*4+2]" d4 n/ `4 _0 ]% [
    cmp     ax, 0f386h, P3 J9 _% L" M/ m  ?
    jz      SoftICE_detected& T7 h; X7 R% C
. l5 i; H) ~: m- W. D! |: ]5 f
int41handler2 PROC8 F( l8 A% r1 i$ k, A' `7 y! W
    iret0 Z4 t7 ^- @2 E! k: _  c1 s
int41handler2 ENDP
3 \+ a& d/ g/ L' n. k
7 s$ l7 {' I' J' g
( B' \- G3 s/ d+ f3 B_________________________________________________________________________
# P$ {. H5 x; i6 {  A
5 ]1 P; K# K9 ^+ l! I) b
! m! v+ j9 c' P" DMethod 066 h3 i& r9 ]# R, E$ u
=========; O* X9 r9 A' ?# y" z8 P8 }- X9 f4 h
- [  V/ R# f2 g0 m+ P& c& g9 o
+ m2 d, c. ]+ T( h
2nd method similar to the preceding one but more difficult to detect:
$ @6 f, ^7 Y! f
, d; F0 F3 P: B  I; M# w, c2 i; h0 Z. H& \" [& Y8 j1 Y0 a9 i
int41handler PROC! T* @: h/ x# U7 k% I3 z; d) F
    mov     cl,al: U/ g" Q$ _1 \
    iret: _) A6 ]* R2 B7 ?$ Q# ?
int41handler ENDP
; C2 c. O; \- c; e# w& H3 v3 d9 i: }' j6 A# J- q# B/ c$ H

# q; u6 r6 Q, e* Z' b8 P7 |    xor     ax,ax  O( `' i. d5 L' D6 E
    mov     es,ax
( g; i' w. d! q/ F( S) ]5 j8 D- W1 C% b    mov     bx, cs& U! p2 i) v5 a  I: e5 i. K1 J* M
    lea     dx, int41handler+ t5 `  Z; [5 f" H
    xchg    dx, es:[41h*4]" c# ?4 i3 s( q  M  [2 x/ R% {$ S
    xchg    bx, es:[41h*4+2]
$ u. |& ^! l* J4 m+ c- E    in      al, 40h
( V" }  t0 H( b, i5 C    xor     cx,cx& a- ^! O' M2 @! V0 ^- |
    int     41h# h5 O6 E0 q2 P) u1 k0 \
    xchg    dx, es:[41h*4]
$ i6 @5 ^) p( \+ T, t  \    xchg    bx, es:[41h*4+2]
) g& b  [9 n" B+ R5 T( z    cmp     cl,al+ G& P7 P# h! d/ M4 E
    jnz     SoftICE_detected( d8 G2 w/ {0 l  L$ Z. ^

! H* c8 W$ y( O& a_________________________________________________________________________
" m/ k! A5 ?; {* v
; ~; S6 D; |! W+ K4 q) tMethod 07' n+ f9 j4 ~- x: z
=========$ `2 F5 m1 E9 @: ~; W# O
8 z% O, D1 I3 E& Z# @; I5 `
Method of detection of the WinICE handler in the int68h (V86)
  A9 Y# t! b7 j/ I7 [0 _% n1 r4 U- y+ e0 ]+ Q8 k4 ~. q* {
    mov     ah,43h
8 ?) [& h# z5 U) h" P    int     68h
3 U8 D# ~7 C8 v" a    cmp     ax,0F386h% \3 d- p2 j3 _) J$ k7 n- `
    jz      SoftICE_Detected, }. Y3 X$ y# C, u2 A/ H

% R6 z. V; n' i" f' i1 l+ E
1 `% d2 |- T* {' P) s. ^- B% F=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit& E" B5 o: G1 A+ a
   app like this:
* q" p4 N% y: r9 T6 |( u$ s' X) g9 m2 `" L- I
   BPX exec_int if ax==68
' W. O, p" }' x$ u! F! x   (function called is located at byte ptr [ebp+1Dh] and client eip is- Z) a5 a7 f8 D3 g" ?  q
   located at [ebp+48h] for 32Bit apps)
$ T+ O3 A2 d! U$ s: ~__________________________________________________________________________/ Q' f2 N  W. I3 A& {

' c' L( x; t' \2 e
; {' s0 T# q5 {0 t0 h( {Method 081 o/ |$ ^( c5 r/ K0 y( ^
=========
- X, Q. y( i7 g
7 f! ~9 \  y! Q7 oIt is not a method of detection of SoftICE but a possibility to crash the
/ J9 N) E  m7 C  @/ h4 Dsystem by intercepting int 01h and int 03h and redirecting them to another
% u4 C* y  f3 q/ c# ^7 J/ c  k9 K) C) _: jroutine.
  X8 q) \" m; N! B' w3 IIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
' f. K' L9 J$ A- P. d9 Fto the new routine to execute (hangs computer...). B- ~2 W, ]/ k, N: @6 W5 m

8 T8 B8 D. l1 D: l2 K    mov     ah, 25h
" H- `/ G4 S/ ]: p+ v9 q    mov     al, Int_Number (01h or 03h)
/ G8 }' n) w6 b- o# @8 a    mov     dx, offset New_Int_Routine
# H9 O* C2 D2 A8 P  c    int     21h
, [1 y' j0 F; U, K1 D
0 Q: g( H/ |! \3 b1 T% U5 _6 i__________________________________________________________________________5 t9 T9 `; J9 U! i) f% M
3 ^) l5 }/ V6 m2 g7 l
Method 093 p/ B( A! M. d6 R/ R  K3 b1 n
=========8 W/ O3 G, H3 ~( i# ?( U% p

+ ~! @) x' W$ F7 V3 f# O0 nThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only9 W* L" z; m* W1 }% Y( g5 v
performed in ring0 (VxD or a ring3 app using the VxdCall).3 W( U! F9 r9 w
The Get_DDB service is used to determine whether or not a VxD is installed5 L$ b% ]: x0 ?8 x% n* F! J5 v
for the specified device and returns a Device Description Block (in ecx) for- P6 y/ @  T4 m+ s
that device if it is installed.
* q2 E4 v4 P0 g/ k9 `
3 g6 v! K. Y  ]/ L; K( u' Y   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID/ \3 X/ J9 T" n9 _
   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
# O# v6 t/ p. }2 ]; y* F4 R8 ]4 ?# ?   VMMCall Get_DDB
/ ?7 A4 Y; i  Q+ h" u   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed1 _8 L% o% m* e1 J) X  w8 |
% I4 P, a" [6 w! q9 w- V
Note as well that you can easily detect this method with SoftICE:& r7 ^" U' i% H" y% G" {% ?
   bpx Get_DDB if ax==0202 || ax==7a5fh
1 t' N1 k# F4 _# e6 o+ n. O
. l" X" f5 I5 I! N7 p: O# {" Q: ~3 ]__________________________________________________________________________
4 o4 ]+ s5 h, l8 n' x" E: S
! O) i& y$ `- _/ z% ~3 t0 J1 WMethod 10
4 d. S6 N) K8 Q( h0 P1 J=========
; \# m: J7 I8 `( s# k# ]  x3 e' p' a) z: {
=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with
6 w! r$ ^) j8 G0 e5 x' P" @  SoftICE while the option is enable!!
2 R2 T! ?2 L6 K& ?9 G+ p
- E7 \+ t3 u- RThis trick is very efficient:) k1 m! @. [6 g# Q5 G
by checking the Debug Registers, you can detect if SoftICE is loaded, O: U' @% b3 C9 z9 o
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
1 g, g; {% d9 P; x; f9 qthere are some memory breakpoints set (dr0 to dr3) simply by reading their7 r' d' \  P* I0 Y' w! h  a0 M
value (in ring0 only). Values can be manipulated and or changed as well
1 {6 g. e# r" z  \$ B$ [% J( ](clearing BPMs for instance), X; ?+ B  V/ u' T4 b  E4 J, l
# ]- P1 n! U1 ^- ?# s: [' l5 b
__________________________________________________________________________
5 d+ J8 p/ G9 M6 a3 |9 K8 N
- O& z4 y( ]. P$ W; SMethod 115 D7 z* f% _0 x) e: I4 Z0 Z
=========
9 J% y% ?' W7 |8 s
) c& p$ J: ]+ O5 M; yThis method is most known as 'MeltICE' because it has been freely distributed
" u1 n: q  _, l% `$ Evia www.winfiles.com. However it was first used by NuMega people to allow8 A3 ~+ s' c) h" R  G1 e
Symbol Loader to check if SoftICE was active or not (the code is located0 N& r2 k. W; d
inside nmtrans.dll).# s, D/ w2 \5 }2 |

* }% V" g6 r' t8 fThe way it works is very simple:
$ Z" [+ F0 W" ?  KIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
& ?( Z9 K; p: K* ?" {WinNT) with the CreateFileA API.3 f. g$ _9 w: M
& D4 B4 I4 l+ i+ G: P
Here is a sample (checking for 'SICE'):  K5 h" W" K% K# \% T8 i  D
5 i9 W2 L! F, j4 `: h+ ~* Y7 @
BOOL IsSoftIce95Loaded()
3 t1 _, H/ b3 ^, e1 S( J8 y{# M6 I# A1 [/ S: ~, s( c/ L
   HANDLE hFile;    x4 R' X  M/ ~
   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,' H  O! m& j6 y* n+ i+ B
                      FILE_SHARE_READ | FILE_SHARE_WRITE,5 S: d+ ?; ~& k2 `! a6 q; D" V6 T
                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);; b- ]7 `7 }/ x1 L
   if( hFile != INVALID_HANDLE_VALUE )& i- R+ ?1 _3 a) J) L/ |' g
   {
; P2 m& U# B( h      CloseHandle(hFile);# j1 ]) ?) ^- A- g- S; m, T* T
      return TRUE;
- N7 H- [3 ^, V. X  j5 H+ J   }
8 B- L* d/ f% S" f4 ~* ~   return FALSE;5 z* E3 c% ~' ?* E7 d+ p0 d1 a
}7 |9 L% p4 n1 e+ \2 ^
4 P4 B: c/ K+ e% s/ _3 E$ v
Although this trick calls the CreateFileA function, don't even expect to be
! B7 W, \6 m% p) Table to intercept it by installing a IFS hook: it will not work, no way!
1 [( Z6 g9 Z) _* m9 e; J& LIn fact, after the call to CreateFileA it will get through VWIN32 0x001F. S8 b' _5 ^: E, A, \8 B9 I
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function), A& x+ V" f4 p$ P
and then browse the DDB list until it find the VxD and its DDB_Control_Proc
) _  T( ]- n# }  Dfield." O  ~  s2 @. |/ a* O0 G
In fact, its purpose is not to load/unload VxDs but only to send a
4 P. f, |2 d; }& ~6 b& S- g. cW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE). ?/ `1 o" e2 R
to the VxD Control_Dispatch proc (how the hell a shareware soft could try
) l* I* C: \3 n( {to load/unload a non-dynamically loadable driver such as SoftICE ;-).
, I* B' Z* J6 O/ \' nIf the VxD is loaded, it will always clear eax and the Carry flag to allow
& {4 b8 `: b0 m0 }% V1 Yits handle to be opened and then, will be detected.; Q8 }4 M  D) v6 v' l2 r- L
You can check that simply by hooking Winice.exe control proc entry point- U( A: V+ J. P: a& ^
while running MeltICE.& C' K5 ]! C$ _& n

3 l3 I; I1 f! V8 E) M
- @* R4 ~, z5 J3 @' e  00401067:  push      00402025    ; \\.\SICE7 U  e& {% N9 b+ u5 l! B( ~/ G
  0040106C:  call      CreateFileA% O2 F3 }5 l2 S
  00401071:  cmp       eax,-001
$ Q/ N8 t  E; m3 o% F# T  00401074:  je        00401091
$ i- I  T% H! W( z% F( r! g9 s) ^# i5 G4 {

# I* W( S4 |, {& x+ ^: p+ z2 x3 LThere could be hundreds of BPX you could use to detect this trick.
7 {! \! i( F/ F( B% Z( p-The most classical one is:
0 n, K1 o# k" E$ K# F  f9 s. E  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||4 Y+ j) K+ Q5 c: {" g
    *(esp-&gt;4+4)=='NTIC'; Z8 Q( v8 G2 u. P

# V: H: x. U+ b: M; C. n- s3 W. f-The most exotic ones (could be very slooooow :-(
/ }8 m& L- l5 W1 K  T/ y, n   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
! ^* h  S2 X8 L9 ?% E) L* Q     ;will break 3 times :-(
/ w! _8 y& a4 L. c! D( h5 R; |0 k0 u( y
-or (a bit) faster:
, d. X" ?# c6 ^; _1 E9 u7 |   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
" [2 i  B# ], G- w: ~2 J# a) N$ w# g* f8 t2 c# O) V9 Q  {/ \
   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  & Q( @; U) {" [! H- W3 a; C1 P
     ;will break 3 times :-(
6 h6 ~4 g. |# s/ ?  b; ~
- f( T* X* c( s2 g-Much faster:
1 ^0 L% x3 j% C6 c& o   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV') R0 S' \' C6 ?; T: \2 [8 y! k

: O0 `4 `  a( S% s' `- `$ }: M, kNote also that some programs (like AZPR3.00) use de old 16-bit _lopen
7 v; T5 o* O4 ]function to do the same job:
  H( i. N. g! p; H+ l/ ?9 Y: i- G2 ]
0 C6 C& m  i$ R8 f5 Q   push    00                        ; OF_READ0 a6 W' k, A) E: e& B( @. r
   mov     eax,[00656634]            ; '\\.\SICE',0: w% e. E+ Z; ~: M9 Q/ {+ I! v6 z
   push    eax
/ [  H2 f$ N/ Z1 ?   call    KERNEL32!_lopen( U7 ~& C0 a/ s
   inc     eax
3 H. b0 D5 t# X" C' Q. K8 `/ k   jnz     00650589                  ; detected1 P( h# S9 ]1 }) Z. C
   push    00                        ; OF_READ) W) O/ J0 T7 I# ?, R
   mov     eax,[00656638]            ; '\\.\SICE'
( H' z) \& s: N' M, y   push    eax
3 {/ @/ g8 n/ }- y" _! O   call    KERNEL32!_lopen  V  Y* U' E% n2 p% W
   inc     eax
2 p3 u1 n4 g) M" Y0 A: K   jz      006505ae                  ; not detected
7 l6 L9 R  H& C  {2 g# k* e2 C/ \' G. ?5 M$ B* l# K4 k% v) w4 }
0 |: s# q0 L% e# `/ h# S
__________________________________________________________________________7 i4 n% y7 t0 U1 i

- N" ^* a. s6 IMethod 12) k% g# G% K3 B6 j! C& f
=========2 v; C# l) {: H$ y3 s5 g+ z8 r

. ]. K" d, O8 T  w) G6 q8 H( U4 |3 IThis trick is similar to int41h/4fh Debugger installation check (code 050 O6 i9 a) l8 p# u+ h- G8 r
&amp; 06) but very limited because it's only available for Win95/98 (not NT)
0 X( g) B- q$ M" }3 Aas it uses the VxDCall backdoor. This detection was found in Bleem Demo.; Z* P# n) E2 w4 `
# t0 S7 m& ~9 N8 G+ U6 f
   push  0000004fh         ; function 4fh
  Y9 |1 \9 n" @   push  002a002ah         ; high word specifies which VxD (VWIN32)
& P5 P8 U& g& k$ j- e( o- @; u                           ; low word specifies which service8 D0 V) I) i0 l0 @0 c, C
                             (VWIN32_Int41Dispatch)3 Z0 E6 J2 ~; S0 N
   call  Kernel32!ORD_001  ; VxdCall4 \2 ]" G0 c& k- b6 ?# m" V
   cmp   ax, 0f386h        ; magic number returned by system debuggers; _% S$ J: i- r, p
   jz    SoftICE_detected
0 d; O- q. i* U; \# Z# h5 J% F' _# E& l5 p
Here again, several ways to detect it:
! C" b" c) T  x+ n, R3 i; h! T' d1 z8 s" U2 x
    BPINT 41 if ax==4f
' M* L/ e: T2 y$ M7 Z5 @
$ m: x, G7 U! M- d) k) K; a/ C    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one3 K! A8 ~7 j- [5 [* H2 v
" `* U* F( c  Q! p# R0 h  F
    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A
/ l" e# f& l. w( `
* \0 T: F. B' b9 U- Y$ x    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!1 E1 Z( q, D6 o5 V. ]" j

" k0 L: d' N8 M& [3 C  {__________________________________________________________________________
, J) l- p; l. B' d$ I8 X* }3 `/ G' d) C* k; F
Method 139 K+ n: k. ?: [" w
=========5 Q4 a$ B# L9 t/ N' p6 q, P6 L

/ C+ ?* y3 t6 D* ^3 }$ LNot a real method of detection, but a good way to know if SoftICE is  ^$ n- F; l3 g
installed on a computer and to locate its installation directory.( g% a0 o+ i/ ?
It is used by few softs which access the following registry keys (usually #2) :( n6 F3 C2 b% r) ?

3 G; `& y; h- t/ h- o+ ^-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
9 Z( h; {$ g6 m) U( d\Uninstall\SoftICE
5 P2 ]7 a! s: _" X3 f-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE5 W4 x! t, `3 G0 w! ^; j+ c* h
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion# o. T9 \* F( z
\App Paths\Loader32.Exe
4 N/ Q3 G' V! ~: Z, U; j# m/ ?
3 x. f0 s8 D3 J" x, `+ S; I3 H  F" X# G# H0 q& G
Note that some nasty apps could then erase all files from SoftICE directory
; Z/ l# U! V5 p6 t; [# q6 b(I faced that once :-(# [# z5 y( j& O) W! ?1 `+ i

$ M0 q% J2 B6 M( m; pUseful breakpoint to detect it:: @9 R; m; F3 s$ L, \

1 |. U4 s0 A: z! X& @     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'
% e7 a* l! |$ A. o6 Z( B0 R) x
0 }; `1 w& k9 K9 b; L__________________________________________________________________________& |* O8 S5 X7 \7 u5 G: |/ w3 B

' S$ Q. x2 ]% J7 ?( }1 u8 A% r0 [: m- i+ B
Method 14 / C$ v8 r# K, {3 Y
=========) l3 W  r0 v; X% r
- X7 w9 X! d5 l; C+ A5 i; p+ ~
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose- C6 g. G" T8 k& |) K
is to determines whether a debugger is running on your system (ring0 only).
8 Q3 M6 ^0 H+ N9 X, p
* U" V/ C% x* E, B   VMMCall Test_Debug_Installed
  ^" ^0 k" ?- k5 w9 ~   je      not_installed
  v' T7 N3 C1 L- K* x. T3 P1 T  Z) ]( D
This service just checks a flag.
3 F8 Q. D  q- O</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

关注公众号

相关侵权、举报、投诉及建议等,请发 E-mail:admin@discuz.vip

Powered by Discuz! X5.0 © 2001-2026 Discuz! Team.|鲁ICP备19052200号-1

在本版发帖
关注公众号
QQ客服返回顶部