找回密码
 注册

QQ登录

只需一步,快速开始

About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>
" \$ k8 u; z8 q0 A* m<TBODY>- `+ K5 J1 ~* m" L5 S# B
<TR>+ [( i6 i- E" S( E- J  l
<TD><PRE>Method 01
% x$ w( d& F& |$ H( h=========3 Y- b8 e3 ]/ _; t- `

* E/ F; I! m. l- AThis method of detection of SoftICE (as well as the following one) is
% R8 j, T* Z- w, n3 p0 V, l+ rused by the majority of packers/encryptors found on Internet.' r( z/ D2 S3 x) F6 \- F
It seeks the signature of BoundsChecker in SoftICE9 r3 i5 L6 D% P

6 N, k% j0 B* G6 I& h    mov     ebp, 04243484Bh        ; 'BCHK'# i2 v2 F) g+ c4 Z
    mov     ax, 04h4 t+ _. S  n' b# n" d
    int     3      
  p, F# e3 O, P" W8 M1 E    cmp     al,4
2 c  ?) L; ]- z- P* Z- ^" d    jnz     SoftICE_Detected
3 O6 r; h) `) ^5 m# T% n  f* _( o" f: _
___________________________________________________________________________+ D# X/ ]* j0 f. }

% m  R6 w* b( d3 zMethod 02
" a! B, S* S. p& ^% y" E+ [( o=========
( Y! i* O6 M  `, f! R$ C( n' k8 h3 m  w3 s
Still a method very much used (perhaps the most frequent one).  It is used
$ ^; j0 A2 l0 |/ t1 S* x: Hto get SoftICE 'Back Door commands' which gives infos on Breakpoints,
0 X" G; g7 T4 Q( `, y8 z6 Cor execute SoftICE commands...
- U8 w: e) Q/ o9 zIt is also used to crash SoftICE and to force it to execute any commands9 G6 M0 c5 k5 m  f" _9 t% }2 s
(HBOOT...) :-((  $ g9 |+ r: V8 t& Z$ d

+ I$ V+ |# h6 A& V3 d' EHere is a quick description:
+ \' Z, X# X" e2 |! f-AX = 0910h   (Display string in SIce windows)
+ d( f9 b* v( x8 ]# R4 U7 Y-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx), H" h$ V" d7 V
-AX = 0912h   (Get breakpoint infos)
# m0 ?: B& Y( Q! ?6 S9 {-AX = 0913h   (Set Sice breakpoints)7 s+ K" @: G% I) d, o0 R
-AX = 0914h   (Remove SIce breakoints)1 ]! B  T/ [1 w# p7 t5 p3 c5 P7 k
. `! u; f; ?# ~! {% u1 q4 n
Each time you'll meet this trick, you'll see:2 n- A  m/ F5 r! @  V: L% ^
-SI = 4647h5 A5 k/ Z7 G3 Q6 W  g, T
-DI = 4A4Dh
# g7 m( j9 ]3 |1 C7 v& BWhich are the 'magic values' used by SoftIce.; w  j$ I2 `8 j) N7 r* D
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.7 {0 ?8 Z0 ]9 H' e( f
8 e/ v+ X7 P6 p4 r
Here is one example from the file "Haspinst.exe" which is the dongle HASP* x/ i2 L. m5 S/ K6 G; [
Envelope utility use to protect DOS applications:4 e( N/ j9 N1 x6 j. d' F

: \$ j* F$ I7 o% E8 v/ V6 V9 [1 h- _
, S. s" M+ d) ]$ G4C19:0095   MOV    AX,0911  ; execute command.( |) b4 L* [( M. o1 F4 k
4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).. S! f/ k3 ~; y7 J3 D* ?
4C19:009A   MOV    SI,4647  ; 1st magic value.1 o: ~* ^* V9 u: `  |3 `) ?1 q8 W
4C19:009D   MOV    DI,4A4D  ; 2nd magic value.
) A) c  {' x& T9 F4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
8 N! X- k7 c/ h8 f+ M; [. S) C+ l4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute
; \* X/ A( y9 a4 R9 i) x4C19:00A4   INC    CX$ _, o1 c* S1 n2 t% V, R
4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute2 U/ }2 A6 P4 o' }! N( b" \
4C19:00A8   JB     0095     ; 6 different commands.$ V3 M- N9 Z) g( d
4C19:00AA   JMP    0002     ; Bad_Guy jmp back.
' I% d% V* u/ Y0 ^4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)0 F5 c  w; H$ w/ q; @+ t

, J* e, m* k9 Y6 L) u" }! |The program will execute 6 different SIce commands located at ds:dx, which
) G( ^! L0 B3 |& d# ware: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
3 ~# D- F; M4 D' S" K( j1 a2 g; v8 t6 Z2 N4 h6 W: ?' q
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.4 C, \" y7 F* Z5 ~% _+ |/ _
___________________________________________________________________________0 `* o9 |% y0 k# D

$ S- }9 U/ Y  l  r1 D6 L* d# c2 u3 p' _$ [
Method 03
' q) ^1 L1 c+ U' A$ {' j( G. I=========
- z! L, T# }) s# U/ @- M! e. q8 L1 ?. L8 p3 w; ]
Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h; K% m" ?8 _1 N
(API Get entry point)
; i2 }% l& c+ C0 G( j, z$ H        % A* i1 Z6 q6 ^

- a" b. h2 |: H" W( w: T    xor     di,di+ H0 i3 {; }* t
    mov     es,di3 V9 G. m1 J$ L3 X7 j
    mov     ax, 1684h      
% G2 m6 P, m' r4 S3 i  Z    mov     bx, 0202h       ; VxD ID of winice1 Y+ M7 W' t, O! N. u' k
    int     2Fh! @$ N7 ]- V, C; g# H+ J
    mov     ax, es          ; ES:DI -&gt; VxD API entry point" e% B7 {/ Z0 Z
    add     ax, di3 ^# j1 k* A' b( T" z
    test    ax,ax
3 f- P9 @5 U) x- c0 i    jnz     SoftICE_Detected8 G0 U7 ]$ P2 L- D5 {, A

( {0 O& z2 F+ E4 c0 L: z+ d- N8 @___________________________________________________________________________
9 T* l% A( {) B1 x, {8 ^# s# ^( G* F
- A- ^/ R% _( N6 ]2 `6 LMethod 04
+ P- Q! N8 W  m7 V- N, V7 Q9 P=========+ r6 d) |1 v# {" j" ~
8 m( i( B0 x; ?3 L
Method identical to the preceding one except that it seeks the ID of SoftICE+ L+ ~2 I' D" {/ i6 o
GFX VxD.8 A2 r+ S2 T* t. j7 ~
5 o* |  R3 I* T  D& C! z0 s5 t' z
    xor     di,di6 E; Y0 Z% G# ~# c# h4 K& G
    mov     es,di0 `" z5 \- V) ]5 Y7 o  J
    mov     ax, 1684h       8 C. d9 D% d: M1 S  N
    mov     bx, 7a5Fh       ; VxD ID of SIWVID* c) k8 h( c$ b, w
    int     2fh
* x& O1 _' Q" B3 G4 v2 s. E/ B) c    mov     ax, es          ; ES:DI -&gt; VxD API entry point
  ?) W. J% \( _  B: T& [    add     ax, di
5 @4 }. V. O1 ]0 o    test    ax,ax0 V7 ^3 A6 e' ?1 P7 |
    jnz     SoftICE_Detected
7 j# _! f- v/ _8 `- Z& v7 F# S5 z; V: d; p' Q7 C# n! Y1 h. X
__________________________________________________________________________
  B" X7 {" b1 c! f
9 X4 `0 C4 @6 J) K7 i
( U2 U9 O& y6 y7 s  N! WMethod 059 i5 {/ O0 X3 u4 G" r
=========
# H+ A# \  n9 v* h5 s& j7 a: c
" g% T1 e8 }3 M9 j: ~7 LMethod seeking the 'magic number' 0F386h returned (in ax) by all system
  l. }3 g2 E9 Rdebugger. It calls the int 41h, function 4Fh.
6 n: ^8 G( Y8 E8 U0 a& aThere are several alternatives.  
2 Y  ]& |) C, g7 N' s% B3 K* h$ k# ^3 f/ e7 j/ U2 e9 M
The following one is the simplest:: [/ p% A" }: L9 Y" \
9 K0 |. U0 Y2 Z/ K- l
    mov     ax,4fh
' g9 W# z# g: S6 d9 h% L% r4 \    int     41h
5 F  E: R- N. c4 j, F    cmp     ax, 0F386
( ?- b0 H$ G  V3 @( }) X+ U, z2 ^2 J    jz      SoftICE_detected: m( V3 [0 M9 w- K: y9 ]
2 F% f4 n' y1 k' B" I9 f
4 g& O" M: i) s. g# _. p" s5 T
Next method as well as the following one are 2 examples from Stone's ) b2 \6 _9 m( F; n: S
"stn-wid.zip" (www.cracking.net):
8 W1 U& t  w, ^9 I
+ q* V' z# Y, `    mov     bx, cs4 i" i# F" d) ~8 j
    lea     dx, int41handler26 |9 U& a$ b- v& k4 `, _
    xchg    dx, es:[41h*4]' ?4 L/ P' O) Z2 L
    xchg    bx, es:[41h*4+2]" s" E2 P; Y8 A3 D1 S. \: F) @7 f
    mov     ax,4fh
+ U% W# Q0 F6 E; \$ y    int     41h; d; N+ T, B% i6 b
    xchg    dx, es:[41h*4]: J$ g8 @2 D8 m- s+ b: D4 L
    xchg    bx, es:[41h*4+2]
" O) {) R. j  K3 Z( Q, G# r: @( q    cmp     ax, 0f386h+ `  |2 ?, l5 E0 w; U! h# k) |
    jz      SoftICE_detected1 E$ q: z5 i/ G6 P7 j. W% l
7 v. W% q% j3 X+ i) U
int41handler2 PROC2 d5 W/ e! Y( g8 h+ R  Y
    iret2 }" L, H# |* a9 d
int41handler2 ENDP  Z5 D  D# j2 n1 n" l
5 e; X4 d# ]+ }6 r* {

, @' b1 J: j( f0 l_________________________________________________________________________& Y0 P) }3 A' K8 d6 |) z
& I( e" [: Q  {1 J5 y+ a1 [8 _1 P) A& B

: ~; w7 V$ T$ x& L  v1 y: J5 f% _0 eMethod 06
3 G$ {7 B  `  j  c9 t1 O4 q=========
- I+ t- S$ u4 z2 R! {; j1 k7 F. Y' f! c5 h' S' I' u
$ c: b7 t( o& f( q
2nd method similar to the preceding one but more difficult to detect:* g7 c1 F9 E/ N* ]
7 {% X0 R5 O$ c4 P7 X

1 i5 q( e' K" u: g: w# ?int41handler PROC
  b4 Y5 u  p7 y$ C5 i5 n6 S    mov     cl,al
% t, Y4 |, I) n$ {3 |$ f    iret
* L2 Q$ N4 {$ \5 Z  U7 J% D; r( m, iint41handler ENDP1 ]) ?5 }6 k9 W/ j. Q  u, L. `
/ x* O$ d0 B2 q2 E$ f

, T  z% G% y. V9 M: H: t* C    xor     ax,ax3 s  K2 J3 u# |( r0 R; \, F
    mov     es,ax+ a3 d- e' J7 J$ Q! t
    mov     bx, cs
! M; z/ x2 w& u( l    lea     dx, int41handler
' ?2 O' c: E8 f    xchg    dx, es:[41h*4]
7 i! f5 v  n5 ~    xchg    bx, es:[41h*4+2]) t" F! I6 I+ [/ t! W0 J
    in      al, 40h
" ~9 V0 Z/ X. S1 ~7 K    xor     cx,cx. Z& r) W, S+ i
    int     41h9 g  h" @# N. F
    xchg    dx, es:[41h*4]% Y) k/ b) N7 V
    xchg    bx, es:[41h*4+2]
9 |8 D$ [# k" \9 f1 ^5 R    cmp     cl,al% Y8 }+ i8 e4 G, c3 x
    jnz     SoftICE_detected
; B8 t! l2 }( e* e) ~  E. W& Q6 A' |; U. n
_________________________________________________________________________7 I$ S" X" u" u: A7 O3 c+ ~, y$ U

- L' u7 }( Z# rMethod 07  O4 c& F* H' y; a% C9 k* e; ~/ P5 w
=========  T8 S2 w' k- T7 y
+ Y) M% v4 ]4 p) X6 U: ?# Z
Method of detection of the WinICE handler in the int68h (V86)
' U  ^6 W/ {& n; n9 m4 X
1 r! E$ v5 D" Z- m) S" w    mov     ah,43h
0 K$ E6 i) R, U4 j5 l! I" B# O- q7 _; l    int     68h6 H" P) Q# t1 L* M2 ~
    cmp     ax,0F386h
" A: T9 W; [1 b4 k    jz      SoftICE_Detected
; }6 u$ n5 B4 U3 _1 l6 d. c9 Z( k4 [' b5 p- T" X

6 X$ N. `) Q* @7 B=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit& G" X1 V% C! O# i1 r
   app like this:! `5 x" c' [( q* C: {. I; s8 z3 D

4 L, i, [& w9 I. x) Y0 a; A   BPX exec_int if ax==68
8 }, a: i0 E! t" y0 f   (function called is located at byte ptr [ebp+1Dh] and client eip is. l6 y" B) Y4 t) w# e
   located at [ebp+48h] for 32Bit apps)
0 q5 o: z5 h% Z* @__________________________________________________________________________
" U% _( M5 `2 g( J5 u9 t& \. X7 p, M0 w
# e  {( ?0 u2 L  J; G7 {
Method 08
8 _8 C/ k' n. A8 h* E$ c1 j=========* j6 _5 w$ u/ R( [1 P7 Z

$ K/ |, c  ~  z8 _; HIt is not a method of detection of SoftICE but a possibility to crash the
, a: f  A7 h& M: _$ }+ H6 s, Csystem by intercepting int 01h and int 03h and redirecting them to another
+ G! S9 O; s+ \7 K/ D, `) eroutine.
. h0 s4 \/ @9 F+ qIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
) R2 g3 v/ K% vto the new routine to execute (hangs computer...). K3 r- I) C9 F3 E
+ ~9 b( Y+ b7 k3 Z7 V) I
    mov     ah, 25h$ t2 ?' @7 o% I& s0 }$ h$ T
    mov     al, Int_Number (01h or 03h)
' e- i0 e& k  V. G4 F% m: V: t    mov     dx, offset New_Int_Routine
& B% R5 T6 p: _" F+ U    int     21h
. m& H3 u" |3 G/ M8 {3 k( [+ K; D3 d" F5 u  a, O  q% W; m4 S
__________________________________________________________________________0 y7 n4 W) O. z) m; i) ?7 P

: F2 ^1 f& |% K+ P! `- F; uMethod 09
: a- i. J- I4 ~) N, J! T# u=========2 ~" q  _  \6 X0 D  |9 V

! m' }4 n' Q" ?, A8 b: pThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
- o( M$ C  j2 Y0 F( bperformed in ring0 (VxD or a ring3 app using the VxdCall).4 t( U8 `. }1 O" U& |1 r: Z! k
The Get_DDB service is used to determine whether or not a VxD is installed
/ g: b9 {% c" o% o" ]6 m( ^for the specified device and returns a Device Description Block (in ecx) for
( I( n; y# p' x! xthat device if it is installed.
3 D3 o7 F6 F6 Q: M& k/ P8 S
$ k# A$ R3 E( X- p9 `; ^: X   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID
# t2 ]" K  u  |. V& e   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
3 }* g1 y8 q' {7 Q& o5 ]   VMMCall Get_DDB# U6 W7 ?! s6 X; k) X
   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed2 D: i# J' j) N6 v$ B7 U% j
! C3 ^/ ^4 C+ m/ h; W& C) V% K
Note as well that you can easily detect this method with SoftICE:
, w! e; y) Y: w) |# T   bpx Get_DDB if ax==0202 || ax==7a5fh$ e, U1 Y  @- ^& w3 U% e4 L

( t& M. z/ }: P/ ___________________________________________________________________________  E% b# C# d' H, _# H* C* k
$ s3 J; C" Z3 g" ?5 b5 D3 b$ ^
Method 10
7 j# z8 j( _% A5 H=========4 \- V" v9 z( G- o% ]! G& R: Q7 z

7 v! [" i* u9 J; l! ^# i5 U  ~=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with6 s- x2 Q9 q8 ~7 C2 g' Y
  SoftICE while the option is enable!!$ g2 x0 X. a. b
$ P4 T4 @  b& {+ \# x7 O" P9 ~
This trick is very efficient:
" C7 b( J* n6 ^by checking the Debug Registers, you can detect if SoftICE is loaded
* \2 X% i4 }6 M$ U+ h# c3 n0 N9 x5 @" T(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
# b/ _( M3 h* R) [/ C$ r! gthere are some memory breakpoints set (dr0 to dr3) simply by reading their
: Y: t0 }$ O& }2 P/ gvalue (in ring0 only). Values can be manipulated and or changed as well
8 U7 T6 ^( S+ M+ a4 D3 F(clearing BPMs for instance)
* |$ v3 h- v+ l
, R( E6 u4 X3 p* R- b- W) q& [__________________________________________________________________________+ e" m& V* U# k8 [* ]0 \
: J- {; q& v$ l$ s
Method 11
7 u* Z6 O* y8 h; W=========
. k& W% k" t7 [% z1 Y
8 j  w7 r- S& AThis method is most known as 'MeltICE' because it has been freely distributed( s4 ^- [# a4 S3 _3 g
via www.winfiles.com. However it was first used by NuMega people to allow. r/ T( C' C+ f% d& W3 m8 h
Symbol Loader to check if SoftICE was active or not (the code is located
/ m3 ?3 [" t' G" Yinside nmtrans.dll).
3 j$ Q2 b  U# p) ?# l/ d6 w0 X8 U+ r! F- v
The way it works is very simple:8 N# {" u7 h1 |2 k4 Z& h2 `
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for5 r: H# T* L' d, q7 L, S* T& X
WinNT) with the CreateFileA API.
6 ?2 f6 C4 ?8 I; ~8 p+ f8 q: O( T0 ~* p" ^+ Q
Here is a sample (checking for 'SICE'):
8 K8 B# P" Q# \: ~0 }  R5 n
( L$ W* c# g8 C. C4 C! GBOOL IsSoftIce95Loaded()
. M! y) g. J4 L- z5 f8 _& f9 Z! I{
) ]( M! h) o, D4 B   HANDLE hFile;  
; R$ n/ ]" S4 v  N   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
5 q8 K* j! I* s* |+ y+ @0 j                      FILE_SHARE_READ | FILE_SHARE_WRITE,: B" D$ q8 z. V- u3 y/ z
                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);: ?5 n2 H; y/ _. A  T- B
   if( hFile != INVALID_HANDLE_VALUE )8 V- _1 @1 Q5 J  W3 M; Z
   {
( o$ C, L4 s* }- `' Z      CloseHandle(hFile);% `  z' ]8 R9 I
      return TRUE;( B, ~# e, C/ `; ^6 I
   }
* t' `! l0 z' W' s   return FALSE;
8 K# x. o+ r, t4 f* D}
: N% u% ]' J% R+ n" f
/ K; T8 Y; B9 U# U/ m! l6 W- BAlthough this trick calls the CreateFileA function, don't even expect to be6 J( ^& L6 _' Q- _& z& k& D6 c: |
able to intercept it by installing a IFS hook: it will not work, no way!1 x& ~4 ^" E/ L. T8 d) u
In fact, after the call to CreateFileA it will get through VWIN32 0x001F. @$ ]1 a( h8 |' s% W) y6 w
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
0 g, C! E0 W. |4 Rand then browse the DDB list until it find the VxD and its DDB_Control_Proc
7 G" y5 e% |" Dfield.
% w5 [. [( E* o$ q' ?! XIn fact, its purpose is not to load/unload VxDs but only to send a
+ X& c0 g: Y9 j, w: E, @$ ]0 oW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
) {9 R* j( }" S1 L, ?to the VxD Control_Dispatch proc (how the hell a shareware soft could try# \, s3 k7 t9 O! W  N- v+ X9 f
to load/unload a non-dynamically loadable driver such as SoftICE ;-).1 \& r* [# j5 D2 C# {
If the VxD is loaded, it will always clear eax and the Carry flag to allow) x1 Z/ ~7 l& b1 F8 L
its handle to be opened and then, will be detected., R$ H$ G: V7 d6 x  y9 D% w
You can check that simply by hooking Winice.exe control proc entry point+ n1 g: C3 ~; j) L) i: Q
while running MeltICE.9 X- L# a' t+ s
5 i. l0 |" o( B, T7 ]5 I

& O9 `/ Q) [8 F3 L  00401067:  push      00402025    ; \\.\SICE
6 R# Y! Q7 ~% m* B( C! T  0040106C:  call      CreateFileA
$ m% |& Z: ?" Y# ^/ _: m  00401071:  cmp       eax,-001
) N$ W0 `7 B( ?% y6 U5 C/ w  00401074:  je        00401091+ x( k. e, k* T3 s- E, V

( H+ I# Z% X% o3 ^8 ^7 k1 `$ C% I0 ?6 \8 }' S
There could be hundreds of BPX you could use to detect this trick.
' |5 \) @: X3 P! R5 K4 l+ i: Q-The most classical one is:" y1 }4 B2 [) Z) k, ]" L
  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||; B. L1 o  E* v
    *(esp-&gt;4+4)=='NTIC'6 n/ d. ?9 q+ z; B6 }2 r
8 }" w9 B) a9 o% y
-The most exotic ones (could be very slooooow :-(
! G6 l/ m" W) ]2 m1 Q   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  # a6 }1 ?$ V. M+ K; w/ Y4 l- u' D
     ;will break 3 times :-(% y7 \" W( _) I5 \: e  \

7 `" t/ B4 b: C# I0 z4 T" L-or (a bit) faster:
  o3 V* X7 M4 w6 h2 `6 _: _' d  R   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')" i: |+ D6 O. x4 j. w* x

% C6 Q5 r2 A- j' U6 \# i1 P% y   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  
% ?! G* X3 r9 E# ^     ;will break 3 times :-(
! x" b0 y' g1 o, n: l5 a2 N* y2 E. }, f& q
-Much faster:
; ^3 e) W8 C( c4 ~- G! [   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'6 s: f, C- z; v+ ^1 `
  p4 T& i) M1 j& g% k
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
/ j1 {# _  U7 j, z1 A9 z8 zfunction to do the same job:( h5 s+ a) K# N! q2 y; e

8 N2 a) |! I+ {4 H9 U   push    00                        ; OF_READ
, o3 i: h+ P' w3 T. |   mov     eax,[00656634]            ; '\\.\SICE',0. R# P7 {4 x9 K7 O7 ~
   push    eax9 ?; o/ [4 c8 F3 W2 ^1 W0 V" _
   call    KERNEL32!_lopen0 T, \& Q5 P* ~, T1 @
   inc     eax; D& M* ]: o' z! w
   jnz     00650589                  ; detected7 g" |( n; e1 M$ g, `3 t
   push    00                        ; OF_READ  d# Y2 k/ |7 Z: I2 Z7 z6 I
   mov     eax,[00656638]            ; '\\.\SICE'+ M4 }  ^6 p" i% G$ q! I
   push    eax
; J& Z3 R( j: ?  T" [, A4 G+ I   call    KERNEL32!_lopen; |( Q. n! v/ M2 E
   inc     eax
' b) a2 {; e  ]* f) Z/ ^1 a   jz      006505ae                  ; not detected7 U1 D2 N+ v9 m. n6 \
- o5 j& e* K2 x& [6 Z. \

' X6 h1 G+ K( m( J# N# m/ A__________________________________________________________________________" C. I- m0 c: h2 X3 `" @/ I' j

% Y9 N+ B9 S/ [Method 12
" @9 ]/ ^9 `# s/ s5 p=========* G( _2 d' V( V5 I) P

2 Z6 H2 V" F8 U4 U$ y) [This trick is similar to int41h/4fh Debugger installation check (code 05
* s8 o* S5 T# k- N* v0 U&amp; 06) but very limited because it's only available for Win95/98 (not NT)
+ F0 q9 z# ^0 F+ [" H; G7 h2 was it uses the VxDCall backdoor. This detection was found in Bleem Demo.) R, A9 A% i2 [; z! [
. a3 n7 ]; V, K+ ]$ f
   push  0000004fh         ; function 4fh
3 t, k+ a) {0 r& P+ Z9 S; H1 K2 K   push  002a002ah         ; high word specifies which VxD (VWIN32)
% h1 S& e3 g2 C5 ^7 k0 ?                           ; low word specifies which service* ?4 K, g6 @7 D, l4 {
                             (VWIN32_Int41Dispatch)
$ ]9 i0 ]. p. |& f: q   call  Kernel32!ORD_001  ; VxdCall
& K" ?2 O  @. b$ [8 U7 f7 K# R   cmp   ax, 0f386h        ; magic number returned by system debuggers7 X% m7 {) z4 R1 u" v
   jz    SoftICE_detected
* Z6 o. G) d* a" z; j
" W9 u5 I. Q# {- Q* iHere again, several ways to detect it:3 b7 h# b" ]+ Q6 P6 |3 q
; B8 g) C5 h' e# P  c
    BPINT 41 if ax==4f- A9 i; h  X* P3 |8 ?, m

; J# a0 D3 M. E    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one& ~% x( _, [9 n' W  a: `) W" \

( O" i2 {' w6 N) U3 |    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A/ d. l* T$ o! q' u* m, T) @( A
# c" Y- m! t9 L/ Y$ Y
    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!
# ?% S  e* e0 }& `/ G: n9 n) S6 P! w; `
__________________________________________________________________________9 e. y3 E$ W; I9 ]1 `. N
  b  {& a3 D+ n  h/ H5 d
Method 13
2 ~( w; D1 g( x8 X=========
0 Z0 t: W% W: C7 ^( p/ v" I3 X7 g. F" k  P3 a% M4 \: i$ A2 y) B5 s
Not a real method of detection, but a good way to know if SoftICE is2 y) u8 l% o$ ]3 o) y+ j3 M3 _
installed on a computer and to locate its installation directory.% @) v& w$ p8 u+ D; Z
It is used by few softs which access the following registry keys (usually #2) :+ _0 `5 c' i% U; I1 }9 Q
+ X; ?! T9 V  ?. g
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion2 e3 U# G8 A, `0 N, Y/ x4 P
\Uninstall\SoftICE
$ V* j9 B# V; O0 P; Y-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE, h! {( S7 u' f2 \
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
9 A) W3 w* @- v2 c: C\App Paths\Loader32.Exe
. X; Z6 m' ]) J! T
0 y& v& n5 D- I6 u, ~
. O2 X, Y% z5 p) pNote that some nasty apps could then erase all files from SoftICE directory. U; p$ i1 G3 d* O- T/ ^; g& z8 y
(I faced that once :-(* `! s! d; T- _" @. ^

! f$ O8 l. J( d: i& o+ S2 XUseful breakpoint to detect it:# P* r* t! o  s4 d9 ]

( F( ~( j  a9 ]$ G. b, C- g: b& m     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'
. h8 J5 y& m: j# n, ~* Y7 U5 r1 Y. ^+ j% d
__________________________________________________________________________
3 M1 a" K( P" g+ W! l; X! w. W
5 s) V3 i/ I+ I
5 C8 l0 w1 x  g9 E5 u7 _5 [! ?( MMethod 14
# G# j5 a* T3 ^7 i5 e6 j=========
" G. i& W9 N- K  T- w$ F" w$ G+ b/ l+ Y$ @$ u2 H* N
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
9 J: b8 |. p" m- y0 p% uis to determines whether a debugger is running on your system (ring0 only).
4 d% P1 }: a3 T- H6 l) l7 P9 `2 @2 o. x, R" Q& R7 u& k
   VMMCall Test_Debug_Installed
3 y: p: B# A6 r% T   je      not_installed+ c9 o1 u/ _$ `, n) F0 _( t+ ~5 E
: Z5 O9 E$ A% {3 t7 ]
This service just checks a flag.. w3 Q: r3 u  W* i  }
</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

QQ|本地广告联系: QQ:905790666 TEL:13176190456|Archiver|手机版|小黑屋|汶上信息港 ( 鲁ICP备19052200号-1 )

GMT+8, 2026-7-22 21:07

Powered by Discuz! X5.0

© 2001-2026 Discuz! Team.

快速回复 返回顶部 返回列表