About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>
8 E. x1 I2 N2 m/ W0 E7 s) v$ g1 c7 W<TBODY>
- Z% B* G% V( ?" T1 P# C, T1 l<TR>
3 |1 {/ {  q- O! g2 J: s<TD><PRE>Method 01
0 ]2 b( p/ l! {9 Z* e) n# G=========
6 z& c, T" r( x: w
: M; f( C% ^+ J* q# N: X: mThis method of detection of SoftICE (as well as the following one) is0 Z- Z1 ~. G& }! g) a
used by the majority of packers/encryptors found on Internet.) P, e1 l+ a! g( S9 S
It seeks the signature of BoundsChecker in SoftICE
# l& H/ ]9 l# C# l, d
9 j: s- a. k& f: w7 H$ o) U    mov     ebp, 04243484Bh        ; 'BCHK'
2 h+ R5 S/ z1 n8 a; f% J  Y    mov     ax, 04h/ h$ d8 P! z; f4 [4 u9 p
    int     3      
/ P( L" @" @7 h    cmp     al,4
" }  z* ]# |9 m; c1 b# \    jnz     SoftICE_Detected- S( ?( S3 [# Z+ @' O
* y8 U$ l: O* [  S
___________________________________________________________________________
$ x5 q% l0 Z" F# ~$ X( i
' |+ e/ A6 s  G" z. LMethod 02* u; Z4 t  L/ y! m! N
=========2 I; [4 c& A4 M1 g+ m4 Q: _! P! K

. e+ o7 p% i4 V- _+ I, \4 bStill a method very much used (perhaps the most frequent one).  It is used
9 q( ]8 ]- L# Y* I. W' t$ Fto get SoftICE 'Back Door commands' which gives infos on Breakpoints,. S1 t, W/ f4 \5 x( P. r
or execute SoftICE commands...9 Y1 o' x- S* m8 l9 C
It is also used to crash SoftICE and to force it to execute any commands
- S% j$ Y6 w* T# P: r  _& O( _$ J(HBOOT...) :-((  
9 g8 S( O+ J0 K$ f% ]0 F  V- d4 S( u$ R7 G$ J
Here is a quick description:& f" D% i, D' x$ U5 R; l+ Z0 h% `! d% e
-AX = 0910h   (Display string in SIce windows)
6 ?' X3 _3 Z- B- a7 ?0 P# n4 E-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)
- L; k( M( B3 l) t! Y-AX = 0912h   (Get breakpoint infos)3 |* y  ]1 q7 P! y2 |1 \
-AX = 0913h   (Set Sice breakpoints)
8 R. D7 F1 t% f/ G. Q4 q& H-AX = 0914h   (Remove SIce breakoints)( N/ g/ R" ~1 f# H+ D
9 o7 U% Q( U# ]% h+ q
Each time you'll meet this trick, you'll see:' l. q5 h' f0 }! b
-SI = 4647h2 s% g$ g6 i' b$ J* {* R9 S
-DI = 4A4Dh
3 ^3 u, u8 I; ^: w5 BWhich are the 'magic values' used by SoftIce.: i5 H$ J* I, g% C1 y% W/ O
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.
: R2 Z9 s5 ~5 f& Q8 v$ Y: h, s7 ^) o* y1 R5 R, Q. Q3 d
Here is one example from the file "Haspinst.exe" which is the dongle HASP
1 Z$ n! O/ n9 ]# U$ u4 w/ JEnvelope utility use to protect DOS applications:
  o7 E+ C, j+ A) ~* j& l8 x) ]( Y# Z$ u5 @( q5 X

  q6 x$ i8 f* @4 t' g* Y- a4C19:0095   MOV    AX,0911  ; execute command.9 d" B8 T- I) n
4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).
1 M( A1 I* `& p9 k4 u# q( y4C19:009A   MOV    SI,4647  ; 1st magic value.5 s' n, }6 j; r2 ]9 d
4C19:009D   MOV    DI,4A4D  ; 2nd magic value.6 H0 G, D, y5 D: \7 S0 ^
4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
5 C7 ]5 @* l3 W+ Q0 N  S4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute: M9 z0 P: `, x' {- R7 I0 T
4C19:00A4   INC    CX+ v/ d, ]2 Y/ T6 {& P5 K9 y- {
4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute8 b( Y/ U% r; d  b
4C19:00A8   JB     0095     ; 6 different commands.6 A% R$ k4 S3 g/ l7 Z
4C19:00AA   JMP    0002     ; Bad_Guy jmp back.) d6 ~( H0 I! V5 I# K
4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)
( w4 W7 O% L' X2 `& e- \1 N; c1 U0 ]  ^! s4 X* f0 ^* l
The program will execute 6 different SIce commands located at ds:dx, which& R# L6 S3 o' t1 \5 _
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.  u8 k) t9 ?" }- Y) E8 z

0 U! R' [! Y7 s/ P8 |% O. p" F* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
0 p; V  ~3 @) I2 q___________________________________________________________________________- C8 e2 }. O. e5 h
/ t/ {# g! b' v2 c

( Y1 S1 i2 r2 K4 K! o% U, W/ r' L& eMethod 033 |1 ?# O3 o- b/ b
=========4 l* V" ^- b  f7 L. {$ B

0 d  M  A1 C& W2 PLess used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
" U* W! d, p( {4 S. G4 t% t(API Get entry point)
1 O7 E/ o1 \! r- Y        
7 Z7 T5 L) r# h( U& ~- b* J0 h1 T) y. L" r9 A$ B
    xor     di,di( o. A" T0 D; {2 w" n
    mov     es,di
; J9 f, _$ W) M2 Y7 t    mov     ax, 1684h       6 f. y/ Y7 Z' ^. A1 F
    mov     bx, 0202h       ; VxD ID of winice
* e" b. r- p/ i% g7 e    int     2Fh
: i3 m# @# ]' M    mov     ax, es          ; ES:DI -&gt; VxD API entry point
, o+ s, w! b5 E' J7 V2 _    add     ax, di
8 S0 n4 ^0 I2 J. T    test    ax,ax( @# x3 ?1 H6 [  B4 t( }! [4 u
    jnz     SoftICE_Detected+ ], d( f! Q% ^( k0 e9 V5 a# E4 V8 [
1 `# }& `7 l3 y: m* x
___________________________________________________________________________) n$ x: z0 a- X* Y1 ?8 h3 v
, M' @8 s6 L$ y/ H
Method 04* X, K8 J! T5 s: ^0 R/ `
=========
' N% i4 u7 w; d9 u) u+ [3 B2 ~9 p, c
Method identical to the preceding one except that it seeks the ID of SoftICE
! r" j% A0 p  J/ ^) [GFX VxD.0 m3 S5 o: o1 [

7 l$ n1 m1 W! W    xor     di,di! N4 A3 p! S5 n: W" _: o+ n/ S, ~
    mov     es,di+ q7 S6 g; u7 H) Y
    mov     ax, 1684h       + A  ~( k0 n/ Y* K; ^5 F
    mov     bx, 7a5Fh       ; VxD ID of SIWVID7 ^) H3 ?# I: ], I. x; _
    int     2fh8 j* V% l/ x$ f4 n  z3 z3 t
    mov     ax, es          ; ES:DI -&gt; VxD API entry point
3 T2 u) {) O" X/ B+ y4 O    add     ax, di. j$ S0 e& j6 x7 `6 s% P3 L8 E  y2 c
    test    ax,ax$ |- N9 }" n5 s: a. P+ ]$ w$ U4 i' S
    jnz     SoftICE_Detected
$ g$ c: r: p; H. H" h0 G. M, T. a4 r  {$ |8 w3 I9 j
__________________________________________________________________________
- N4 i# r% ~7 W  e- P3 Y2 I3 z% D; J5 b) Z# I% m
3 B) E# G7 j- b" O* e
Method 05
$ K( E! Z7 t0 C: _& Y5 D=========; N& c: \) q2 L4 @  e

7 j  c) k4 e- s5 _5 a! Z2 Y# RMethod seeking the 'magic number' 0F386h returned (in ax) by all system
9 e5 Y: z" ?3 s. x( pdebugger. It calls the int 41h, function 4Fh.
& `9 ^2 q( d& S0 C6 [0 K+ t) F( HThere are several alternatives.  3 O: p- |6 ~0 F: E0 l0 g" g2 @
8 w% N/ U/ Y1 C1 p2 S6 U* m
The following one is the simplest:
$ ^7 q3 N, ~, c( a
" n2 ]! G6 O, m: ]    mov     ax,4fh
. ]1 A, i% y+ G' t% A% j    int     41h! B; W9 \9 M  P+ Q
    cmp     ax, 0F386: ~( D/ [6 v3 e& G
    jz      SoftICE_detected
1 E( i* s: D  x, d7 w2 x+ P! g! ~, g! ~9 ]2 H

' {3 t4 G1 l* z) ^9 A. J) _Next method as well as the following one are 2 examples from Stone's 5 f" v% J* P5 ?5 y1 e  n- \
"stn-wid.zip" (www.cracking.net):* @* K! _; _8 _" F4 T+ ^  r

5 i& g1 c' }6 N6 r    mov     bx, cs
8 {" {6 D4 t. j9 X    lea     dx, int41handler2. }" U, K9 c$ x$ Q
    xchg    dx, es:[41h*4]# c" ?( ^7 {0 d
    xchg    bx, es:[41h*4+2]7 g' t! u- b! i7 X2 q. b
    mov     ax,4fh
( X. h+ s$ }8 S$ S+ [' Q& [( g2 d# h    int     41h
+ o* |* [. b/ k  }- {( d4 \& H    xchg    dx, es:[41h*4]
, o* @* G  ^. f    xchg    bx, es:[41h*4+2]/ z/ ]: W7 a6 a( M: H) ], H
    cmp     ax, 0f386h
3 A# K1 u7 n& ]7 v5 C' H9 M    jz      SoftICE_detected, D/ K: `% D2 Q
' t. `% l: Y- h. o$ N4 o
int41handler2 PROC
1 E% P  S7 K2 Q  J0 F" I5 n    iret
$ f3 P0 S( |0 x0 s5 gint41handler2 ENDP7 d; f* r. w% Q8 a- Z' H
- \& f" [# c$ |* x: Z: ?- |

/ B  A, e) Q" C8 _/ B1 e_________________________________________________________________________
  `. v1 l3 R2 ?1 ]1 }2 z
% m# R+ B" t& W: @% t$ v
4 i; q  O* Y% [! nMethod 06
- A, ?; w3 K9 s2 A1 Z# `=========
! t$ y- f" f9 Q- H
2 P+ ^5 e% P: \, z0 ]
: e2 h; L* {3 e) j+ r2nd method similar to the preceding one but more difficult to detect:: A) q# Y! u3 o- b; W! A. q

: S8 I, O9 ?7 o7 Z- C% |
3 o* t* Y9 V9 p/ Wint41handler PROC
; z6 w0 \. w+ k. [$ ^2 d4 g    mov     cl,al8 z. r% O& V) f' U7 A. V
    iret
" _" `: E* S- `9 g' ]" oint41handler ENDP/ O7 }$ i9 c1 S- C0 o3 Y* _2 u7 \2 ]
9 \  |% H* B/ f
) O1 @; {9 W! ?9 K' x9 a5 H8 O
    xor     ax,ax
$ V3 `5 x* Z" g7 l* R$ w    mov     es,ax3 ^" `& W9 w& q: }; K, ]
    mov     bx, cs
  s; c5 a% ~$ L* I6 U* M& f    lea     dx, int41handler8 P8 R( F" I  y: G
    xchg    dx, es:[41h*4]
% n% H- A+ Y* p4 u    xchg    bx, es:[41h*4+2]
4 M7 c3 J0 l+ g+ G; M& r( _    in      al, 40h
5 k) y& a7 ?* d  I    xor     cx,cx$ h- a  D7 q" x, }& A, ^
    int     41h
/ Q% Z+ ^) v8 N9 }6 W* k4 J    xchg    dx, es:[41h*4]
) }' R5 i! r9 H2 B. |" H' |5 L: l    xchg    bx, es:[41h*4+2]( K4 {3 [, A; p; u0 l% y; ^5 y/ ^
    cmp     cl,al
3 {% v! K+ Y, \    jnz     SoftICE_detected8 P) `  y. N, F- h( J) e+ |' b7 z
* P1 ^1 u% ?2 A$ S
_________________________________________________________________________' a) w: j$ e9 e# u% v& D

# O) m) p& o( j4 }3 X; eMethod 07
9 M9 ?. \; H+ y4 Y6 J' @=========
& j! f5 O/ p; W8 q6 Z$ d6 a: I& ~; ]$ M- Y* `* {: I# @3 Y
Method of detection of the WinICE handler in the int68h (V86): I3 F$ x8 @' T  }

& V6 g' |$ y3 c1 x- c# H    mov     ah,43h7 \& l# c+ h" @* ]3 O
    int     68h- \* v* S7 E* d' J
    cmp     ax,0F386h
( W8 @! F' H8 ~6 i( `    jz      SoftICE_Detected3 _/ v# N& F- Z/ O6 X2 P

- n* D' Y5 c% A$ i. {& h  `3 G
) \" ~8 d$ s1 E8 u=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
/ t- o3 t; Z) [1 C   app like this:7 ^4 U& l. W/ |: k) t

" E+ r) Y4 U1 t. Y, @   BPX exec_int if ax==68; A- k: j% _! ?2 Y: Z
   (function called is located at byte ptr [ebp+1Dh] and client eip is! O" c; g; g. V! r8 d5 s* T
   located at [ebp+48h] for 32Bit apps)
$ p3 F5 s. V+ p__________________________________________________________________________
/ ?# s; S0 S% h/ G9 [; I2 Y1 G8 l1 z9 p8 @! E7 }

* d  I0 @6 V) Y/ [0 A- QMethod 083 e% ^" u4 t. t+ f( T. r) c. T
=========2 ~& T6 d9 b) y6 _/ q' C

0 U7 I+ H$ \( k9 q% pIt is not a method of detection of SoftICE but a possibility to crash the* F) I+ r* ]1 L0 C) p4 V  Y: ?" E3 l9 D
system by intercepting int 01h and int 03h and redirecting them to another. l. v7 W* K  e5 n' J: |$ s5 z8 F
routine.
0 L1 T6 r+ O8 {% t* ?! D' \It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points1 v6 I; ]. C8 H% k" H5 C! s7 g- i
to the new routine to execute (hangs computer...)- s, @1 E3 T/ G3 q  `- m0 w7 ~" {

1 j: i( `) j# G    mov     ah, 25h. A  M! E! z" L+ R/ y( L9 c% r
    mov     al, Int_Number (01h or 03h)/ z+ j) O9 `( ?; D* c
    mov     dx, offset New_Int_Routine) Q3 H1 i8 c$ L1 ^
    int     21h
) t/ T4 s( Q5 Q+ Z  u5 X/ c( w1 h9 B0 m. V4 L1 X9 Q) x
__________________________________________________________________________2 ^$ ~5 _- u) A2 ~6 n$ W9 m- C, n

- M- z) q% \) m- Z8 I6 J6 BMethod 09$ g4 X5 ~) `0 h( G+ B
=========1 Y; a( Q, E) D8 D, w: S+ A% k9 }

# H; V- C( I. @9 }- F% a9 LThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only7 ~  @$ f/ \( w. R+ }/ E9 u0 ?( N! Y$ m0 v
performed in ring0 (VxD or a ring3 app using the VxdCall).
6 g6 R/ F& n/ Z( MThe Get_DDB service is used to determine whether or not a VxD is installed
1 _- t; o: c; N4 T( X8 Qfor the specified device and returns a Device Description Block (in ecx) for
: u; H9 n% K1 u) Mthat device if it is installed.
3 x: \4 X$ n1 ~6 L" [% L! F0 @8 _9 g! g( P( H, P
   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID
3 R  K( L9 b7 |. W1 ]2 ?, f- c   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)7 l& D: C& @0 f4 f
   VMMCall Get_DDB. ~8 N( `3 F2 Y/ r
   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed- ~# ^6 J' d: N, S8 r

7 G' D0 H9 q+ m2 HNote as well that you can easily detect this method with SoftICE:& |& L( D3 H2 i+ S7 x5 r* C
   bpx Get_DDB if ax==0202 || ax==7a5fh
) L" }8 Q+ `/ Q4 e# \1 ?4 d  r% v
__________________________________________________________________________
  x; h8 y% Q9 }: w2 n3 N, d
) o. Z( _: E2 ~Method 10$ t* K3 z8 @, T
=========! a$ A# H0 ^* F3 m- i1 H* k' o( ?4 e

% W1 {0 ~: N2 g7 }=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with1 y" L: r! u( T( E- ]
  SoftICE while the option is enable!!
* t1 f: J0 e9 E  h! W6 G! q6 B& |3 Y+ o, d# ^2 {7 y
This trick is very efficient:) k% y5 S  C4 |1 M
by checking the Debug Registers, you can detect if SoftICE is loaded
1 B0 c8 `* O' W( |; b(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
* e6 B  d8 _4 V) ^% Q* w  I7 Othere are some memory breakpoints set (dr0 to dr3) simply by reading their/ `5 y' G/ \  C! s5 H( V+ f) @0 X- Q
value (in ring0 only). Values can be manipulated and or changed as well
5 |% b9 _. x; D! ?* Q1 G(clearing BPMs for instance)
& A3 |2 m- x3 h  b/ c) X
* {3 d% r2 m8 p__________________________________________________________________________
) k- x9 T7 }, i' }; W) }- n+ ~# N  T& o- R0 w
Method 11' C0 |. m. d; [: t. t2 D
=========+ G5 C- N2 ]3 H
5 \. v* o# u0 t2 \0 p
This method is most known as 'MeltICE' because it has been freely distributed( C9 V  w7 O& z
via www.winfiles.com. However it was first used by NuMega people to allow
- D& C; e8 S$ q) tSymbol Loader to check if SoftICE was active or not (the code is located
7 P1 j+ g# L! o2 `6 {; }inside nmtrans.dll).% A( `. o6 a. ?% J3 h% U2 @

/ @) _0 B9 m; Y4 oThe way it works is very simple:
  o. B3 B7 T! y: {7 p8 j7 UIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
( k8 o; C6 z; B: ^0 m# I3 cWinNT) with the CreateFileA API.
! u# W/ R/ X. |) Z8 O4 E& i( ^- Z6 H3 Y3 a+ g7 o
Here is a sample (checking for 'SICE'):/ |; H* w( l* |9 m' T, g  R& o: m  B
% d$ E4 C$ B7 ]1 v; ]
BOOL IsSoftIce95Loaded()* T- G( P( \8 f! [+ ?: Y
{9 y! `9 F' H  L1 A1 {, ^6 A7 I  |
   HANDLE hFile;  + L* `6 X6 T. m5 u5 |
   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,8 g& \5 I2 g; d% v( _# x
                      FILE_SHARE_READ | FILE_SHARE_WRITE,: r# B; W$ Y/ l* n
                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
) Y7 n3 Q# W% Y   if( hFile != INVALID_HANDLE_VALUE )) s/ S5 ]5 P" j0 E: t/ }
   {
1 P7 R; i7 b( d/ z6 U; D      CloseHandle(hFile);* P8 H0 L& \( w, _7 v2 S+ b5 y
      return TRUE;8 F! ~  E! k" ]
   }
9 y& t4 c& s$ T- m! z" ]+ o   return FALSE;
' h7 u3 c! X7 N; m! F# P7 T5 w1 T}
4 s# [! Q  x* m. W: B/ o# G6 X2 S( d! q
Although this trick calls the CreateFileA function, don't even expect to be
4 p; ^$ G) E' p* t3 iable to intercept it by installing a IFS hook: it will not work, no way!0 q; G/ ]  t# G% F. Q+ l2 I
In fact, after the call to CreateFileA it will get through VWIN32 0x001F: \3 L  U7 W3 b% C' i: Q; Y0 k
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)" ?7 d4 X) ^% r% r
and then browse the DDB list until it find the VxD and its DDB_Control_Proc
/ A0 T# F6 U$ L( o5 @* E4 |9 k8 ofield.1 y  t) Z# Q' R0 w8 [
In fact, its purpose is not to load/unload VxDs but only to send a ! t5 \- f+ v3 l8 _! b! \4 c: ?
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)/ Y$ j. z) g3 Y* u% S  i& i
to the VxD Control_Dispatch proc (how the hell a shareware soft could try; v% m1 E0 O: o) H( i- ]
to load/unload a non-dynamically loadable driver such as SoftICE ;-).& f( e# @7 ~, N! T# k1 D; L0 A- c
If the VxD is loaded, it will always clear eax and the Carry flag to allow
; ~; a- Q. n, L. o; bits handle to be opened and then, will be detected.
' G& F! K! f: C+ OYou can check that simply by hooking Winice.exe control proc entry point
4 r  {6 }8 o5 o1 c0 p1 _& ~! Mwhile running MeltICE.
  W* S  \9 O- m2 K0 k2 J9 v
  a$ q7 l3 Q: L
8 @: H; ]+ {# W# `1 F, A  00401067:  push      00402025    ; \\.\SICE
! ^# a3 w# n$ e' b( C) N6 M. d  0040106C:  call      CreateFileA- o6 ?9 F/ P% }& X& c
  00401071:  cmp       eax,-001
, @- ?: M5 s% X1 h) Z  d  00401074:  je        00401091
: D" d6 b, Y$ y7 ?% {: S. I
; z+ Z% S8 n9 t& i
, h1 T2 P9 h6 b9 LThere could be hundreds of BPX you could use to detect this trick.
, {9 V$ C. I' S! P. q; o! q-The most classical one is:% z3 A8 }* E. u! t7 A& n
  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||
" r7 x% h0 Y; z" Z. u8 A/ C    *(esp-&gt;4+4)=='NTIC'
, w; G: e4 p% ?7 V3 s0 w5 J( ^# P* l
8 L2 f, l% X) l0 m/ t9 D-The most exotic ones (could be very slooooow :-(
% w1 S: `1 a; z% L/ Q  P' v3 @: o   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
' X3 `4 i! o  h8 c9 G     ;will break 3 times :-(0 B% D2 J! w0 F( a: y* E) C/ _; T, ~
4 {: L8 d' k" f5 g+ u( x. P3 J4 O
-or (a bit) faster:
& V5 V7 J+ d9 `4 \9 H$ p   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
1 D. X! p6 @6 ]" c) i- t( B
, A9 {0 s' t, ]9 e+ l( x1 Q   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  
1 Q# R: v7 \% ^0 u) l/ V( F6 w* v     ;will break 3 times :-(
7 r% r; F( d- [0 |
! l5 [2 V4 O  v/ a1 \-Much faster:6 [1 f' n4 E! ?* A6 B' m
   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'4 j8 }* `6 P- K
, E( s: ]1 i: O! h
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen% e" t. e! n0 _/ @! L4 z
function to do the same job:
& y0 ?0 E4 |, O- U/ n
& B' g+ i: |% H9 r   push    00                        ; OF_READ, a7 t( r, Z  _* X' Z2 {% ]
   mov     eax,[00656634]            ; '\\.\SICE',0! P$ O# f; k& h5 l' }+ g
   push    eax
  P1 I! ^5 X8 y8 O, Z, `% f% {1 p   call    KERNEL32!_lopen
4 A# I! ?: ~- B6 v& W) ?   inc     eax1 [( ~+ q( ^6 u! d! z! V3 r
   jnz     00650589                  ; detected
  y3 n/ F# R0 d9 z1 j2 H7 H8 K   push    00                        ; OF_READ
' Z9 g" |5 X3 E4 o   mov     eax,[00656638]            ; '\\.\SICE', l5 n  D4 ^8 d/ o9 i; ]$ Y" ^. D
   push    eax
9 k3 H; a  L5 X% \   call    KERNEL32!_lopen
6 T( m$ q  h% g   inc     eax
+ _. T' D& Z% t9 S* J   jz      006505ae                  ; not detected% u3 R( Y/ K) |! c1 X" T

1 q5 f( X" r! ?4 u3 @5 a$ z& X# C
__________________________________________________________________________1 r" }: t7 I3 Y. ^/ d4 {% ?

  k( x6 l7 q5 DMethod 12& @+ n8 a7 G( i! ?
=========
' c, C4 B$ D8 T  m! F
; B# z, Q) I4 V1 }: ]& JThis trick is similar to int41h/4fh Debugger installation check (code 05& p- ?$ a3 c. o; G* J8 t$ J1 B
&amp; 06) but very limited because it's only available for Win95/98 (not NT)
) C6 N5 ?) }; D! _- c# Has it uses the VxDCall backdoor. This detection was found in Bleem Demo.% ?% U) K4 K/ s/ s5 ]/ F+ P

8 r, E' r2 D6 b! y* m# x: |- u   push  0000004fh         ; function 4fh  c, @2 Q; i) X( T" \0 I& R
   push  002a002ah         ; high word specifies which VxD (VWIN32)
+ k: f8 z1 P8 s                           ; low word specifies which service# n* x+ Y3 b/ R- L# Q
                             (VWIN32_Int41Dispatch)
7 c/ {% R% p8 t+ }# A4 H   call  Kernel32!ORD_001  ; VxdCall+ h( T7 k; L3 t7 b
   cmp   ax, 0f386h        ; magic number returned by system debuggers. a/ c! b5 b; p% r; Z3 [' K
   jz    SoftICE_detected
. A/ t* }9 h1 m: d) I2 y7 `5 E4 s! B1 I+ g* O
Here again, several ways to detect it:  I( ?: K: L* a; a( i& Z8 J" y9 k
# ?  @: X  C9 c, ~2 t8 d- v, u7 Q
    BPINT 41 if ax==4f- P. e* q/ y7 V, H1 J  \

1 V, j6 a2 |: j    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one1 E1 k2 M, y3 u" Y+ ^& Q3 w$ P

$ G' o4 f; T( ]  d! c% ]    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A
" h9 y4 `/ S: m) B5 p( _! O5 S" s1 h- [" I7 c4 u
    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!
2 s$ b+ V; d- S# S* y$ {+ D( M% o; }* E4 W0 A* M. Q2 w
__________________________________________________________________________
: t4 R" y$ b* v/ [3 }8 G+ n1 x$ X: h2 ^6 ~
Method 13/ a7 u' U, \1 h: m* A5 H9 S! v  q: B
=========
, d% h0 _4 v! H- l! _& `* i/ X8 k3 k4 j) e
Not a real method of detection, but a good way to know if SoftICE is
' W/ b. k# A$ kinstalled on a computer and to locate its installation directory.# {! h3 O) u  B( h* ~
It is used by few softs which access the following registry keys (usually #2) :7 t% B) h4 d; f& w8 O4 D+ U

- ]" Y9 o/ P: ]* L' S2 Y-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion8 g! v4 S. l' B  {% c2 [
\Uninstall\SoftICE. x5 c4 O# S) a" O0 r- f, c
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
' }0 B; f- r+ k1 @-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
: h  N; P  `5 T$ T) v* W\App Paths\Loader32.Exe0 {# b* J- p; ?/ K. x+ i  R

& v/ W% O( M: ?2 U; C
  y, P0 Q/ `% X6 M2 n; M3 _Note that some nasty apps could then erase all files from SoftICE directory
- _/ f5 X" P$ D$ \. j3 ~(I faced that once :-(
# o5 Y/ z: M# [. h  [2 [' f; X+ V/ U! U! e  e. j* m/ e; @
Useful breakpoint to detect it:$ O6 b+ `8 @' h

) }& q9 {3 E; s* n% e6 g     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'
5 u, W# P* ]# n9 \& _% X0 O& I6 \1 j# @0 H3 {* |
__________________________________________________________________________+ `. n  m9 o0 N/ a8 K
3 r+ T: l2 B$ U+ U0 u

! w- `0 i% u3 FMethod 14 / Q9 R9 Q$ s9 B& E2 Q& ?% F7 P
=========
* D0 J% G3 ^" S
. t: S3 ~& M8 F- H1 N$ RA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose% g) i7 a4 g; W
is to determines whether a debugger is running on your system (ring0 only).$ N& y+ Y5 y6 J3 \2 M# g/ o
5 i6 }) F# Z! d1 G2 ]" k
   VMMCall Test_Debug_Installed
9 {  n3 s# y/ Q4 k9 h0 K, P   je      not_installed0 a% U8 G8 k( i

4 }, G6 ]) Y) o5 N! hThis service just checks a flag.
9 i/ H. l+ J5 v  w</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

关注公众号

相关侵权、举报、投诉及建议等,请发 E-mail:admin@discuz.vip

Powered by Discuz! X5.0 © 2001-2026 Discuz! Team.|鲁ICP备19052200号-1

在本版发帖
关注公众号
QQ客服返回顶部