找回密码
 注册

QQ登录

只需一步,快速开始

About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>
: j' \6 o# {; p7 H/ ~7 I<TBODY>. ?/ I6 Y5 a5 {) y0 W, v
<TR>& D0 C6 P6 h+ a' L( a
<TD><PRE>Method 01
% t9 \1 `4 Q0 ~$ [3 X=========. a. r" h2 R* T- R! h% e& \- w6 {
8 i1 x: K/ T4 B4 N* i/ B: I: L3 |
This method of detection of SoftICE (as well as the following one) is2 N, I7 y) |- O4 t! T+ p
used by the majority of packers/encryptors found on Internet.8 V% h! F( H5 Q, _; k1 m
It seeks the signature of BoundsChecker in SoftICE
6 S1 g4 t  F) X( D; H
8 |3 {" E, B) G* W    mov     ebp, 04243484Bh        ; 'BCHK'
5 n- Y$ h4 k7 p& x% B    mov     ax, 04h0 P: v% p( u4 s& ]
    int     3       & a+ ]% A- v! [' J3 X* t1 @! ?
    cmp     al,4
0 M. Q+ @* d/ ^# X( g) H8 F" ?1 I    jnz     SoftICE_Detected" Q2 {: s* K: `3 V9 F
) l/ S4 U1 i( d) F
___________________________________________________________________________
- j! }* u$ K8 _9 |
/ v; x) n0 X* g$ }. j' ~8 {/ B7 lMethod 02
4 l: g5 R8 d* @- B9 }=========! d: I  N& T5 U# G& _7 y
' _) l$ d6 l' x# R: y' ~" f
Still a method very much used (perhaps the most frequent one).  It is used
1 e; H. O& j$ qto get SoftICE 'Back Door commands' which gives infos on Breakpoints,7 B7 M- C. M1 B9 K6 A* ^
or execute SoftICE commands...5 @- u* K' a) ]1 M
It is also used to crash SoftICE and to force it to execute any commands2 o" N5 U% q) ]' B  [- @, ]' c# c
(HBOOT...) :-((  & W2 A' u4 P: ]1 ]: r

: I% J5 R2 {8 qHere is a quick description:& g" @6 }9 c+ c+ p
-AX = 0910h   (Display string in SIce windows): g( |. }, X  U$ v
-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)
1 E$ @4 [, w9 Q1 u  ^" `9 N% f3 r-AX = 0912h   (Get breakpoint infos)- r) [5 r% a' B' H& _2 J
-AX = 0913h   (Set Sice breakpoints)% y8 S4 C4 S% m) r. Y
-AX = 0914h   (Remove SIce breakoints)) s  b! g$ g; g- a+ D

# r1 z" F, W' f- ~' TEach time you'll meet this trick, you'll see:* ?  P/ w- }4 y+ G' X8 c3 F$ l
-SI = 4647h: P+ p. T% @0 B
-DI = 4A4Dh" U& o/ t1 @* R5 V! O
Which are the 'magic values' used by SoftIce.
$ n2 a8 `0 `  HFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.
, L0 i! a$ _- t- l# g) @$ P6 M& `* c7 I) ?9 z
Here is one example from the file "Haspinst.exe" which is the dongle HASP
, O* {% X! P% T* ?) uEnvelope utility use to protect DOS applications:$ V# f6 C& O" ?) Y& n5 J  l  M
7 h4 h( }. @0 t2 I

3 Y2 n( \: w5 X6 d4C19:0095   MOV    AX,0911  ; execute command.; N1 ^+ P5 f+ w! l# `: J
4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).
1 l& \$ T6 h- O8 o" A8 p4C19:009A   MOV    SI,4647  ; 1st magic value.0 Y4 l* v0 X( [# K7 H
4C19:009D   MOV    DI,4A4D  ; 2nd magic value.
5 r/ B: B5 I2 C% S4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)! Z) o2 g1 D8 }: ^6 p+ J
4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute
/ U7 J" U5 [! O% e: T8 i4C19:00A4   INC    CX
7 f! \# \# j6 r/ v4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute9 l6 r! _  b' ~8 `0 V; W, Y
4C19:00A8   JB     0095     ; 6 different commands.
7 T: [9 p3 U. O4C19:00AA   JMP    0002     ; Bad_Guy jmp back.8 U" N8 z# t: {+ k
4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)
3 t6 X$ y% |/ D, Q2 v5 d% i6 w; a" w5 D9 l
The program will execute 6 different SIce commands located at ds:dx, which+ ^# J0 z: }1 [+ C: I
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT., n5 S: j1 o/ h" g7 V0 ~

5 q3 Z0 [. A8 U+ w+ H" X7 x; ~+ k* T* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
* r5 H5 \+ c$ |4 v- f___________________________________________________________________________+ @* V" n. r* K4 R1 Q6 X

" ?, e2 ?  N$ |) C( ^% z* [" b$ ^/ D! p) w1 h- g
Method 03
: J7 X/ p$ U9 S! B8 @" F- k5 h' m=========
3 L" l7 y" x) T* b0 Z* U6 T2 E( L& c9 H# w* Q/ c3 k; E) _0 G
Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
. c7 j2 _4 Q1 d2 }  B(API Get entry point)# p: F2 R; U2 y* l8 E& ^
        ' ^3 e' f3 R0 t5 Y8 v/ s
; U% F% X& S7 Q. u; I+ l
    xor     di,di% H8 f! K8 m4 D! O4 t
    mov     es,di: ?3 e! b- j$ K1 e3 N8 H
    mov     ax, 1684h      
; a! {! y3 m9 W% r/ K' H    mov     bx, 0202h       ; VxD ID of winice
: B# b2 U" u1 v. g: a( c8 Z: L    int     2Fh
' N* u- z2 N3 w  I6 @  n5 v/ C" A    mov     ax, es          ; ES:DI -&gt; VxD API entry point, u+ r! u* G4 I6 c9 V' Y! n
    add     ax, di
& E) Y  d9 C* i7 A    test    ax,ax, {( O; X: H; f8 e/ R6 h
    jnz     SoftICE_Detected
' ~. e. m6 j" U4 b" W$ ~& R  a; c) X; ]! q# u" f
___________________________________________________________________________  A" ~  p7 T, A) \" J1 i
: \* \% U2 M% {: N' W
Method 04
( U" j: m, j' L2 W1 x9 N: Y=========1 v6 t' [$ \2 _0 l% O
! H4 h9 o1 L+ K
Method identical to the preceding one except that it seeks the ID of SoftICE' @) k& C! g6 N2 s7 x' ^. c
GFX VxD.* f. x. ?2 u' n
0 h' j' O0 M& T$ ?# l, k
    xor     di,di
. i: H7 H& o& q* v    mov     es,di8 A  j0 I" U  X
    mov     ax, 1684h      
' a8 M; L3 @% d2 w8 }/ X- w/ y    mov     bx, 7a5Fh       ; VxD ID of SIWVID
& G2 m1 M) N& n$ A. \9 E  g& t    int     2fh+ N- \6 s# j4 a
    mov     ax, es          ; ES:DI -&gt; VxD API entry point
9 K- F, M8 m' h! y* j    add     ax, di
- s, t* R7 ^, U( Z8 @3 A- k) {$ v    test    ax,ax$ e8 D. P& Q! {8 f$ q/ M
    jnz     SoftICE_Detected3 a) ~5 j8 F6 z+ D# ]( L

3 c8 x1 Z0 ]$ x2 U6 u__________________________________________________________________________
3 X( l' A# w0 |( X/ ]1 c1 `) f" Q: {) l* V6 ~5 c' E, a

% z+ o# d! x$ ~4 U1 V" z6 zMethod 05
9 L$ ~0 H# y1 o  W. }2 u, F; B=========
% U; s1 D# l7 s8 w+ W+ P( ?3 k# L) m0 k. e) O: h
Method seeking the 'magic number' 0F386h returned (in ax) by all system
, X( l9 c: X3 Cdebugger. It calls the int 41h, function 4Fh.3 \  m5 }- A8 x7 @4 t+ d; ?
There are several alternatives.  ' T/ }! F2 S- d0 C

6 f5 C% _' P4 N* [' X0 wThe following one is the simplest:1 I) A* n3 d% n4 K' b) _1 O
3 `8 r' M# E+ Y7 I# u
    mov     ax,4fh$ T: j  U8 u' y- R6 I2 {7 P
    int     41h5 t2 l; ~3 T6 t# a. F% p
    cmp     ax, 0F3862 d! \5 ~+ P* Q9 i3 v- F% |1 [  {  C
    jz      SoftICE_detected& y: c0 M9 }; v- a$ t7 j

/ T! k8 Q9 S# r: U. l  P! H. D4 {  j) N! ^5 ?7 L
Next method as well as the following one are 2 examples from Stone's $ ]4 N- F! }2 L# _
"stn-wid.zip" (www.cracking.net):
$ T5 }- ]& P8 p; v
* {. ~1 J) G8 u: u! j    mov     bx, cs: l4 Y* e% F  }0 m4 [4 o4 U. T
    lea     dx, int41handler2
4 R' J! [2 k! g2 O! {    xchg    dx, es:[41h*4], ^; b: F, l8 O. l0 ^* d. ^% v
    xchg    bx, es:[41h*4+2]
$ G) T. b, A7 u9 h. F! c' |4 a& W    mov     ax,4fh1 b! {5 E5 ?8 Q: }
    int     41h
" g' g6 h* ]3 |) S" s' `* ^+ a    xchg    dx, es:[41h*4]  c0 Z: n2 s% H7 z( Y5 h$ g, Q
    xchg    bx, es:[41h*4+2]
* H# V1 M* o7 W9 O    cmp     ax, 0f386h
$ p) U& }) ^  A* m  F    jz      SoftICE_detected: V: S) u* m  X% Q- {# V4 C
- z( {) {# \5 c' G# H
int41handler2 PROC! j  V3 t' F) ~% m. P; V! B/ d
    iret' j1 J9 a) O# W5 d5 @
int41handler2 ENDP- }9 b* f4 \, s; S( q7 c
3 s5 R* G2 c% |: T2 H; }" A4 Y
# _# i/ T2 C. _; J0 z; @
_________________________________________________________________________
+ R5 d# X8 o: [) U5 D4 V4 r' f- H: k4 H+ W0 S% d
5 h! \" A, p2 h  y0 F
Method 06
  p' z3 W) e% E5 j' W3 U  v2 x- \, m=========" ~& c. h" o9 ~

2 h4 L7 T8 T( K8 y0 n) c. T( f1 ?* C3 s, L. K5 v6 f+ q. ]
2nd method similar to the preceding one but more difficult to detect:
) c! D4 h7 @% s3 |  L- A! J
& w4 I% E8 C6 }' |) P' U  D  A7 o. Z7 ~3 v; n7 @
int41handler PROC( q7 s4 p% n& h: f
    mov     cl,al
' c) k+ y2 |. ?* z    iret! w+ c% I: G- _+ f. v9 L
int41handler ENDP
& c- G* d& V! O- P$ w0 B
5 V4 F# p: r: l0 k( M7 V$ }( g1 J  ~% R) X6 ?
    xor     ax,ax
! \) d2 M! @+ p7 m    mov     es,ax# X, U: E7 X/ H6 h
    mov     bx, cs* V* S7 p# y; q& `
    lea     dx, int41handler
# L8 F- m+ p( O5 _% J, j+ b8 n    xchg    dx, es:[41h*4]
& l" g9 h* G$ e    xchg    bx, es:[41h*4+2]2 n3 T9 U- k) @/ d
    in      al, 40h
% g* \( u! x: }7 g8 Y8 T5 \8 \; @    xor     cx,cx0 v* L0 O4 f/ U
    int     41h2 K! L! B1 p" r; `0 M( p
    xchg    dx, es:[41h*4]
! u5 v7 d+ z$ f6 m8 b    xchg    bx, es:[41h*4+2]
8 f# y( v4 `5 `4 d7 N( J/ w    cmp     cl,al
; Q- |$ I, k9 T  P6 b4 l- b    jnz     SoftICE_detected$ n7 M1 F* z8 i& C" d! M5 e

3 {* A$ |  L. G; o, v% __________________________________________________________________________7 S" X8 n# G( g+ r1 |2 D

6 c6 v& r8 ]8 J% fMethod 073 Y$ w" K8 |. u9 r, R
=========
' o; R+ ]' X0 H- t/ K+ h% E. i8 q8 Q2 Y: S
Method of detection of the WinICE handler in the int68h (V86): ]- k! n8 u9 {1 L4 h

) P- j  B6 C! W% [/ o  |' E    mov     ah,43h+ T5 g: f+ M2 i* B
    int     68h- E4 N( X* W  |
    cmp     ax,0F386h
/ A$ }3 E2 Q/ E1 ]) y    jz      SoftICE_Detected' P- J- l6 V- n: Y+ Z/ I9 v
6 b% i* k9 i% w8 |4 h& V( Q( l" M

; K: o5 F' P- B& n7 _=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
$ F: g8 n) r) w1 Q   app like this:, e- E$ q, K" P7 z
) |8 t$ s% \. z' U2 K
   BPX exec_int if ax==68+ r, b: q) l& f3 O
   (function called is located at byte ptr [ebp+1Dh] and client eip is1 X, E; q+ U& g0 G
   located at [ebp+48h] for 32Bit apps)
- F/ g! Y5 k* z1 U$ N* {; U__________________________________________________________________________* s: g3 p9 A4 X$ u% i
" |, V8 N6 ^; J* J1 E8 M
! i5 @3 _9 z$ h
Method 08
' y& c2 p& o: ?' u; B=========0 o# `1 e+ Y; y0 J1 C
" r  \5 d" ^  s( G6 _+ i' F
It is not a method of detection of SoftICE but a possibility to crash the
! ~8 {4 D; l* ?$ psystem by intercepting int 01h and int 03h and redirecting them to another
0 l* Y: |( |7 O2 ~* `6 nroutine.
) b9 D  l; F. ^8 E# d* K2 cIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
" ?3 J4 J+ ]) }  j3 T6 O0 S  z" Dto the new routine to execute (hangs computer...)
- g3 Q# @2 i" I4 |- {- b+ W: k8 Q7 \8 \. C  X; P" s9 k
    mov     ah, 25h
3 ?' y$ k" D  j: j    mov     al, Int_Number (01h or 03h)
# p6 F2 W, b  k6 i    mov     dx, offset New_Int_Routine* u1 b3 a/ U6 @  `$ [
    int     21h/ _" e1 M, c  Z+ C- P$ h% W6 O

3 r6 \) W0 Q7 D3 a__________________________________________________________________________
( V3 S6 m4 I4 l; t2 V3 v
. m' l$ T4 Q: @4 @- {6 jMethod 098 L* ~1 |  d% Z. l! ^  p
=========
: m+ j5 A( K' X/ G% O+ p$ f  c
* Q) D. g% f( E; W$ UThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
* G! S3 u6 A# k/ Xperformed in ring0 (VxD or a ring3 app using the VxdCall).
& y; _  L' `1 ]$ O0 ?. H! z& SThe Get_DDB service is used to determine whether or not a VxD is installed
  T7 q, }/ C: h4 J7 Q) ]for the specified device and returns a Device Description Block (in ecx) for; t3 ^3 ]/ F9 Y' s
that device if it is installed.
8 W9 z8 ?8 F& q& e' F, Q  n' y" h5 C/ W7 G0 o( [! g
   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID5 p! `+ P$ F8 w" S4 i: _6 P
   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)( B* K0 |- A# h9 n3 y
   VMMCall Get_DDB
0 C  ]* a1 J" d0 h) h  ?1 }% L   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed
, N, g3 V, B7 }' d% b
: S6 C- [1 U; t$ k/ v" M" D5 ANote as well that you can easily detect this method with SoftICE:
" L  R5 m1 \; g9 f$ i; }4 [3 F   bpx Get_DDB if ax==0202 || ax==7a5fh$ r! e. [$ m: M! G& L( U, |

0 t" U7 ~7 V  U__________________________________________________________________________
( B# `$ m0 {! h6 B& O- P$ W. v8 x+ V8 g
Method 100 r( T- \. c- S- `  h; E
=========- h% d- O+ y! w

( j% A$ O; h( c$ ]8 k1 G=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with7 ?2 b5 n3 Y$ x8 v
  SoftICE while the option is enable!!
7 G! y: r. \& p( c
* ~% ^# Q0 S& }2 B2 S# q8 h/ U5 zThis trick is very efficient:: z/ x- }# _1 }" i) }
by checking the Debug Registers, you can detect if SoftICE is loaded% q) C: Y4 N- V  ?, ~
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if) p: r4 s2 V+ w
there are some memory breakpoints set (dr0 to dr3) simply by reading their
! U4 e7 L  u, G- Dvalue (in ring0 only). Values can be manipulated and or changed as well
1 ^/ `4 g8 {4 B( D2 s(clearing BPMs for instance)2 b  y, I) L& a3 W7 J0 U

$ V0 i0 ^+ ^- V" R__________________________________________________________________________
* {( v& B4 S4 \7 o4 d* q: ?* B* X
Method 11
8 o* O$ \8 a- b=========/ _9 g4 p2 L/ A& [. i4 l, q

/ E* O6 F- W8 @  xThis method is most known as 'MeltICE' because it has been freely distributed
9 W, j3 B" x/ z" nvia www.winfiles.com. However it was first used by NuMega people to allow
% \5 ?+ m) a$ Z8 V& VSymbol Loader to check if SoftICE was active or not (the code is located
1 z% `, t# ?8 @4 Jinside nmtrans.dll).
0 D7 E& T! {6 Y
) l9 i; ^, l! V6 H" y7 AThe way it works is very simple:
8 z# Y/ i! G$ t- yIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for: ~( h  O" f. O0 H/ x2 c
WinNT) with the CreateFileA API.
6 K* u+ n% M! W7 s2 H* [  d) a8 Y9 y4 ~1 I$ r
Here is a sample (checking for 'SICE'):
! ]( N& [4 n) a
0 m) m9 @1 @/ \# S+ @" u& ?3 F3 XBOOL IsSoftIce95Loaded()" h3 v: j* J- Q) X: @5 K# P
{6 h7 z6 C7 g8 B7 a9 q9 H, T0 {/ c
   HANDLE hFile;  " ?1 ?2 M  |4 x, a5 B3 g
   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,5 s9 {9 t9 a1 z* \& A: i
                      FILE_SHARE_READ | FILE_SHARE_WRITE,0 j0 r: s& N6 Y3 ]+ W8 K
                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
1 u2 B" O5 l: ^  Q# v   if( hFile != INVALID_HANDLE_VALUE )& ^: ~% S5 [& o) v- n  z
   {& c: o5 h2 _+ K7 V
      CloseHandle(hFile);; C6 L! U/ [( ~8 d4 y3 N
      return TRUE;
7 X# d! ]2 @4 q  P   }
3 _% H' y1 h0 C8 w& p   return FALSE;
1 W8 e0 Q* ?7 C8 m}# c- C% x/ `0 I
/ x& T8 o; I, A, n" o
Although this trick calls the CreateFileA function, don't even expect to be" Q# J( B& I% K1 }
able to intercept it by installing a IFS hook: it will not work, no way!
: q% G* }2 w, j9 t8 L1 n9 PIn fact, after the call to CreateFileA it will get through VWIN32 0x001F
8 |/ U; Y: }6 \% {0 @, Hservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
7 ?8 h- a5 e/ s5 |and then browse the DDB list until it find the VxD and its DDB_Control_Proc
. `( H: n2 }/ Sfield.
( y$ q( h# i0 C# l9 iIn fact, its purpose is not to load/unload VxDs but only to send a . Q& {- V: [: K1 m- c% G* N, g
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
% H; t: {0 r+ Bto the VxD Control_Dispatch proc (how the hell a shareware soft could try
( S  R: m$ U7 k, Z1 yto load/unload a non-dynamically loadable driver such as SoftICE ;-).
' T8 S* r: |3 D& pIf the VxD is loaded, it will always clear eax and the Carry flag to allow5 `4 K! w' y6 w
its handle to be opened and then, will be detected.
9 n5 j5 k$ ?/ w8 R+ C! J) wYou can check that simply by hooking Winice.exe control proc entry point* V$ Q& K/ A# m5 X
while running MeltICE.4 c2 @# C6 m. `* d/ v) g8 n

7 ^# z1 k& C6 K! K
9 b# D' s( m$ [# g& p: E  00401067:  push      00402025    ; \\.\SICE! \. `. ]# L* H7 d3 v# v" ]
  0040106C:  call      CreateFileA
5 Z- s9 C. i3 G( [  00401071:  cmp       eax,-001, j/ U; u; u9 A
  00401074:  je        00401091
" S1 r/ a; j5 s% T- W. c
- X# D8 M; U) R' j1 Z' e: ?0 c0 h$ N/ T; K5 n
There could be hundreds of BPX you could use to detect this trick.  I" e) |+ q; P' G; i! f. r6 j
-The most classical one is:
8 X. X: T4 c# L4 J' G& k8 b  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||( I* R. V% Z3 N$ y8 u6 o
    *(esp-&gt;4+4)=='NTIC'
7 s3 P8 g/ U: m) Z6 P* E- C
& n) u8 o, |2 l8 m-The most exotic ones (could be very slooooow :-(
) a; P7 b9 k+ k6 u! M7 Z1 h   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  ! T+ P+ p4 V, |% g: W; P
     ;will break 3 times :-(1 U4 h/ ?& C  R1 }
  g: I5 Y; F8 L
-or (a bit) faster: 9 l6 y9 w! S$ Q# k8 k2 P4 Q
   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
# u/ q5 g% L) g1 e6 T1 n: n5 Z
" x9 J) f3 q& ?/ h% ]; _& x  Q: @2 |   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  + @% \+ V, g0 q: K' R/ A
     ;will break 3 times :-(/ `  e/ B: N/ Z  i6 M2 k3 c( e

: {; [, W6 d; g: ]: l. y-Much faster:
' R, }& r* ]' X% Y8 _2 H3 f: K- V   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'
. b0 i5 @" Y2 ~8 z- B# g( R$ l( p
+ n- u7 u# s# BNote also that some programs (like AZPR3.00) use de old 16-bit _lopen
0 z0 ~) X2 k! f/ y0 Ufunction to do the same job:
7 O/ D: V7 N# Y) t: m
; R& g& m1 G7 W$ i# C- r2 V7 e   push    00                        ; OF_READ. |2 l7 _# N" M8 U, e
   mov     eax,[00656634]            ; '\\.\SICE',06 y* o2 g" k6 Q; M8 O% g8 |
   push    eax
- S" S$ f( g; P6 @6 w7 A   call    KERNEL32!_lopen
1 h, r0 e' J, I2 n% F5 F   inc     eax  r4 ?0 ?1 C# D9 G7 H. \
   jnz     00650589                  ; detected; C7 E) k2 [, B( a0 }% J4 D
   push    00                        ; OF_READ
( J7 u& b4 j) ~5 ^' S/ L# V   mov     eax,[00656638]            ; '\\.\SICE'7 P% r) o7 w' T% x4 h4 C8 D& h8 \
   push    eax
) v' i6 {& I2 m$ @   call    KERNEL32!_lopen0 p. H$ U- H2 A3 o
   inc     eax
1 x3 n1 Y' |+ Q   jz      006505ae                  ; not detected
; v5 Y, O7 a/ H2 s
# N. S* O; c6 S) @; Q' S( n/ `5 \, X3 D8 f/ c) [4 u  m( d
__________________________________________________________________________6 d; }8 N+ V5 `
! v1 }4 M& Y7 S" T7 y9 q- `+ a
Method 12( e) e) c" Q- y* _7 R
=========
+ o/ Q3 ?/ J" A8 U9 _- a( m. }( G0 B5 Y) Y+ |% i  V; F
This trick is similar to int41h/4fh Debugger installation check (code 05
5 y) Z9 n6 S4 B) x1 B$ e2 j&amp; 06) but very limited because it's only available for Win95/98 (not NT)6 G" _8 V: e* F* n  J* I2 p8 D  F- P
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.
& z. R/ f# P! u4 h, U( G! j, @$ [, z
, L3 L$ n6 O* C& F   push  0000004fh         ; function 4fh0 i/ {4 ?. }3 V; P" p
   push  002a002ah         ; high word specifies which VxD (VWIN32)
$ g1 _+ l' M, \) a: m% I                           ; low word specifies which service* {8 m  r5 Q' D& m& e( x2 ?. K
                             (VWIN32_Int41Dispatch)
+ S3 n/ o3 @' j" {   call  Kernel32!ORD_001  ; VxdCall
- h( l; v( J( [0 L7 K4 {* f   cmp   ax, 0f386h        ; magic number returned by system debuggers
( P1 N% v3 c3 d  k   jz    SoftICE_detected' C" Z+ |- k& x! k- _' X( f
/ B- \) T) o; e* u
Here again, several ways to detect it:
# f1 x0 Q  P9 y7 R2 c
5 R/ h$ X( u) g. |, R* }3 @    BPINT 41 if ax==4f
& G" [3 C  }- v, K7 Q/ C
) V: \7 Z3 e0 q! Z    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one3 V7 X0 k% B5 F. B$ c

! v6 ]% Z/ O% k$ F6 I7 [( `+ ?    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A3 Z% K# _9 H; m/ \1 K6 v' Z. Z5 Z

8 K1 d" E! \% q    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!
) t2 w! g8 `  U5 I( @& \3 U9 {$ ~+ t
__________________________________________________________________________
; h  Q  t# Q; i, C) i9 ?9 x
% K; O5 ^+ Q# p; ~+ }% ]7 eMethod 13
$ B3 K: m: n2 h+ {0 t0 P3 o0 y=========
6 ?& ]: J1 W- g# j# ], s( b: p  n
7 r" {8 ^6 |7 o+ H+ z$ cNot a real method of detection, but a good way to know if SoftICE is
2 V% \2 a$ O3 V* D8 [+ Finstalled on a computer and to locate its installation directory.; y+ j; D4 K& r/ w3 m
It is used by few softs which access the following registry keys (usually #2) :/ S* p1 ]/ r8 U

7 @% D- S0 ?% K8 U# R2 u1 {-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
* @5 X; ~6 L. k& C\Uninstall\SoftICE4 p/ R, A# o! I. }
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE6 f& E$ o, Q! [$ t' C
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
5 i* u0 V5 J5 o\App Paths\Loader32.Exe
: A( |6 S! m) a  H+ p- L0 z& ?
& Q  d7 f7 J' y4 N, i+ R: X) S
/ J* l9 N" A4 K8 aNote that some nasty apps could then erase all files from SoftICE directory
+ ^. T7 W! ^" L" J9 t' {7 L' ^(I faced that once :-(; K. m1 B% W4 U% \4 S( C) L

9 j& m5 R8 r. F) |1 b' M% A: A1 h$ DUseful breakpoint to detect it:1 l, z: I6 H' m

% }/ z, R% P0 R4 Y; ~4 u- F     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'
( E$ Y. I" A# t4 |: I( X5 T4 k4 J* L1 K  |) K: H
__________________________________________________________________________+ l; i4 E  C2 \, A1 \0 X, p
: K! U& E" o2 H, h+ }6 {) O
) N6 V) r. n- e( P9 Z7 \
Method 14 # f, m0 ~) D" l8 d5 U# k! Z0 R
=========/ x9 l6 y; u" o! q0 V8 z

' N# n3 e$ _, J. Y. L  PA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose' ~' \3 F9 q  u2 s! w9 B, p
is to determines whether a debugger is running on your system (ring0 only).+ J4 w6 M) @: n$ o! a
  i1 ^8 Y; O& \/ Q, i
   VMMCall Test_Debug_Installed
* B. @6 d. h5 c- n   je      not_installed9 v3 ]5 @$ p. i
, x+ R/ L7 _0 P- h
This service just checks a flag.
1 B9 h: r! Y) |2 i- p  o) j</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

QQ|本地广告联系: QQ:905790666 TEL:13176190456|Archiver|手机版|小黑屋|汶上信息港 ( 鲁ICP备19052200号-1 )

GMT+8, 2026-8-5 06:34

Powered by Discuz! X5.0

© 2001-2026 Discuz! Team.

快速回复 返回顶部 返回列表