About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>
8 p0 z6 d( |5 F+ T6 l. l<TBODY>
/ F6 W0 k5 ?% `$ F. I$ f" b<TR>7 }: }1 a& t7 ]) }5 i( U  R
<TD><PRE>Method 01 ( w% N  O9 p! j5 Y8 v6 F# o6 F
=========
; q5 ]( p0 w8 M  \+ X9 p) [1 E4 Z4 c/ b$ j, ~7 m0 x2 K
This method of detection of SoftICE (as well as the following one) is
1 a$ M4 A7 n, ^used by the majority of packers/encryptors found on Internet.
- r5 O7 P4 l9 M' s% D1 wIt seeks the signature of BoundsChecker in SoftICE
( s" m7 H# K4 u
+ Q( e+ l7 g" {: c6 ~    mov     ebp, 04243484Bh        ; 'BCHK'2 ?' Z% J* N7 w2 A
    mov     ax, 04h
) ^4 V" N7 g5 H  P- D1 g( H. L! Z    int     3       * l8 K  D4 A; K5 U' e
    cmp     al,4  w0 a$ [- h7 {
    jnz     SoftICE_Detected
4 E2 P. H( T- x# A) m2 Q0 W" y
9 f, H; T6 V3 K. m, d# Q9 p# z9 y& x5 g___________________________________________________________________________, z  j8 L5 B( y7 i% d( h/ {# ~; q7 O

) n* z) [& e" O. t, F( RMethod 02
; i8 R$ D4 r) r. H9 G* w=========
% u1 [, |9 r& c3 r1 [- e& S! f. _- R+ y/ \! ]* B: A% i
Still a method very much used (perhaps the most frequent one).  It is used/ w6 U) E' n$ Z2 ?( p
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,
: O% K* R2 Y. u/ ^or execute SoftICE commands...2 k" A" ]+ Y2 h. K8 J
It is also used to crash SoftICE and to force it to execute any commands. _( L) d, v9 J; \6 t) s
(HBOOT...) :-((  
: s1 \  ^3 Z1 ^" a* @( u
. n% G  p8 x1 w, T6 @9 E) }3 H" DHere is a quick description:
) M( [. F$ |% S# m! }/ P2 D* f-AX = 0910h   (Display string in SIce windows)
# E/ q: V5 D5 C" p6 O' F- y- |; m-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx); W7 }3 Y' O; ~2 h- U
-AX = 0912h   (Get breakpoint infos)
" P2 A3 D% N$ B  t4 E* C& m-AX = 0913h   (Set Sice breakpoints)
6 q( M* ]( x" h( Z: Z1 M-AX = 0914h   (Remove SIce breakoints)
! ]- n" x; w) s% o) X' N3 I7 h' Y, k
Each time you'll meet this trick, you'll see:, B" ?6 a6 E4 s
-SI = 4647h$ n1 [$ v& z5 k  X/ k  X, v* Z
-DI = 4A4Dh
6 `! ^; ]" \& K* F9 o  yWhich are the 'magic values' used by SoftIce.
; V/ `. l4 y" Q/ N" p/ u' I$ k. N) FFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.
* f# S1 R/ J! S6 L
! a2 r" y: a- s" ~; e" VHere is one example from the file "Haspinst.exe" which is the dongle HASP
: c8 f5 t& p, |- Z2 sEnvelope utility use to protect DOS applications:
+ T4 f4 r& h0 H# `( V$ X2 i
* I# T* t  J- ?1 T: ~  _
+ k' O8 T( c( H' A+ B4C19:0095   MOV    AX,0911  ; execute command.! O* u# A6 h/ O5 _9 @% L+ e+ P
4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).; w0 A5 }4 P. j3 \: c2 r
4C19:009A   MOV    SI,4647  ; 1st magic value.4 ?$ h; d1 y4 Y8 Z
4C19:009D   MOV    DI,4A4D  ; 2nd magic value.
, Q( }8 L5 f" B* @7 g4 S" w4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
8 G6 \; N; b+ X& H4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute
/ A& L/ K9 y* d. F$ Y4C19:00A4   INC    CX) K4 v$ I4 p# }2 O0 R9 u$ C
4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute% A. [1 A+ }3 q$ C
4C19:00A8   JB     0095     ; 6 different commands.
$ u9 P2 F) a$ h! a4C19:00AA   JMP    0002     ; Bad_Guy jmp back.
5 w: e. |( U; V6 [! e2 D2 l( g4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)
3 {  c0 w; f) n+ r$ d6 m) x6 v- G  p4 T& l& H/ u) _2 U
The program will execute 6 different SIce commands located at ds:dx, which
7 u6 B+ [3 c) v5 `* }6 |are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.! o& y( ?) h. x0 ^3 z. _$ Z

& M, a4 n8 D3 I1 M: w, z* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.7 c* n! C! t; W' E
___________________________________________________________________________, m( u- M5 R( x* X6 B/ R4 {

  R/ ~% q3 S2 g2 n0 Y$ a1 n9 a2 e
Method 03
+ s, F, q1 {1 V=========; k& C/ ~. p! Y: n0 {! j- q
/ I' R$ w( `- q* q
Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
( a8 S6 |, W0 f* H$ c(API Get entry point)/ I9 v5 |6 k+ ^. n) Y; G0 p
        
5 A1 i& ?/ V& f% H2 W! h* F6 J' c$ D, }
    xor     di,di
3 a7 P/ p0 c5 B+ y( G# [    mov     es,di$ P1 Y  D6 ]8 z- S; h* |6 o; d( H
    mov     ax, 1684h       3 c6 l: K- Z! d/ d
    mov     bx, 0202h       ; VxD ID of winice, c$ n* i7 z* ^. O
    int     2Fh
# V$ U- d' a* Y' G. G" W# C- S5 d, s4 V0 c/ l    mov     ax, es          ; ES:DI -&gt; VxD API entry point/ ?6 V( |" S$ _% Z
    add     ax, di
# G; F/ _/ F! p. y% g    test    ax,ax
6 F, j! m1 O# z    jnz     SoftICE_Detected
+ r* C2 M+ F, X# G1 n% v. `; T1 l( B' P  [
___________________________________________________________________________
+ V- E5 H) m4 J4 i
# k9 k* o' k7 E! {' U) i' kMethod 04
& g' G1 e+ ?' |! Z7 A6 \=========
0 d' [7 Q) @4 D
; Z/ _8 u9 x( l6 G7 j$ {Method identical to the preceding one except that it seeks the ID of SoftICE+ A/ ?7 r3 `  H" q' k" i4 `
GFX VxD.
/ \; c' P9 C: w1 X
* T/ y- T9 \8 u3 D    xor     di,di( G* m$ l: _6 V. U2 D
    mov     es,di
, K1 z3 u, W- Q1 @9 U* {: g    mov     ax, 1684h      
: y- V- A1 e2 N    mov     bx, 7a5Fh       ; VxD ID of SIWVID
) y4 C7 v' H( o% R    int     2fh3 n+ f! I* f8 E5 [( {2 e
    mov     ax, es          ; ES:DI -&gt; VxD API entry point5 ?, g9 w: X9 }, ?# q) O$ f
    add     ax, di
( x1 n. A, U& g4 g* ^    test    ax,ax! K7 f; @: X0 p9 ~: i/ Y8 D* l# z& }9 M
    jnz     SoftICE_Detected
& o1 {/ L) `+ \' @+ T2 g, `3 g$ i: m: ^) ]7 q& o% Z' s
__________________________________________________________________________
8 {! Z/ }6 e4 ]; G5 F3 l6 L# l1 M0 M$ ]1 S( `$ ~- D

  t4 n+ M" y6 e  S- w+ n6 ?  f& DMethod 05
8 w5 |: M5 u( s$ W/ h* O- p=========  b. @+ n/ H2 l7 _

' j( s6 q, o5 s3 Y! u  h/ PMethod seeking the 'magic number' 0F386h returned (in ax) by all system
# y1 |' b: a, `4 U+ ddebugger. It calls the int 41h, function 4Fh.7 [  [; E& c0 R4 c# m
There are several alternatives.  5 i+ ~3 o0 _& b+ q2 L. U5 b5 z, |
) B% P. u, h* d( n) P3 |8 h
The following one is the simplest:
4 T' ~# L- e9 j1 M' G4 S) `. V- W; |) ~: U* h  C+ N
    mov     ax,4fh
) _. V6 b: |9 x$ ^% v+ b# A; ]    int     41h% ?( e& A" A! O- D  A
    cmp     ax, 0F3864 d; Q3 Z! G* b7 K* I8 m
    jz      SoftICE_detected
+ a( k) d. _: V
. x5 {/ j& X0 O- y+ u6 r& n4 X6 X, l# l  y  j& ]
Next method as well as the following one are 2 examples from Stone's
  h+ P$ z, \. X3 N, J5 E"stn-wid.zip" (www.cracking.net):
9 T$ [" D0 H3 v' v, m" K$ u
- V' r% f! f* ^5 k  Q; \/ r    mov     bx, cs( g2 n" H0 ?: d# J' \/ y) b
    lea     dx, int41handler2: P. _" w* H% [6 b2 Y! F$ ^* l
    xchg    dx, es:[41h*4]
! o5 y6 g/ O3 r5 e1 T& q    xchg    bx, es:[41h*4+2]
+ Z  `4 A3 T$ J    mov     ax,4fh9 Z9 p  M" b! a3 G$ ~
    int     41h
- \8 G3 }" c$ k9 U" R) L- \    xchg    dx, es:[41h*4]
" Y, {( Z4 e; Z    xchg    bx, es:[41h*4+2]
6 f/ s1 D% S) e' E+ n- @: x* c    cmp     ax, 0f386h
  f% g/ Q2 x8 B' y* J2 U3 k; [3 C) T    jz      SoftICE_detected
5 b1 b  q- K1 E) X' f4 S: k' X9 I' ?) P/ B9 {
int41handler2 PROC) b0 m* Y/ t. V; Q4 t4 x
    iret
7 V! }# x5 Z+ `* U( ?: ^3 }6 `& _int41handler2 ENDP( F" K) K! C  u% W( c

# R  i- @2 D- Y/ P* @7 V1 \# i6 @9 m% z: Q( m5 L5 V* W
_________________________________________________________________________
  {) X) a: ?5 G# q/ a5 }, j" \8 J
. j" Y+ U; o5 {. B6 k) v% Y% e' D+ V+ r. @' ?7 f# A1 V
Method 068 k/ c  U1 v! x1 Q8 x+ R6 j) ^8 Q
=========
  w4 ]: R/ {: I* D+ s
, f" u9 Y3 E3 o6 H' D7 A  }" V0 S; q2 X% o' L) @# P# l
2nd method similar to the preceding one but more difficult to detect:+ w: p% Z6 |4 o! G' u6 Q
* z( _. W4 y- |

. M' e+ u3 z! R4 lint41handler PROC" n6 C0 i2 p. J2 e4 S$ y
    mov     cl,al" q: _, u7 C6 A3 o& u% b( b' \
    iret
4 [0 y. P8 O6 F/ oint41handler ENDP+ D1 P3 I& s3 y/ c* h! O

& q0 C* t$ ]- H7 r2 y- o2 K9 U. J& D% _# v+ c7 M9 z% D: S1 S
    xor     ax,ax
7 j: ^! m, ~/ z2 B    mov     es,ax
$ A1 h$ J& D8 a# y* W% V    mov     bx, cs3 y, I+ g/ r/ I5 h# p
    lea     dx, int41handler
2 v( b, W2 Z- J7 s( o/ n* Z    xchg    dx, es:[41h*4]
% I: U# s) ]$ s6 X9 u, ^9 W    xchg    bx, es:[41h*4+2]* K3 q5 C8 A% U6 T% Y0 ]7 H2 o0 B
    in      al, 40h
; k. K4 J+ Q  J$ A/ V1 p0 D    xor     cx,cx
: S- J9 N4 d/ b, A7 a    int     41h
# M7 k+ `3 G% s    xchg    dx, es:[41h*4]
7 X  u8 O' W0 v    xchg    bx, es:[41h*4+2]7 S& O3 l1 U( c- A5 W0 Z, z
    cmp     cl,al
. {) ^5 U- S- H3 _    jnz     SoftICE_detected
3 H8 Z6 K9 I" I* R& {/ C. R- N4 U0 x1 h& y/ Q6 E) _0 L4 b" E7 A
_________________________________________________________________________: C# @. ^! e" J/ `& U0 p

, y1 N* I; c( d! V7 KMethod 07
# ]  i1 X# F/ J( G# j4 D8 q=========
8 s6 N. X+ T& C: w0 ^! g
  Q- M' K+ B) o) x# z% ?Method of detection of the WinICE handler in the int68h (V86)# J0 T3 u0 Q. R" \% w3 }

, j# L6 _7 Z5 N( [6 a    mov     ah,43h
3 E" Q* [- X+ U! @    int     68h
$ X/ m" b: D& F6 d+ e$ n$ p    cmp     ax,0F386h
7 H: I: F8 c, n0 v( @' O    jz      SoftICE_Detected
$ G5 |$ `+ M, D3 l0 i# \% N
. I1 h) X1 y# `, G5 H
9 `- @5 k$ @: e& l1 v=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit$ N4 @- p4 t3 n( I
   app like this:
3 |4 {4 i6 T* l+ n8 U( j6 Y2 a
( X- {! A' u* h, E   BPX exec_int if ax==68
: |; C; f( ]% q- a/ O   (function called is located at byte ptr [ebp+1Dh] and client eip is
' q" H0 ~- o# `& s  ?   located at [ebp+48h] for 32Bit apps)
2 H  u/ p9 F. |/ O* x' [__________________________________________________________________________) c! ?5 G3 `! l: u+ x
5 d5 f  M+ g( w. R9 K9 I
& K$ H: f" u/ o9 [$ i) n
Method 08+ }, q6 q* j2 z
=========
7 l; Z! k% {6 k
& [# }" h% i7 ~1 G8 a9 fIt is not a method of detection of SoftICE but a possibility to crash the
7 }$ y  U9 a" m' ~! y- O+ W+ h# x7 Asystem by intercepting int 01h and int 03h and redirecting them to another0 u. N: D' C7 u* D" S( w' s
routine.6 x' m: b4 A9 Z0 U7 l. ^
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
/ U" h8 d  U1 Y+ \, m$ H) Wto the new routine to execute (hangs computer...)" y6 D; X( p9 ^5 V6 B
+ I" i' b' v( h  V
    mov     ah, 25h2 R  e2 A8 E  B5 F9 l
    mov     al, Int_Number (01h or 03h)
( ^6 b9 E8 w& a( X3 w/ _( ^    mov     dx, offset New_Int_Routine
- t3 @& p& h+ {6 `    int     21h' \  P7 E! E# N, K, G* d! A
) t& S5 j8 u) [* [( M1 ?' G9 q
__________________________________________________________________________
0 c& [+ a; o* h5 u0 \: }, B8 I
Method 093 L. |5 N- [2 r, s4 k; ]! w
=========
7 i2 i0 t9 y& j2 D7 Y6 D( Z, a$ F  M0 m' m2 k
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only$ S6 D" O& ^& g' ]: M* z+ g5 R
performed in ring0 (VxD or a ring3 app using the VxdCall).
3 N7 X$ [9 A# k9 c; E: g* p8 ?The Get_DDB service is used to determine whether or not a VxD is installed2 p+ @- {% y! w7 D( ~! B% P
for the specified device and returns a Device Description Block (in ecx) for
, p1 `* X: J# R: othat device if it is installed.( P5 {- [2 V! d7 b: t( a

  Z, Y% i* f! t6 }8 O2 V   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID
! N8 ~! s9 r# a) U   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
+ t. L/ [4 J/ f5 H, q9 g9 @   VMMCall Get_DDB
# A8 U2 L1 K8 B* N: B( c9 V   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed& y! N" L9 F! c0 }! G+ _

  U! o- o8 x- W5 n6 K; UNote as well that you can easily detect this method with SoftICE:
2 F* ~! `9 ~  h) i' k   bpx Get_DDB if ax==0202 || ax==7a5fh  T  h7 I2 L0 ^9 K$ ~! U

; ~; q1 C& J6 Z. _5 S__________________________________________________________________________5 k2 F3 `- o. d) S5 q5 P/ A; x

" t4 C" k/ t" _6 O3 H+ }Method 10
' I2 H$ Y/ e0 X' v4 ?=========
9 N8 Y7 W" Q* G% k  I. ^' f% ~4 I- \4 j
=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with
1 D, b1 z; \1 w" F2 ]3 N5 z  SoftICE while the option is enable!!) Z' x# E0 Z7 i$ a! c" ~' h1 S

: b/ ?7 c* C* _. n6 {7 z; SThis trick is very efficient:
$ s9 L0 Y- b! D& U& _by checking the Debug Registers, you can detect if SoftICE is loaded/ a/ Q! i* _; a% p/ e  d7 M- Q2 _
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if+ `0 j6 Z$ S: G$ A. F% x+ O
there are some memory breakpoints set (dr0 to dr3) simply by reading their3 x  B- p  L7 s7 v; ^
value (in ring0 only). Values can be manipulated and or changed as well
2 t! ]& w7 A  D2 ]8 @; y: Z(clearing BPMs for instance): S% _  u  R! ^4 c

; s  f: M# H6 {5 Y: I9 Q1 M__________________________________________________________________________
- _: F2 M/ F; s
* t: j* k& X: l& lMethod 11
6 a$ T( X$ N' w3 _- H=========1 l: q, F1 T/ X

: j: Y, }7 U* ?! y8 kThis method is most known as 'MeltICE' because it has been freely distributed/ |( h+ C1 N+ y7 c9 p" p$ G
via www.winfiles.com. However it was first used by NuMega people to allow6 y- l% q7 K1 m8 z% d
Symbol Loader to check if SoftICE was active or not (the code is located
  Y3 \, Z: z* V4 I$ I1 Y4 w* `inside nmtrans.dll)." R$ {4 x# ]$ a, ?
' `1 `9 S9 {1 L; U; T3 B
The way it works is very simple:
3 k4 W* u$ t, }9 ^! SIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for4 }5 G# o, t: K3 ~; F; f1 k# u
WinNT) with the CreateFileA API.
" r( }* I1 i, ~- }6 ~. p4 p$ t% w+ l1 G# `
Here is a sample (checking for 'SICE'):
" U3 D; f( C' s8 O0 a. b, Z* p/ X* O8 M3 I, O
BOOL IsSoftIce95Loaded()
+ d  D6 C9 E! V7 Q4 s0 U7 _/ t  ?{
9 z3 ]* l; R. l  X& [$ u: J0 ?   HANDLE hFile;  , Y8 K% l1 ?5 U3 c% L& W
   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,  p+ O8 K; I2 V+ p" J. H6 ^
                      FILE_SHARE_READ | FILE_SHARE_WRITE,
! s; X8 L2 B: E: }& G4 W4 ?                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);; U8 b- B) `5 A
   if( hFile != INVALID_HANDLE_VALUE )
6 z6 T) R$ d7 D; S) R' x( ?   {; S% I! V$ L' t- C  f- {
      CloseHandle(hFile);* g7 D5 i, {1 ?' ]" _* ~+ }
      return TRUE;# H5 g4 c& V9 }4 F5 o3 V* p
   }
: d) `" C  V; T/ B& ~. Z+ j   return FALSE;
( u) V- G$ S6 r& J- d' Z}
3 v* f9 X+ t+ X# |; u# ~
: h) m1 z7 V; B- n3 \Although this trick calls the CreateFileA function, don't even expect to be
2 b" ~( o/ `, y+ p4 t( iable to intercept it by installing a IFS hook: it will not work, no way!! }% N8 W, e" N% B; P
In fact, after the call to CreateFileA it will get through VWIN32 0x001F+ `* V' J5 e% P: y2 |
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)8 Y: Q& @: W3 T6 N  T
and then browse the DDB list until it find the VxD and its DDB_Control_Proc
9 Y6 b6 v. l1 [! I  gfield.4 o7 k0 s3 {& V5 c  N
In fact, its purpose is not to load/unload VxDs but only to send a
: ]: ~+ ?  D! {3 y4 |( W- \' ]W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
  i7 N4 S" T8 g2 B/ q* z5 D8 R& _to the VxD Control_Dispatch proc (how the hell a shareware soft could try3 J1 ]: E: N) f  Q
to load/unload a non-dynamically loadable driver such as SoftICE ;-).7 g) [) U" y: w, z( B* P+ T9 O3 a
If the VxD is loaded, it will always clear eax and the Carry flag to allow5 G6 O9 d2 W7 Q& O
its handle to be opened and then, will be detected.- C* }7 d  j9 \% S# e0 H5 \1 k# e$ H
You can check that simply by hooking Winice.exe control proc entry point: g0 t! {0 T1 {5 p
while running MeltICE.
- t) @: _0 a7 ]3 k& h; m7 |9 k% T) h

9 X7 p* a5 k1 F4 {4 R. [1 ~9 \  J  00401067:  push      00402025    ; \\.\SICE% t$ t- c4 r* ?& O& e/ Z
  0040106C:  call      CreateFileA
9 q2 E1 E$ B6 w0 O$ q  00401071:  cmp       eax,-001
3 ?0 }6 Q% i5 u/ Q  00401074:  je        00401091
2 `+ b7 O" _0 T0 z4 @! ~6 u
! v$ U: g  K8 t2 n& M
1 F* o! f0 S+ OThere could be hundreds of BPX you could use to detect this trick.
. f* g+ L2 z; e2 _& [-The most classical one is:0 I. e6 f4 M$ x4 S5 o( |5 ]/ v
  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||# W: l# G* `0 |" H* \' K* X$ v
    *(esp-&gt;4+4)=='NTIC'
2 F- b! H( }. |
/ `$ o" z) H, O8 b9 E1 J-The most exotic ones (could be very slooooow :-(
5 w8 w9 o- ?6 @; q   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
. ]; T+ ^. H/ ?0 F* k     ;will break 3 times :-(
- V' \; u( u' ~+ y
9 A. ^+ ^6 t$ F4 F/ I3 i2 M-or (a bit) faster:
5 n" {. K) Q+ ^( v% d6 r0 `   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')1 |4 r0 S, I9 E, Z0 K. O; {* ]

4 ?2 d! w, W- Z! A% ]   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  & _1 \# c% U' u6 N& U! H+ P
     ;will break 3 times :-(
9 y7 p8 m. D$ i/ _" E- v& z. A1 `1 u0 G
1 d% Z% D; @$ C# w" R5 ~-Much faster:* c+ K: h3 N4 N' I( V$ M) l
   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'
6 d0 M4 L- p4 S/ {" c$ ?9 r0 v( e; A) M' w" `  y
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
) c, ]( L# r% J) K2 I4 t: D. kfunction to do the same job:
1 w9 i2 U# Z5 f
7 {7 v. P% {; n; I   push    00                        ; OF_READ  F$ w- Y6 e' L& |2 S
   mov     eax,[00656634]            ; '\\.\SICE',0
1 I: A6 ]" z4 @   push    eax
1 ]& |6 W0 h0 F4 {   call    KERNEL32!_lopen
* v4 h5 L9 L- \8 z: J   inc     eax4 s. t; E4 A3 R8 y' j4 d3 v
   jnz     00650589                  ; detected1 C% _- ~0 m) z3 v* Q7 N: |! J
   push    00                        ; OF_READ- ?+ m/ G" D, Z- s- t* z$ c, f( c
   mov     eax,[00656638]            ; '\\.\SICE'
) l' H2 n, x# Z/ `* u( Q5 r- F   push    eax
3 C$ ]5 q* N0 m4 W- x" ]   call    KERNEL32!_lopen
: P1 i& x, i1 D* s$ Q" F, Y   inc     eax7 e. _5 e# W. t, I( E' _2 B
   jz      006505ae                  ; not detected
* Q: x  n" u5 c5 V- b6 i9 E8 C+ c' n% S
0 A1 `  D* s) k% ?$ N" Y9 E! I- X9 T/ v9 Q# M& O3 p. D
__________________________________________________________________________- d3 P/ G8 T- X% X6 p0 P3 T
2 R& v& j3 z/ I6 o3 S1 `+ s/ |
Method 12- p/ d. R. f/ n5 M2 V9 O4 c1 A
=========
+ A% N# b- R4 }' E" k( C  J
  C7 ~5 c3 J6 n& `3 YThis trick is similar to int41h/4fh Debugger installation check (code 05
  o4 }5 X% u, Y& `+ ~, s. A&amp; 06) but very limited because it's only available for Win95/98 (not NT)
- b2 Y' J9 W" \  I" ]as it uses the VxDCall backdoor. This detection was found in Bleem Demo.% N6 y0 T3 L* g/ E

' B2 X" ~5 d1 f+ \6 U& S5 X   push  0000004fh         ; function 4fh
9 V/ Q& [9 k. e1 N( [   push  002a002ah         ; high word specifies which VxD (VWIN32)
+ S  p! u1 V8 r. u/ H% e( E1 u                           ; low word specifies which service' A8 w4 d8 U4 M3 w  A% A. H! q
                             (VWIN32_Int41Dispatch)
4 A- k+ j, a, R7 s0 k3 x4 G   call  Kernel32!ORD_001  ; VxdCall
- r- X# h# t6 y+ @! G8 M   cmp   ax, 0f386h        ; magic number returned by system debuggers
' W- ?0 R3 }3 S$ E5 z   jz    SoftICE_detected; Q0 i1 x( G+ S8 x

6 `! c/ v& J# k8 S1 r# yHere again, several ways to detect it:
$ L! d+ c! k' e$ y* W: S8 s8 W2 v+ d& ^# l4 h2 N" X* f
    BPINT 41 if ax==4f
! Y# H# _1 S* J0 {5 ^
1 r+ a) O9 B  @) o2 m! X, r    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one) I$ e! K* v5 E2 U6 v

2 x4 d% @; I! f2 E    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A
9 |0 |, e( x) R; Z- Q
0 l+ l' P& n, K$ b# Z) T- I    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!. R8 W0 B( o+ `. ]% T
" u3 e% y' W5 b! q; Q. p% m
__________________________________________________________________________
8 r% D* i8 S3 m3 `9 E+ P: L, C
Method 131 b: Q! ?0 V9 E% `! W) r
=========1 }7 b* ~# o# c/ z

' g$ E) A/ u( J* {- A; R; }' R  vNot a real method of detection, but a good way to know if SoftICE is
! L+ R% y# }; Einstalled on a computer and to locate its installation directory.
3 Z5 e5 M* d6 X+ D: e2 i4 nIt is used by few softs which access the following registry keys (usually #2) :, S% _) @- K3 F! f  N
9 i8 m2 X5 j* ~1 z4 a
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
3 L/ \4 H; p( U! U7 C\Uninstall\SoftICE
( g9 r0 E1 b' W% h/ U6 x6 I/ }-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE9 q: z: o, H: i1 Q
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion$ ?9 l* J  p1 d6 L
\App Paths\Loader32.Exe
$ ?, n. ^# {; @9 Q( H) i9 H
) U; r$ y0 z9 N3 H
9 U& t, |4 f: F5 R3 R& \Note that some nasty apps could then erase all files from SoftICE directory8 C9 `2 |* c$ E5 ~# N: H9 W
(I faced that once :-() w, z" ?8 N/ J7 |! i2 s0 v

6 g8 ]3 D) T/ c4 ~Useful breakpoint to detect it:
# Y. }* |/ J( d; X/ R! }9 [( c
3 ^9 S5 K# H$ [     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'1 O+ p% m* p! u& q1 f! F

5 K. g" |( b( {/ q1 m* E0 y__________________________________________________________________________& ]: F- s3 q( R
3 G1 R( g( x- G9 c; _6 t6 E

& v# ^+ I0 g% H3 X9 E7 I$ t' vMethod 14 % ^' k* a1 P( z  M0 w4 F
=========* C& x: N  G9 E

5 l2 X1 Z- `9 M; T* b8 c2 c0 AA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose" A4 B% H$ L. [( a
is to determines whether a debugger is running on your system (ring0 only).) p1 [  V8 Y% z# C

3 q' z. w5 e3 O' |# f& e   VMMCall Test_Debug_Installed
" w. n( p: Q8 p5 ~; }4 s   je      not_installed; \: E% J$ n9 G' w+ t# L
* y3 S9 D; @5 |* P' K- w& {7 w
This service just checks a flag.2 o. B! \7 p  i
</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

关注公众号

相关侵权、举报、投诉及建议等,请发 E-mail:admin@discuz.vip

Powered by Discuz! X5.0 © 2001-2026 Discuz! Team.|鲁ICP备19052200号-1

在本版发帖
关注公众号
QQ客服返回顶部