找回密码
 注册

QQ登录

只需一步,快速开始

About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>! y! X. ?0 n( D
<TBODY>9 G8 k9 T9 J8 G; v
<TR>4 |0 Y# t2 \* ]9 s# t0 s7 t5 j) L
<TD><PRE>Method 01
+ a0 j$ ]1 M& A/ i# A" ~7 P: M=========* L- O; v# Y1 R
& X. k: k9 i) B: o  S0 g
This method of detection of SoftICE (as well as the following one) is2 `: j6 |9 l. R! d
used by the majority of packers/encryptors found on Internet.' C3 L1 ^* [: L7 l' `
It seeks the signature of BoundsChecker in SoftICE2 I* z# Y" u+ a. h
' I4 ]/ }$ |9 `4 ~; Q( Q& l
    mov     ebp, 04243484Bh        ; 'BCHK'3 S5 L! n, E# D: g& B
    mov     ax, 04h8 o: S6 }  |# d6 s6 v& k. n
    int     3      
: F% O* o! D& A0 r# m; N    cmp     al,4/ s' F) v" \" B) Q% e% m% r  ]. R
    jnz     SoftICE_Detected
2 a/ _5 W' b4 X
, X. G* b" d$ V- z3 t  j___________________________________________________________________________
5 @* b! F8 \! G- T! o5 N; w1 k  J  |1 d, Q/ ~
Method 02
: v* X0 b$ V4 q; I- X: w5 w=========" _7 O" N4 b7 Y9 R- }: c$ r
  v" \- L# L( |+ Q
Still a method very much used (perhaps the most frequent one).  It is used. U7 O; f+ R2 l! @) x
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,8 ]0 f  g  T# }5 Y: f; W8 D
or execute SoftICE commands...- R# G! y0 d+ H8 I6 @
It is also used to crash SoftICE and to force it to execute any commands
* j9 b  R- R, \) e(HBOOT...) :-((  + M0 L8 b3 z. S  u+ m4 [- |* r+ {
/ D, f, t+ K1 H( J
Here is a quick description:
( s5 K0 t( a8 i* |( M" a-AX = 0910h   (Display string in SIce windows)
, p, R) N! r$ s5 @6 E-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)
1 Q; ^. B) }8 x9 o-AX = 0912h   (Get breakpoint infos)
( x* \; R8 ?9 g( A" |-AX = 0913h   (Set Sice breakpoints)
- Q* m  _3 A$ ~9 Q/ D-AX = 0914h   (Remove SIce breakoints)  g; J9 E4 J0 G  ]
4 r+ j" J3 ^* M- i4 C# \. R
Each time you'll meet this trick, you'll see:
  v' w+ g+ e# x& Q/ ^6 O-SI = 4647h6 M, X5 Z) V2 K. r) r0 D& X; Q
-DI = 4A4Dh
7 [1 U# m+ n  B  HWhich are the 'magic values' used by SoftIce.
, ]8 I1 z) X) p0 x! j) g( OFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.
# Y8 I' U' n, M6 O
6 ^# x  x( y1 v# D5 t; o  nHere is one example from the file "Haspinst.exe" which is the dongle HASP
' V4 t) s) C; P6 z% v, n" rEnvelope utility use to protect DOS applications:# Y: \! k: ?2 ?

& m% f. C  r7 H- r9 d, L# _
" `6 X% L8 r1 i  ]; a8 f/ f3 T3 a1 y4C19:0095   MOV    AX,0911  ; execute command.
# r0 E: u# ^, v4 Z( [. N/ g4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below)./ ^; ]. h1 H) }/ F9 l% J% A2 ^9 p. L
4C19:009A   MOV    SI,4647  ; 1st magic value.
* ]4 @3 {; O) P6 N/ M& n/ Z" n0 w4C19:009D   MOV    DI,4A4D  ; 2nd magic value.
" U; v' S% c; z; k7 G5 c7 O4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)( Z! c! F7 N# c
4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute
7 X, I! X2 ^3 p- N! P% K4C19:00A4   INC    CX
' E* l' Z4 \6 b: n+ ?0 D$ \4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute
2 ]) Q0 F2 O2 v  t4C19:00A8   JB     0095     ; 6 different commands.& k0 @/ ]$ \5 `- ?* E0 y/ l2 c
4C19:00AA   JMP    0002     ; Bad_Guy jmp back.
% Z5 x1 S# f8 d  I! l+ x1 ~1 t4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)
! N7 _) \/ V, a- C. o+ L5 p/ x! V+ A8 q; G/ A9 W: P& m# x0 l
The program will execute 6 different SIce commands located at ds:dx, which
, @- y/ g* t9 s9 G& Lare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
2 o5 Q& M- h# G0 W  U
' Z. h  ~6 L& X! F3 x: n* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
* a7 v5 j- ?3 Z+ ^' p4 b3 m& Y___________________________________________________________________________
5 J- B$ N& @; u0 E' d# {
; v+ J6 a$ }; g5 e! \+ y. G0 h1 K& M+ t5 }
Method 038 @% O; ^; S- g0 e# B1 G
=========8 j5 w" O. [8 b4 G7 E0 |+ T
6 K+ B% m' e5 J
Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
2 u) _  x7 l9 {9 ]5 I(API Get entry point)
! _( l7 U1 k: i% G4 V+ C$ c( v        0 `: ^0 W! [% G! F% U* \# `

" w# w7 ^8 y8 H, T! }    xor     di,di' P; T6 `# ?4 u
    mov     es,di$ w- A3 p& H, t8 e
    mov     ax, 1684h       ; u$ @) X- f8 [* g9 o
    mov     bx, 0202h       ; VxD ID of winice. c9 x& O8 G/ f" A, A6 Y0 ?
    int     2Fh, C! E& J, C  B
    mov     ax, es          ; ES:DI -&gt; VxD API entry point  a5 g. E$ w' e' M# H: u
    add     ax, di
0 F; a4 e+ t: y' R  o    test    ax,ax
9 t8 W/ |6 }1 ?' L/ H" [6 L    jnz     SoftICE_Detected
3 R* B0 K5 t0 p/ i/ \3 ?# U0 i/ A. a. a% K1 j$ I2 ~4 w
___________________________________________________________________________+ L, ?& u4 |& M, \' p
& w$ o9 H1 I; f1 y, h
Method 04
8 j) t; j0 r+ g' B: w=========, n4 e/ H1 A9 d3 \

1 S) C/ [) Z! Z6 oMethod identical to the preceding one except that it seeks the ID of SoftICE, v/ T( A  _! z5 O2 a
GFX VxD.
3 G2 S2 W  N+ a9 u( x8 W
8 x& r8 `- g' J: |, A    xor     di,di
' |, d% I* r" l* R6 Q6 p" `    mov     es,di
, q+ i) v; N* g# ?& |/ r% N    mov     ax, 1684h      
/ v$ V" M' q4 r1 Y9 e2 P3 I: f    mov     bx, 7a5Fh       ; VxD ID of SIWVID
% [( e7 x6 M" q0 H" w& t  M- ?    int     2fh- W0 g2 r4 d- g* [
    mov     ax, es          ; ES:DI -&gt; VxD API entry point" U4 K) x6 I& ]9 W
    add     ax, di
- d$ T& z4 J1 n: y; D. X% a- ?    test    ax,ax
5 s- ^$ F$ m$ e* {. h3 ^: P    jnz     SoftICE_Detected3 {  t  c; @. K

4 l4 W4 v8 C7 k( q& J$ }/ x3 y& s__________________________________________________________________________
& e! Q4 a6 E0 ^4 O& b; x
; [/ c( s. ?9 u! u7 s1 a8 I
5 F; L* V6 C' i& ^$ n* A& aMethod 05
' [; }+ l# ^& Q=========
* S) F! k$ i( ~$ G( Q" c1 c
) ^5 j  Y: W% g1 c* f) b  |5 eMethod seeking the 'magic number' 0F386h returned (in ax) by all system& y7 B# M& @" j0 R
debugger. It calls the int 41h, function 4Fh.' M7 m; p8 a. Z1 r2 E
There are several alternatives.  
3 ^3 |3 P' u  R$ P' Y) f& W4 ]5 t7 s. C0 N
The following one is the simplest:
5 L# Q* v9 j  A' Y9 ~3 A! h- t/ m  n5 h: @$ @7 X8 M' D
    mov     ax,4fh2 v& D3 v. V, X
    int     41h% D1 G1 L3 G* P. w0 f* I
    cmp     ax, 0F3864 o6 w  j( X) m8 X! h* S2 i1 _
    jz      SoftICE_detected
" a& S- G' b& R
$ \0 g& _3 l" \& L
# _* h  L" D* p0 {7 ~Next method as well as the following one are 2 examples from Stone's - x8 s! M; I/ g
"stn-wid.zip" (www.cracking.net):, K2 `8 J$ `& n7 z9 Q

8 Q7 o1 |7 A! ~    mov     bx, cs& _# K5 _7 e! t0 A# @# E1 E( K
    lea     dx, int41handler2
2 I+ }5 M: J2 E    xchg    dx, es:[41h*4]
( ?. i( `, b) s    xchg    bx, es:[41h*4+2]
: w) F* V' ]5 n/ `    mov     ax,4fh/ P) R7 o) f& ]; G  m" {( V
    int     41h' \/ w5 V, o$ y: X7 b7 h
    xchg    dx, es:[41h*4]
) Q1 V0 U' [9 c& F& C3 w2 P5 M    xchg    bx, es:[41h*4+2]
, n0 R# K9 t# R7 ~2 ?4 _) z, d/ q    cmp     ax, 0f386h6 m( G2 j  K1 t
    jz      SoftICE_detected
) R: R2 k& u$ o9 U3 b0 w; q5 y3 _( ~% a2 P& K; i1 E
int41handler2 PROC
' j' u# G) T& _0 y) f' y9 y5 Q! Z" O    iret
. s! {) h6 \- u  Q1 ~int41handler2 ENDP, m* U6 ^  r; v

7 l1 G6 d# w" c: A0 r+ C8 `. L8 h' [1 P' _" f+ H, Z3 d
_________________________________________________________________________' a4 W2 }, N2 J& N4 C7 I$ C6 W
* H; i; \* {) }

' X0 ~" t7 N( w3 i3 `: ]2 C. n4 uMethod 06) \# r( m( V4 e$ I) i
=========
0 ?2 ]. g! i6 Z, Q/ \  X- @* e& A% R6 p
. k. p. k5 V) ]1 b) @! @5 X" e- n
2nd method similar to the preceding one but more difficult to detect:6 D5 l: _& z. V# P' {
4 o+ U4 h2 I# ^: Y5 T* `% k
7 J, l1 G0 w" F5 V1 [
int41handler PROC3 e2 \# q+ E" ~; r8 L
    mov     cl,al/ I' N- H$ I' @( c: Q
    iret4 s* L5 [+ C) t8 q" w
int41handler ENDP
/ g- a: k9 r. |* z$ M% J! W
/ G* Y5 V8 J$ Z4 y# X0 U0 O: |; R1 Q+ [7 u) J
    xor     ax,ax4 `" o0 ~% ]% [' ?
    mov     es,ax
3 x7 `. o7 Y7 C0 ]% h1 {5 m! K* D    mov     bx, cs: l# s4 H, ], t
    lea     dx, int41handler1 Q  ~% X3 \% w0 ^
    xchg    dx, es:[41h*4]
) {1 J0 {) @# h9 l    xchg    bx, es:[41h*4+2]
' j4 x- F% ?) u% e: y/ a7 S    in      al, 40h  ]6 }: o3 D% k. w  }( C
    xor     cx,cx, u$ R! L8 a2 e* n* o
    int     41h
) d& S! E5 j+ u: `! p- j    xchg    dx, es:[41h*4]' b6 Y4 k9 K3 Q0 {* ?5 A
    xchg    bx, es:[41h*4+2]
4 N/ D' G6 G- k) J5 g% z, d/ }6 j- _    cmp     cl,al: a5 W3 a: i2 B( N: ^  \* {
    jnz     SoftICE_detected( n4 R+ U; ?' p( v3 s
6 C% P8 h& S, {4 u, o, `6 {
_________________________________________________________________________
+ C9 S' E/ ^+ |+ p; T) G! }! B4 Q: T5 r8 t. Y# Q1 a7 ]
Method 07
* q0 E; H, h& S, V+ {=========5 l. R1 z( C: C' K7 p) |
1 E' C: }; Z4 H9 t+ t6 q
Method of detection of the WinICE handler in the int68h (V86)+ @: p2 n$ B% f3 E4 k! }
# W* V+ Y* |1 f% d6 y$ h. W3 F
    mov     ah,43h+ d0 W3 K5 W7 Z: c. g; H$ d* ^1 o5 x, v  T
    int     68h
, a& U$ y& s6 f    cmp     ax,0F386h. F2 H; g0 C0 ^- |0 ]
    jz      SoftICE_Detected
* F5 F0 g+ u- s( b, V" C, P6 Y- {" V3 X  v& t+ B
$ ?! B! q& O1 `
=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
  ?7 S: o8 s9 Z6 ~8 H( l: w5 C   app like this:2 x( L8 @( b8 H) x5 R
. s" _% m1 f* O
   BPX exec_int if ax==68" p8 a- s$ W; v$ m, v# n
   (function called is located at byte ptr [ebp+1Dh] and client eip is6 B' [9 z* b# I8 Q6 @* g4 ~
   located at [ebp+48h] for 32Bit apps)
# a. B* Q) q4 M8 O: g__________________________________________________________________________
3 Q+ S  a2 o3 x; g; [  y
( I/ r. e* J3 b$ N( L* m2 c* `) f
5 ]3 I' ]' N7 J' P* T% xMethod 089 b' H& b$ ~: R" F7 w% y
=========7 Z( c) m2 h/ N7 y+ X4 a3 m5 n

, e8 p8 F/ ]% r0 v4 a& K$ RIt is not a method of detection of SoftICE but a possibility to crash the
& c' v1 c5 l) i: r1 b3 _system by intercepting int 01h and int 03h and redirecting them to another
: i* P. N7 p- \routine.7 j3 Z" R7 y" Q0 }4 e# Z3 q0 `) H
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
/ c, A  ~3 n6 G( f. J* H/ wto the new routine to execute (hangs computer...)3 R' i/ ]1 i3 V  j. @

6 @( a/ e# y' X    mov     ah, 25h
' m. `5 E& N9 y( m/ k4 j    mov     al, Int_Number (01h or 03h)
8 Q' j4 M3 _4 l3 P    mov     dx, offset New_Int_Routine
6 a6 h* _; g# o0 I    int     21h9 A) |  I  ]* E5 M

. J/ n8 a9 {+ K6 ^4 u8 K__________________________________________________________________________
, V/ v7 K" T, }& v' h
1 f5 Y: h, P6 h4 \& U* ]6 ]) OMethod 097 X! T! k: j* M, o5 D
=========, h6 m9 e, j# T) Y
9 R6 e! X9 B2 R0 i2 k3 N
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only  Y) x: Q/ Q5 y  X- V$ }
performed in ring0 (VxD or a ring3 app using the VxdCall).; x6 Y0 v0 D( d% y
The Get_DDB service is used to determine whether or not a VxD is installed
  \, B5 T9 t( y! T" Y5 yfor the specified device and returns a Device Description Block (in ecx) for5 o4 C  F6 v! e3 U! M
that device if it is installed.7 z1 P, D) s3 y

' [$ v8 Y' p% H5 }   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID
- N, Y5 T, r  g: ~4 [0 L9 v   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
# \  P2 _2 k* `) F/ }   VMMCall Get_DDB
1 J8 w. ~. }5 d7 G9 U   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed; {9 M* g2 z8 W) ?

8 I4 ~+ _/ f, `2 f6 `* }( UNote as well that you can easily detect this method with SoftICE:5 b3 l/ H  H9 @; c0 y) m
   bpx Get_DDB if ax==0202 || ax==7a5fh) F( {0 A) u( S
" h& e3 K2 e( ^8 a
__________________________________________________________________________8 Z) |3 o; b$ \, J% e3 ~/ Z

+ Z# }  f; }/ X) A! g' ?$ ^, gMethod 10
- h: E  l$ O, V=========
$ w% G' U2 f6 s  X# ~
( F6 p$ p; V4 c% J( [8 x# m=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with
- {" a1 Q! D0 ^( ?: `. e/ N3 @  SoftICE while the option is enable!!, [% |% v$ u; i  ?

. H4 S  N# \' l& y6 `+ SThis trick is very efficient:
3 K# r# e( f; @- zby checking the Debug Registers, you can detect if SoftICE is loaded
: A# v$ }  p5 {, I4 o3 V(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if# v% p% i# v+ x; w- o2 G' U( D$ R: h
there are some memory breakpoints set (dr0 to dr3) simply by reading their
+ Q+ _% y# N5 {! Wvalue (in ring0 only). Values can be manipulated and or changed as well
0 G3 c/ [( p# N8 _$ L6 ?* N(clearing BPMs for instance)
) C6 W$ u. W" A4 r4 l' z( @6 l/ u, [& h( ]% E. n$ S
__________________________________________________________________________
' p! x+ }% ]+ r! z$ y0 ~% p- G! Y5 E- \+ a
Method 11
' o# d  c6 H) }6 g=========* V* t* G& G3 ~! ?
. E+ \+ k, w4 m
This method is most known as 'MeltICE' because it has been freely distributed
) z  z3 A! b0 ^; h  H. xvia www.winfiles.com. However it was first used by NuMega people to allow% L2 g0 o: j5 S0 W
Symbol Loader to check if SoftICE was active or not (the code is located- H% X. M. p2 ]/ y; C9 P1 o0 o/ J
inside nmtrans.dll).
3 S! t4 k3 p' d; I2 n8 a8 [0 u5 h# t1 o
The way it works is very simple:
: Q/ r, ]) N7 B( }6 \% j* BIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
; @4 y% P: U9 FWinNT) with the CreateFileA API.
6 H/ G5 `- k! p1 p9 _) Y4 X+ S' ^2 o# h5 X5 F  i
Here is a sample (checking for 'SICE'):
9 T% W4 P6 S) n7 r) z5 i
1 U6 ?! l2 U( P: x6 |& wBOOL IsSoftIce95Loaded()* s, h- H' m9 l8 N7 q& e9 X* }& B
{
: I7 B  e* r' ]' o7 m; B* G6 j( r   HANDLE hFile;  
! P  I5 I  {7 k' F( j   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,& o8 K2 x# g& s  k8 w
                      FILE_SHARE_READ | FILE_SHARE_WRITE,# x# A/ I5 r" Y" [8 z
                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);8 b$ R1 i( n7 M+ \
   if( hFile != INVALID_HANDLE_VALUE )
4 \2 ~( \0 f9 r5 R1 m9 r, G; ]   {/ v' `9 F# z8 C* }/ X7 O! H6 J% V8 s- q
      CloseHandle(hFile);
1 [  B, v' _9 r# Y+ B1 z0 ?3 `% S      return TRUE;
+ ^3 u- c8 i9 C! @   }
3 n+ o3 Z# r8 k& Q, _% s5 K   return FALSE;
" G- s, w- Z% v* q# F( v1 t}/ H+ _! G5 e3 s4 K8 c$ l

8 h* f$ N1 y5 K. [& o. bAlthough this trick calls the CreateFileA function, don't even expect to be. q6 D2 a2 `' C
able to intercept it by installing a IFS hook: it will not work, no way!% [1 H& v# n3 @5 ^  H8 ~
In fact, after the call to CreateFileA it will get through VWIN32 0x001F8 D2 ~) Q3 B' s/ T9 I' m1 B1 Z6 Z
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)+ I9 o, ?9 l( I# n
and then browse the DDB list until it find the VxD and its DDB_Control_Proc4 K* l" S# E  ?* Y0 S
field.& W) O) e9 U: c6 g+ m! K, d
In fact, its purpose is not to load/unload VxDs but only to send a
4 c/ R$ o" X, H1 HW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
9 n4 m7 t  e2 Dto the VxD Control_Dispatch proc (how the hell a shareware soft could try
! z. J0 `; ~& d/ H2 G' jto load/unload a non-dynamically loadable driver such as SoftICE ;-).
: x! i2 E6 `' |: V% |: u6 VIf the VxD is loaded, it will always clear eax and the Carry flag to allow3 ?! J7 @0 Z9 q  Q5 m1 U2 b" H
its handle to be opened and then, will be detected.( K! o: ~8 D2 A4 W1 t& p$ A
You can check that simply by hooking Winice.exe control proc entry point+ i" Q" k$ r) y+ w! ~" z
while running MeltICE.
9 h3 U" R0 j- S! n- |; |$ Z# J7 }  ^4 X
/ h% g0 z: G% a6 ^
  00401067:  push      00402025    ; \\.\SICE% t! ?; B3 I+ c. k! W& j: d
  0040106C:  call      CreateFileA, S9 M( ^+ V! [. v0 ?9 @" z: J
  00401071:  cmp       eax,-001
! I/ O$ y9 U3 H. }$ i  00401074:  je        00401091
5 G6 O, M: T8 N% i" i7 Q0 x# S7 H' J4 p, N
, H: Z, ~4 b0 P4 ~
There could be hundreds of BPX you could use to detect this trick.
" Q' A* m0 C( B% r" @3 m-The most classical one is:
6 A# q6 q) D( ?: D  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||* R9 q$ D: s4 L* u& P
    *(esp-&gt;4+4)=='NTIC'2 x; f7 Y& j. ~  I% D* f/ a
3 X8 c& z* t/ E( X: k. A$ _9 }' G
-The most exotic ones (could be very slooooow :-(
+ ?9 r# _4 ~; I   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
3 U6 T8 e0 a4 m" T     ;will break 3 times :-(5 r% Z0 |+ D/ w& E
- E' u- X; d9 [6 j
-or (a bit) faster: + o  f$ r! K$ h% a7 L; p" x* i0 d# r
   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
! ]. Z" P2 h# J/ y; F- Z1 |8 I' y7 L: |: S* k6 |5 I* `( t- _1 x: J
   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  & P; p6 t. @3 p
     ;will break 3 times :-(- d  p" M. u) [# J

: t# r$ _4 x! Z3 ?: u: B8 x) [# X-Much faster:
6 C2 E! f( n+ x) f   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'
; l8 c$ T9 C+ o6 z$ I4 S9 e) L) D) j+ ]  w" `2 Q% n+ {
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen) y1 k) T- k3 w5 f
function to do the same job:7 V2 I  ]# O6 p" J% _8 d

7 C5 W0 p" S2 G4 {   push    00                        ; OF_READ
( D, p& \, V% J5 U2 T* w   mov     eax,[00656634]            ; '\\.\SICE',0' @5 _- D5 n( A, W! Z
   push    eax; `0 e1 c: N5 c( d1 a) q* m
   call    KERNEL32!_lopen
. q$ d& |& c  ]% O9 U+ h% p   inc     eax
) ~5 \" d# F/ q: p   jnz     00650589                  ; detected
) [! |/ u: _) m7 a# p3 r$ s   push    00                        ; OF_READ
1 |1 B! {  a. x( R6 e! W, d   mov     eax,[00656638]            ; '\\.\SICE'
1 _5 L, H# ~4 J/ p* }( c( z) a   push    eax
% z0 y' u/ }. b* ^, l  w' F   call    KERNEL32!_lopen' p+ A" L$ K5 E" i# ^7 @
   inc     eax6 E- N, e" v, ?% p3 U
   jz      006505ae                  ; not detected
1 s$ d! M( A& L  }; ^; ~7 C$ G! E5 [. R; u: G& A1 M/ z# T4 I$ r" Y
: S, N! L7 L8 d( I+ ^0 Y
__________________________________________________________________________
8 K% o% U2 G3 M
3 T4 n5 N0 _: A: RMethod 12
$ B' M4 H' d+ X+ ]=========4 Z( C) N8 g; n- G/ J
" P- D) p/ ^7 G* I2 i
This trick is similar to int41h/4fh Debugger installation check (code 050 Y& `0 a& F5 K. f) Q
&amp; 06) but very limited because it's only available for Win95/98 (not NT)
& [; L! ^2 S! l" I5 Was it uses the VxDCall backdoor. This detection was found in Bleem Demo.
" @5 Q/ n: l9 R" J( a7 M4 H
. B; g8 c- L' Z7 C( Z   push  0000004fh         ; function 4fh
: Q5 k/ ?9 a- U) Y6 J6 P: Q  ]   push  002a002ah         ; high word specifies which VxD (VWIN32)9 V5 T- h. B. l# j: s5 _( ~
                           ; low word specifies which service; d  Q! ?+ }1 X6 I# o
                             (VWIN32_Int41Dispatch)
# N3 d" z# x4 \! c1 r   call  Kernel32!ORD_001  ; VxdCall3 M' |+ Y* D" a7 f$ C- ?* Y, @
   cmp   ax, 0f386h        ; magic number returned by system debuggers3 g0 a7 V6 @! Y( f6 P
   jz    SoftICE_detected6 `3 ~, U4 `6 ~( I: @

: C0 c5 `; N  N6 aHere again, several ways to detect it:. j' ^8 b9 X# B2 R, b  [  J+ T

. b0 m, O% |8 r8 w    BPINT 41 if ax==4f
1 p. e) L" u6 m7 \7 d4 [* Y4 e  \
0 T3 J2 y% v1 w5 u: K$ h3 j    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one
! v, ^% j7 b7 U/ D; D* Q+ ~
  |0 d# ^6 h8 Z/ O    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A8 ?) j$ X7 A2 s+ [6 o" q+ ^

) a9 W( G& h+ B    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!
6 \' H- q4 h, y2 Z0 C4 c
1 h* e( N, C9 d3 y# a) I+ \: \7 I  C__________________________________________________________________________
$ }! l" W) x8 q5 A) l( ?0 x" x
. I: O7 V$ ~9 ^- z& oMethod 13, @/ Y0 p9 \2 u  t( L# E
=========( W2 s$ z6 Y2 Q) }+ o
3 n) a- R" b1 q# `5 v9 a
Not a real method of detection, but a good way to know if SoftICE is8 Y! |: l+ v: @! G( k0 {; D
installed on a computer and to locate its installation directory.+ B) J. b! `4 @2 J; U
It is used by few softs which access the following registry keys (usually #2) :9 E3 C/ f- f9 k6 j

) ~0 g3 l, g8 j7 s2 i# ~; @( M; m1 t-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
6 S% d. x4 {8 t$ l\Uninstall\SoftICE
0 B! y; H) O0 a( ?5 Y: O-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE8 s- l1 `) H+ t0 k/ V
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
3 U+ n8 N: F0 L& A- ~5 a5 d0 {\App Paths\Loader32.Exe
4 A$ V. {% k2 T8 W2 C- t2 o) Y& f8 j6 ~! z* Y# N+ N

3 o3 z$ r" C( r* M1 x8 l( tNote that some nasty apps could then erase all files from SoftICE directory
% j. \4 x: f, m(I faced that once :-(% E/ M" s2 y+ N6 C
0 ]; Z6 C* h7 q4 k  _3 F2 k
Useful breakpoint to detect it:# q  T4 D& _, Z$ @0 K

! r, t, o, `& t8 K: G0 B8 ?% A     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'
( ?+ f  W; P7 ]8 M
8 E5 h- S- W9 [3 y; R' n  \, ?__________________________________________________________________________7 l, p, m( ^0 v- y) F2 p6 a5 i
. ~+ a3 {' ?: {0 b; J0 t

" _- {5 H5 y' _4 [Method 14
5 R# A0 V1 p4 A0 D% r=========
: Z* b" ?: c4 w4 O' F! z) p! O! P
$ N, \$ Z: h+ |5 dA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
7 h- ]  F5 v, ], Y7 e1 }is to determines whether a debugger is running on your system (ring0 only).
0 x4 j8 ^% v, T
) E$ }# W# ]( [  O. I1 o   VMMCall Test_Debug_Installed. U3 m8 T* a( H" H3 X2 l
   je      not_installed
0 \# q, @& G5 I! T! T6 Q2 w
/ A. @$ p" n2 M* E$ K& CThis service just checks a flag.5 T; z( U% D+ K- f% Y1 l3 g
</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

QQ|本地广告联系: QQ:905790666 TEL:13176190456|Archiver|手机版|小黑屋|汶上信息港 ( 鲁ICP备19052200号-1 )

GMT+8, 2026-7-31 04:35

Powered by Discuz! X5.0

© 2001-2026 Discuz! Team.

快速回复 返回顶部 返回列表