找回密码
 注册

QQ登录

只需一步,快速开始

About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>
9 u7 w, s. w; R, J4 y1 q) W<TBODY>$ N5 |% B- c. D
<TR>
& c1 P  v& s6 H' v" m5 K% G) A<TD><PRE>Method 01 9 \8 ~" i/ e. ]1 Y+ q
=========
0 ?. ~$ h& B6 p9 ^% ~8 H! l9 Y8 L' I6 }% e" u6 ^) N! C/ {
This method of detection of SoftICE (as well as the following one) is
: F9 g! u  x* `8 Y5 @used by the majority of packers/encryptors found on Internet.
$ \$ q6 R# b! l" j. _2 jIt seeks the signature of BoundsChecker in SoftICE
7 G/ k; A- J( R' _  ?
5 Q1 J' I3 f4 \) V    mov     ebp, 04243484Bh        ; 'BCHK'
: z* m1 ]: ^( S( ?+ E8 U    mov     ax, 04h- |: i: v6 i, |+ Q# }: c' H
    int     3       ' ]0 I5 ~) j# V6 N  D9 t
    cmp     al,4$ I) g4 _% b7 G+ n4 a) [
    jnz     SoftICE_Detected9 c5 H: ]( P& \: C
( ^' S3 _2 ~+ a; ?
___________________________________________________________________________
* f1 Q, E7 }, l5 d4 j9 Q+ ]0 Q( @& z2 }2 z# J% F
Method 02( k+ e/ V4 }) @
=========& C) V* A# v6 A* F8 S
; A! g( l  t3 n  @
Still a method very much used (perhaps the most frequent one).  It is used7 I. G  w& `2 D2 A" c1 U7 t
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,) E+ \  b4 S8 c! d, Y+ H) F
or execute SoftICE commands...
! ~) N! k  f' h" X+ H% _2 L5 N2 XIt is also used to crash SoftICE and to force it to execute any commands
, f( M1 L1 _; }' F(HBOOT...) :-((  1 Y, A  y3 O) i
, `: u3 z' v( k5 v1 E
Here is a quick description:
3 T: B1 \0 {- ~/ A-AX = 0910h   (Display string in SIce windows)
9 b/ ?( r) J0 y9 Q+ ~5 g-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)
2 o# d  I! }9 u/ _! k6 K0 y& @1 b-AX = 0912h   (Get breakpoint infos)
7 g2 X" x& u+ K- ^- ~+ J-AX = 0913h   (Set Sice breakpoints)
* \" x+ A% k: \-AX = 0914h   (Remove SIce breakoints)
* d) q* q* L  X* S
( E4 C% N4 F& |4 \Each time you'll meet this trick, you'll see:" b& M  V1 A3 |6 `6 s
-SI = 4647h
' p& s+ C3 c5 Z4 {-DI = 4A4Dh9 [4 m0 S, A4 Y/ ]
Which are the 'magic values' used by SoftIce.
+ f. M5 S9 d( U5 TFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.3 M; f, t7 D0 ]7 k1 I
! I8 \4 m4 ~. P: ?
Here is one example from the file "Haspinst.exe" which is the dongle HASP$ |3 R6 o: C1 q2 ?: X/ V
Envelope utility use to protect DOS applications:3 G: E8 Z* V+ I) ~2 t
+ d- |  q. _" s( V, F/ w

* D0 A" k% `6 U8 c! d4C19:0095   MOV    AX,0911  ; execute command.
- m% X) `& H6 P5 F6 o& ^8 _& X) H4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below)., p0 S. t3 C* O: r8 w% K1 F
4C19:009A   MOV    SI,4647  ; 1st magic value.9 b. h  f- @1 J8 k1 Y/ E: C2 J
4C19:009D   MOV    DI,4A4D  ; 2nd magic value., v# g; I& g4 V+ N6 A8 N
4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)% I7 e2 n! U/ l0 ~! e) n4 Q7 K
4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute
2 b9 P/ j1 `7 {9 J, [4C19:00A4   INC    CX
) x% b8 i+ ~% x6 j, u1 o' P) S4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute3 \6 p$ [  q6 g" g
4C19:00A8   JB     0095     ; 6 different commands.( L2 b) h/ g4 _
4C19:00AA   JMP    0002     ; Bad_Guy jmp back.1 h5 w6 n! F) F$ _: O
4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)7 ?5 i# s5 C/ w+ l& g1 y

8 L8 ~1 R% M& w5 M1 J! NThe program will execute 6 different SIce commands located at ds:dx, which# I$ h8 i6 C; B: F+ J5 g
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
/ F& Z8 u+ e; `, |* P; i9 x# c& @$ ?( r. j8 ^# S- u  r, u) J
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.' Q$ }( H# B1 ~" u1 }6 l/ A
___________________________________________________________________________
2 ?0 |/ c2 p" r& e" J' d0 L& Q9 o
( v/ l. t' d) H  T: g6 r1 X
3 ?  Q  S9 j3 ]; t2 B$ |6 T% uMethod 03
8 J  G5 t8 C6 c9 _" e+ H9 H) t. D' r=========
8 x8 Z# Y; N4 E4 `: D. [* |4 i% T9 u% h" G# i3 s  l
Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
6 u% u+ m( V  S# D  }  W$ d(API Get entry point)( S  n! j) |' l0 h0 s; q; v! N: Q
        
! b* k5 `- s$ I: C9 k/ V, x6 I5 [1 |5 ]2 {0 W
    xor     di,di
. n! R5 m3 r9 A) @4 c    mov     es,di
5 G, g( b4 V( ^    mov     ax, 1684h      
+ i& E8 n5 @- J( i    mov     bx, 0202h       ; VxD ID of winice
) ^( S* E- D6 k: k. ]0 m    int     2Fh
0 @; Y9 H: D% P7 F* v1 N8 J    mov     ax, es          ; ES:DI -&gt; VxD API entry point% b" u9 l% p  E1 H9 V
    add     ax, di, B  u5 L" E8 Z' p8 M, w
    test    ax,ax% \; A- e& P" K  p$ ^6 C
    jnz     SoftICE_Detected
3 V' L; _* o! H/ W9 w) Y" w
# s  b; Z( K9 C___________________________________________________________________________
! L1 B0 f1 d7 ^
' y# w1 l8 B$ |1 ?9 D7 N) |Method 04) N0 h# l0 M2 ^2 I7 H9 Z( W
=========
( u9 ?  z. ?  _5 o7 K
3 d- y- D; C$ E, BMethod identical to the preceding one except that it seeks the ID of SoftICE* V! ?+ x8 d) J7 I; F( s# f1 I+ N/ [
GFX VxD.9 X1 k0 x. e8 E# I( B

2 j: Z7 S4 P/ w  y8 h    xor     di,di2 M8 N! K, ?0 l: ?
    mov     es,di
: O: q3 r. u$ J! F( G7 G1 }    mov     ax, 1684h       * J4 T9 Z0 r( |$ T& m" t8 P' _
    mov     bx, 7a5Fh       ; VxD ID of SIWVID2 e( O) ^( J3 Y
    int     2fh
- o* S3 I4 k' g; _# j    mov     ax, es          ; ES:DI -&gt; VxD API entry point1 k; {* I# \) P% X
    add     ax, di1 }2 t0 g, e0 N4 M7 ?
    test    ax,ax2 i. {$ E$ I1 \9 L2 L8 Z
    jnz     SoftICE_Detected) e: [9 U# n" I

; T  t* T; Q) Q% ]2 y# u6 Q__________________________________________________________________________
' m7 d1 ~6 r2 [3 J% `0 h  {" ?5 W3 i! @% x3 q& P

2 w. y! _9 U' T4 S8 M6 DMethod 05
4 X* V; s0 B% H0 I$ c" M1 c: P! d- g) d=========. H1 e  M" t% U; N

8 K: }$ p# p# ~4 P  |: \4 TMethod seeking the 'magic number' 0F386h returned (in ax) by all system
, Q1 T  Q  S8 E: V" Udebugger. It calls the int 41h, function 4Fh.7 k4 @, l, h/ _2 w" L  t
There are several alternatives.  
$ ]4 I/ i- ]1 m" G2 K9 g8 {2 b2 K6 C, W& ?. d
The following one is the simplest:4 }0 r& X; u: a: M* D$ P
. q% _7 s  W" G7 l( n
    mov     ax,4fh* C! ^1 m" n* M* u9 f- `5 q1 {
    int     41h) X4 i: o4 j9 W$ ]* W1 f% m+ u
    cmp     ax, 0F3865 ~  M: w. G/ P3 H$ Q+ J
    jz      SoftICE_detected2 W/ _0 U$ Z4 k

+ G  p1 k( p$ O: v& @) L7 R7 l2 u  t1 d1 s9 A+ `
Next method as well as the following one are 2 examples from Stone's 8 v+ t; C! ?3 H" }" ]0 w- ?' Q
"stn-wid.zip" (www.cracking.net):4 B5 a- }# Z! @! o* {3 q& S

" L- g8 Z) T! C% H  g' N    mov     bx, cs* e# z& X% H1 Z3 r2 e
    lea     dx, int41handler2
# _# w' z) h# M1 @/ Z% c3 f! D. Z    xchg    dx, es:[41h*4]
/ A2 Q3 {) f2 p+ _# `  ]    xchg    bx, es:[41h*4+2]2 R8 l5 C" n. n, f6 s8 C3 Q
    mov     ax,4fh
+ v7 \& A" a# e# b% v' ?. Y  A    int     41h2 F2 O% b+ K) [0 ?
    xchg    dx, es:[41h*4]' z; P, F+ j$ C
    xchg    bx, es:[41h*4+2]4 }4 }' w- W/ r/ e
    cmp     ax, 0f386h
7 ~3 d0 _5 N3 q* `    jz      SoftICE_detected
# h4 B, T/ m( l1 Y8 W% ^7 \& Y& @( L( q* @& ?
int41handler2 PROC* q5 M6 R- `2 v+ p! q! H
    iret
$ a6 _1 Y" o6 Nint41handler2 ENDP
& R% n' k/ u+ }" M1 b! V$ c( d6 [. U" q  U, }7 p

9 {; L, j' d/ j8 U* [5 `_________________________________________________________________________8 W+ ~6 M# r9 h4 g

$ ?* v# S; j9 R! l* L2 `8 a/ m( _
( \# S3 ~- M! K3 c2 @) Q' s2 vMethod 06
4 Y8 M* r7 n& j% b6 Y=========) t' y' I& v: L; b  w+ V

" D( l* i8 Z3 j, X' [- O. l; M' d8 b/ ?/ ^# `2 J- Z2 X5 s7 N
2nd method similar to the preceding one but more difficult to detect:. c+ V, P/ F6 l) m7 t  a

. p# D9 Y. z$ S
( Z; y/ S+ H1 D+ ^, rint41handler PROC3 E) J& ^% H* y! \
    mov     cl,al/ F6 @; q% X1 u7 `$ I$ L  ~% h* h
    iret& D9 b+ C& D. g$ {% T
int41handler ENDP) W, c$ W+ b+ b7 N9 u4 u9 I- G
" d7 w% A  B1 u, ~
( h) B* s' X- {& C" C# [
    xor     ax,ax
. n; b: j7 C, g% l: Z    mov     es,ax; D) b! R$ A- A9 {/ f6 T
    mov     bx, cs
! o; j6 ^) z$ l: E6 J; s! G' I* y) [    lea     dx, int41handler: c. u& O* j1 d# k
    xchg    dx, es:[41h*4]7 y% c& n1 L5 g+ {9 y: X
    xchg    bx, es:[41h*4+2]9 w4 B( |/ c  _7 G
    in      al, 40h
6 w& }. E2 Q; @2 C& S    xor     cx,cx+ a. L1 p# l2 b
    int     41h
+ M. O* a. {% w, q; G0 E" G! y$ H9 h$ t    xchg    dx, es:[41h*4]2 f- A; F# G' \# T8 j$ `
    xchg    bx, es:[41h*4+2]; s- A6 s0 {& d
    cmp     cl,al
0 |. R: n+ q' d" }    jnz     SoftICE_detected" C% s3 m" P& s% ~  e. y3 N0 L4 }

/ M2 ~# E3 a; N9 ]* Y_________________________________________________________________________+ y" p+ ^# z" m' l! V; w3 J
  s1 g: k0 V1 D% p
Method 07
; M/ D/ I6 e% \. s# n2 {=========& r" H4 ~! B  g- b$ g

9 O/ D) Z1 T7 ~: L% T6 Q3 zMethod of detection of the WinICE handler in the int68h (V86)$ o* o. i4 F" x; `2 N2 D

, [+ F( T+ R3 o8 z" T    mov     ah,43h# L. Q3 b1 g$ V1 V; h* S
    int     68h
& R9 @# C) G) [# {/ D( K. q    cmp     ax,0F386h
: v9 q: q, U$ P    jz      SoftICE_Detected' L4 Z6 L0 X9 F. a

* G, N$ Z! e5 Z9 |
' s  t' w) Q9 |* z: G3 W=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit+ Q- B3 }( |, v9 S
   app like this:% J& d1 Z2 b0 q* e+ Y2 ]8 o
8 o6 }# S! {# H) p0 N( |$ t4 [
   BPX exec_int if ax==68
3 t6 Z: I" O/ ~3 V; C) Y0 L   (function called is located at byte ptr [ebp+1Dh] and client eip is' o$ N* t$ \- q) p" e
   located at [ebp+48h] for 32Bit apps)
4 h. l' V: _2 ^; ~8 F__________________________________________________________________________1 e( M) c+ o1 b  o; `4 N( K) n; L

' l* B  L( T8 u/ P$ O4 O$ e, Q* R" `! w8 H2 z; B; t
Method 08
) L! R8 s2 `# m% v" P( ^=========
# [! T3 q5 d7 ~1 O# g6 R
/ h) V/ V  H# E  L6 JIt is not a method of detection of SoftICE but a possibility to crash the9 u: c% W3 }( f3 K  z. |" \
system by intercepting int 01h and int 03h and redirecting them to another' C; b/ D* z/ z+ A8 Q5 c( x
routine.
* F4 ~" b+ Q8 S4 e7 u: O0 PIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
' f2 [, r1 y) C' F2 f/ h# {to the new routine to execute (hangs computer...)
$ l& ?: A1 d7 v
" f9 `! |% o* I2 l) n    mov     ah, 25h; u8 N& L, j+ N2 j$ o+ h* q" c2 z6 g2 J: x
    mov     al, Int_Number (01h or 03h)
7 D- Z9 u4 [  z' ~9 w; ~' I    mov     dx, offset New_Int_Routine
/ Z! O7 ?, V( j    int     21h3 `% K+ c. [5 p

7 a' x- U: k' L1 f  }' |__________________________________________________________________________
% v0 @9 J9 r# \- e7 m3 s5 u1 i( Q9 W1 T0 d5 ]; C3 u# T
Method 09& f! Y7 }# \- S- ^( t* a
=========
8 a% ^7 S0 @4 [8 R5 \, b
, Q6 b! ?' A8 b) x. ZThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
3 m) O6 S  ^/ r. q7 Yperformed in ring0 (VxD or a ring3 app using the VxdCall).
% G% F6 a! |' x# G4 M; l, WThe Get_DDB service is used to determine whether or not a VxD is installed; r+ q1 H9 g# u3 j. o5 |
for the specified device and returns a Device Description Block (in ecx) for9 h* `$ d# K2 ?/ X$ _
that device if it is installed.
+ U( c; M. h! N8 M) ~$ P( p5 @1 O/ O4 T2 [4 S$ D9 `) C6 |: ~
   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID
" d! h" f5 T8 w: n( X' `4 b   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)/ C2 J$ D# F! N8 O' T. e) K, \
   VMMCall Get_DDB
0 |# j- z7 T+ K! I   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed
" Q/ `: {: R3 W2 {" k0 f' I' r2 U; j+ l* _3 b2 P
Note as well that you can easily detect this method with SoftICE:
; ^3 J. l- q2 E2 _0 o   bpx Get_DDB if ax==0202 || ax==7a5fh
: h2 B0 v+ D' `& `6 z+ @4 J# h$ T4 C1 l
__________________________________________________________________________6 E6 X+ z. v3 N  [
) N9 a" P4 r% I( @! W$ N7 ?/ |5 o
Method 10
9 {  ~9 v" Y$ R4 M: T6 s% Y9 c=========: ?7 p, q. o- W# U- c! z/ d. [

" }0 Q& y  }; V$ p6 {* T=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with
4 I# H  z" T; x- {( Z8 e" T) k  SoftICE while the option is enable!!
, [) |( t# r7 H9 ]2 w( |( X
) e; D- I/ w9 r% pThis trick is very efficient:
; v9 F( Y2 c# n$ \by checking the Debug Registers, you can detect if SoftICE is loaded
5 Q  P, S  R9 t! a, e( `(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if! A% w) \1 K% _6 m) E9 L6 H
there are some memory breakpoints set (dr0 to dr3) simply by reading their$ |  l& r3 E4 ]8 z: g5 R
value (in ring0 only). Values can be manipulated and or changed as well
# s5 [3 W( |! P0 T; r% S9 {5 J(clearing BPMs for instance): i6 Y0 Y% K0 q4 Z, a- U7 _
, w% n2 O; n, R; T+ v
__________________________________________________________________________
/ J1 D. ], ~+ w; V4 z( Y9 |( G. }# @, o' {5 j4 A) x0 {- Q
Method 118 l/ D0 j5 _! K6 D$ c/ D
=========
* W$ V: p8 D' _! r: F  u
; V/ H. W4 [# ]This method is most known as 'MeltICE' because it has been freely distributed
: t) {. e& [+ r  M. P8 h( }5 g( Fvia www.winfiles.com. However it was first used by NuMega people to allow
1 W' f$ O, j' C! YSymbol Loader to check if SoftICE was active or not (the code is located
# W- C+ X2 h- @- g& M: h2 v  z& hinside nmtrans.dll).
$ D& w0 K0 O: s( e0 x1 J2 [
4 J7 p4 K2 |1 _, q6 o. j( oThe way it works is very simple:2 g" \: p$ `# _) H& r
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for8 M$ F/ j8 J" b' i$ p
WinNT) with the CreateFileA API.$ m; t# Y# C, u$ ^1 x1 ^
, i! I% z; l+ r) K3 A
Here is a sample (checking for 'SICE'):
8 |& O2 _- r% p/ V# b* y
- q6 ?9 Y6 e4 kBOOL IsSoftIce95Loaded()- J- B$ U6 S  Z" a. z9 H  s8 \
{
' `: y9 d. }# Z$ f, W   HANDLE hFile;  1 [. d" }* X# w7 y. ]
   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
! R' i6 q1 h) ?: l) V/ z2 I; ?                      FILE_SHARE_READ | FILE_SHARE_WRITE,
  _* Y8 H: d# \- p; m, D! Q                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
' I% Y: v9 ]7 Z' r; {: y8 b   if( hFile != INVALID_HANDLE_VALUE )8 w3 m) i  a  v7 Y
   {
# h: S+ j0 h+ n% }      CloseHandle(hFile);0 B# z; [0 P" I1 e. {- f
      return TRUE;: X% e9 c% c, ?2 ]
   }4 D, J6 Z6 Z# ?: K- ]
   return FALSE;$ ?8 _4 N1 u7 ^3 q6 @
}
) S5 o" X& z. q2 C: w1 A& F9 m5 r. ]% \" p8 [  D; O& A( k( x: r* g
Although this trick calls the CreateFileA function, don't even expect to be* p5 V1 X# W& f$ Z
able to intercept it by installing a IFS hook: it will not work, no way!
$ e4 g  R: ~. s, ]# X& M0 lIn fact, after the call to CreateFileA it will get through VWIN32 0x001F
$ T4 R# q) [# y8 y. I4 `service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
/ `2 h  s/ g9 L% wand then browse the DDB list until it find the VxD and its DDB_Control_Proc
) E* e$ B. a; }& Jfield.
0 O2 P: N9 m5 l3 \+ @' r& bIn fact, its purpose is not to load/unload VxDs but only to send a   v: K5 p! A8 l) ?. e
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
- ]9 [: L3 {# R& B- M) Q4 ]" Z; tto the VxD Control_Dispatch proc (how the hell a shareware soft could try
7 A3 M, Q$ @% b0 h2 e1 d& i5 qto load/unload a non-dynamically loadable driver such as SoftICE ;-).$ t( w( c) Y- M- t1 R$ W
If the VxD is loaded, it will always clear eax and the Carry flag to allow
6 Q2 o+ S1 ^" @its handle to be opened and then, will be detected.* w- o( M! \3 ^( O8 K, |
You can check that simply by hooking Winice.exe control proc entry point5 P4 f% G; h; g- h! H% y0 f1 I
while running MeltICE.# f" T( f0 P0 H, }7 |
; x9 K7 r0 x4 H' k

5 n+ c, `) s; i& n2 v* s: V  00401067:  push      00402025    ; \\.\SICE5 N0 Y9 H* S; e# t* ~
  0040106C:  call      CreateFileA. w4 L$ Q# Q5 m# p( f6 V- t
  00401071:  cmp       eax,-0016 g5 J' D, ]4 ]/ y0 e; v, J  p
  00401074:  je        00401091% R  R8 e& I! P5 j) ^
; G# p# [3 G: t/ S: Z7 R
# ]- y# J% y& t; `
There could be hundreds of BPX you could use to detect this trick.
: n0 n  t8 n8 U  S* e+ {( t5 H-The most classical one is:" u5 u3 ^* {5 y% [
  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||
( ^6 `8 U; ^, l    *(esp-&gt;4+4)=='NTIC'
9 `% Q7 T( C/ y! k- c. @
( f: @7 Y) @" w: {9 \+ f6 r-The most exotic ones (could be very slooooow :-(8 e4 J' b* h. R$ f" X% x$ c
   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
" |' I: D! s/ E     ;will break 3 times :-(! o, u7 u$ H/ p( e  O8 v

0 T* g6 G/ Z) V+ O5 d-or (a bit) faster:
. c: P) U6 M( ~- [$ |- W   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
( {1 L7 x, r+ _& X* R  L
. ?4 H- H# u& ~+ c   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  
, @) Z, l" D- g# ?     ;will break 3 times :-(
; R: D7 K, g- z# X' J# B7 E
* F; J) Y# C, s! ^( _1 p' D) W-Much faster:9 C+ R) E/ a, I3 r0 W
   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'* t# a+ Q1 U( l. e2 P/ w) h
4 I3 f0 D6 o+ `  D& N# L
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
/ W0 a' w# k" O& l$ D/ Nfunction to do the same job:/ B  Z' v* p5 D& H" m; \
& q/ e. ~5 x& g; ^0 S
   push    00                        ; OF_READ
3 j9 q2 a% s9 x' g   mov     eax,[00656634]            ; '\\.\SICE',0) t& ]/ W& x/ i# D  i
   push    eax
9 L, D" k9 t( I) k+ S   call    KERNEL32!_lopen
# q& h- W5 W8 l   inc     eax) X' H: P) `6 P* ?3 d7 V
   jnz     00650589                  ; detected
# ?4 I* T6 I. A' I   push    00                        ; OF_READ; w! n) @- y) A0 G1 e
   mov     eax,[00656638]            ; '\\.\SICE'- n5 x! m% z  H% h3 I
   push    eax
$ C8 n9 j* |/ F- ~# h$ j   call    KERNEL32!_lopen1 g8 h) ~3 W  M3 a7 Y" r/ x
   inc     eax
  o, W+ s, p' \' W   jz      006505ae                  ; not detected: b  Q# \6 _$ d: q& F0 `1 i+ c

  a+ G  k5 j8 `, w
: P" {$ a8 [* B; S* |4 {3 a5 ~- Y- M# j__________________________________________________________________________
% [$ A2 Z6 a1 f2 o0 u& v) k0 r% |6 f$ |4 V
Method 12
3 n& f: v) o+ Y) S) U7 t=========# O7 t+ [0 h1 Q$ A. Q8 C

$ u& E9 N' x9 O5 e/ Y4 |8 Y6 J  r4 MThis trick is similar to int41h/4fh Debugger installation check (code 056 r- V0 B/ r# J1 L, K% g
&amp; 06) but very limited because it's only available for Win95/98 (not NT)
2 G! y/ Q' \8 c* [( ?% ?as it uses the VxDCall backdoor. This detection was found in Bleem Demo./ X# V& p, ?4 n/ i
& E! w. p' D; _. m
   push  0000004fh         ; function 4fh0 ^+ ~, g- j( J
   push  002a002ah         ; high word specifies which VxD (VWIN32)6 c# \2 Q/ ?* F! Z; f
                           ; low word specifies which service
9 Y- b7 j/ H  Z6 k3 T4 A. ^                             (VWIN32_Int41Dispatch)- [" Y) S* c9 a: z4 q! O6 W
   call  Kernel32!ORD_001  ; VxdCall. d6 m7 t3 o& w5 d# B9 R- ^
   cmp   ax, 0f386h        ; magic number returned by system debuggers
+ S) ?0 G' _- d( \) y8 W   jz    SoftICE_detected7 E& s1 Z& G, w9 G
% g: o! N2 K; n! G, }# A7 @3 E
Here again, several ways to detect it:, d  O, h& Y) n- _+ |6 J) U5 y

6 {3 k# f1 A+ w% e5 Z8 ]    BPINT 41 if ax==4f, h) c" y9 |& e. K. r
+ q, B2 L  z- q. ]' J5 [
    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one1 M  T+ @+ `1 B1 [

/ b- |( i6 T: C    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A
  B* p, T! ?  _. ^0 Q8 P- Y1 M
    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!
1 r7 P- H: `' a" z1 |- Q; M/ m: y! T. ?/ l6 F  }% c0 n. Q. {
__________________________________________________________________________, z5 l0 [0 f% s2 U! D6 Z
  g+ x* f; G$ O
Method 131 z: [/ o3 w# P$ V1 V
=========* O3 |8 Q, Z' N3 [1 s
7 U, M: C+ ^$ o  d' y
Not a real method of detection, but a good way to know if SoftICE is
" _0 W0 J; E/ I! linstalled on a computer and to locate its installation directory.
: b8 I' H8 I( z: U7 hIt is used by few softs which access the following registry keys (usually #2) :
& d- [# E7 P7 T+ `: _6 ?6 T% g  Z
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion5 P9 h' G9 f4 q: s  ]
\Uninstall\SoftICE. c* S4 H6 p% `) w/ s. Z2 t% w
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
$ l6 e5 l6 }$ f5 y-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
; h3 v: K0 t* C% P8 s4 F\App Paths\Loader32.Exe
8 O; j( e0 ~$ H: D) F2 K
! w7 j1 `1 Y; _+ e  i
: A" z: Q. R- l1 L9 eNote that some nasty apps could then erase all files from SoftICE directory
7 \% U" K+ v5 c4 T* P(I faced that once :-(
2 t: ^" y; ^. q) D
& D" K5 X( ~' s, \5 cUseful breakpoint to detect it:
& ^1 v# H/ Z; `$ N- R7 X! Q
/ Z0 ^& V" ]1 O, k+ L     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'
; R: y6 c9 _* y; f, f( }' `& s- O
__________________________________________________________________________; z8 n. R, K+ X7 T  w

6 K. }, e; a' p1 d" }( O9 W$ s: o4 P1 |; J, G
Method 14 7 L9 N2 ~* e' k; q$ \  M
=========
  W: D/ Z  s9 \5 Q& }( I. F) J" R( Q/ {. B
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose! t% I# }7 H- I+ z( a) N
is to determines whether a debugger is running on your system (ring0 only).2 t7 H9 t% h4 F( `9 |% T: P0 g5 s8 l" F

: ^3 _- B! f, \   VMMCall Test_Debug_Installed
$ \6 f: q$ N3 U4 T' x* L   je      not_installed
* z1 H. \) z8 _. I. t9 \
! m( Q, `6 ]$ E4 `% C( t$ I- M/ w1 dThis service just checks a flag.
% F$ x" Y( g( E6 |4 l# S4 @</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

QQ|本地广告联系: QQ:905790666 TEL:13176190456|Archiver|手机版|小黑屋|汶上信息港 ( 鲁ICP备19052200号-1 )

GMT+8, 2026-8-10 11:47

Powered by Discuz! X5.0

© 2001-2026 Discuz! Team.

快速回复 返回顶部 返回列表