About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>
( C* f' b$ {! p# ~2 W6 I<TBODY>3 }/ J8 ^/ p& t+ y: z+ ?% A
<TR>
" O: f( r( I* `- G/ L8 S0 A9 l) g<TD><PRE>Method 01 % b+ s/ K0 ~! `& D
=========
- ?; l4 ^2 N0 g
: P3 g- Y* l5 v4 K) s: r! u( h6 X! P# B7 zThis method of detection of SoftICE (as well as the following one) is6 _5 H9 m% ^  I0 n9 j
used by the majority of packers/encryptors found on Internet.
+ l% I6 A6 a% e6 o/ G& bIt seeks the signature of BoundsChecker in SoftICE
8 y  E# q" P6 e& _4 a4 b, A" f4 M1 X" H- I5 x
    mov     ebp, 04243484Bh        ; 'BCHK'
/ x5 a) V$ j/ t: y) k    mov     ax, 04h0 Q0 B. ?+ m% r7 ]* ]' X1 y. `
    int     3      
/ p, J$ p" b2 D    cmp     al,4& I7 S7 w( A( X) e0 J- L
    jnz     SoftICE_Detected; d# v( O7 n6 l5 k9 D
2 E; h, O- h3 v' B) n/ Z
___________________________________________________________________________7 \! ~* D6 i7 o, c7 o% [) ^& L
- d( T  k2 W# H! C# b' j( n& H
Method 02
+ c7 G0 J$ w% W+ @3 u=========
+ Y& m/ f. a: M* q+ }* ]! A6 {" Y4 ^4 H% j2 n: S1 t1 s
Still a method very much used (perhaps the most frequent one).  It is used
& B2 L# j1 u6 U( C  [" R) c, Ito get SoftICE 'Back Door commands' which gives infos on Breakpoints,! W- v# f* l- z8 U
or execute SoftICE commands...  _& L+ o2 @: c/ {' W7 q
It is also used to crash SoftICE and to force it to execute any commands& E% J! [: {8 h; O
(HBOOT...) :-((  
( l6 J3 X# H5 g7 L4 m4 V6 c" u5 G: `. d
Here is a quick description:
6 W& P+ L/ O5 n* k1 f8 [-AX = 0910h   (Display string in SIce windows)
( m( B+ b$ G) y7 {-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)0 I+ W3 p, e# f$ _$ ?& L. I
-AX = 0912h   (Get breakpoint infos)
- {/ R1 n$ M+ y) a-AX = 0913h   (Set Sice breakpoints)
. z7 y% C% I" b, I) g: r-AX = 0914h   (Remove SIce breakoints)
3 _( i8 h! ^( ]# @) U% R( s8 c- }& G5 c: p* Q
Each time you'll meet this trick, you'll see:
. |# x0 ]- ]; [- v* W-SI = 4647h7 l! V6 J. p1 J
-DI = 4A4Dh
9 f  s4 c! L" e7 gWhich are the 'magic values' used by SoftIce.4 @3 Q# v- D1 Z  [2 {6 v
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.
% B0 M: Z. M$ s. j
' g+ {) I1 t% E0 f/ U2 HHere is one example from the file "Haspinst.exe" which is the dongle HASP# O" P9 Z7 R+ j$ u" ?" v& j( l0 X" L
Envelope utility use to protect DOS applications:
! i1 O/ I# z3 S6 L$ _, ]( n- W& }, W8 \: C

. P/ V& I4 E& I# U4C19:0095   MOV    AX,0911  ; execute command.# E! w- `4 r8 _2 ^% m5 C
4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).' l, r7 N5 K+ W3 U8 e; t
4C19:009A   MOV    SI,4647  ; 1st magic value.
! ]; ?0 O8 A+ C0 J4C19:009D   MOV    DI,4A4D  ; 2nd magic value., x, v. g" G. N$ K
4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)* o/ Y" g( h( f, r, s* A( S
4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute
- J' |/ ]. ?: P6 V- e! j4C19:00A4   INC    CX/ T( e8 n" j3 f% s' j1 O7 V3 T
4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute
1 F% z4 b) s, ]1 P4C19:00A8   JB     0095     ; 6 different commands.
; j- [) j) I9 z& g" `4C19:00AA   JMP    0002     ; Bad_Guy jmp back.
) e: c- v1 n: P4 ]7 U9 Q7 C4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :); o# [0 ]$ r3 i0 a3 T- U
. l6 S% @( b/ s
The program will execute 6 different SIce commands located at ds:dx, which
+ g) c- ?) @2 w; E" @; C3 Xare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.+ t$ w. z- l8 W

4 P! O3 y" ~, G) Q% K, H: E1 }* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.$ k2 J0 x+ w2 A: D. x8 ], y
___________________________________________________________________________& ^2 J( L* h' x+ @8 F

3 l+ _3 z: A7 y* E; U# {, d0 T7 k$ U9 g+ [8 a5 B$ J
Method 034 r# `; T7 I5 X5 @' i' t
=========
& }' L/ r2 e: r1 q4 ?% |, t8 x5 a% |* z- K7 p( `
Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
4 A$ D; ]' D* g2 @% X5 V(API Get entry point)1 x' {2 Z' _' T' V4 T* t9 @3 g1 d
        9 `  `5 B: I' Q) j8 e
# c5 Y8 b  W: ~$ h
    xor     di,di' u; L& e2 a: f1 X! f* d6 l3 _
    mov     es,di
7 w9 u4 `( ]  e2 M- m  f2 k; K    mov     ax, 1684h       / u* R* ?: S, N2 ]# p) h- Q
    mov     bx, 0202h       ; VxD ID of winice
: p5 K5 C5 |9 Z% o* G4 v    int     2Fh: z- ^% H7 \1 k/ N6 K1 D
    mov     ax, es          ; ES:DI -&gt; VxD API entry point  J/ q1 {. R: Y: [- |% W
    add     ax, di$ ]+ K3 Q0 S2 r7 U# v" e1 [
    test    ax,ax
8 u5 Z4 ^+ A- Z    jnz     SoftICE_Detected5 [" V1 B$ i0 d
& Z$ C1 L4 ?' i! h! d
___________________________________________________________________________4 A$ j0 `& |+ g  J

$ ^9 T% Q* |3 _% r# }Method 046 l# f- q3 m* M" l' E8 V
=========5 V. ]4 K+ @5 i6 a: `5 B

' N* D- d9 D' b, T4 K# mMethod identical to the preceding one except that it seeks the ID of SoftICE+ V( y9 Q9 s. r2 D/ J
GFX VxD.
5 ~# A/ d/ J- Q7 w# {* o; H
( Y+ v2 I  w$ a# }    xor     di,di% i# V: b- |8 y8 n
    mov     es,di1 x2 [" t& g* ~: H5 T3 ?; h
    mov     ax, 1684h       4 i2 Z3 K3 y( V8 a1 z/ f
    mov     bx, 7a5Fh       ; VxD ID of SIWVID
: v5 w4 h$ \  l3 T8 F* i    int     2fh
. _3 Y1 V) M. o* q4 p! r    mov     ax, es          ; ES:DI -&gt; VxD API entry point$ d& _! q) N+ t2 X2 U+ \
    add     ax, di4 E, \" Z; W+ M6 P
    test    ax,ax
) {+ A4 X2 N5 @/ G' h9 }2 u7 A    jnz     SoftICE_Detected
- g% g4 }0 k, w8 F0 f  V
1 y$ q0 A7 O% E& Y  z% m__________________________________________________________________________/ f/ d0 n, I  M% F- h' O
9 R# @$ Y5 g4 n

) f$ H" N* ]7 j1 C7 K( R0 k( OMethod 05
0 }2 t5 ?4 U: s& R1 l& l: b=========
( i. z- G6 p9 m& ~  R7 j/ l. J, n' M3 [3 U2 |, \, I" p( r' x* O
Method seeking the 'magic number' 0F386h returned (in ax) by all system) k/ n# S$ N5 [5 f9 ?
debugger. It calls the int 41h, function 4Fh.8 h: H) D9 d/ _) W
There are several alternatives.  / e% R: G- @: w0 e
( }% i5 D1 [+ z% q
The following one is the simplest:8 @8 I! s: J1 J# v- u( u5 x
! H8 I6 M/ u! K4 a& N" Y( n
    mov     ax,4fh
; y- ^: e9 B* I, e* D% \    int     41h% o! Q9 g5 M, c7 g1 B: w
    cmp     ax, 0F386  w. k5 ~7 O0 M' v4 T- t  `
    jz      SoftICE_detected
$ _% ]& [8 y" t# B% o/ O2 M" v( ~) h. S: v
" H& z0 e7 {: Y( R( |- |
Next method as well as the following one are 2 examples from Stone's ; K2 D8 k& U6 {" W0 v6 c
"stn-wid.zip" (www.cracking.net):# M; M/ G3 V4 X! m& B1 X

3 f2 {% l7 t# H5 ^    mov     bx, cs# ?% y6 k2 V% K( K
    lea     dx, int41handler2
: G% U: ^8 s3 E5 W2 g    xchg    dx, es:[41h*4]7 t9 X4 \/ G: A! ?8 V/ G0 A9 ~
    xchg    bx, es:[41h*4+2]4 [8 C/ w% A7 D
    mov     ax,4fh6 w7 }3 V9 @: x' O7 E4 o: U# N
    int     41h9 P: e# k, t0 e  K+ G6 _( ]
    xchg    dx, es:[41h*4]
/ O+ b1 {5 [0 w  E    xchg    bx, es:[41h*4+2]$ G8 t/ W9 t' b
    cmp     ax, 0f386h& s# E+ r& D- A  D7 y* a
    jz      SoftICE_detected6 x' r# @( w: l% m
! b* y. p) m5 t1 _( m
int41handler2 PROC, c0 k4 ?: F4 [5 s
    iret
2 U0 [) j. U8 Z$ P& O4 jint41handler2 ENDP% g$ W* D6 X& y

+ D. J! m* g2 i' v3 Y) }* a. P/ O( l$ [8 Q& `- u
_________________________________________________________________________
& t9 X4 E+ f- \1 P7 ^$ e3 e
; j) Y& v' |) E8 g7 P9 T4 x5 J* |' r
Method 06
3 }' t6 z$ E1 ]4 N5 R% @2 X=========
. S2 C- L% U+ ~; d& d
! G$ M) p& m; F7 I+ z; Y- _9 J2 _5 z( l$ ]
2nd method similar to the preceding one but more difficult to detect:
# ]% D: |1 i/ @/ o0 R; l( u! n* d

6 G" g0 o8 u. L! k3 `2 O. rint41handler PROC
, R2 g0 }6 i7 n" h! B    mov     cl,al( `4 _+ j/ n! e- z
    iret1 K0 r5 I/ j. u: }5 o" ]1 A/ z  U6 w
int41handler ENDP
" Y( N' k9 f( Q6 }) q$ C* |- P' K% R1 y
3 b2 p+ j8 o8 Y( D& [5 `7 t/ x# u* h: V0 G! ?3 j! u2 \
    xor     ax,ax, I( g3 j1 S7 n$ |0 T5 i
    mov     es,ax" g! T& H5 O' u* ~: S. n
    mov     bx, cs
, R: U0 O3 P! m' U    lea     dx, int41handler
5 a2 o% `3 H8 ^" m' s. o    xchg    dx, es:[41h*4]
/ Y3 a9 @' K/ s; k7 J3 d    xchg    bx, es:[41h*4+2]9 l+ M6 A3 V1 t- k5 X
    in      al, 40h7 T: g4 d+ T& A9 v$ S9 b/ F: d
    xor     cx,cx
; l6 U# e; D8 w+ d" r( M    int     41h
; S& b% u% c4 b( Y    xchg    dx, es:[41h*4]- F% G7 x; e: e( }' W5 S8 g1 g
    xchg    bx, es:[41h*4+2]$ B, n3 q0 n/ ]
    cmp     cl,al
) a# M. K  |7 W4 ?  P    jnz     SoftICE_detected
8 E$ R& d- A3 Q# @8 Z; B5 S0 W8 o. O& D! Z. Y! @: Q* Y( S: S
_________________________________________________________________________
4 n& J/ I7 r5 G7 p
3 l) \+ f# m% rMethod 07
4 ]) N+ V) Q; C" r% O- a=========
" F" F# Y( r8 R) q* V- h# k. Y6 I( ~7 E" x7 S
Method of detection of the WinICE handler in the int68h (V86)
$ V) b+ \1 _* g  W5 C* `4 c! t- v. b8 G% l) J. e& a3 {
    mov     ah,43h
+ q0 k' s! o, M. x    int     68h
$ n1 I1 S* ]$ `; }, u/ r5 s' T0 T    cmp     ax,0F386h% B& b; d, Y9 b9 W& H' z/ @& K
    jz      SoftICE_Detected
6 f/ W* G1 S. {4 T( ~0 r
. @: i: u. k9 x* O1 U0 S+ b7 E2 P
=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit+ J9 Y' Q  c5 q0 n7 L8 d& L
   app like this:8 D/ N7 J( Z$ O7 |# r8 X6 f* \

5 }; j  p) ?5 j: H6 e; P   BPX exec_int if ax==68* u5 d6 Z) k7 s1 f! o$ j0 Z: t- V# t
   (function called is located at byte ptr [ebp+1Dh] and client eip is
) J9 E9 o, e' R9 M% i+ a   located at [ebp+48h] for 32Bit apps)
+ h4 z5 x( L! ^__________________________________________________________________________
' ], C. M+ D( Q8 D: w' L1 ?" d' P' i2 `/ y

. }' H" M3 o( x& _/ R/ FMethod 08
  M/ q9 ]# [% s# o0 O1 b=========
3 A* k9 R% F$ T3 v
* R) c  M3 s. d$ H3 gIt is not a method of detection of SoftICE but a possibility to crash the* `0 b1 @7 `2 A- ~6 N8 r4 c
system by intercepting int 01h and int 03h and redirecting them to another
3 J. V$ W1 G9 ~4 }9 G1 Droutine.
- X3 S' Z6 B$ H5 e3 @3 X6 lIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
( _) F# \& O' Eto the new routine to execute (hangs computer...)
9 W( q* f0 y# R7 ^$ P
6 q% K/ u* c" q: a( x  l+ `1 m2 `    mov     ah, 25h
5 d% B8 w4 F- F4 {1 X$ p    mov     al, Int_Number (01h or 03h)6 a9 T- G! K& e; Z6 Q, i
    mov     dx, offset New_Int_Routine
: y+ E$ i' o% B! u% E3 I    int     21h" ]' ~9 |2 Q8 ~) ^& D
0 x( Y; t4 v  H9 H8 |& J
__________________________________________________________________________
+ U$ U: o- {* Q- R0 a9 c3 j4 R$ @( c0 R$ \; Q  r( A
Method 09& _1 q& F  _. Z) O8 F
=========
8 H! i+ Q- F" K9 E4 o$ f) Z. v. w, o& Z4 s" k
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
6 w4 [- L8 F7 S) Cperformed in ring0 (VxD or a ring3 app using the VxdCall).0 Z1 C8 m; H  }5 q1 f9 a' X
The Get_DDB service is used to determine whether or not a VxD is installed
& I( @4 g- ~% U& qfor the specified device and returns a Device Description Block (in ecx) for
( e, A+ Q0 ^9 ?7 D. E) R: ^9 Bthat device if it is installed.+ J3 d1 b# Q8 C7 ~, s* x/ w
8 V0 i/ i- s  L- F
   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID- x  Y; r7 a9 y3 M$ [2 F* c5 R
   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)5 S3 U: s: x7 e; ~/ }7 t3 Y! W' p
   VMMCall Get_DDB/ R8 D: G) y" P& {+ u4 m! N; V/ L% ?
   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed; n) N) C4 G% |$ ^) n" v

1 Y+ y' Q3 {3 N9 B6 |0 W% J% y9 ANote as well that you can easily detect this method with SoftICE:/ Q) T( D* A+ ]" I
   bpx Get_DDB if ax==0202 || ax==7a5fh, r, f# d! v# ]. M$ P
$ L( z/ S( ^; x$ p6 Z7 w8 F! t
__________________________________________________________________________
- p, b; w2 s. ]: z
* r' [9 f- O4 V+ B$ GMethod 10
- i9 l8 b1 R* w- j0 z( S1 l5 r3 |=========
$ W; f/ p. [/ Y# `* L# u4 {2 Y: S5 {  P# `* ?! Q
=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with
5 H3 a5 _$ c9 Z! s  SoftICE while the option is enable!!/ d7 a0 e; J) w

. A2 z; f4 I3 e9 E8 c- z  {This trick is very efficient:) |' l3 E4 c" q  L6 j" \4 A
by checking the Debug Registers, you can detect if SoftICE is loaded  [" ~0 \6 t1 D
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if9 F8 L  ^. M! S( q& y0 U9 R/ _. R
there are some memory breakpoints set (dr0 to dr3) simply by reading their- L- s( Q9 c3 p& L2 l
value (in ring0 only). Values can be manipulated and or changed as well
6 P" w* X4 S; h2 p(clearing BPMs for instance)
; c# w, M- s5 j2 [2 s, p4 ^, A7 O" `4 |4 ~, i/ r
__________________________________________________________________________$ Q/ S0 d; L5 B* [
! G3 ^, Y# ~2 B
Method 11+ {. q  `1 x3 ~* @  E
=========) T* J2 n$ x2 g! O8 M
/ L$ [4 `& e8 r4 W5 `7 r; u4 {
This method is most known as 'MeltICE' because it has been freely distributed
+ F1 @. z1 T! G2 P. t1 z& Zvia www.winfiles.com. However it was first used by NuMega people to allow
  n1 Q% L2 g1 ]9 ^. xSymbol Loader to check if SoftICE was active or not (the code is located2 z! f3 u* M# M3 o* v  v
inside nmtrans.dll).
+ Y" N, D& U2 C; u
+ ?2 s3 r* o* kThe way it works is very simple:
3 h  Q7 ~8 H0 [' IIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
% T/ l: x% ]* o; X' uWinNT) with the CreateFileA API.( d3 c8 o3 i8 k- U+ J4 a) }* E

' j0 R! ]5 y. }( {; CHere is a sample (checking for 'SICE'):* K2 W* d6 O. U. }- ^/ u1 b/ B6 N
  d: s; Z9 R- o" }3 D
BOOL IsSoftIce95Loaded()7 ]. h5 W  B7 ]# E; Y; ^) n
{& k6 D% K+ n2 _5 Y
   HANDLE hFile;  
% s! L' M$ W/ l9 k& v   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,/ W* r4 q/ ]: X% b1 ^: W
                      FILE_SHARE_READ | FILE_SHARE_WRITE,/ j* E  `; z8 u- Y
                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);' A& f( N- K& h# [
   if( hFile != INVALID_HANDLE_VALUE )$ R5 D" x" z8 w, S8 ^$ K# G+ D
   {6 y& I  M) s6 D
      CloseHandle(hFile);) w2 Q  P) F! B/ L
      return TRUE;
. V4 h# s0 n# U0 G- X   }
7 R. f8 c( S. T7 R: [& F$ K   return FALSE;
/ A. v4 }9 B; k}
8 |, ^: [. w& [) R! N) K7 I" E6 ?  W
$ H0 Q8 s# S2 s/ F$ m) g, QAlthough this trick calls the CreateFileA function, don't even expect to be' s" ?; _' A, A9 `2 R
able to intercept it by installing a IFS hook: it will not work, no way!5 {, p5 l* R9 r6 _+ Y# }
In fact, after the call to CreateFileA it will get through VWIN32 0x001F$ f0 p5 i* y! ^) s. B
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
! `6 \9 R$ a* gand then browse the DDB list until it find the VxD and its DDB_Control_Proc
1 ]% K* Z* g8 w# m4 C7 @field.
8 [1 S: x: K  |4 X* rIn fact, its purpose is not to load/unload VxDs but only to send a 9 }( d& G$ N) |; U8 M) z2 b
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)( c6 a2 C% n# [
to the VxD Control_Dispatch proc (how the hell a shareware soft could try5 S4 ]8 y3 G+ ~7 p5 X
to load/unload a non-dynamically loadable driver such as SoftICE ;-)." W. P% x5 U7 N. d
If the VxD is loaded, it will always clear eax and the Carry flag to allow
  T$ T4 U. M' f8 eits handle to be opened and then, will be detected.
+ _, Q! f+ o$ _6 qYou can check that simply by hooking Winice.exe control proc entry point/ [, C6 ]8 o& w( t+ {
while running MeltICE.. m3 H9 D3 c2 k- |& v+ L# m* O4 O+ u: ~
6 w4 q. B9 n1 X$ H

* _' C( [/ J+ _: Y- M- @, L9 j  00401067:  push      00402025    ; \\.\SICE
2 L( J3 _' F! M# n; a  0040106C:  call      CreateFileA
7 ^9 D, F' w2 Q0 O0 B: D0 a* E# [  00401071:  cmp       eax,-001
  L. @0 E8 P/ a! n6 W6 c  00401074:  je        00401091
/ S1 l" m3 [+ N. Z% H- x8 _3 @: g# ]3 u0 k) [. A

1 l% A2 d' L, ]/ `% R, zThere could be hundreds of BPX you could use to detect this trick.4 b, ]8 l1 ]6 O
-The most classical one is:
* F/ y, Y0 \/ j  H  e+ [  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||
4 F* R* A* E9 |- {9 x# o3 v    *(esp-&gt;4+4)=='NTIC'. C) d9 ?9 e) t3 F

) h& e& A$ g/ x' i- C. a" L7 _-The most exotic ones (could be very slooooow :-(
7 Z+ Z4 H! L  C   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
1 ^3 Z# p& k- B+ y0 t' f     ;will break 3 times :-(
4 L6 |2 ?! T) c7 E/ h+ H" M- ^6 @, q9 r1 y8 ^- p
-or (a bit) faster:
9 O0 t" o: }* k+ z5 J: ]% Y+ q   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')8 @' J) h/ p/ u

) O" a7 s' w7 x/ R5 X   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  - n7 t2 h" }) |1 I, p. U/ N
     ;will break 3 times :-() _1 Q" }* s/ w0 s3 R% ?+ X
! j3 u6 N' i: K$ n2 s# r
-Much faster:
, w. \5 l% i, J. i. ~   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'" ]5 p* i' m+ }) ]9 u& }8 S- E
. Q; c9 k- @, V/ x( m; p' ?
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen8 t! P  W* b9 C" I+ G- `
function to do the same job:
$ V8 F) w% R; B1 U* E) A
/ o# q8 }. _2 p8 U" N! w, m8 k   push    00                        ; OF_READ
2 |4 A0 c) U& T- w/ u  Z   mov     eax,[00656634]            ; '\\.\SICE',03 D" Y" H$ b5 R$ |
   push    eax& a! R0 j6 P) f2 k- p3 ^* K% G5 [
   call    KERNEL32!_lopen. H; ^9 Q: W* v' h5 X9 b! s
   inc     eax
6 o) E, Q0 l5 O( b  C3 N' e   jnz     00650589                  ; detected
, J9 j* b  I% E1 p   push    00                        ; OF_READ" y4 r# A0 W* x! ]) `1 \
   mov     eax,[00656638]            ; '\\.\SICE'1 M; n3 z5 I8 w2 i, A
   push    eax
. k/ ^( |( C- \5 r. W$ {   call    KERNEL32!_lopen4 B# a# [" e! d
   inc     eax9 S$ T4 _/ l7 k7 V
   jz      006505ae                  ; not detected. ?& q, a0 A# w. k- t' r( s

; }/ Z$ K) [, E3 K6 E5 a. f& ]- s5 `0 _
__________________________________________________________________________- T9 @' s, K* V& p4 d6 M

- ?+ ?' I/ T. O# O7 M3 LMethod 12
: U) d( m: A" B7 B6 t=========+ G# z# [( I$ Y$ x$ }* f5 N/ t3 F
! Q2 I& F5 D) d( u
This trick is similar to int41h/4fh Debugger installation check (code 056 N7 N  w: g/ g- e# e, y) X2 N
&amp; 06) but very limited because it's only available for Win95/98 (not NT), t4 ?" |9 w$ X6 X% r; l. j
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.
* y9 f% {- }+ i) @9 T; B
3 V1 W2 f, C/ a9 `# V( `+ p" ^4 I& Q, D   push  0000004fh         ; function 4fh4 O7 p# ?4 c  A9 f4 T
   push  002a002ah         ; high word specifies which VxD (VWIN32)
, ?. U# U( U1 X                           ; low word specifies which service
% m) Z' E7 n7 X* p                             (VWIN32_Int41Dispatch)
1 Y( S. X$ W5 H( T   call  Kernel32!ORD_001  ; VxdCall- c# Q9 ~  Z7 h- c9 Q+ t9 M
   cmp   ax, 0f386h        ; magic number returned by system debuggers
2 c, ^! x3 M) A* R3 o   jz    SoftICE_detected
, D; M" R4 I! e7 q6 y; p9 [$ |. {; R
Here again, several ways to detect it:9 }: n9 H0 W( k. J  M
$ c9 X9 u3 E3 N
    BPINT 41 if ax==4f3 |9 M" G9 P+ _

  G# i8 f; A5 [$ j    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one
' b% t, K" ]9 u1 e$ @9 U% [' Y7 C' o7 G
    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A
" f; j4 h! x* A8 f
. d4 ^. u5 W3 _    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!2 ?- x8 m! Z& ]- h% b8 [

* t$ @) I. O% s' F: [__________________________________________________________________________
# B+ ?  b: i7 A( ]7 g5 i
- B% C( M+ D+ G! OMethod 13: H  V# @+ K7 e: A! o/ A4 M
=========8 i( v& ~, }) f1 e
0 i7 L$ n' e* [5 m" d
Not a real method of detection, but a good way to know if SoftICE is% ^3 K* q, _' p7 D+ F( v1 q7 U
installed on a computer and to locate its installation directory./ t3 [5 w9 ?, b  f
It is used by few softs which access the following registry keys (usually #2) :) G  H% P/ N7 e; N6 ~0 o  T
5 f2 N7 T$ L4 U+ i& Z, r
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
1 r% o; X5 i# L9 `8 Z\Uninstall\SoftICE
) V! `9 S/ S. ^-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE1 S+ f3 a1 I% K' X
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion) a0 Z" |$ d, `% y: M9 N  N0 a
\App Paths\Loader32.Exe8 \7 y' F* n9 l9 C  t% e
+ {: f" z1 n8 _3 K1 O

( c3 g! K3 a1 r( N9 ]9 RNote that some nasty apps could then erase all files from SoftICE directory
) e. u0 M0 e# N- C6 s/ t3 E(I faced that once :-(% \. R0 k% ]2 X/ |! c: y

( ?! X0 [" b  w( s* E1 y$ h* mUseful breakpoint to detect it:9 U8 k; s% W- E" U- o
5 T1 j2 g# J5 X
     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'
/ ^/ S) q2 R1 N' r9 O7 z3 H. `1 H0 ?* n2 }9 m3 u  X
__________________________________________________________________________! {  O, k% ?" W9 K, Q8 m' I

0 O/ o7 N& P7 {
9 o6 g+ d# i& u, }9 L; S) G. gMethod 14
3 J  p5 \' Y& y4 @$ M# R=========0 `: N' `' D, K& _: G! Q$ ]5 f  a6 o

6 f8 S$ c2 {6 d# C7 M5 n. EA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
5 W2 q, B! y2 G- v9 Z( l! L: I1 Sis to determines whether a debugger is running on your system (ring0 only).1 @+ [' ~' m) x) _) R0 Y) B/ j
  U3 Z" F- [2 _% i, a: z
   VMMCall Test_Debug_Installed3 a" K0 I% W( s8 v, Q
   je      not_installed& e/ M1 z8 h% ?, Q- K1 @

8 p4 [0 G& F$ h# W  f' S% `This service just checks a flag.
9 R6 n1 w8 y" t/ V( F</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

关注公众号

相关侵权、举报、投诉及建议等,请发 E-mail:admin@discuz.vip

Powered by Discuz! X5.0 © 2001-2026 Discuz! Team.|鲁ICP备19052200号-1

在本版发帖
关注公众号
QQ客服返回顶部