About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>
5 O2 v1 {; [0 L+ J* L( @' M<TBODY>& f2 P; f' ~( i: \
<TR>( X$ t1 ~, p+ c  N& d% X, }/ \8 d; t
<TD><PRE>Method 01
$ ?* l" _1 u- C# r% ?" f=========
- M( q* {0 s* a; y# y5 \  h
3 ^- c; U" y  C" v( Y+ N& KThis method of detection of SoftICE (as well as the following one) is. e! w5 V- g- j  z8 K, L" ~0 [" _
used by the majority of packers/encryptors found on Internet.
1 M  ^- P9 m0 o1 Q2 lIt seeks the signature of BoundsChecker in SoftICE8 J+ w0 N; I5 t: r& D4 }6 d; _" N

. S; I; q) z; N: D, Y    mov     ebp, 04243484Bh        ; 'BCHK'
) y8 a* w8 N" S4 `$ w    mov     ax, 04h
. J1 ?+ G4 n" ^1 \. i9 y    int     3       4 I' Z" u9 D& N8 L: W
    cmp     al,4
# W! @; ]& h' c9 C$ q    jnz     SoftICE_Detected: h  h  N+ J3 m. w( |
" a$ Q* ~$ ~* g
___________________________________________________________________________
, y2 U1 L/ ^8 x; b. w
  _6 [- `/ K( {5 L1 Z1 iMethod 02- L( ^5 F' ]8 n) M6 p# m
=========
( e8 x( W  E4 M$ W$ n9 R
, H5 F" D, m1 P2 Y4 D8 s7 n( HStill a method very much used (perhaps the most frequent one).  It is used
1 b. u+ ^7 k* x) [2 l/ s0 v) Vto get SoftICE 'Back Door commands' which gives infos on Breakpoints,
3 ^6 O" Y" ^) Hor execute SoftICE commands...: `0 d  A! R0 t& \
It is also used to crash SoftICE and to force it to execute any commands. M6 H7 @) Y* V$ e3 {' W
(HBOOT...) :-((  2 @3 y3 `. a- @3 S3 O5 ?' [( y
! m% t5 r/ O5 ]0 i3 |
Here is a quick description:
. u5 P& A5 |1 d" ^! T2 V+ p5 h8 g-AX = 0910h   (Display string in SIce windows)( |# a* h& [4 q; E$ x- k
-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx), j8 E! t  S+ ]2 c- @* ?% U' k
-AX = 0912h   (Get breakpoint infos)  Q4 w- u: i/ T8 j# b5 g, _
-AX = 0913h   (Set Sice breakpoints)5 v! T, }( w' A2 s7 @' W
-AX = 0914h   (Remove SIce breakoints), H& `; E+ ~# O% U- `! l9 c

, I# i' [2 U( u5 M! _2 x5 hEach time you'll meet this trick, you'll see:
7 c; [' n6 e# ^+ @4 J-SI = 4647h
8 R( ]1 ]& O+ `$ ?& r2 @-DI = 4A4Dh
2 F# I& y% X. zWhich are the 'magic values' used by SoftIce.
' z+ E) z, k! DFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.
0 t3 z6 G1 m9 i$ p& I: h1 P/ f( z# g7 T! [  b5 C- x
Here is one example from the file "Haspinst.exe" which is the dongle HASP4 J" d) B5 q0 I: J( g" u1 O
Envelope utility use to protect DOS applications:
0 m+ y& N) |# n0 E1 P$ |7 B  j7 m: \; H( y0 m# \+ j

; F2 e# e7 M2 [( w, `8 {8 I! I/ {  y4C19:0095   MOV    AX,0911  ; execute command.& B! S6 b' i3 X# U2 \# e$ P4 z
4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).; I0 f" f! V$ K7 |# F2 P' e$ ~6 u
4C19:009A   MOV    SI,4647  ; 1st magic value.
+ M7 e$ o, q0 P+ m# l" h, k6 L" {4C19:009D   MOV    DI,4A4D  ; 2nd magic value.
" y( i1 n. y8 s) {: m) J3 @$ ~% L/ I+ m: P4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
7 d# a- t4 c4 F" d4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute4 K4 B+ b% V5 S0 O/ C  E2 `' k
4C19:00A4   INC    CX
- B6 C$ D( T  S$ \4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute7 N) s& {" u+ g9 I' n0 j
4C19:00A8   JB     0095     ; 6 different commands.
) k8 v# ^/ l5 s+ x4C19:00AA   JMP    0002     ; Bad_Guy jmp back.
8 ^6 k# ]0 {2 Q; k& o! u, J7 N4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)3 I6 A4 ]6 p! G6 ?

- m' {( U0 S+ S3 ZThe program will execute 6 different SIce commands located at ds:dx, which
! H3 [1 e( B% F8 p! Q4 ?# E% Pare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
/ N$ M* e) E/ a; A+ z
; K+ }& ?1 b# G) a* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
3 p( p7 M- X- _7 c# J$ }2 S___________________________________________________________________________: r0 U: I. f- D( J8 R

; ], s9 h# c" W9 y# a4 i3 N" d. t/ {
3 D. d' ]: o2 ~! c" Y: n5 ^" N+ eMethod 03
) m9 r, `  E% [' s/ p=========
8 r2 A; Q3 b- r
" R5 [/ [* ~7 Y- @4 A! \% H; p( |Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h( z; q9 h1 t3 T8 b0 B' O
(API Get entry point)
. f2 t* k% y; P5 f. e0 I        : F( j: F) O; G2 Q

; w" E: s% C/ G1 _6 D! p0 X3 y    xor     di,di+ m0 U6 [+ D& q2 X( H4 V
    mov     es,di
! |2 R) ?! @8 t. K    mov     ax, 1684h       ! ?9 w* M# K' C( D/ u+ y; N
    mov     bx, 0202h       ; VxD ID of winice
0 v/ h; T' T/ x4 X9 S    int     2Fh
* y6 m" J) _: ~: r$ K8 k0 c    mov     ax, es          ; ES:DI -&gt; VxD API entry point
- A- o' {# Q+ G5 A1 C6 I    add     ax, di" Z; x4 C7 X" ]- c! l) m9 Z2 x
    test    ax,ax
9 ^, K* k1 E$ ?/ B    jnz     SoftICE_Detected
( D' c) E# }4 l1 X6 f* ~- g& A9 T6 s9 `2 i+ [7 `; l- j- a
___________________________________________________________________________& f2 q- F% E0 L: @% C9 P3 `: f
/ O6 a4 @5 C9 d) P
Method 047 A8 S$ k1 `  i* J% Y# N/ G
=========
* D; v' N  n1 C
8 V/ j+ @% u  S! R+ J0 lMethod identical to the preceding one except that it seeks the ID of SoftICE5 q) M( O* [% @! c4 i$ d' i* O
GFX VxD.
9 U) r- t6 x; Q! p# q8 V; J& i' n' k1 P- H. b2 ]$ s
    xor     di,di
" _5 ?7 N/ \' y! ]/ v4 r- k4 S    mov     es,di
0 D! ^4 T' f  D7 o& s3 U    mov     ax, 1684h      
, `8 m. g7 B6 R5 x" I, t( Y9 y    mov     bx, 7a5Fh       ; VxD ID of SIWVID
3 d$ c9 M* \+ h( _/ @    int     2fh
/ O- @/ p3 O% G( z' o    mov     ax, es          ; ES:DI -&gt; VxD API entry point4 h8 R' J* J$ X
    add     ax, di
2 F- o+ l1 r. J6 V: s/ o+ E    test    ax,ax! d0 P' o  w+ a, T, J* x, z" k
    jnz     SoftICE_Detected) p, r& x, }4 x3 L8 H; H* R

8 ~3 I% u9 m) p__________________________________________________________________________9 v* q! S  ~; q. x9 S: i
' J( S' v6 U: p2 R$ K

- z! K- n- O& W5 WMethod 057 E) }" @/ j$ |
=========. ]# L, D5 M$ v. M

, b! ]% g' G' T. @- sMethod seeking the 'magic number' 0F386h returned (in ax) by all system
/ A7 J! B- x) M- z1 V7 v4 odebugger. It calls the int 41h, function 4Fh.' P. b" g& l0 i" ~1 {# Y& g8 U
There are several alternatives.  4 @& }* Z5 \: V" ]$ \

: @  ?0 S' x/ a# `. C& U$ xThe following one is the simplest:
: j" ^7 k, Y5 L
5 r( p2 Y% _; H3 e    mov     ax,4fh6 }# N* S& k. i$ m
    int     41h# H% G* I, l8 v' q  [, a
    cmp     ax, 0F386
- H) L) p( s' t0 W    jz      SoftICE_detected. Y. B6 {1 T1 q! t/ V; ^1 D) ?  H

; u8 c# Z+ _* T( s! O" Y# B& C) q8 a
Next method as well as the following one are 2 examples from Stone's
+ a2 E5 Q/ n4 T1 e$ H2 U2 P"stn-wid.zip" (www.cracking.net):7 M5 s0 i. D. [: T' q- ?

& ~/ O/ _3 |/ d" Y6 {# F    mov     bx, cs$ O% E7 r, K; v. e4 p" @8 t5 m
    lea     dx, int41handler2- G: l# E& ]( F, ~# ~+ I
    xchg    dx, es:[41h*4]
3 F8 c% G( }& R4 G4 Z+ q# N6 Q; b    xchg    bx, es:[41h*4+2]
% G# A1 g2 m4 W+ |8 U    mov     ax,4fh
+ P$ B  {7 G7 ]  |& B    int     41h1 X; h$ E5 O7 a. ?3 X9 B
    xchg    dx, es:[41h*4]
, ?2 i* ^& a- |3 A& H' \    xchg    bx, es:[41h*4+2]
, J  X0 e) w1 a( E8 W7 R. @    cmp     ax, 0f386h
7 X4 Q' T- D8 {) i  o    jz      SoftICE_detected
5 q- s8 p) ^  y) |# |! I/ Y' t5 Y0 _7 c# ~, N
int41handler2 PROC$ ]6 j9 C5 y* l* ~
    iret
$ |. N+ I4 w! K( Sint41handler2 ENDP  U& G3 |$ K- B7 v+ Y

% T: L, T  I4 ~6 y7 ]; A8 b; N
, R  N. O5 p; J0 K_________________________________________________________________________
" i1 a# o; m" y2 u3 ^  x+ ?2 ]; P  [+ [
; ]# G' R/ Q# h/ N( P: Z
Method 06
$ n; d2 N) l% |& t5 Z=========
/ i; B' x, z* E
8 A5 ]+ I5 E3 `9 q7 P1 [
% @$ G6 S6 _  s/ A2nd method similar to the preceding one but more difficult to detect:' I, p5 H# F' ~, ^5 {5 V
8 I& {4 U, Y$ O2 q! b

" Q! e, R5 @  Cint41handler PROC
" [% q, `3 l! T: E. _    mov     cl,al
/ B3 s6 S' z, _( f3 U    iret
( a, p6 y7 [! p3 @: V* X# kint41handler ENDP
- t% W& v* i" ]0 `$ v0 i0 d& H. [. j, n" g: i
5 P2 x/ U+ R5 j# B3 p, e7 {
    xor     ax,ax; i, o4 p. n# a# ]* D3 T
    mov     es,ax
1 W. b$ b8 p% A! h2 Z    mov     bx, cs
- j  a' C6 v" Y6 F9 E2 J  s    lea     dx, int41handler
4 R+ T* k$ w* ?# s- C: N1 G( ~6 E! |    xchg    dx, es:[41h*4]  }$ y# W2 B; H) D% e4 F2 I
    xchg    bx, es:[41h*4+2]5 t( Z# H$ Z/ p' G% a
    in      al, 40h6 @( S0 |+ e4 I8 F% x  h
    xor     cx,cx
$ M' y& }2 y3 ?  \! `2 E4 T    int     41h
" l7 y" X9 g  [" j, i- A) c    xchg    dx, es:[41h*4]( E- t# ~! }/ }* G' Y  V; A, o
    xchg    bx, es:[41h*4+2]' r# j8 c3 p* I+ H( Q
    cmp     cl,al
7 A, ~1 \  f1 @    jnz     SoftICE_detected
$ x. N5 Q* r+ l; @1 x7 B; R* X' r0 d6 L, x- c( R, T+ M
_________________________________________________________________________
/ G9 c  L" m+ p4 J4 _# G: B9 r1 d4 w
Method 07! n3 W0 j1 Z, D* G8 E# k* J
=========% ?' J, x$ L! F* Z6 A2 B

, N4 ~3 Z3 |. A* [: H( zMethod of detection of the WinICE handler in the int68h (V86); h7 T8 e( O5 l
) l0 j3 x: \$ x; Y3 a; k0 j5 n% U
    mov     ah,43h, K: i" s2 }4 c0 {, f; R& l
    int     68h
: E$ x, @7 h2 I    cmp     ax,0F386h
+ Y4 l  }9 }. U' p( ^  p: `) O* E    jz      SoftICE_Detected: x! K# I3 w1 k; e* @( b$ D# W" z
: K, ~  O* Z  m5 D# W) p

9 c/ E4 |2 q% K! R# |0 T=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit: P2 i- H& f! A' r/ _" ?
   app like this:! O: y8 j) {! g* Y% V: Q% d
* F' b. m6 t1 Q. r' K
   BPX exec_int if ax==68
/ Q) W' c7 y3 {/ L' e8 Q  S   (function called is located at byte ptr [ebp+1Dh] and client eip is( A! K2 W: f; _4 }# W8 ?* {" `
   located at [ebp+48h] for 32Bit apps)7 ]9 `! o+ D4 w$ y) c6 {" B
__________________________________________________________________________; {. C- H" o. D# {' t# L; N

" y( Z+ O3 K  e. {1 |8 |
& Q, K# R/ B7 ]) M" z4 G" WMethod 08+ ]" Q, h& w: D1 r1 ^
=========
7 d2 z: T5 Z; {7 [2 s7 Y! M4 h: p. p! {8 i
It is not a method of detection of SoftICE but a possibility to crash the
' R, p  G9 X" @. z8 wsystem by intercepting int 01h and int 03h and redirecting them to another3 |* D* M, Q7 D# x
routine.) \$ \" X4 h3 O
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
# B9 ]8 `# a3 Qto the new routine to execute (hangs computer...)
: R1 W$ \7 [, `9 d; K. f  f1 h% F  n% x. U8 L) p# E
    mov     ah, 25h: t/ I7 \/ l) j3 I; ^
    mov     al, Int_Number (01h or 03h)
. m( m9 b+ f# s    mov     dx, offset New_Int_Routine3 Z7 x% R3 \# `  m: d; Z" C
    int     21h
" u. M$ [- \2 u1 O* F' K: `; x) N: o" e' y& E
__________________________________________________________________________
' m. Z. ], C6 e# L; [  m& L( k6 D( f
Method 093 x% K. Y! ^$ e- _8 [
=========8 }0 x0 u7 x: l8 j# O

$ T. ]6 q2 }, @. W9 iThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
% ]1 U( g9 n! X0 |+ Q9 ?performed in ring0 (VxD or a ring3 app using the VxdCall).3 b& y: M; f/ t6 C
The Get_DDB service is used to determine whether or not a VxD is installed
- o6 u0 Y: h/ Y- [for the specified device and returns a Device Description Block (in ecx) for
. e' E$ P6 m4 ^  f  kthat device if it is installed.9 J# I, C4 |4 d. I7 [* E. \

* L  f# u% _) \0 O# |, I+ ~   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID- j: C; h! t; a# x$ V1 L/ X, T
   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)3 z5 D" l4 ~- S. ~0 [9 K  F; c3 Q
   VMMCall Get_DDB
; h6 S, e1 u0 u! H! [. W   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed
  n4 I0 D0 C2 t+ C! Y
' D6 D, e( L# `6 ^' ^, y3 ZNote as well that you can easily detect this method with SoftICE:. o. J6 L1 o; A( n. |
   bpx Get_DDB if ax==0202 || ax==7a5fh$ W( K5 P! Y$ C" y. P3 V' U, o
7 w+ S* m( R! M1 g' f2 D
__________________________________________________________________________
9 Q1 i2 P9 K/ a+ l0 q# E6 ^3 u( y2 `4 S% \, j. @
Method 10
6 y% ~7 S, Q" J! I=========
) X' q2 U4 O% f5 k
% W% t) `% e. Q=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with: G: Q" ~) p4 v; [0 f1 t- L) [
  SoftICE while the option is enable!!
, Y  v! h( Y9 M# U
: I" M, D* ~4 U+ SThis trick is very efficient:
% `# R) R. m5 B7 E4 q8 s' _by checking the Debug Registers, you can detect if SoftICE is loaded7 Q& g- M* P) z' ^  I
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
' J* _' d6 \( l$ G( f# y2 ^) Ythere are some memory breakpoints set (dr0 to dr3) simply by reading their
% W" z5 Z1 z3 {# Vvalue (in ring0 only). Values can be manipulated and or changed as well  f( E3 `5 U5 m, ]0 w& b5 z
(clearing BPMs for instance)) |" C' G. U7 [9 e/ U
8 ^: |1 Q, j" P7 p: h: y. O
__________________________________________________________________________
, p3 i! P% A' n
; T& n' y$ e" p) OMethod 11
, q2 n0 t- u3 M) [7 J  b=========0 s2 K9 m) s6 B% Q; E

3 J) C; {7 Q; x6 Z. iThis method is most known as 'MeltICE' because it has been freely distributed: f) T3 _) [6 J  t$ p7 ^# {
via www.winfiles.com. However it was first used by NuMega people to allow
4 f, j- d$ a$ q8 ?  [Symbol Loader to check if SoftICE was active or not (the code is located2 \( j4 Q' q: I* r
inside nmtrans.dll)." v0 _  ]8 W4 x7 F
/ m2 ?4 P0 {" A: O$ b: [+ @  X- |
The way it works is very simple:3 R0 }8 _2 n7 z4 ^
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
5 W( @7 l; a9 I+ P0 uWinNT) with the CreateFileA API.
, c) k4 k* d# u8 d  G
' Z- a- I! S* S# MHere is a sample (checking for 'SICE'):
' d( V( z0 k! m7 S* ]' A, {4 p
4 Q& o+ z% ]  k& V0 D* O: lBOOL IsSoftIce95Loaded()3 V6 d; c: |1 {6 p( \' u
{8 d& x7 h% P. K4 ~  }
   HANDLE hFile;  
* I! h8 b  W7 v; u, C( j   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,+ W( k; w6 m2 @5 ]7 Z
                      FILE_SHARE_READ | FILE_SHARE_WRITE,
' N4 i7 w4 e* F1 r                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
+ F& X- d, Q  d7 f* e2 t6 p8 u4 d   if( hFile != INVALID_HANDLE_VALUE )- ]  Y. P  z6 J& y
   {- Z+ F/ y4 Z. ~* o
      CloseHandle(hFile);1 m( d- B! A& b
      return TRUE;
5 v1 b) P6 J+ r7 ], h; @   }
7 _5 Q+ a2 T, |/ H  G   return FALSE;
4 i! D+ P, ]  {( f# G4 T3 b}
" e- G  m7 H/ j5 m
8 N, ~: ~) C2 {# _5 q- qAlthough this trick calls the CreateFileA function, don't even expect to be
+ ~5 X( v: x; j$ w$ L0 x7 ~9 V6 }) \% aable to intercept it by installing a IFS hook: it will not work, no way!; J9 x0 u5 p& H; w4 j4 L- T8 j& U
In fact, after the call to CreateFileA it will get through VWIN32 0x001F+ P) w" P$ L* `8 F: M
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
; v5 K- y* b) W1 Wand then browse the DDB list until it find the VxD and its DDB_Control_Proc, r5 Q6 |5 A& q7 h* M
field.
4 P( j  a/ V: nIn fact, its purpose is not to load/unload VxDs but only to send a : f' ?7 y- |7 X5 t0 [  g
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
" g; C# D% D- [0 z' Q+ Gto the VxD Control_Dispatch proc (how the hell a shareware soft could try; @$ @$ L/ o, d5 ]
to load/unload a non-dynamically loadable driver such as SoftICE ;-).
. ^- C1 _0 X7 E1 K8 u3 SIf the VxD is loaded, it will always clear eax and the Carry flag to allow
: {( s# a7 B0 Qits handle to be opened and then, will be detected.
( d( V8 l" f0 TYou can check that simply by hooking Winice.exe control proc entry point& P" M7 g! x8 k
while running MeltICE./ O6 M6 O& M2 t+ m' ]: Z4 F
* |8 w9 H! @5 J2 P7 @+ F' g

! ?2 U& `6 D0 c5 ^" C0 X  00401067:  push      00402025    ; \\.\SICE
7 h7 [0 N' M9 o/ |  0040106C:  call      CreateFileA
! a; Z: V8 p; }& P& N: s  00401071:  cmp       eax,-001* o/ G  ?) G7 Y$ [
  00401074:  je        00401091( \9 b9 X: o- Q  L+ }

7 k. v2 ?; }# z- M# f1 d1 P; K7 V( E" U  o/ H3 ~" L8 P& b% {
There could be hundreds of BPX you could use to detect this trick.' D) s/ A, C) N5 ~& ~% ~; `
-The most classical one is:# K  d2 z% r- }
  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||
' H. l8 b7 k  c    *(esp-&gt;4+4)=='NTIC'
7 p- Q/ C' V3 M! [8 l9 ~9 [: ^- K* ?( t- D# ?$ W9 ]4 q: W
-The most exotic ones (could be very slooooow :-(
7 F) Q! H) R: C7 f' s, l4 x, o   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  2 R: z( _$ N2 Y$ V
     ;will break 3 times :-(
8 [/ k) d$ u8 M9 g
2 K" K1 V) N# [4 r1 V-or (a bit) faster: , Y( R& j  P( e3 ]0 ^6 K: A
   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
7 G: q% L  u( `0 l4 D
( y9 e) i: N. s   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  
) H7 a3 Q. m. K+ e$ ?     ;will break 3 times :-(
6 m7 M) h) ]8 }6 c8 ^, t9 d
. V; a' s+ R# f1 ~+ H* A  G3 R-Much faster:
3 C4 D) A0 k# ]6 e1 ^   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'9 k) k- E, `, W  p% @

8 j0 u, f/ K2 c( {1 ONote also that some programs (like AZPR3.00) use de old 16-bit _lopen$ E8 t8 X0 Q4 h; H
function to do the same job:
$ [5 I0 W; x/ M  ~- u/ \
9 b) S; v) q, Z# Y" L) |   push    00                        ; OF_READ
# G) E5 X8 N6 {' p0 F   mov     eax,[00656634]            ; '\\.\SICE',0
3 Q  {) R( j- L* ^7 F5 _   push    eax
# d2 ?/ q  d& S% F5 m" m* j   call    KERNEL32!_lopen6 k& w2 X: ]  p$ @. {
   inc     eax4 }( _2 F8 ^% p$ [7 @. {7 N
   jnz     00650589                  ; detected
4 @+ B2 G1 K7 d) b   push    00                        ; OF_READ
9 O! J% T# I0 \% O   mov     eax,[00656638]            ; '\\.\SICE'
( c6 K9 m& K' H7 W- L6 b   push    eax
/ k  h1 w/ V1 L5 A& }   call    KERNEL32!_lopen! }& ]$ t& S, t, D
   inc     eax5 K; n8 Q4 ?8 R; `+ V
   jz      006505ae                  ; not detected
. I+ B0 b% x; ^8 p) ?8 H  a* E2 c0 [1 i" |  v5 O* G5 e# i

. ]$ b% `! e/ z2 b1 h2 Y__________________________________________________________________________6 W$ W# g. C3 [( F/ ]9 W6 e

0 g" E) ?1 R1 M: o* m1 tMethod 12
% M0 W% K( o( a% Y' K+ v  m=========  b7 y- v5 M2 F: c
6 x) l: P) {1 w( T" n
This trick is similar to int41h/4fh Debugger installation check (code 05
! x/ h- p, O3 _. C&amp; 06) but very limited because it's only available for Win95/98 (not NT)* K& {3 ~) ^* g* j
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.
( O5 q" e# n( X6 X+ Q# i& z5 W) C" M( D( ?
   push  0000004fh         ; function 4fh
9 n! N8 j% V, z/ V( @0 j7 ]3 B5 c   push  002a002ah         ; high word specifies which VxD (VWIN32)
: _! J' P. j- S) R4 `: I* M                           ; low word specifies which service
: z: w' J& t/ ~) u1 }. n5 S' A- t5 d                             (VWIN32_Int41Dispatch)4 B" G, v9 S) m6 b1 {7 _/ h
   call  Kernel32!ORD_001  ; VxdCall- V  G4 ]1 l2 o  e0 X
   cmp   ax, 0f386h        ; magic number returned by system debuggers
2 c; ]) V9 B& h5 R( t   jz    SoftICE_detected- B/ V2 f1 [5 b8 M7 F

2 H' V- H4 z. \9 {. @Here again, several ways to detect it:! j  V9 Y' C# {1 b& w
: n* L0 I) q) S: _( L" a1 l
    BPINT 41 if ax==4f$ e6 t( e+ B+ z' j# i0 v0 b
, h. r' N( g; m% k! u
    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one
5 U& S1 c7 L2 _1 [  v) O, `
  |# x& j" h: D# w    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A9 ~+ s& ?; \8 M4 ^  E
3 w3 H4 ~2 v/ A* N1 B- y
    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!+ ]/ r/ ]8 @' U3 q, B7 H
* T7 w/ Z# _) E" j* E
__________________________________________________________________________
: `: _4 ^( e- z6 v8 M
+ k* j) d4 O2 K3 e5 t7 F) o! lMethod 13) t8 m" x( t, S! g1 k
=========' |/ Y5 c) m3 B9 g& p# i/ `

  G: I6 r/ Q( X1 pNot a real method of detection, but a good way to know if SoftICE is2 o8 b* F: }2 g+ p- |( \. L
installed on a computer and to locate its installation directory.5 _5 c& M% Z5 v* b, b" u# L' [
It is used by few softs which access the following registry keys (usually #2) :/ q% W6 K- P1 e% Z& W+ }' x

, r; x* l4 g; Y9 X9 {* r! e% F* [-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
) |0 x- v$ R+ a/ p4 m. G( A+ M+ n4 L4 _\Uninstall\SoftICE
$ p, S6 D& D# q-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
1 M8 e) o3 g: Z  b7 ^! ]- M# {-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion8 F, D) P7 h+ C
\App Paths\Loader32.Exe; p7 ]5 \( j/ b* Y/ z! T: G

( d- L4 P& P! ~) q7 o2 X. T3 @4 g  E
Note that some nasty apps could then erase all files from SoftICE directory1 G/ Q, J& }+ e. u/ i5 E
(I faced that once :-(
/ O( J3 [, ]( T9 c+ G: s
. `' e/ d2 z4 H. F3 w4 hUseful breakpoint to detect it:
6 `1 F( P6 e1 |: \4 l% ?3 H& P* j/ s* K5 h
# G+ ~4 V2 b) Y; F& s" }7 p+ T' b     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'; g& z: u, z- }1 I& l
# c, ]" W) T' M0 T" N. j" E
__________________________________________________________________________! B1 ~: F9 Z* f9 I
- R+ d; k* X$ @2 K' P5 H
! L  F6 I# d: K" G# c
Method 14
) Y( e, ~# ]! t8 }4 b0 y=========
' L7 H# H: Y+ X
  e% i' l) P1 KA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose' Q  w. j. y+ b% b5 _% i- P& g) g
is to determines whether a debugger is running on your system (ring0 only).
" F6 p4 ]1 O0 `: @- g( x5 m6 ~: \$ b& {0 t/ F& o0 g3 X
   VMMCall Test_Debug_Installed5 l/ [. g$ ^3 @/ h! L) H
   je      not_installed. X7 S6 b: U/ T& B( o

" P5 n; A& }4 f( H) uThis service just checks a flag.3 B, ]: f' ]- \  u, H  f" x
</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

关注公众号

相关侵权、举报、投诉及建议等,请发 E-mail:admin@discuz.vip

Powered by Discuz! X5.0 © 2001-2026 Discuz! Team.|鲁ICP备19052200号-1

在本版发帖
关注公众号
QQ客服返回顶部