14种Anti - SICE的方法（英文）

• About anti-SoftICE tricks
  text written by Frog's Print
  Method 01  
  =========
  This method of detection of SoftICE (as well as the following one) is
  used by the majority of packers/encryptors found on Internet.
  It seeks the signature of BoundsChecker in SoftICE
  
     mov     ebp, 04243484Bh        ; 'BCHK'
     mov     ax, 04h
     int     3       
     cmp     al,4
     jnz     SoftICE_Detected
  __________________________________________________
  Method 02
  =========
  
  Still a method very much used (perhaps the most frequent one).  It is used
  to get SoftICE 'Back Door commands' which gives infos on Breakpoints,
  or execute SoftICE commands...
  It is also used to crash SoftICE and to force it to execute any commands
  (HBOOT...) :-((  
  
  Here is a quick description:
  -AX = 0910h   (Display string in SIce windows)
  -AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)
  -AX = 0912h   (Get breakpoint infos)
  -AX = 0913h   (Set Sice breakpoints)
  -AX = 0914h   (Remove SIce breakoints)
  
  Each time you'll meet this trick, you'll see:
  -SI = 4647h
  -DI = 4A4Dh
  Which are the 'magic values' used by SoftIce.
  For more informations, see "Ralf Brown Interrupt list" chapter int 03h.
  
  Here is one example from the file "Haspinst.exe" which is the dongle HASP
  Envelope utility use to protect DOS applications:
  
  4C19:0095   MOV    AX,0911  ; execute command.
  
• [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11] 下一页 
• 复制本页网址和标题，发送给你QQ/Msn的好友一起分享
  
  
• 14种Anti - SICE的方法（英文） 相关文章：
• ·14种Anti - SICE的方法（英文）
• 14种Anti - SICE的方法（英文） 相关软件

上一篇:豪杰超级解霸3000[英雄版]算法分析

下一篇:中文拨号上网计时计费器 V4.12注册算法分析(4)

• 特别声明：本站除部分特别声明禁止转载的专稿外的其他文章可以自由转载，但请务必注明出处和原始作
• 者.文章版权归文章原始作者所有.对于被本站转载文章的个人和网站，我们表示深深的谢意。如果本站转
• 载的文章有版权问题请联系编辑人员,我们尽快予以更正. 转载请注明来源：http://www.hackhome.com

精品推荐

热点TOP10

特别推荐