找回密码
 注册

QQ登录

只需一步,快速开始

About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>4 A9 G) T* x1 \  b8 p8 C
<TBODY>
/ r2 B* i% u; m/ a% z( l<TR>
  o' u/ x4 h- M; A- b<TD><PRE>Method 01 2 a6 ^+ R9 b' q1 k+ _
=========
; ^9 Q5 c. v# i2 }; n, U/ D6 `
( q1 c8 B: |+ BThis method of detection of SoftICE (as well as the following one) is  l! H% C4 u% d3 o/ u. F
used by the majority of packers/encryptors found on Internet." |! j# k9 G* n5 l
It seeks the signature of BoundsChecker in SoftICE
* ~6 f+ f$ @  N' U1 Y" L- e8 b4 m6 {) j$ z% v2 U
    mov     ebp, 04243484Bh        ; 'BCHK'
8 }& ^% y* p6 T5 q# D5 S    mov     ax, 04h# V" v6 {, i6 t/ c
    int     3       5 _5 X' [. @: O& ?: I) s1 `- C8 h
    cmp     al,4) W( v+ N0 Z$ K' `7 I
    jnz     SoftICE_Detected
8 l% A( P3 [" l7 S, |4 b$ V0 O  x- v: @. h- Y4 e6 t  D6 Y9 A
___________________________________________________________________________; f4 P! B- [! @8 V' H

+ R% O! z' T* {( h( kMethod 025 U9 B4 x5 b4 [6 d, b  N
=========" o0 e, k; K" |$ i

. h, {2 z$ G# O; ^) I! ]% XStill a method very much used (perhaps the most frequent one).  It is used: O7 `/ g! e0 v
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,1 D9 Y7 r/ B8 u: ~
or execute SoftICE commands...
' f! h1 q9 @. h& f5 }# b2 q4 WIt is also used to crash SoftICE and to force it to execute any commands3 t' I' L; j; U3 ?" a2 F
(HBOOT...) :-((  
% F2 T$ U6 f: t9 e: {: R+ \1 @: f$ d* k; {9 b4 j
Here is a quick description:: Y) f" V/ l( z" y( j2 l
-AX = 0910h   (Display string in SIce windows)
4 ~$ c" ~$ z; O7 |+ @3 ^-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)
8 a# Q$ c( n" H8 I+ A& G9 C-AX = 0912h   (Get breakpoint infos): G0 o2 @& K2 W$ H& N
-AX = 0913h   (Set Sice breakpoints)
& |* H; X. U7 G& B6 r-AX = 0914h   (Remove SIce breakoints)7 c5 M1 \# j" `9 f4 q. u; H

8 B" t+ k; R& g# U) A4 tEach time you'll meet this trick, you'll see:( Y3 s" n* {3 x' N; D
-SI = 4647h
8 h$ n, {- q. H-DI = 4A4Dh+ R3 i8 K$ x5 E- y1 X! O( k: ^
Which are the 'magic values' used by SoftIce.
) b- K3 a/ K& Y' l( J* J5 Y7 @For more informations, see "Ralf Brown Interrupt list" chapter int 03h.
$ O( E9 G! C- T. I8 p9 {4 T; B) B% |* k: {5 P, m! S+ N* Z
Here is one example from the file "Haspinst.exe" which is the dongle HASP$ R& p7 N) T+ z' e
Envelope utility use to protect DOS applications:( v5 T( ^2 r0 {, B- P" ^6 a1 \/ y
% T5 V7 b  _1 }2 O9 Z/ z
  h0 q. {+ S; c+ _$ _3 [8 o
4C19:0095   MOV    AX,0911  ; execute command.% r6 a" h3 M' k- |. p1 D" `
4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).
; l+ x5 g( }' n: _4C19:009A   MOV    SI,4647  ; 1st magic value.
# c: X$ ?7 a# \6 Y- f5 d4C19:009D   MOV    DI,4A4D  ; 2nd magic value.% w# g! z2 @" c; @3 Y
4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)! G( L. |) Q  p: p
4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute3 Y# U, ]" s7 r
4C19:00A4   INC    CX
+ Q, Z2 q/ n4 j- w2 y$ G4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute
2 }  ]4 r6 J1 a" Z, _& ?5 z! o4C19:00A8   JB     0095     ; 6 different commands.
- T: r6 a# y+ [: e4C19:00AA   JMP    0002     ; Bad_Guy jmp back.  {4 }5 a- Y% l  ]' m: S
4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)
0 \+ J" @" r8 Z0 c% Y* D+ M4 {% H) S$ P
The program will execute 6 different SIce commands located at ds:dx, which! |) n; q/ e7 [1 S$ Y9 Q! L, W' e
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
8 C* o* H6 M1 V3 Q6 L# P8 [0 `4 ~) x5 V' Q& L$ o; F0 ^
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.3 Z9 H# B0 B4 S3 y0 K/ V. P
___________________________________________________________________________) m& j0 g( V9 E
( s9 {* l* ]) ~/ [# j2 s' {

% `0 G  ]% v& w( CMethod 03
& z1 I7 A5 Z7 m' }/ u=========2 T4 o9 J! m/ N4 l+ y5 R

2 w) X. o) G" c) ~6 ILess used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h( D% o9 ^5 k6 Y3 N  Y
(API Get entry point)
( W* U4 S+ \  T) c0 K; O        ! e8 k9 w' O$ r
% A% J$ u1 P/ j; B
    xor     di,di
( E) Y/ I5 S! ?4 A# D    mov     es,di
5 I6 ?" E8 g  e& ~  N8 k    mov     ax, 1684h       ) s1 }. H- r/ Z
    mov     bx, 0202h       ; VxD ID of winice
3 w! K& a- h7 I+ ]- F, r' ]    int     2Fh
8 I+ j( k$ \# [. D    mov     ax, es          ; ES:DI -&gt; VxD API entry point; n' J) S- F! D- a1 B2 S& l
    add     ax, di
! v4 D3 F' y# q* n0 n    test    ax,ax
7 I1 S5 b! s- S- F/ O, l    jnz     SoftICE_Detected) U, B2 b* T$ V! {. f* f

" e! m* M" K5 W; I- [___________________________________________________________________________* Z- k* f' F6 f
4 T8 V3 b( T# b$ f
Method 04
" D* p, U% a* W( L5 z; r=========
( d' U7 U) G5 |
1 v, u+ Y8 N  A  C+ i+ {  v4 G2 eMethod identical to the preceding one except that it seeks the ID of SoftICE1 S: f, ?* M+ X1 i# s7 F
GFX VxD.. Z  r& \  ^6 y8 i8 P  G
! r) g2 q! e" r3 k7 r& T
    xor     di,di& C; e2 \) h8 x, @1 Y
    mov     es,di
/ k% O) Y! T* j3 L2 Y8 F+ m& B    mov     ax, 1684h       + y( v- f8 ?, a  ?9 X1 m, h0 i" @
    mov     bx, 7a5Fh       ; VxD ID of SIWVID/ f; `; @- E3 i' `# Z
    int     2fh
! N9 v% X; w$ J6 }: I" o! @    mov     ax, es          ; ES:DI -&gt; VxD API entry point5 F4 p9 ?5 v# a, ~$ A; N% E
    add     ax, di  z: W0 v3 L) }! F1 d' Y9 v
    test    ax,ax; Z& |. y9 ]( J/ B" D7 B
    jnz     SoftICE_Detected
0 }! a5 V. d: B9 c" C4 t
$ R8 i0 H3 [. ?- H: {__________________________________________________________________________/ t; L& b# J9 T

) F3 @# i' G" ^$ x: _) Z6 h+ _6 s" R4 m8 s& V! b
Method 05
0 J0 |& m  f; B0 g6 W; ^=========
9 g& t# P+ w1 w% k% ^* U
! o( y$ e9 U( R: AMethod seeking the 'magic number' 0F386h returned (in ax) by all system2 V5 l, I5 }7 o4 X) E
debugger. It calls the int 41h, function 4Fh.
% W2 d# Y9 m$ E! L2 sThere are several alternatives.  
$ U0 v) G2 o$ Q- D6 v  C1 i) O0 N1 ^
The following one is the simplest:3 r' q9 {6 b1 `$ C9 ^, r

, D) E: T" ]/ a: F' k# }    mov     ax,4fh
' M( M8 [( Y2 p. Y; o4 \    int     41h
/ Z- c+ `7 M) v/ W+ k% _    cmp     ax, 0F386
- T' }: V6 _- w9 a+ A/ g  o    jz      SoftICE_detected' q' }3 Z3 D: j
* j  _, h1 Q/ q. u8 g( S5 m+ j) D

+ O3 S9 n9 n' j7 v1 @8 p# K1 J1 GNext method as well as the following one are 2 examples from Stone's $ V' f1 j7 s" ~2 H" p
"stn-wid.zip" (www.cracking.net):
( ~: M  u0 }! g8 M$ w0 P8 @
1 u9 j, ~- Q$ o, k; U( h    mov     bx, cs
! c  |$ p7 d# c, n* @6 c    lea     dx, int41handler2: h* `, G1 b7 Y3 ?$ F7 d/ @+ ?9 A" z
    xchg    dx, es:[41h*4]# Z4 @7 \9 V& ?+ ]# d( P# n
    xchg    bx, es:[41h*4+2]
# N! ~% o$ B7 ~3 n: r    mov     ax,4fh
8 _1 p# j! p3 W7 p, G, H' y+ b' A    int     41h
2 \# k9 D! N& |1 l9 c. p    xchg    dx, es:[41h*4]
  F, {! |4 d/ @0 ^5 X  G/ L! v    xchg    bx, es:[41h*4+2]0 O  }' Z$ T4 G
    cmp     ax, 0f386h* S9 M) R0 m9 d  \+ ]
    jz      SoftICE_detected: W4 _" }* ^  s9 k

! Z0 I) e" m6 R3 y0 d( R0 x! ^# a( Yint41handler2 PROC9 E) m1 Q$ C$ z: ]% v+ c
    iret7 g2 J4 Q/ e" j, G2 }
int41handler2 ENDP# I& o9 r- d) Z- B* b3 A# l
, F4 g9 x3 B' v/ ?* t

7 ~7 t; k! t- @  s: Z. _: d% ]_________________________________________________________________________" a+ y) Q. q3 p  |* z
! \2 t2 U; `/ C3 r+ _

6 K0 V+ h9 J  }5 C. G7 R$ \Method 06- J. e4 J- c& N6 e( n3 P( W
=========( |* f* `2 A* b- ?9 w
3 M9 L! Q; R' \: a/ Y

2 S# `* v: r% a2 c: {6 |2nd method similar to the preceding one but more difficult to detect:* O& Q3 x: K! N# s" P

% a/ v' ~* ?8 b
+ E! o7 I) r$ ^* [$ S# ~  z' yint41handler PROC
9 f6 m- s$ ], A# X% c* b    mov     cl,al3 _0 b  x5 ]2 I" V: K. @8 u
    iret
$ l6 g# J5 y/ r$ i5 qint41handler ENDP1 g. p3 h: x; }+ S; R. P
. b) c* F( `5 @, M

2 U1 W0 h6 E, H4 j) s; j    xor     ax,ax
) g" ]7 i5 \% q0 I6 P- E$ H    mov     es,ax" C2 g5 S: v7 r! K
    mov     bx, cs2 ]  |$ d) o* |+ ^4 h/ z
    lea     dx, int41handler& z+ Q9 u4 }" u/ R& M' K& C
    xchg    dx, es:[41h*4]7 S2 }. J4 P4 n  k/ c3 U
    xchg    bx, es:[41h*4+2]& m; R5 c* f! Q0 ?5 _# v, \" l
    in      al, 40h( k' k* Z. q) ^/ q+ i" ^) O+ ]
    xor     cx,cx# E% A6 ~& E$ J: I  W
    int     41h* N0 |# p0 o: r7 S  _
    xchg    dx, es:[41h*4]3 F/ i8 D5 b3 ~
    xchg    bx, es:[41h*4+2]3 }5 O. g  b6 s
    cmp     cl,al$ g/ L+ C9 G* E
    jnz     SoftICE_detected
" d# I, \- G  N% j) f9 g3 {5 q; ~' y. |2 y
_________________________________________________________________________
- g; [3 }% r* i$ f* ]8 m+ Y$ \6 P7 n; j2 y* A" `' P
Method 07
3 d/ r6 u( w" A& `=========+ j( U  R4 }. {2 T/ H/ d9 `

4 u. s3 q& S8 P* h+ k3 _Method of detection of the WinICE handler in the int68h (V86)4 ~- x, c4 v$ m6 F" z1 E

% v$ T$ x. q* H( F4 j4 o" J    mov     ah,43h
" S: z7 ^6 f) k% U" @    int     68h7 e* i0 t& v: \3 c* r
    cmp     ax,0F386h* G  N; w, {5 {+ d7 N# v
    jz      SoftICE_Detected/ j! C6 K  Y- F6 ?1 [
- J5 d5 y8 H$ }) P

7 D( [  @* \; L& g=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit" m  K% E6 f" S$ U" W
   app like this:
% s! T4 F; E# B7 p- {' \$ |- X4 {% n' V
   BPX exec_int if ax==68
+ s6 U' O1 z- O9 d+ b% u   (function called is located at byte ptr [ebp+1Dh] and client eip is
# Z, H' B+ g/ V9 \# v' x/ q   located at [ebp+48h] for 32Bit apps)
0 i/ s4 f+ U% p. k__________________________________________________________________________8 r4 o% o3 G: A* Y

7 z/ F7 H' A) f# h2 a, s% B5 S8 Q% H! g' `. I
Method 08
% l- B& A8 M% H) b=========
2 X; D/ j; O( i6 k1 a- Q7 }. C+ U, K! Y4 u" j7 y) W6 i
It is not a method of detection of SoftICE but a possibility to crash the
8 ~, [, o6 E8 a; t2 }5 isystem by intercepting int 01h and int 03h and redirecting them to another
6 X1 l  o% Y1 o1 oroutine.2 j" Z8 q  b0 a4 q$ q
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points8 K: N/ y7 g2 u* K' z
to the new routine to execute (hangs computer...)5 z3 ^8 z! E9 L1 I. F
% t. x+ O( Q/ i* }9 v& H
    mov     ah, 25h8 z- k3 Z8 ?' E# F; [" m( ]
    mov     al, Int_Number (01h or 03h)
% v; ^9 C) \) e* ~# R& k# y" {: ?    mov     dx, offset New_Int_Routine% v  y1 u! k! u  }8 z
    int     21h
5 q% j4 a+ k$ w0 w5 N2 }' b; q* S7 p& r. F+ ^
__________________________________________________________________________9 b9 S4 R& I8 E6 s7 z5 K0 x
  m- V; K/ I0 t4 T+ n
Method 09' I$ B" l' F2 R3 {( Y
=========
! D# R# t% I0 P0 W# P, ?# ]( q
) f- F7 s, }3 b4 W. i# T3 C3 w' cThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
4 ?: f: R8 w" U% w  h# |' b& aperformed in ring0 (VxD or a ring3 app using the VxdCall).
* z' h. g4 `& {/ WThe Get_DDB service is used to determine whether or not a VxD is installed5 Y6 }$ q0 p$ K+ v
for the specified device and returns a Device Description Block (in ecx) for
. `; n0 o% v- V) P7 ]2 V% O% @that device if it is installed.* T" h- G. X' a
! o8 ~1 U) z) s: x- n
   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID
$ o# ?9 }" x  n/ ?+ T! A, P/ @/ L$ S   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)/ n% k$ v! n# D6 g2 p5 M
   VMMCall Get_DDB
4 N% a& I0 T8 v& C  U   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed
& y, y" V5 v5 P5 S( |! |" N
1 a2 q! B9 J) n& e- wNote as well that you can easily detect this method with SoftICE:& l7 `" L/ l' a  @& T- l
   bpx Get_DDB if ax==0202 || ax==7a5fh0 @  Z5 }! P3 E
! V  d* Z+ `9 |  n3 C  x
__________________________________________________________________________% N" ?" o& c+ J1 ~- [, h
* j  B* G0 U7 a/ r
Method 10
$ ^8 Y( z2 C6 V; q7 }=========9 ^* ^0 b3 d8 i% L4 @0 M

+ G$ q* ~" Q. b=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with
. A) s; h- f5 u/ Q$ j2 ]  SoftICE while the option is enable!!7 j( O6 d! u6 ]

% z+ p4 V" T& v/ m$ }& n' {4 ^This trick is very efficient:
, M0 I% p. J7 Tby checking the Debug Registers, you can detect if SoftICE is loaded
2 i- d" U* ~3 c4 F(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if9 S1 W: A: T- @! g3 R. }  S0 o
there are some memory breakpoints set (dr0 to dr3) simply by reading their& n+ x9 y, D$ A2 {& M
value (in ring0 only). Values can be manipulated and or changed as well) T8 O; }2 ~  p: T3 Z- `2 D& F
(clearing BPMs for instance)
* i( h' j9 N" C4 L/ F3 q. x
( K6 J6 S, X7 V0 S$ u1 I& p! p* ^__________________________________________________________________________
6 ?  D. l0 L$ _. k3 D- N) E4 n& R, \
Method 11
" m  Y) J. e0 I  z2 w=========% B8 D" S7 k4 t& s. \$ ]

/ ~: o; y  K. MThis method is most known as 'MeltICE' because it has been freely distributed8 y$ c  @9 k9 b7 }8 R$ F
via www.winfiles.com. However it was first used by NuMega people to allow1 Y7 Q3 g. m# F% G, N3 A
Symbol Loader to check if SoftICE was active or not (the code is located% o1 _2 t5 C2 m1 o" v
inside nmtrans.dll).- C2 k* ~3 |8 q1 y  b( `

3 J- q- T* ?0 ZThe way it works is very simple:
; R$ @) g) M+ B7 u: KIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
  Q( A7 q* r( lWinNT) with the CreateFileA API.
# W) N+ D8 r! f" O) D3 ~
0 Y* H# ]+ c5 f/ S% ~& \Here is a sample (checking for 'SICE'):
4 H  L6 e( z: H, ~: z( h1 X9 M9 a/ L; J5 D" n! v  q4 j; B
BOOL IsSoftIce95Loaded(): z' C7 ~0 W1 |0 c6 x1 c" v' ?; Q; s
{0 y( T. A4 [9 A2 M, U
   HANDLE hFile;  
  ?/ y0 W& Q1 b+ q   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
+ x4 e% @8 u# o; i6 K                      FILE_SHARE_READ | FILE_SHARE_WRITE,( ]+ u$ k* D# X/ F) H5 O
                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);8 D9 ^0 Z; x3 f* L- r9 }
   if( hFile != INVALID_HANDLE_VALUE )
/ U+ r" q$ {: n7 s% M   {
; @% C6 N5 ^- u  o( [7 F7 B      CloseHandle(hFile);
8 F& ]8 g. T; e# D( H5 R      return TRUE;
+ F8 ~! _, s* r0 @) f3 E   }
0 @$ y/ [& L0 Z/ ]" z" S   return FALSE;+ x/ l& R7 I0 y* o3 O) X
}
" s) r- [7 K. g' x5 F: q" J
' a) A/ P# _( k& B! SAlthough this trick calls the CreateFileA function, don't even expect to be4 u# m  y6 o) B4 W; l/ i. Y
able to intercept it by installing a IFS hook: it will not work, no way!
# T' x* \8 e$ R1 v* n  q# aIn fact, after the call to CreateFileA it will get through VWIN32 0x001F+ E% {3 y3 U7 r% f3 ^
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
6 G* V1 s. J/ G' f: ~: e3 a  R( D# Mand then browse the DDB list until it find the VxD and its DDB_Control_Proc
$ S# f1 i! |7 s6 ]! K4 Tfield.0 H) e- \# c" _
In fact, its purpose is not to load/unload VxDs but only to send a
0 J( z" q4 l! J' {& yW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
% L0 l5 ?" @, b0 C5 s+ Wto the VxD Control_Dispatch proc (how the hell a shareware soft could try
/ f1 c% m: {3 C2 \to load/unload a non-dynamically loadable driver such as SoftICE ;-).
( e5 Q$ f( W9 yIf the VxD is loaded, it will always clear eax and the Carry flag to allow
" u8 Z/ C. h1 t+ T8 W6 }8 kits handle to be opened and then, will be detected.
; m3 l( L2 _5 RYou can check that simply by hooking Winice.exe control proc entry point
' R2 T2 u9 ?4 M; rwhile running MeltICE.
- W3 x/ f) X% S, T; A' m% \; s  \1 P. S% }. K7 [
3 U) J# V# |# b7 R( m3 S
  00401067:  push      00402025    ; \\.\SICE
/ o' s  U0 w. x9 ?: @7 P# o  0040106C:  call      CreateFileA1 ~. O0 P/ B  [1 c$ {$ m
  00401071:  cmp       eax,-0016 |: K7 i% U; j6 p* E/ |: c; x: E  Q4 [
  00401074:  je        00401091/ u* V2 j4 y7 G' f9 ]

& @6 k. w; I- `2 ^1 k, E0 v9 D% v; K* |8 a
There could be hundreds of BPX you could use to detect this trick.5 V: [: Y# P4 Q. n0 @( ?
-The most classical one is:1 H( h/ j( V2 e! c8 C4 @
  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||- m" C( A0 Q, _7 y0 y5 r
    *(esp-&gt;4+4)=='NTIC'! I9 y, v; z" g7 U% W  d# r4 b/ k( B
% O3 ^/ h7 s1 m4 J! I5 l( j: v
-The most exotic ones (could be very slooooow :-(* Y$ B* V, u0 e" P
   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  ) b$ `2 Q# T* m$ S* n
     ;will break 3 times :-(
' a* Y) w7 \; z" ^- ?9 W5 e, [1 u% r; q
-or (a bit) faster: ) V3 R: X/ E6 O2 \  Z$ T. V
   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')% l- p4 W* L' ^: |" F' t* G

% J! _: C( }  w8 W1 s3 ~8 j1 b  n   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'    i2 X. P' B# x8 |; b) W( l
     ;will break 3 times :-(
4 S" m! K+ \7 k+ @8 }' U
3 T' v# B; d! M-Much faster:/ f; z; D  A8 F8 B7 m+ G2 c+ Q
   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'
' O) N0 S# x2 B* O/ z3 K3 \! m; }6 q5 O, `! b
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
5 Q6 j) X  ~8 c+ u2 Y0 t5 ]& Efunction to do the same job:  ?% ]% a; n  i
0 {  ]  |! W: I$ C; E& o
   push    00                        ; OF_READ4 |9 M5 m6 d/ h
   mov     eax,[00656634]            ; '\\.\SICE',06 t; Y+ m6 w% l1 ?" o
   push    eax
" W2 ^& Z+ c% h4 L   call    KERNEL32!_lopen
) f+ V2 F$ J+ q# ^   inc     eax1 N9 m! d7 e# H0 i5 k* Y
   jnz     00650589                  ; detected/ e9 n$ r: d) \
   push    00                        ; OF_READ7 }/ Q+ _5 K+ _9 t7 m: ?* [
   mov     eax,[00656638]            ; '\\.\SICE'9 ~! B/ n6 n% O, p* x: m
   push    eax, V6 D8 _4 Y$ p5 l5 \7 C
   call    KERNEL32!_lopen! M9 j3 z* B! g4 f! u0 h
   inc     eax
4 [' P# g& ?: l   jz      006505ae                  ; not detected
9 e" A# c8 q4 `# Y& ]: G$ ?9 l0 [8 z. z0 p- k

9 T0 D8 p0 s. }- z__________________________________________________________________________2 Z1 i# D8 W& y/ U' {

8 I5 L. X# J7 b' I$ U8 iMethod 12
% |, n4 x! t! Z$ `  S, g7 Q3 r6 M=========8 e* q0 r& {& y( w
/ M8 Z" b5 m; ^+ E5 ~5 u: b( t
This trick is similar to int41h/4fh Debugger installation check (code 05
; L; l) X6 R% b  D&amp; 06) but very limited because it's only available for Win95/98 (not NT)
, B3 X/ v* A, k( Aas it uses the VxDCall backdoor. This detection was found in Bleem Demo.
. G4 h* S! N: k( y5 `9 s  t. X* y1 t3 T7 }4 J8 a+ w1 @# z/ W
   push  0000004fh         ; function 4fh
7 t' J# G- p) _; m5 W   push  002a002ah         ; high word specifies which VxD (VWIN32)
4 ^8 X( j0 X9 X8 b# p                           ; low word specifies which service0 ^: B& S7 H6 r2 r
                             (VWIN32_Int41Dispatch)0 |2 C6 o! \* p! m" o% N3 H' j
   call  Kernel32!ORD_001  ; VxdCall
$ U+ p2 t1 t# U   cmp   ax, 0f386h        ; magic number returned by system debuggers
8 p. E2 c( }! r/ r" T/ m( Q   jz    SoftICE_detected
3 U$ i' q$ N8 n2 ^6 S
) c$ ~" _& F. E7 hHere again, several ways to detect it:7 z$ @; z5 k1 ^/ f- r* Z

6 L1 P2 I" S8 v    BPINT 41 if ax==4f
* O& w0 h: P8 q) F  b: w7 u) Q+ j# B1 q
    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one
# M$ V& ^; _& g1 g0 ?4 h( \* t3 U" d7 w: b; w
    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A
8 h9 Z. G& S4 L# a7 V; P6 ]7 `0 X/ X
    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!
% E- D5 e& H( u1 x: l- l5 q! F  |5 H9 E) }. [0 @: G
__________________________________________________________________________
, W2 I& |9 a' X, @( D- M
% G" }3 s: C5 W; ^$ d# mMethod 13" T5 a/ v. ?1 l% h+ Z0 f
=========
- }/ P- e, V0 e  T. e# R  h; d& V: Q% Y1 t( i
Not a real method of detection, but a good way to know if SoftICE is  c7 f4 W8 |6 w5 R
installed on a computer and to locate its installation directory.( o  I9 V/ d9 Q
It is used by few softs which access the following registry keys (usually #2) :
- r: v( d$ k$ ?3 Q8 m( J6 U
2 [! y8 [' s! T. f8 t8 Y-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion8 I. ~7 Q! S  S2 [5 ]
\Uninstall\SoftICE
+ t+ B7 V6 B6 Y) B-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
2 O6 G( P9 @$ d" B  O-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion# P& l0 C* p+ r* C4 h
\App Paths\Loader32.Exe+ o1 }6 R2 Z8 F- ~% M0 a

" B2 ^$ o9 ~+ l7 v
9 Z2 N: D& E/ z# ENote that some nasty apps could then erase all files from SoftICE directory
/ r" H9 L9 C. P+ B# r(I faced that once :-(4 W% w; _4 z! l
  b: [; _+ S$ D3 P
Useful breakpoint to detect it:
" r: p: U: X$ _6 x  e# i! D
4 n( z1 k/ o+ }! p     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'# B& l6 Q# ^" H+ X+ i4 G

7 g2 E5 e. F8 n5 N; ?+ Z, x. j$ |% ^__________________________________________________________________________
' O- r+ J4 F* m5 Q9 Z
/ v+ k0 I0 J/ |1 P1 r. i6 t. D! d* ?7 Z9 A
Method 14 + L! [) }1 r, S2 l3 @, c* t$ ]2 \  a
=========
) \3 H% d' i) N6 w, K+ o0 y
/ ^9 n& Y6 y/ [$ W, Z+ @% GA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
4 l6 L' b+ I$ t, n3 T; n" P! vis to determines whether a debugger is running on your system (ring0 only)., \1 u2 c( p4 z& j! |
* S1 Z- T' P! h5 N" C
   VMMCall Test_Debug_Installed
: T5 c% J, D1 f   je      not_installed+ ^/ H  o, c8 C( J" x- V1 Y) Z$ F
6 q& ]$ K" Y) k' W5 ^% d  Q. l. I
This service just checks a flag.2 |3 t2 j6 G- f# b1 k" r. c/ Y/ n) r
</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

QQ|本地广告联系: QQ:905790666 TEL:13176190456|Archiver|手机版|小黑屋|汶上信息港 ( 鲁ICP备19052200号-1 )

GMT+8, 2026-7-21 09:15

Powered by Discuz! X5.0

© 2001-2026 Discuz! Team.

快速回复 返回顶部 返回列表