找回密码
 注册

QQ登录

只需一步,快速开始

About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>4 ^7 Y& o# i  H  C- M" W% j1 P! E
<TBODY>
9 n1 Q& p# e! s. b<TR>
. N) u2 z: u1 a# [6 z<TD><PRE>Method 01 + y5 x6 G. J$ h: t2 v% k" E) |8 ?
=========5 o+ L9 \# m% H. ~3 w. v% Q
5 C( p1 U% J$ R, q9 d% K
This method of detection of SoftICE (as well as the following one) is) d  g* O( J- j5 ^! u: u1 g
used by the majority of packers/encryptors found on Internet.
5 f! X+ }2 n9 R+ h3 aIt seeks the signature of BoundsChecker in SoftICE% `- T, ^  ]0 H" C0 _- e4 P
. ]- G  [" ^1 D; b! S7 J
    mov     ebp, 04243484Bh        ; 'BCHK'- {- K5 P3 H( o
    mov     ax, 04h0 Z9 j; I  \- Z" d% p4 z* d8 m
    int     3      
5 t  }" o* A' P1 e& E5 U, K4 o    cmp     al,4' ?! e& i$ @$ U6 O& T
    jnz     SoftICE_Detected: K% C; x, \: |7 @+ S% I" I: P
. @- t' {+ `: Z1 x# t
___________________________________________________________________________8 z! M% K/ E  }5 u
3 Q# K4 ]$ f3 L
Method 020 c8 ]! K6 f/ u. m2 O
=========6 {* c& C7 k! U
. n+ E1 D5 I8 f* D  E1 S' X
Still a method very much used (perhaps the most frequent one).  It is used
" p% g+ d+ L$ M3 n+ Zto get SoftICE 'Back Door commands' which gives infos on Breakpoints,
; e0 ]( a, G3 Y# a9 ]or execute SoftICE commands.../ `( X: x( v# c
It is also used to crash SoftICE and to force it to execute any commands3 H2 e' S0 F4 @4 W
(HBOOT...) :-((  
0 m6 h2 c7 A& `: S  E" g( t) n3 b* V% J* p
Here is a quick description:
; g! X8 L, }% W1 I. |: a-AX = 0910h   (Display string in SIce windows)
" w" w$ C# d  K# T-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)
+ k9 E6 j* V3 R9 K$ V1 S$ A-AX = 0912h   (Get breakpoint infos)0 N) }( b6 @% w& k8 E2 o
-AX = 0913h   (Set Sice breakpoints)) G5 Q9 I; T1 Q6 L& q
-AX = 0914h   (Remove SIce breakoints)3 B$ i3 n+ S, Q

# Q( ^/ U: s- Q0 a! u# ?* R* vEach time you'll meet this trick, you'll see:; v2 P  u& b9 M- e' ?% {
-SI = 4647h* q+ k1 l" d2 F" B5 t+ \
-DI = 4A4Dh1 d& y5 y: R8 Z( ^- Y' n6 \
Which are the 'magic values' used by SoftIce.6 U9 @" t( z- j3 M% s0 I
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.8 s0 M, O0 K" V( r+ L( n& B  Q

3 s- n% U: W0 C! E) V( ?Here is one example from the file "Haspinst.exe" which is the dongle HASP2 c/ e1 ^6 L3 g/ P$ p+ x
Envelope utility use to protect DOS applications:
# m% u+ Z) u  b$ p9 M7 @4 M3 T& b( ^

# \( }6 a. L$ V' S) r4C19:0095   MOV    AX,0911  ; execute command.% K$ C# x; R4 X* X! A0 j
4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).3 N# [, u( R! `* X0 k- l5 k' P  K# b
4C19:009A   MOV    SI,4647  ; 1st magic value.% `# i) n/ L9 ~& S+ u
4C19:009D   MOV    DI,4A4D  ; 2nd magic value./ ]3 |8 T9 u. M2 i  j: |% Y
4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)8 M) n  h1 S/ R) v" p, ]
4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute
* J$ l5 L. l4 P& c$ D3 |: i3 z4C19:00A4   INC    CX) l2 ]( H1 y) n
4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute
5 M% ~3 A1 X6 P: b& h. V" N2 A+ c5 M4C19:00A8   JB     0095     ; 6 different commands.
9 U% I7 \$ c$ C8 H; o+ ?4C19:00AA   JMP    0002     ; Bad_Guy jmp back.4 d  `, D; s" m
4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)- p5 Q$ c2 F$ p8 R' C2 N

3 ?1 ^' g# w( ^! w* H$ H# R3 d" qThe program will execute 6 different SIce commands located at ds:dx, which
$ o8 o' @8 A! O' X' L) b# j6 K7 jare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.) j6 e* O0 V/ v7 `

. p4 ]2 j: j' U3 G  W' f* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
) e8 k& F! n5 e2 O/ H___________________________________________________________________________
% g/ V$ W( Q- I) r  w* Y: g2 b6 d* d7 B) H9 R" v( C

# w( O/ ?* c; s3 }& A- C8 nMethod 030 v& C  d4 M; \: I
=========1 A6 L1 S% `  m  W/ N

, y$ d# o& C+ V- h' YLess used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h/ j# M  L/ }! e1 X
(API Get entry point)4 L( p  J- |4 _/ o
        8 s; A) X( ?/ S

; q, K1 o7 j$ Z) h; H    xor     di,di* d+ w  V) E' o4 ~1 s: b" Y/ s8 }
    mov     es,di
, D! }# N. C4 W/ S    mov     ax, 1684h       9 r+ b, o5 f- w' o' Z: X
    mov     bx, 0202h       ; VxD ID of winice3 O/ Z: E  Z# Z$ m
    int     2Fh
5 k  F$ ]& x- S! b, b9 N    mov     ax, es          ; ES:DI -&gt; VxD API entry point; N) U8 u$ _4 j$ N$ T
    add     ax, di
, v0 G% w, R# X% _* v, v    test    ax,ax% W# `1 K3 g9 i
    jnz     SoftICE_Detected
5 i) p% n1 b: F* A6 x% }3 Z7 D& P- M
2 m2 I, C4 h( `; _$ W1 t+ L___________________________________________________________________________
9 Q( D: c, [' T
( t, m" a$ p8 B8 }3 Z% h+ V! G5 ]Method 04: y  @4 N, z$ |
=========
  U- ^5 ?. e9 `3 b; d8 V- [* Q& J# t2 w2 J2 x
Method identical to the preceding one except that it seeks the ID of SoftICE8 \7 k$ c: B2 _
GFX VxD.
* Y% `0 G. T! J( @/ W2 @
6 ?6 V6 o" F. ^; S, _* U) p( B    xor     di,di
% v7 t, c) D( G5 `/ [) u% p0 ?5 Z    mov     es,di
& U4 Q6 S+ n) X6 c$ Z    mov     ax, 1684h      
% H( _3 `# P2 H/ z  u    mov     bx, 7a5Fh       ; VxD ID of SIWVID
& _) n+ w6 n+ J6 J0 {    int     2fh; H5 u7 Y+ S8 _! E  D8 F
    mov     ax, es          ; ES:DI -&gt; VxD API entry point
: t( p8 T1 Y; J' b9 S2 U    add     ax, di& O; W# t, t" n
    test    ax,ax0 ]- m. @( U. B: @: X
    jnz     SoftICE_Detected" c0 N* n  W% I6 z& H: Z$ y1 Y
( E7 H" M) {; f& F) g! B
__________________________________________________________________________) O& i# u# k" `" a' _. o

4 H) A4 ]7 G. P6 ~' a2 D* `/ b# R( z, `- V6 ^' |. X
Method 05
+ ~* w) X: Y: ?* |=========
3 x" ]. y. T4 W$ O. X2 q5 m1 V9 w7 E8 z. g$ s
Method seeking the 'magic number' 0F386h returned (in ax) by all system, N, {: E* O+ j5 h3 G' D
debugger. It calls the int 41h, function 4Fh.+ V" u0 [& X" l, D/ m0 ?
There are several alternatives.  
) L2 `4 f; w* y. {& z
* N: v, x6 T/ B( ]" L5 z9 tThe following one is the simplest:
* X+ N% D6 }1 ?4 U. t9 o3 N# e4 K7 O# r/ `, h6 I8 D
    mov     ax,4fh
0 f! F" X( l5 R) T  @7 Q    int     41h5 j3 h8 y, D5 Z) z1 S& Y: k
    cmp     ax, 0F386/ c3 ]' ~. g, Y" d$ I0 k
    jz      SoftICE_detected/ z, A3 m* O! B& m
" n9 r( x8 r4 d" t- }5 D

7 j: j: }) M) w- R2 o0 x8 |9 jNext method as well as the following one are 2 examples from Stone's
9 B. H" i9 D4 F7 U4 E6 c& U"stn-wid.zip" (www.cracking.net):
; e7 C$ J- ^0 m  b/ i* \0 ?
4 R+ @) i0 x* z- ~. x: u4 Z& O    mov     bx, cs
) A: I% ?3 U" B& Z! x* n    lea     dx, int41handler2
  L" m4 ^& g/ X6 Z    xchg    dx, es:[41h*4]
" h+ H$ {6 ]/ @( F3 E    xchg    bx, es:[41h*4+2]- m% l; i/ V  K+ w) c
    mov     ax,4fh5 a3 {. G: k! O  w6 G7 _
    int     41h: ~! S# L. F7 Z: O& q9 d+ ]. h' O( ?% F
    xchg    dx, es:[41h*4]
0 j% o, H/ y" M/ {4 x3 y    xchg    bx, es:[41h*4+2]
% R9 D& T- a$ a    cmp     ax, 0f386h
; y, }" g0 l# E1 p' q3 W    jz      SoftICE_detected
4 s3 s; h; M) `
, U' i3 y, k7 dint41handler2 PROC% V# u& d" W  `2 p8 I7 }
    iret
" ~# p: N5 k  r9 n( Uint41handler2 ENDP0 Y$ u( ]% z5 K8 D) g6 T* u
- k6 c. S* N$ Q) j* P1 w0 q
: `6 ~  w2 T' c1 f: U6 O* ]
_________________________________________________________________________$ P# M1 k2 j  q  P) ]
' B# g, C7 U# L- i  _
, j6 \. O' ?0 t
Method 062 `5 l. G$ O# x- }
=========
0 Y. \; |2 U- K# q2 e) F& `0 ~7 J; K$ ~7 {; J
& P  |8 q& g3 d, |  e# t
2nd method similar to the preceding one but more difficult to detect:1 R; P5 J6 ]- ~- ^

7 C' @: N# b$ b/ v0 a1 M0 J
; c* N( \/ w* Xint41handler PROC& V* P+ L; A/ c) `, g* E; H
    mov     cl,al1 z! R( ~8 Y  K4 V
    iret
' R: f1 L. V' t6 W# ^/ N6 @int41handler ENDP
( m7 D' O) B; D+ d6 l/ {# n6 T$ [, J; R9 m/ {  H
1 `3 Y6 c1 }4 ]; n' ~( s/ Z
    xor     ax,ax/ q* P% a4 {8 a  n& n
    mov     es,ax2 s" ]$ o" B9 X0 w
    mov     bx, cs& m# ^' O6 a/ R# r1 y5 [1 _
    lea     dx, int41handler
% Q0 |  ^) j. _  [. v    xchg    dx, es:[41h*4]
, O; J: S  p6 F1 K, b5 A    xchg    bx, es:[41h*4+2]
+ v7 i- |% _$ U7 W4 E: L8 g6 c! H    in      al, 40h& P# ^! M' H  v3 M, Y8 N
    xor     cx,cx
% o7 p; r8 k- a8 q4 Q& o    int     41h
" B- ~  D' `* `9 \& [3 [4 i$ A- Y    xchg    dx, es:[41h*4]' Y- s) ^/ g8 n2 U* [2 \
    xchg    bx, es:[41h*4+2]
1 u7 _5 ^$ O5 T5 X* y( O    cmp     cl,al
, g' N, D' P' |5 b" [5 x    jnz     SoftICE_detected
7 b8 ]$ Q! _$ `" a; T, }# i3 p5 ~% T$ L1 E- C( Z. Q
_________________________________________________________________________
& P; G( Z3 k8 ^1 E: x3 ^& f: {' c( h, ]
Method 07: t3 l3 j2 c, p. Q8 V
=========
' U8 R2 O0 I2 L% C+ U) N3 i7 l$ r/ V, ?$ y: r
Method of detection of the WinICE handler in the int68h (V86)
  J3 T; k& v0 H) x
3 I, N/ z; r& T    mov     ah,43h
) r7 {# l( q& F7 R6 C% W  e- m    int     68h# k" m- ~4 s. S/ `' J
    cmp     ax,0F386h9 U+ N% E/ Q5 r1 R" w2 E
    jz      SoftICE_Detected
. F; p* g  E3 d& Q) \+ q6 v3 T( J' a' g, y/ q

8 X. n- `" S; P- o=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
' o% W: ^" @  \- ^- e: I- I   app like this:
1 p8 j  x7 b! Z, a. s5 V
" }- c: M( r  q4 r2 Z6 ?   BPX exec_int if ax==68
9 H; W2 t' T2 W! h1 E   (function called is located at byte ptr [ebp+1Dh] and client eip is( @3 _( D1 \  F
   located at [ebp+48h] for 32Bit apps)
4 X4 S8 z: M. q; \3 j1 z' B__________________________________________________________________________
" u1 i1 r+ [& ~: Y2 D
/ m, z  g. U& y
2 }4 a* i* j$ y" }( p0 QMethod 08) ^/ ?  P2 s( F5 o" q& z% ?
=========: [# t$ {# |/ e

# I3 f' \7 Z4 _" q1 N; W1 \It is not a method of detection of SoftICE but a possibility to crash the
6 v9 L+ M$ y3 W+ H% S, Lsystem by intercepting int 01h and int 03h and redirecting them to another
4 }3 Z( C: L6 O0 Droutine.% y0 Q: A- a& P! F5 R
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points2 l: q$ q7 Y* W' C4 _+ G4 d; Q2 I
to the new routine to execute (hangs computer...); c, x% N0 E" T* }8 X

  ~# F" v# |( p  |8 k! }2 ?& B- M! h    mov     ah, 25h7 A2 q: \" ?% t6 b
    mov     al, Int_Number (01h or 03h)) p& g8 h0 J* o0 t
    mov     dx, offset New_Int_Routine
0 w/ d: ]( h. L: s/ i8 c8 E    int     21h
2 S# ]% y# }/ [! U. @
" s& x! t: ?7 N( l) q3 o( q2 j' C__________________________________________________________________________
8 k( b* r3 m* i- n0 Y7 s$ f/ Y
1 j  x7 S+ l* b/ EMethod 09
9 u6 }0 p" C/ c% [: u=========' _  N- e( Z: o
2 b. X6 s* D7 z0 b, Z
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
; m8 ~! V5 i. e' L+ O# j% {+ U: Aperformed in ring0 (VxD or a ring3 app using the VxdCall).+ @$ n: ~& Q) k0 i0 o2 I$ t
The Get_DDB service is used to determine whether or not a VxD is installed
$ z' ^# L) n0 z1 ^0 bfor the specified device and returns a Device Description Block (in ecx) for+ s+ l  C( {2 H4 \; {0 r
that device if it is installed.6 R+ \, m$ n  C* u% E

7 X* Y' V3 g& a! _7 V. i) v   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID
1 g* I' H! K- |3 K   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)6 @, ?- T) J, d' E4 W, E
   VMMCall Get_DDB
/ |! l# F" ?( b+ h! f   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed: z% r7 A% O# z/ x7 d

5 U5 h* _( ~" A3 d+ HNote as well that you can easily detect this method with SoftICE:* a* x* k. E* c  ]: O9 ]/ ]# ^
   bpx Get_DDB if ax==0202 || ax==7a5fh) h: S$ P' r" n* d
  H6 A/ {" ]# {# h' r. p5 g0 j
__________________________________________________________________________
2 r, j8 D. \( \5 A
+ G3 Y% ?9 W8 {: {+ |9 m- qMethod 10  E5 u5 j1 \: q# A# D9 M
=========
1 c  R: t  }; ?6 v6 Y
1 q! W* U+ W% j$ F1 ^=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with$ ~$ ?! ?+ p  x9 n5 x  m
  SoftICE while the option is enable!!1 Q6 O4 O  Y$ Y: h, |* k8 u

8 K! ]6 F. Q3 {- d4 b8 Q, RThis trick is very efficient:) `7 o  T& M* [( P$ g
by checking the Debug Registers, you can detect if SoftICE is loaded
4 w. n  [6 J2 q: I0 n(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if5 [& ^2 T. l( L: `1 w; J
there are some memory breakpoints set (dr0 to dr3) simply by reading their; p- F# Y$ {8 u2 L* O! c
value (in ring0 only). Values can be manipulated and or changed as well
) h' Z5 q9 Y4 S5 b2 {(clearing BPMs for instance)
; X4 M9 B5 R" r1 {. R& k" `
, f4 x2 l9 t. {4 A6 ~__________________________________________________________________________
' v: n6 u  ~. d$ c' b+ l, E' E6 [
Method 11
# z& v, s9 O  y& V9 e=========
$ Z1 `! [+ X% y  l; ~' N/ F# {- P  V: t% N& _# m
This method is most known as 'MeltICE' because it has been freely distributed
, f( w4 U' y) b; wvia www.winfiles.com. However it was first used by NuMega people to allow
$ j* Z7 ~$ y% LSymbol Loader to check if SoftICE was active or not (the code is located
6 q4 t! b) ?; J& ]" O) Binside nmtrans.dll).9 v3 t  n$ v, t. j5 n
% f9 u5 e  V3 c5 B- I
The way it works is very simple:! m3 }/ V5 w# J) b6 ]" l
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
! D* u+ `" i, y- c2 n% {) ?$ QWinNT) with the CreateFileA API.$ `4 R; T  N- _: b7 x; p3 b8 |
! z, R% `* F* x5 B! s) v
Here is a sample (checking for 'SICE'):
5 L- o  g& O0 f+ b& T# D3 w
/ P5 w7 O% u7 [7 F/ l. [# CBOOL IsSoftIce95Loaded()
& C' Q6 M& J3 V9 K, d9 d{" T! P/ |: h- c: i2 J* a. a6 r
   HANDLE hFile;  
* p  e# Z& e% L   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,: d% a$ D1 U8 j2 ?7 y
                      FILE_SHARE_READ | FILE_SHARE_WRITE,/ O6 J. C7 o, C
                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);& ^1 g! ^0 w2 a  u" E
   if( hFile != INVALID_HANDLE_VALUE )
: [% K- _% o0 m   {( k4 Z- o7 r1 D0 a4 \" d
      CloseHandle(hFile);
9 K9 u7 N/ U5 @# S. ^9 G) E. w0 K      return TRUE;1 n1 m# ?* |: d+ t/ }
   }
; e5 E* j' d- N: J   return FALSE;
1 N/ R& i, P2 R3 s, B$ b}
& x& r4 D* w0 I# j/ J) S2 ]' v$ X* c& `2 K8 E0 Q
Although this trick calls the CreateFileA function, don't even expect to be. [2 @( J2 G" ]0 c
able to intercept it by installing a IFS hook: it will not work, no way!* J2 M7 g& \1 R# \- l
In fact, after the call to CreateFileA it will get through VWIN32 0x001F/ {6 F7 U( l" A+ V4 |; S% U  m
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)- J; j6 s5 p3 D6 H$ i/ h1 E' W
and then browse the DDB list until it find the VxD and its DDB_Control_Proc. P% t  r6 T1 D6 Q/ H. v; j/ @
field.$ [4 W: A% O( i
In fact, its purpose is not to load/unload VxDs but only to send a
6 t& ~# j, s5 W9 d+ mW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)+ X# f4 ^7 v/ Z
to the VxD Control_Dispatch proc (how the hell a shareware soft could try+ I% X$ N- i0 f
to load/unload a non-dynamically loadable driver such as SoftICE ;-).4 |1 c4 C. X5 I
If the VxD is loaded, it will always clear eax and the Carry flag to allow4 Z# v3 v/ `2 z! f
its handle to be opened and then, will be detected.8 q! j  g, p0 C2 E4 g7 v$ _
You can check that simply by hooking Winice.exe control proc entry point
' u' l5 y9 P. i2 B7 owhile running MeltICE.
9 m& \1 j1 D7 t# x8 \3 m# m6 G' U' {- w( n6 `* @2 l
. ^: i+ a, D& n+ n7 r
  00401067:  push      00402025    ; \\.\SICE7 w! o/ q+ ~% c6 V
  0040106C:  call      CreateFileA5 w% ]9 L  k& q
  00401071:  cmp       eax,-001
/ f3 E$ r/ Z5 x: E" j0 }  00401074:  je        004010918 C" O2 n* E% Y  E; N" |

/ H$ m0 }3 J$ c
9 O( F  u  r8 ]' p0 PThere could be hundreds of BPX you could use to detect this trick.- J' p; k) q1 _) u. @! v
-The most classical one is:5 \. N6 V/ u" |/ O( J
  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||
+ n0 @: ~- H2 r9 [2 ?# N    *(esp-&gt;4+4)=='NTIC'2 f5 c- ~' p7 A& }7 @. P
* S8 T0 b; m: W8 Z+ x' ^
-The most exotic ones (could be very slooooow :-(
5 ~4 q: m! n4 [   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  . h" |- _* O/ i& N  e
     ;will break 3 times :-(' H: d! f  G$ P. a2 I' t
1 [/ w8 g" R+ Z6 J0 z
-or (a bit) faster:   c6 \! f7 C2 H3 @: f+ z2 P/ m6 v
   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
7 \7 }# Y( i7 Z7 d- J6 o/ o& F" x  b2 T5 ]9 x
   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  
( ^6 x2 \/ l: f1 y3 V$ t1 I3 s, R' a% b. l     ;will break 3 times :-(
5 U3 G2 x$ e; v8 u& |1 _
$ j% @) q; s& W1 x-Much faster:
( }. x. m1 _6 u6 C$ p   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'1 Z! W+ T. L  j$ m9 t7 J# t
0 P& F( Z. t5 j$ L
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
' s" V$ }, Q9 S3 P" pfunction to do the same job:- _( Z8 A2 {1 M6 I/ d, `2 b

9 h5 v2 V; r" j; h8 }0 n   push    00                        ; OF_READ0 V2 U" x! p! Q. o
   mov     eax,[00656634]            ; '\\.\SICE',06 L# k$ W/ U: }, \1 x* R
   push    eax
: Y3 O: q. b3 I8 Q6 Z* O8 u   call    KERNEL32!_lopen
; t) [$ H4 N* ~% l* o2 L   inc     eax( ~% @0 D) A3 R, A
   jnz     00650589                  ; detected8 d! g) N% I9 R/ @
   push    00                        ; OF_READ
5 u! G# s% r9 d9 Y  v8 d5 Y; M' A( b, t   mov     eax,[00656638]            ; '\\.\SICE'
9 U! Z1 A% M% v" U3 K) z' X7 m   push    eax3 [8 ^$ x/ ^$ {8 [4 A
   call    KERNEL32!_lopen3 W- d. u! I3 F5 \2 ?
   inc     eax
1 N7 A' o4 V- V1 K   jz      006505ae                  ; not detected
2 P4 ^  W3 q6 ]3 |, z/ @: v' r6 p
0 k) u3 _+ B' F* n0 A- Q+ {* J1 \2 \& ^. ^, _5 [/ V+ b
__________________________________________________________________________' h  ]7 B/ t! Q7 F: s
$ W9 U1 a, Y. q" n* v
Method 123 u% _' `& |" q" }$ F
=========# H  J' M5 W* E+ j2 }0 n
1 ]0 I" ~: m. S' _: L6 B
This trick is similar to int41h/4fh Debugger installation check (code 05
% C0 I0 o! n! z&amp; 06) but very limited because it's only available for Win95/98 (not NT)
) w% s# I1 a# }! Q# h: Was it uses the VxDCall backdoor. This detection was found in Bleem Demo.
# m: j* I+ `) q; c) _" \( m. Z7 f3 H. l$ `- u: E7 X
   push  0000004fh         ; function 4fh$ h1 v" O8 @' M5 K+ D
   push  002a002ah         ; high word specifies which VxD (VWIN32)
+ ^" A. `- g" T/ j                           ; low word specifies which service, N) a7 R0 g0 i) F: c1 s; `
                             (VWIN32_Int41Dispatch)1 |  N! n2 @$ k% }0 Z& y
   call  Kernel32!ORD_001  ; VxdCall. n! x, ~' N$ r- n) s& Z
   cmp   ax, 0f386h        ; magic number returned by system debuggers4 v+ W. G5 I6 ~$ X
   jz    SoftICE_detected1 v' H2 X/ g! m+ j" |
1 d) V/ c* K8 u/ m) o7 o
Here again, several ways to detect it:* ~( J* t- B2 `5 f8 @

% N) o) P8 {! p) K    BPINT 41 if ax==4f8 C' C7 w' i/ V* F* L' p0 {

% G' [/ r; ^! v    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one
% t: w# E! p) Q' j
7 b  }; w1 n$ u$ U( O$ H* m: o0 Q    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A
% s0 g! `, Q4 A$ @1 q
5 V2 E2 j8 S% p' N    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!
! M7 H* U3 {1 U! G
, _* R; z3 q( T+ G1 p2 q/ T__________________________________________________________________________4 e8 O/ U6 Q& Y1 J5 F
" k0 L: X3 [0 w. v! x- R/ m: Q
Method 13
  i0 g  b! a' s) E=========
) T& R. K$ O5 U" V1 p
, o4 W' c. w" j9 F# ONot a real method of detection, but a good way to know if SoftICE is. _  ]5 J) x, [  q3 F
installed on a computer and to locate its installation directory., Z) ~# T( K: ?4 ^1 p$ ?# a
It is used by few softs which access the following registry keys (usually #2) :
; C) }4 L$ D0 u1 ^6 @( y# p
5 i5 |- d1 q8 C, r% r9 W-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion9 v( R" B4 s) w2 o" g% w4 Q
\Uninstall\SoftICE
! H4 d9 ]. Q. O; a, D-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
, H: m& A! Q+ g7 f: o- |- `-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
/ p3 n+ u" ]+ c0 m\App Paths\Loader32.Exe
# f( {# R: T2 Y  M+ y+ m, ]
* l, [7 J- f' N  ~
) k4 [: r* F8 V" F7 m: J. |0 L$ {Note that some nasty apps could then erase all files from SoftICE directory
- w% [6 V1 w, H) {* d) a( g(I faced that once :-(
! I9 Q% l+ u$ o! Q7 Q& s* I' E5 F  v0 N9 o! O: ^
Useful breakpoint to detect it:
9 Q$ ^7 @  d: X2 Q8 ]9 Z% r+ e/ i+ ~
     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'
& n# k! H% p% w6 F" k+ n
6 w& m7 j4 V' D. V* ]__________________________________________________________________________
$ n# U( {6 V7 S* h* [4 e! K! e
" D0 }$ Y" a# w1 C7 e- h3 Q: t. L
6 m1 ?: y, a& `0 x7 {3 nMethod 14 * P1 J$ N# _0 \. |0 _' u6 {$ f
=========* i( h& U# z5 B0 g  ~
  L( J# q3 S/ K) j! A6 b
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose) F# P: u7 p$ Y2 {4 w9 W! b) b
is to determines whether a debugger is running on your system (ring0 only).+ R) k' H  u7 x4 s' K4 ?' g- f5 y1 v
' S, x' h: z8 k  U1 T2 |# M- a
   VMMCall Test_Debug_Installed
, _, B! D0 J+ x# V   je      not_installed( c/ Z) q: l5 Y1 {
! B$ K7 C6 U+ R1 c9 g& o
This service just checks a flag.
# n! S+ F/ {2 _. K1 |- x3 k</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

QQ|本地广告联系: QQ:905790666 TEL:13176190456|Archiver|手机版|小黑屋|汶上信息港 ( 鲁ICP备19052200号-1 )

GMT+8, 2026-8-9 22:28

Powered by Discuz! X5.0

© 2001-2026 Discuz! Team.

快速回复 返回顶部 返回列表