找回密码
 注册

QQ登录

只需一步,快速开始

About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>5 y! S- i. s! [- w- h
<TBODY>( @( X' M- `6 a5 E0 _5 l( o( Z
<TR>
* h1 Q) c: y  d! T0 l<TD><PRE>Method 01
, `1 _, f5 }4 V=========
1 r' c( |5 k6 o( e2 o) \" Q: j0 [, y7 K$ O
This method of detection of SoftICE (as well as the following one) is& Y- H7 D( l' D3 M% J
used by the majority of packers/encryptors found on Internet.
$ g# W; d/ _  P5 P# ]It seeks the signature of BoundsChecker in SoftICE; U0 F6 ]  q2 }) r
' T$ G6 y( u6 L6 D. t1 n6 G9 O5 q
    mov     ebp, 04243484Bh        ; 'BCHK'
$ \) _, N8 `& U' r9 p+ d/ G    mov     ax, 04h
; {" E  U3 z5 y1 _) |2 d  y; v    int     3       7 J: i1 G" O: v- R
    cmp     al,4
5 h9 d) j) W0 ]0 L( g6 o6 F! F    jnz     SoftICE_Detected3 u6 u5 v7 s. Z- Q( H) q( i7 u

) S* X% B3 d* l/ f  Q___________________________________________________________________________6 O. |. K/ I5 z; d, ]3 |- E- D
: e3 p. ^4 |7 o8 J' Y
Method 02
5 M! E7 b& h7 h=========+ a$ d6 _( _$ X  a2 u( f2 @

0 [: S+ ]. f& j3 b' S/ U: i' d2 ZStill a method very much used (perhaps the most frequent one).  It is used! [, k$ I, N# S8 q+ c) L
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,2 m& L9 C- i2 e7 O
or execute SoftICE commands...3 _, g+ k! `: a. s4 |
It is also used to crash SoftICE and to force it to execute any commands
" ~& k+ S  d: d" M+ q(HBOOT...) :-((  " D# ~1 Y% J+ [4 S8 I4 {

! E5 X) k6 U! K2 E9 F% u) @Here is a quick description:
( Z) b) I! m/ P: K5 d1 O-AX = 0910h   (Display string in SIce windows): Y6 b7 O6 R% {1 p; w
-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)
3 J6 h0 `" e( _5 z-AX = 0912h   (Get breakpoint infos): ^: d, Y6 W5 u5 U. z8 ^& O
-AX = 0913h   (Set Sice breakpoints)
0 }3 @# j; U# Q-AX = 0914h   (Remove SIce breakoints)
5 d7 o/ S9 j1 c: D  [: @
, L/ o2 p, B/ x8 X* U1 p# Q0 I: K" T4 GEach time you'll meet this trick, you'll see:
- n3 F( ~! ^2 A! U; f-SI = 4647h
/ n  T" k* x2 h  |4 d# K. v9 Y-DI = 4A4Dh* C3 ]. t" r2 e# y& g" Z4 ?5 Z! K' z
Which are the 'magic values' used by SoftIce.
3 F$ p7 b# t# @4 a1 Z8 R7 mFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.4 p" s# H" Z# ?$ n
+ i6 y+ ^0 L% l/ s1 ?
Here is one example from the file "Haspinst.exe" which is the dongle HASP( C; V+ }% C- a
Envelope utility use to protect DOS applications:4 C& g  e/ g9 K% I7 c9 V- [4 O: ^% a- L
# l$ [3 u( B. |8 p. L

/ \7 Q6 a3 P6 l4C19:0095   MOV    AX,0911  ; execute command.
2 Y" j8 ~8 ]' `$ v  j( s4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).
$ E" v) e+ ?2 H2 |/ B: v6 \5 a+ t4C19:009A   MOV    SI,4647  ; 1st magic value.8 e, z! v( O: N! l( h6 J" D0 @8 g
4C19:009D   MOV    DI,4A4D  ; 2nd magic value.
) M1 R5 M" k: F4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
9 B0 @8 I% u* T, r4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute% P: x7 [! H0 }" d: A9 l# k% \
4C19:00A4   INC    CX
6 N. {. n" ^: G+ b; |4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute
% d# J, C$ S! V- }2 E  C4C19:00A8   JB     0095     ; 6 different commands.1 P. D% b  V9 f/ w9 Z3 Q
4C19:00AA   JMP    0002     ; Bad_Guy jmp back., x6 [: [3 ?& o6 t) P1 D
4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)0 n4 A+ e# u. d2 p7 s1 p
" t9 W, p0 x2 w6 ~
The program will execute 6 different SIce commands located at ds:dx, which, z; a* i# _8 i7 {+ ~
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
2 n9 b# p- B4 U. M7 ]. J! ~4 W& l* Y1 H, U' x( ?$ ?# x
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
( G4 [, L( _: q/ X; ____________________________________________________________________________
/ f3 X6 R) d( f: _) v: h9 t# I5 [( C0 ^# a2 L* P
4 t* V& [# F5 Y1 k
Method 03
1 _5 J+ J% q; a; H=========
/ i7 e7 }# Z8 v0 N0 ?2 ]! C8 V' p/ B6 z; g6 W6 N
Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
1 X9 [& Z4 y9 C8 L4 D  h: y(API Get entry point)
" q$ ~: z5 F. p2 h* S& y6 M0 C        ) m5 X/ D8 \0 z/ B: a4 v
, G' S  ~8 v5 L1 X2 d& n2 j
    xor     di,di
3 d) q+ Q; c. r/ m. N& `    mov     es,di. }/ F% O  m) e
    mov     ax, 1684h       9 n8 a* I: \$ v
    mov     bx, 0202h       ; VxD ID of winice
( m  X$ q! q$ N$ E/ B+ i    int     2Fh
9 s; P* m3 J+ e/ _" w8 L    mov     ax, es          ; ES:DI -&gt; VxD API entry point# L0 j% N& Z. s8 p  D: x  |
    add     ax, di
) Y4 M5 x6 \- x: \+ H. A/ ?    test    ax,ax
% s% _- s$ d# g/ }    jnz     SoftICE_Detected5 x% O4 w5 l8 g
3 z! H" i1 W8 P: v
___________________________________________________________________________
& {" |" B4 \" n, s1 Y
& Q% z: J& p8 N- V4 H2 K5 CMethod 04) ~9 Z# y% d6 X, ^
=========& A% a4 O/ J- y/ v6 v) N

( G8 c1 `, j  iMethod identical to the preceding one except that it seeks the ID of SoftICE4 p' i- y2 e' p, I/ c" B
GFX VxD.; Z! c1 E/ B, R& _
7 h9 W- r3 c# g
    xor     di,di  {9 K  J, R0 T8 v/ \
    mov     es,di8 `$ L1 N' i  E; V: n5 \% ^
    mov     ax, 1684h      
) z! o3 _+ t3 B3 A: l    mov     bx, 7a5Fh       ; VxD ID of SIWVID
/ Y0 y$ V" P% T6 ]; r1 F    int     2fh
. W5 u7 ?) @  {3 m# x/ y    mov     ax, es          ; ES:DI -&gt; VxD API entry point
8 H: b' Q  E8 M    add     ax, di
; Z. O1 ^: i) a* E# A: ]    test    ax,ax
5 W, X1 e. B: R6 m" K% K- Q    jnz     SoftICE_Detected6 P! n* G! z7 [$ O: R# {
' O0 f( k9 ~' O' |- G5 T/ H" g& g
__________________________________________________________________________* r+ m" N" g, m' m& l4 U
2 Q% O$ U# o, C8 r

1 L) d' c. x$ _4 TMethod 05
1 K; N/ d* {$ Z- c; i' b=========5 I: a9 y. f  \* y

0 O9 U5 Q7 @; ?7 eMethod seeking the 'magic number' 0F386h returned (in ax) by all system
' f1 ], v( s+ _7 Qdebugger. It calls the int 41h, function 4Fh.
3 ?# T/ Z# I1 H( M. \There are several alternatives.  
0 X  J9 X) N, _; v
1 O# J8 ?6 T7 T, ]. i  F/ yThe following one is the simplest:1 N' v! `5 M+ `* a6 N
  K1 t8 X( A+ k7 s7 a% e  d- P
    mov     ax,4fh
6 Q4 h. e4 \9 _* H0 u. M    int     41h
" Q5 ?; D+ A' ^+ r5 U    cmp     ax, 0F386
* m5 T* G. V, a. ]" u( @% k    jz      SoftICE_detected+ C# a: m& c( ]$ B7 t5 h2 ?
. E  \! [! X; ], }
& ]3 J8 m, Q) ^8 p2 r
Next method as well as the following one are 2 examples from Stone's & L9 g" o0 H4 q: {
"stn-wid.zip" (www.cracking.net):
# w' \; f- D1 [
: c) w% \. Z: Y' ~    mov     bx, cs
# ?( k; o4 j! ^! J* t) v    lea     dx, int41handler2* O( p: [) I6 m5 \+ T
    xchg    dx, es:[41h*4]
; q# v+ I* T# B! f! `/ B" G+ D! S    xchg    bx, es:[41h*4+2]* ~2 i9 V! P% T( D& X- O
    mov     ax,4fh9 t( h; c# {" H
    int     41h4 K! c/ k7 v  ]
    xchg    dx, es:[41h*4]. P* |$ m- c6 t9 m
    xchg    bx, es:[41h*4+2]3 z9 K4 j7 C" l0 }! K; e% H* E" Z
    cmp     ax, 0f386h3 W9 y( {0 M# W1 ^
    jz      SoftICE_detected4 w/ G3 \* u. O6 d" Y8 H2 m& \" w

2 G" {$ G7 g- `1 ]int41handler2 PROC
# F3 a6 X5 Y0 J    iret
5 B3 d8 p9 E1 Nint41handler2 ENDP7 H4 Y; ^0 h# @* L/ T: a9 J

6 \- m- Z& q; ]4 F4 d4 w. m* x& D/ x: X: j. J
_________________________________________________________________________" K0 _- Z% f. \9 u% v3 g! M

. q1 |3 r  }9 n6 l2 P. M) P2 U- |# m4 Z
Method 06
0 Y" S# u- B( U! E=========3 ~& P' b5 @3 Q9 \3 q
" F8 @5 M/ X2 r/ T% r1 D* S
; b' m8 W1 s% @( r, y
2nd method similar to the preceding one but more difficult to detect:% L; _! E+ D1 s5 P- D4 E
5 }% W( C" U7 L8 Y, x/ E
1 h6 C) o' q1 l; x9 [
int41handler PROC
  U6 w0 R( I+ f    mov     cl,al: z9 w; T/ P; J  v* u
    iret
( }6 B, G  P7 s/ r1 xint41handler ENDP
. k  H8 A0 \# o$ N, s+ w9 T( L' j% w8 @+ ?

4 q9 G' ~" v( K5 p% K% z. p    xor     ax,ax$ V) S/ ~2 t8 t; H2 M/ W
    mov     es,ax
* V: [) @# c# i    mov     bx, cs% y* Z- H: y. A; D
    lea     dx, int41handler
# f: e2 m7 K6 A, J& I    xchg    dx, es:[41h*4]
( Z: I" _/ y4 r* A& W3 E+ v    xchg    bx, es:[41h*4+2]
8 a1 y7 R/ c: A6 U" }2 }- t0 n    in      al, 40h
; U; a9 j/ {# J0 Z' y    xor     cx,cx) O$ S+ W" Z( D' _6 w  D
    int     41h/ Y" j% b9 F6 a- ?
    xchg    dx, es:[41h*4]* i3 r- u# ^  i; ~
    xchg    bx, es:[41h*4+2]2 N6 L& C8 K4 W( K  R- M4 e- C8 Y0 @
    cmp     cl,al' }! Z% h, t) d9 \
    jnz     SoftICE_detected9 Q; b5 i4 {# r. N8 q# m. S
) K7 \9 P# k6 h" S. @* a
_________________________________________________________________________# P; w  c) }; ~3 q, W
0 Q) D' y2 f+ M( v1 F
Method 07' O- p; [, Q& K' T7 ^: j4 J
=========7 p9 c2 h6 g4 s1 _0 G0 X) l

$ g  y4 T8 h6 ~Method of detection of the WinICE handler in the int68h (V86)% @' N7 T' y/ X8 b. y$ g
# Q8 D& R; `% S
    mov     ah,43h& [  r; V% x/ S: \" Z
    int     68h
( E! d" h7 T2 h  N7 E    cmp     ax,0F386h
# w" O/ C. k; R6 u7 f    jz      SoftICE_Detected6 Z: n9 m) h6 n) |

5 m' A/ Q$ c& y- K8 h  g! f- e/ |
. i* s" |7 p9 O* |# W& n=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit8 f) |- [2 B9 v( \) I. @0 a
   app like this:. B/ R) I: x7 ^

: |9 _; s9 K) D9 ^& ~( S   BPX exec_int if ax==68
* S) ~# ^- J0 [+ D; V   (function called is located at byte ptr [ebp+1Dh] and client eip is
/ Q8 r2 L& i! {   located at [ebp+48h] for 32Bit apps)
5 b# y  f4 e9 h/ L__________________________________________________________________________
' b6 U9 z9 w2 m  S0 g/ _+ j' M8 y2 l, X
7 M: J# P' T) K7 L, A9 V% b
Method 08! Q7 o: g1 f, }# x6 l0 s1 }4 X# Z; T4 D% C
=========4 }( m% f% W5 }+ @( z2 T
6 m) K+ {, ]( o% R  \, ]
It is not a method of detection of SoftICE but a possibility to crash the7 M, O- V/ ?) B" c
system by intercepting int 01h and int 03h and redirecting them to another: c" \& G- L- M3 K  A# ^  ?
routine.
  g) w7 f5 P- I! oIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
- H$ y0 L. R2 x1 L' A+ _0 yto the new routine to execute (hangs computer...)0 |+ c8 r' F' E& l7 U. c5 P
6 S6 d% [4 t' a9 ]) T
    mov     ah, 25h
: `, Q/ t' u: B) L    mov     al, Int_Number (01h or 03h)
* t9 B* O0 R. D) v    mov     dx, offset New_Int_Routine
3 i, n: w5 F# ^) X  P    int     21h: a% D4 S% G% b. O6 m3 x
2 L, T2 `8 ^9 _: ~+ q& F
__________________________________________________________________________- N1 e: A9 y' b! W; c

0 [9 [$ U& N5 L% J* I. sMethod 09
5 Q/ l" {& E3 k! J4 v& D9 S( f& c=========
& y8 l$ N3 u; l
9 W* a( |7 f2 mThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
2 i" E1 Y3 G5 ?* Iperformed in ring0 (VxD or a ring3 app using the VxdCall).
7 n8 t; u4 n$ V+ eThe Get_DDB service is used to determine whether or not a VxD is installed- V8 E3 r: ^7 Z1 S
for the specified device and returns a Device Description Block (in ecx) for
$ z' E/ g( Y" @that device if it is installed.
$ N  v5 `% }& e4 Z; |
2 |! {# J; n8 \# C   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID3 Q, V( `" h. v' s
   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
3 n# n: m1 D4 W/ L5 L   VMMCall Get_DDB/ H1 T# U: |  Z+ b# S) E
   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed
# c1 _8 N! l3 o; p
- a9 Z- m7 h  n: U, J2 bNote as well that you can easily detect this method with SoftICE:
' A# e) [) v- z" |1 S   bpx Get_DDB if ax==0202 || ax==7a5fh
( m' @+ ~- ]! `3 s
7 k  T0 P) s/ U__________________________________________________________________________" n1 M0 s  a4 S# a) N

8 ~. u) n1 I5 K* M7 RMethod 10
% P. V5 \  m" m! t! G=========" _0 h/ q1 R$ }! C; W3 Z5 V! O) g
4 b8 W! [5 X6 n' }9 z/ s3 P* k
=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with
/ R' g. z, l  C: r/ H) k  SoftICE while the option is enable!!
) d$ u7 ?" e) @0 A6 Y3 Y) p; t1 w$ K. u. {& }8 u( x5 \
This trick is very efficient:
. s; D7 f, J3 ^5 }) Aby checking the Debug Registers, you can detect if SoftICE is loaded
, D" |( D! t$ Q1 N4 [. |(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if. w6 J$ C9 C$ m7 f# S: p+ u
there are some memory breakpoints set (dr0 to dr3) simply by reading their
! ]: x7 S# y* J  I- K1 Bvalue (in ring0 only). Values can be manipulated and or changed as well
0 J+ O1 C+ c* T(clearing BPMs for instance)
2 X& F% t) |7 Q4 k, {# w* n4 t
5 @& S+ w# p/ \0 J__________________________________________________________________________
4 F  T" ~, B- X7 l5 W3 c# Q% {, t! S4 w6 T; f4 L0 s
Method 11
( k6 ~! p" {4 c. X8 [; U* e=========3 T5 W/ h1 J; \' @! d3 h

# T. ~$ E* I- {) D+ pThis method is most known as 'MeltICE' because it has been freely distributed  x/ X/ h* Z& }; r" D' U
via www.winfiles.com. However it was first used by NuMega people to allow
& w) U0 R# b+ a, kSymbol Loader to check if SoftICE was active or not (the code is located1 w- @0 o9 i# T/ R; i
inside nmtrans.dll).. P* @# ?9 B- q6 D& b: [
9 D* N: M3 Y/ z" a& W
The way it works is very simple:( ?) J: d0 H" i" J
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for& m, o, @* Y  k2 `3 J
WinNT) with the CreateFileA API.
  z4 e) ^8 u  M5 f" B
; |9 j/ a* Z/ B5 T, r/ T: oHere is a sample (checking for 'SICE'):0 ^, ?* z% h3 o2 h0 }* ^# L

& Z# d. g. x6 \( D! g# sBOOL IsSoftIce95Loaded()) r0 Z4 |0 U. ^+ r' p5 {0 }
{4 o8 S0 D* b# z* r+ X9 Y5 t  e" p$ f
   HANDLE hFile;  # A4 [) s: n3 X; W5 j
   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
( V- [/ H' W2 M; r" a' n0 M                      FILE_SHARE_READ | FILE_SHARE_WRITE,# }/ {2 d- L8 s/ j: e1 L3 e
                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
9 P- T; D7 b' r   if( hFile != INVALID_HANDLE_VALUE )
6 z. F, o/ F& o2 x/ `   {
; l) D! c& U7 Z      CloseHandle(hFile);
8 |1 W$ \* E7 \' D- j- [      return TRUE;
0 b% S: B% J  K) b. N3 U3 e   }7 k3 q  r: A8 q- d4 I6 s; O
   return FALSE;
; e# B- U" S- j- |$ C2 \2 L3 f8 J) k}. S$ [6 x0 X2 \$ i$ y: U1 f

+ ]. n# f- J/ e! Y  J4 ?1 W' kAlthough this trick calls the CreateFileA function, don't even expect to be/ K+ _* {) t( {" J* C: T+ ^7 s
able to intercept it by installing a IFS hook: it will not work, no way!3 U0 V+ V  n, v4 i8 m7 @% U5 i
In fact, after the call to CreateFileA it will get through VWIN32 0x001F
% H# U4 P  o' t! w6 Iservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
% o  F* Y: i- j; n1 d3 |& k' Rand then browse the DDB list until it find the VxD and its DDB_Control_Proc
" @7 U2 B' p, A, G2 p( Mfield.
1 ?: {  x1 i4 s& h8 j& }In fact, its purpose is not to load/unload VxDs but only to send a
6 a7 N& l  g' gW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
( n. x5 t! S3 Y( q7 [% Ito the VxD Control_Dispatch proc (how the hell a shareware soft could try
/ p( r* o/ L, t/ Y( v; i3 C+ jto load/unload a non-dynamically loadable driver such as SoftICE ;-).( p- f5 Y, i* B3 G  w
If the VxD is loaded, it will always clear eax and the Carry flag to allow7 f; t/ I, g! P2 x# @
its handle to be opened and then, will be detected.
4 I2 a+ a% Q6 z4 K8 L5 x+ TYou can check that simply by hooking Winice.exe control proc entry point+ E6 _% k+ \% t  e+ B; Z
while running MeltICE.# q* ]8 S% j/ W

( @2 c6 i( V8 S4 t: j. |) I
$ V3 P' o1 q% n8 U+ Y5 ~  00401067:  push      00402025    ; \\.\SICE" a" V, s, F& N7 [) K' i2 M+ N
  0040106C:  call      CreateFileA
- @  N& y( e3 f' J& t* q  00401071:  cmp       eax,-001
( [, X. a& S7 c* b9 C  00401074:  je        00401091) i' g$ t/ w) i
8 T0 `: X# E. K# W( \7 z
; M9 g7 P+ M% a+ ^: c* C
There could be hundreds of BPX you could use to detect this trick.) P, T4 n4 C6 ]3 i; ^( Z% z
-The most classical one is:
- \# Q) [2 Y4 |' J- f  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||; E8 K+ B! w7 M9 `
    *(esp-&gt;4+4)=='NTIC'3 o: _8 i% e7 @, X% k) e
5 V0 z8 I7 {- @4 U7 \& N7 p
-The most exotic ones (could be very slooooow :-(. k8 H* d% l( r& b9 r5 P& r
   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
1 J3 y/ R& R- w2 p: V6 q6 G# g. v     ;will break 3 times :-(
& z$ Z) R8 |. ^. z; e& g" E
( r0 E- e- u; [# K' a& d& e( I) d/ z-or (a bit) faster: 8 B3 i5 g9 h: U4 a
   BPINT 30 if (*edi=='SICE' || *edi=='SIWV'); _( _1 u2 [3 r' x' L% T' q

" ?# R6 D9 [1 ~. j) B3 T3 v   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  # I# {5 H: I* v3 [. b7 V& M
     ;will break 3 times :-(% b0 S, y0 b7 t. h

, t* i( x- o7 d0 ^7 [-Much faster:5 U- Z( I; N/ e" H2 F
   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'
  B6 t2 Y( ^& D) Q: r; s
" R9 t% w& d& B: C. p) M( g3 [1 tNote also that some programs (like AZPR3.00) use de old 16-bit _lopen( P2 j/ {1 e9 S; M' ]4 l
function to do the same job:
6 u5 S! R: Z8 ]8 C' \2 S+ A2 E; i  p
" A0 H6 ?& o/ [5 Y( d5 n5 e. e7 U   push    00                        ; OF_READ
! u4 P0 a/ m- y0 \& [, f( S   mov     eax,[00656634]            ; '\\.\SICE',0- A% I0 Z/ [  L
   push    eax2 y; j( p# d. I% @7 S7 h
   call    KERNEL32!_lopen# r9 J0 e& j' O! j3 ^& H. n5 u8 b
   inc     eax
) m( Y  T$ q3 I1 O   jnz     00650589                  ; detected7 D& h1 Z* ^3 r& S: n( f
   push    00                        ; OF_READ" Q* F7 j( |8 T8 q$ f/ Q
   mov     eax,[00656638]            ; '\\.\SICE'% M/ S! @  |# r, X9 W6 K
   push    eax2 ^+ n: w9 K5 |9 G+ a
   call    KERNEL32!_lopen8 D* H3 l9 F  G( S0 Y
   inc     eax4 D- G& h9 b( r) G
   jz      006505ae                  ; not detected
) B$ T/ g( }# h+ L0 A! V3 l% p1 p, s  H( I, c8 Q& K

( h6 d" k7 Y. s1 w$ F& i7 I__________________________________________________________________________
6 h  r7 m6 j+ O: {+ `) u' T- t9 O8 ~
Method 12
: ]; O% \& d( X0 m& o, V5 ]3 M=========! P$ {2 X! E8 l! S0 Z
+ K6 x0 g* y4 d# n
This trick is similar to int41h/4fh Debugger installation check (code 05
+ J5 S' L/ d" L, q&amp; 06) but very limited because it's only available for Win95/98 (not NT)
, I$ {) I* x' h" Tas it uses the VxDCall backdoor. This detection was found in Bleem Demo.( c4 a, W4 V4 _

6 }: a% S% W+ i! q, E% P4 T! b   push  0000004fh         ; function 4fh
% ]7 W" o) O7 d. u1 J9 u3 L   push  002a002ah         ; high word specifies which VxD (VWIN32)
" P% x9 f$ Y' L- I2 k                           ; low word specifies which service
- q6 j$ p! Q/ P& r7 V8 G& }9 P# l                             (VWIN32_Int41Dispatch)
1 B  [  f! v+ f% g8 z( P& v   call  Kernel32!ORD_001  ; VxdCall# v9 k2 ]1 x! t9 e- o+ O0 p
   cmp   ax, 0f386h        ; magic number returned by system debuggers) T: w  R7 Q$ s: S
   jz    SoftICE_detected
! E3 h5 W" A. k3 s4 A; H; Q0 {* A; ~
Here again, several ways to detect it:
# E" j0 z0 G% \5 G( E) M
5 e. W% l/ s9 q5 L( T4 f    BPINT 41 if ax==4f
) Z( X3 M2 A8 k$ ^0 n4 t+ j& X" O9 i, P+ H( a
    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one/ H' z9 L8 |% f! o% K; c8 L

7 J7 P( N% ]1 J7 c    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A8 l' Q. T9 _  l+ }# n# a8 Y  U0 D
: k* Y& {+ m5 _. i6 X' I' c, w
    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!
3 n+ w/ v* _8 i  L3 l- g2 @1 K- ~/ z" v. j) U
__________________________________________________________________________' ^/ Z. n' ^9 V7 f8 a! p
/ _! N( T0 v& z* k/ Y* x/ \# {" f5 K
Method 135 d5 \( J- k, T+ _# F# e) x  k
=========
" a1 a4 ~) S3 M- Y$ v. d
! v/ R2 L& F) {/ GNot a real method of detection, but a good way to know if SoftICE is
+ z6 h/ D. u( p- Z! k7 v8 ^installed on a computer and to locate its installation directory.
$ y# J- ?: Z0 I/ s: R* hIt is used by few softs which access the following registry keys (usually #2) :
  j( E. \( X# b5 a8 j
  f* _' a; C7 A: f% t0 [. W& u-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion1 M0 w& ?) u+ [* r% t* h8 R& p1 t
\Uninstall\SoftICE5 n- ]2 r9 l9 h! I' X
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
5 F; l1 D; A- W! g9 ]1 P+ G-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion; ^" t, d2 H4 H
\App Paths\Loader32.Exe
& u4 [) k8 @+ b4 C* e" e* _* G4 T+ |$ U; Q6 d( _& q3 a4 K: J
$ B; x: F6 ]7 L; n
Note that some nasty apps could then erase all files from SoftICE directory9 s0 r+ a, q; E, d; `$ w
(I faced that once :-(
0 ~8 |5 u$ P. t2 V/ _5 P
8 ?0 R. H; d: c! [  OUseful breakpoint to detect it:
7 W6 ]' `( I2 z8 H+ b0 K- t6 h6 Z7 `/ x/ u
     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'
3 q7 e" j0 U' @. j8 z/ W0 z+ ?7 y6 e
' E1 X) Y+ C! G3 A: V! D2 ~__________________________________________________________________________  H; s! c4 O# l; n; H) k5 Z
3 D4 b; t/ f! d6 F

. N. m$ y! f0 j" L  `) z% mMethod 14 4 A6 W7 m$ r' P- D# _
=========; w0 c$ @- Q8 H% Y. Y/ ^2 T% l# j

- l/ K6 ], J) N# jA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
% W7 A3 n4 y' kis to determines whether a debugger is running on your system (ring0 only).+ E2 a7 n, f: M  u

# d# W& R. t. L9 r/ e* }( ~" z# Z8 [   VMMCall Test_Debug_Installed4 R2 b3 S% p8 |8 h5 z0 e* I* R# `
   je      not_installed
8 c* K, {+ v5 `, b1 y9 J/ d# X: p" O7 I, W; g1 V% S
This service just checks a flag.
6 ~1 g& i, t# g$ U; V$ ~</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

QQ|本地广告联系: QQ:905790666 TEL:13176190456|Archiver|手机版|小黑屋|汶上信息港 ( 鲁ICP备19052200号-1 )

GMT+8, 2026-7-25 14:47

Powered by Discuz! X5.0

© 2001-2026 Discuz! Team.

快速回复 返回顶部 返回列表