Driversuite2.x如何檢測SoftICE是否啟用. (6千字)

driversuite2.x用以前的 MeltICE方法不能檢測到ICE存在了:
hFile = CreateFile( "\\\\.\\NTICE",...)

今天看了下，其實質還是用 CreateFile來檢測的，但其引數要經過計算。
例如我的序列號：78228510DD9D
記憶體中的就是NTICED052.sys在服務了
這樣就能檢測到：hFile = CreateFile( "\\\\.\\NTICED052",...)
這種方法暫稱MeltICE+
現在軟體防Sofice也太瘋狂了，逼的NUMGA也加入反反跟蹤的行列來了。

Symbol Loader要檢測到ICE是否啟用，會提示："SoftICE is active"或"SoftICE is not active"

用bpx createfila直接可中斷在nmtrans.dll裡，基本流程如下：

* Possible StringData Ref from Data Obj ->"Software\NuMega\SoftIce"
|
:1001F779 6854860710 push 10078654
:1001F77E 6802000080 push 80000002

* Reference To: ADVAPI32.RegOpenKeyExA, Ord:0172h
|
:1001F783 FF1504B00610 Call dword ptr [1006B004]
:1001F789 85C0 test eax, eax
:1001F78B 7535 jne 1001F7C2
:1001F78D 8B542404 mov edx, dword ptr [esp+04]
:1001F791 8D4C2408 lea ecx, dword ptr [esp+08]
:1001F795 51 push ecx
:1001F796 68A4DD1F10 push 101FDDA4
:1001F79B 50 push eax
:1001F79C 50 push eax

* Possible StringData Ref from Data Obj ->"Serial"
|
:1001F79D 684C860710 push 1007864C
:1001F7A2 52 push edx

* Reference To: ADVAPI32.RegQueryValueExA, Ord:017Bh // 不言而喻，取安裝序列號，我的78228510DD9D
|
:1001F7A3 FF1500B00610 Call dword ptr [1006B000]
:1001F7A9 85C0 test eax, eax
:1001F7AB 7515 jne 1001F7C2
:1001F7AD 8B442404 mov eax, dword ptr [esp+04]
:1001F7B1 C705A0DD1F1001000000 mov dword ptr [101FDDA0], 00000001
:1001F7BB 50 push eax

* Reference To: ADVAPI32.RegCloseKey, Ord:015Bh
|
:1001F7BC FF1508B00610 Call dword ptr [1006B008]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:1001F76E(C), :1001F78B(C), :1001F7AB(C)
|
:1001F7C2 68A4DD1F10 push 101FDDA4
:1001F7C7 8D4C2410 lea ecx, dword ptr [esp+10]

* Possible StringData Ref from Data Obj ->"\\.\NTICE"
|
:1001F7CB 6840860710 push 10078640
:1001F7D0 51 push ecx
:1001F7D1 E83A000000 call 1001F810 // 此處計算

{

:1001F8DA 3B742410 cmp esi, dword ptr [esp+10]
:1001F8DE 7D22 jge 1001F902
:1001F8E0 0FBE141E movsx edx, byte ptr [esi+ebx] //開始指向字串:DD01582287(設為cName[i])
:1001F8E4 52 push edx // cName[i]進棧
:1001F8E5 E84D490200 call 10044237
{
:10044237 833DE0A8071001 cmp dword ptr [1007A8E0], 00000001
:1004423E 7E11 jle 10044251 // 跳到10044251
:10044240 6807010000 push 00000107
:10044245 FF742408 push [esp+08]
:10044249 E82CAE0000 call 1004F07A
:1004424E 59 pop ecx
:1004424F 59 pop ecx
:10044250 C3 ret

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:1004423E(C)
|
:10044251 8B442404 mov eax, dword ptr [esp+04] // eax=cName[i]

* Possible StringData Ref from Data Obj ->" ((((( " //一個內建資料表，設為Table[i]
->" H"
|
:10044255 8B0DF4A80710 mov ecx, dword ptr [1007A8F4] // 取資料表指標
:1004425B 668B0441 mov ax, word ptr [ecx+2*eax] //ax=Table[i+2*cName[i]]
:1004425F 2507010000 and eax, 00000107 // 求或，值透過eax傳出
:10044264 C3 ret

}
:1001F8EA 83C404 add esp, 00000004
:1001F8ED 85C0 test eax, eax //剛才結果是0？
:1001F8EF 7409 je 1001F8FA
:1001F8F1 8A041E mov al, byte ptr [esi+ebx] // 得到第一個數字cName[i]
:1001F8F4 8807 mov byte ptr [edi], al
:1001F8F6 47 inc edi
:1001F8F7 C60700 mov byte ptr [edi], 00

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:1001F8EF(C)
|
:1001F8FA 83C602 add esi, 00000002 // i=i+2
:1001F8FD 83FE08 cmp esi, 00000008 // 也就是說迴圈4次
:1001F900 7ED8 jle 1001F8DA // 取DD01582287前四個奇數位：D052（具體要看call 10044237的結果）

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:1001F8DE(C)
|
:1001F902 8D7C2414 lea edi, dword ptr [esp+14]
.........
:1001F922 F3 repz
:1001F923 A5 movsd
:1001F924 8BCA mov ecx, edx
:1001F926 83E103 and ecx, 00000003
:1001F929 F3 repz
:1001F92A A4 movsb .\\NNTICE和D052合起來=\\NNTICED052
:1001F92B 5F pop edi
:1001F92C 5E pop esi
:1001F92D 5D pop ebp
:1001F92E 5B pop ebx
:1001F92F 81C404020000 add esp, 00000204
:1001F935 C3 ret

}

:1001F7D6 83C40C add esp, 0000000C
:1001F7D9 8D54240C lea edx, dword ptr [esp+0C]
:1001F7DD 6A00 push 00000000
:1001F7DF 6880000000 push 00000080
:1001F7E4 6A03 push 00000003
:1001F7E6 6A00 push 00000000
:1001F7E8 6A03 push 00000003
:1001F7EA 6800000080 push 80000000
:1001F7EF 52 push edx // 經過計算是：\\.\NTICED052
:1001F7F0 FFD6 call esi // Createfilea
:1001F7F2 8BF0 mov esi, eax
:1001F7F4 83FEFF cmp esi, FFFFFFFF // 非-1說明softice啟用
:1001F7F7 750B jne 1001F804
:1001F7F9 68010058A6 push A6580001

Driversuite2.x如何檢測SoftICE是否啟用. (6千字)

相關文章