About anti-SoftICE tricks

<TABLE width=500>
& s5 v$ X: ?& S3 S<TBODY>
2 j, ^; r' j- V; Y: C<TR>
<TD><PRE>Method 01
=========

This method of detection of SoftICE (as well as the following one) is
used by the majority of packers/encryptors found on Internet.
8 U5 u# O9 e" j) Q0 ~5 ^9 dIt seeks the signature of BoundsChecker in SoftICE
6 Z& k! q% }3 [8 e$ T. L8 R$ K6 Z
2 {3 t  ^, a. I4 H- V5 u    mov     ebp, 04243484Bh        ; 'BCHK'
    mov     ax, 04h
    int     3      
    cmp     al,4
    jnz     SoftICE_Detected

3 f% ^! P: v! I. R, R* ~& B! l/ U9 o, f___________________________________________________________________________
$ F% Q: J9 F% }9 H0 s$ x
Method 02
; C8 A2 F2 ?) `7 c$ i=========
# a) e1 x8 w: V; ^6 c+ l0 A- \% F
8 t4 [* j7 M! ~' Z6 u0 f6 LStill a method very much used (perhaps the most frequent one).  It is used
1 N, p& a8 p, D/ t. o6 Tto get SoftICE 'Back Door commands' which gives infos on Breakpoints,
9 {- Z/ p/ @  T: J. Bor execute SoftICE commands...
* d( X( q& @! _' s7 j0 NIt is also used to crash SoftICE and to force it to execute any commands
(HBOOT...) :-((  

Here is a quick description:
. K4 L9 g* O8 I-AX = 0910h   (Display string in SIce windows)
-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)
: U5 J* a1 w# b1 W; y-AX = 0912h   (Get breakpoint infos)
3 G4 x  B; w: z' m7 i( z-AX = 0913h   (Set Sice breakpoints)
0 r- F4 \5 U- L) ^-AX = 0914h   (Remove SIce breakoints)
% }- q! ~, E1 T6 p# S- `  I) p6 y3 g
Each time you'll meet this trick, you'll see:
, _( X5 `. W: d' p0 g-SI = 4647h
$ w0 V. b) O3 U9 d! u( R-DI = 4A4Dh
Which are the 'magic values' used by SoftIce.
4 t+ p- e/ y( A0 `+ ^3 DFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.

1 L  p! S; B7 C0 l' A* ?Here is one example from the file "Haspinst.exe" which is the dongle HASP
5 B( `: t# K$ M5 }Envelope utility use to protect DOS applications:
- r* P' r% K- M3 l
& c" N# a! s! _- @& ]7 K8 R1 {
; ^5 a2 [+ x9 [& L% I9 G. o2 f4C19:0095   MOV    AX,0911  ; execute command.
4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).
+ d6 n4 n5 l, L% n8 N! P+ r8 a$ S4C19:009A   MOV    SI,4647  ; 1st magic value.
. o5 a. i* E& n8 @( M# ^% @, y" |4C19:009D   MOV    DI,4A4D  ; 2nd magic value.
! S+ |, t8 Z3 g1 o7 @* n' Y6 f4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
- g9 y; i0 x; w4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute
4C19:00A4   INC    CX
" g7 K9 s; z7 k- L7 A: B) n' b4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute
4C19:00A8   JB     0095     ; 6 different commands.
1 o# P: u' E% o4C19:00AA   JMP    0002     ; Bad_Guy jmp back.
4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)
1 z1 N8 T) s( k7 `' U" v! p4 W
The program will execute 6 different SIce commands located at ds:dx, which
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
; e; f& Y- r4 y" A
: v# u$ q* B( h2 l1 k3 B( I* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
___________________________________________________________________________

0 S& ^& C5 B- b3 D. U
) ?2 d" I5 N. `0 j: y' `  TMethod 03
0 u% x1 F) R* }* |=========
, g* i8 _7 x& ?9 M
Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
(API Get entry point)
' S9 b  s4 ~6 {$ j" _9 B. p        

) F/ @8 }/ n2 \3 T    xor     di,di
) \- A9 A! P1 y" G& n! ]    mov     es,di
    mov     ax, 1684h      
6 p1 R# j) y3 C' m    mov     bx, 0202h       ; VxD ID of winice
    int     2Fh
    mov     ax, es          ; ES:DI -&gt; VxD API entry point
    add     ax, di
    test    ax,ax
    jnz     SoftICE_Detected
, p# d1 n3 j; P, O8 }
0 F. D6 T0 \* x6 d- p( g___________________________________________________________________________
  `# i, k/ _) x, P9 S* V
# r9 K( ?  F* m/ @# rMethod 04
  R5 e  B' ~1 {! T  T=========

Method identical to the preceding one except that it seeks the ID of SoftICE
GFX VxD.

# }; a  a# P& w1 ]: w    xor     di,di
" ~7 k  h, g7 [9 W: [- R5 \$ J% n  n    mov     es,di
0 |: N8 f" }. T5 x4 F- u    mov     ax, 1684h      
    mov     bx, 7a5Fh       ; VxD ID of SIWVID
- ~, G5 n! ]7 _  T# b( W    int     2fh
; b9 V2 o+ U& y2 a    mov     ax, es          ; ES:DI -&gt; VxD API entry point
    add     ax, di
    test    ax,ax
    jnz     SoftICE_Detected
1 [1 ]/ b% g5 s" n/ U* M
4 i# I1 Z$ l: g6 b& x+ X* n- g__________________________________________________________________________


. [- J! `1 Q- C% eMethod 05
=========

# p4 b  b% C0 d& DMethod seeking the 'magic number' 0F386h returned (in ax) by all system
5 b- z3 l+ R, o* F/ g) pdebugger. It calls the int 41h, function 4Fh.
There are several alternatives.  

  c) f% X7 O7 lThe following one is the simplest:
# I( [, D' |8 q3 c: v! g% d
* A5 Z& l3 U" n0 i' n    mov     ax,4fh
    int     41h
    cmp     ax, 0F386
8 F) _$ ^" \% H" o* [) l    jz      SoftICE_detected

* J: W6 N1 C# z( e( g: H
& w( Z3 B1 l0 s/ r; Q+ @$ c0 zNext method as well as the following one are 2 examples from Stone's
"stn-wid.zip" (www.cracking.net):

    mov     bx, cs
    lea     dx, int41handler2
    xchg    dx, es:[41h*4]
    xchg    bx, es:[41h*4+2]
; p, R8 q  v+ m  m1 t- I" D    mov     ax,4fh
    int     41h
    xchg    dx, es:[41h*4]
2 @- J! u$ Q9 c. _% k    xchg    bx, es:[41h*4+2]
    cmp     ax, 0f386h
4 f3 V& }$ c! Y: W* Q5 B    jz      SoftICE_detected

int41handler2 PROC
    iret
# v# h, H7 A4 l% d. oint41handler2 ENDP


_________________________________________________________________________

" K! Q: T  G5 F5 A" p* Y0 H
# T8 O1 w1 t" ~+ e3 D7 W( BMethod 06
8 T4 n6 x5 Q0 u1 ^( E; M) m6 u=========
! s7 p# a( m5 W8 T) r9 @

2nd method similar to the preceding one but more difficult to detect:
6 I5 q, Z- Q& \& j- C6 F
8 [4 ?0 l7 c9 \) J
) i( y0 k9 A% N; U/ Cint41handler PROC
    mov     cl,al
, X4 n# }8 U( Y& {9 N) M3 O" h: Y1 z! P    iret
% j. r1 d" ]4 F; \5 Sint41handler ENDP
" E& A5 L+ c5 |( ?5 r- e$ n; w7 x

6 I4 U8 @3 r# H) X: Y1 j1 d    xor     ax,ax
& [3 p9 F4 Y1 w    mov     es,ax
# M( e; |: T! ]+ P3 l. B    mov     bx, cs
    lea     dx, int41handler
    xchg    dx, es:[41h*4]
    xchg    bx, es:[41h*4+2]
    in      al, 40h
    xor     cx,cx
    int     41h
7 ]7 i. Z- {! b1 J" H! \- h5 A* }$ L    xchg    dx, es:[41h*4]
% `9 U& R" F; w    xchg    bx, es:[41h*4+2]
5 e" f' a- C+ |  F! ]8 }    cmp     cl,al
8 H, f2 L7 r% q6 X4 n0 G% y    jnz     SoftICE_detected
3 S9 L2 _/ J3 i$ X6 b
_________________________________________________________________________

! W& P8 R4 `; D8 @Method 07
. }9 Z) J3 }: u9 w, g. f# J, t=========

Method of detection of the WinICE handler in the int68h (V86)

8 T" s' K5 c$ H' u& D% T    mov     ah,43h
) h2 {: r' A% q4 W; J% H    int     68h
9 d+ h& l/ r: @0 h. r    cmp     ax,0F386h
- ^" O  U) R+ H' r; w- f: C    jz      SoftICE_Detected


=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
& z7 t- S- j9 X) ~; }6 S7 P   app like this:

   BPX exec_int if ax==68
   (function called is located at byte ptr [ebp+1Dh] and client eip is
   located at [ebp+48h] for 32Bit apps)
__________________________________________________________________________

- V2 {4 ~+ {2 ?: X4 o- Q6 _3 W
Method 08
=========
2 k+ O( B9 ~# N0 }0 f8 u
It is not a method of detection of SoftICE but a possibility to crash the
/ W  S/ A/ G4 jsystem by intercepting int 01h and int 03h and redirecting them to another
routine.
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
to the new routine to execute (hangs computer...)

    mov     ah, 25h
( z. F' J) A0 i& P$ S7 M    mov     al, Int_Number (01h or 03h)
) @# G6 Y/ ]  W    mov     dx, offset New_Int_Routine
    int     21h

4 w1 ^1 k+ v' j- C* X__________________________________________________________________________

Method 09
=========

8 a) C; O1 N% h% T: P4 a# s  }This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
8 L. T" F- L- ^) h7 w+ k5 kperformed in ring0 (VxD or a ring3 app using the VxdCall).
5 r- k0 I/ [- R9 T7 N, Y$ JThe Get_DDB service is used to determine whether or not a VxD is installed
for the specified device and returns a Device Description Block (in ecx) for
that device if it is installed.

- u, O( f4 M& i+ s8 A) B   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID
+ _) }) D$ V9 E   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
   VMMCall Get_DDB
   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed
, L( b' |6 d0 c- K; s
4 g2 d. ]" N; r7 V0 {  [( ANote as well that you can easily detect this method with SoftICE:
   bpx Get_DDB if ax==0202 || ax==7a5fh
9 g, ]$ v0 k2 T
* f+ X% a# e5 i$ u+ Z: x" K__________________________________________________________________________

Method 10
: V( a; s( {5 g% D, k# Y2 U=========

=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with
  SoftICE while the option is enable!!

5 O7 P4 D, J5 T" Y8 r* q/ U$ @- nThis trick is very efficient:
: f9 |. g4 {8 ?  O# h! X) |, Rby checking the Debug Registers, you can detect if SoftICE is loaded
$ g, e* ?1 g' J  S0 ]( t5 f(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
4 {" a) j3 z# Y- nthere are some memory breakpoints set (dr0 to dr3) simply by reading their
value (in ring0 only). Values can be manipulated and or changed as well
/ J) x* |! ^5 u$ F(clearing BPMs for instance)
$ X6 S) J3 ?+ G: L  b3 u8 ^& X
__________________________________________________________________________

Method 11
=========
; Z) ]' k- |7 u- V2 r2 ], [
: N4 W; H0 m9 K1 R& h! RThis method is most known as 'MeltICE' because it has been freely distributed
0 Y0 p: v# W0 ?: H. ^  hvia www.winfiles.com. However it was first used by NuMega people to allow
) |$ n) c' W/ U+ d& J+ SSymbol Loader to check if SoftICE was active or not (the code is located
1 O) m9 ^/ B7 y0 O0 b4 uinside nmtrans.dll).
6 v/ @/ {) S4 i3 W# H# a) K5 N, {; z  w
7 y) J2 I/ A1 j- F# w  M/ OThe way it works is very simple:
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
5 d1 @: u! o1 ]+ [$ sWinNT) with the CreateFileA API.

- r7 K8 G2 S' m/ oHere is a sample (checking for 'SICE'):
3 B+ \: I" @) _5 W4 s' S  U/ J
BOOL IsSoftIce95Loaded()
8 {! t5 K. L& g{
# w( C7 k  O5 M. T   HANDLE hFile;  
   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
                      FILE_SHARE_READ | FILE_SHARE_WRITE,
5 c1 B! \0 t" j  ]                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
; D) a# x5 z9 C& Y& u   if( hFile != INVALID_HANDLE_VALUE )
   {
      CloseHandle(hFile);
      return TRUE;
, d/ t9 L3 ~, o& F7 X) O3 e   }
9 r0 u+ T  t3 _6 x. Y   return FALSE;
}

Although this trick calls the CreateFileA function, don't even expect to be
able to intercept it by installing a IFS hook: it will not work, no way!
! h' f( a& p2 E) Z' G* cIn fact, after the call to CreateFileA it will get through VWIN32 0x001F
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
and then browse the DDB list until it find the VxD and its DDB_Control_Proc
( i& N8 ~  ]7 v. ], a; qfield.
! j9 Y9 H) V% y0 r) A" RIn fact, its purpose is not to load/unload VxDs but only to send a
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
- ^* z% F! R" W' v( }2 _9 o' |to the VxD Control_Dispatch proc (how the hell a shareware soft could try
2 }' f/ U" H( S' I. S7 l) A! H( |to load/unload a non-dynamically loadable driver such as SoftICE ;-).
2 ~& Q) F4 r6 A. G: e0 G6 G' nIf the VxD is loaded, it will always clear eax and the Carry flag to allow
its handle to be opened and then, will be detected.
1 w6 y) G# H" _4 a* VYou can check that simply by hooking Winice.exe control proc entry point
while running MeltICE.

# H8 ^- a; M# r0 d
  00401067:  push      00402025    ; \\.\SICE
1 s' T' d( w% {  C% V; H8 p  0040106C:  call      CreateFileA
2 h" u; m& P  Z& @& v  00401071:  cmp       eax,-001
  00401074:  je        00401091
, X6 F3 G2 A8 Z4 ?3 s* W
- ]( I9 ?# y  }5 A5 J
There could be hundreds of BPX you could use to detect this trick.
-The most classical one is:
6 P, j: j5 M) o9 k  W# n( g  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||
/ f) ]0 v- f  H0 U- y/ S3 G    *(esp-&gt;4+4)=='NTIC'

-The most exotic ones (could be very slooooow :-(
0 m4 P2 `: L4 x   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
     ;will break 3 times :-(
8 R7 B& a0 w5 Q- t( ~; q! {
" J3 ]/ ~6 e7 e  }/ P-or (a bit) faster:
5 A$ U$ Z2 j; _* l" ~1 Q8 G! G   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
3 u7 x& ^( u+ _9 p: D: M
   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  
" \- {0 B- g" n; J" |     ;will break 3 times :-(

: }$ N: ~8 N4 T-Much faster:
   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'

" o1 c8 I0 {2 C6 `/ j; F& u( HNote also that some programs (like AZPR3.00) use de old 16-bit _lopen
function to do the same job:

   push    00                        ; OF_READ
   mov     eax,[00656634]            ; '\\.\SICE',0
. u% J. @! C  w1 o7 x! W* W: b& w   push    eax
   call    KERNEL32!_lopen
   inc     eax
% v) c2 `+ D& Y   jnz     00650589                  ; detected
# P8 |6 [; [5 B. U+ o   push    00                        ; OF_READ
   mov     eax,[00656638]            ; '\\.\SICE'
   push    eax
   call    KERNEL32!_lopen
- \7 j0 M* J0 F" U   inc     eax
   jz      006505ae                  ; not detected


9 l" m5 I$ j6 @& `6 @__________________________________________________________________________
3 R5 @2 _4 S% x9 L6 B
Method 12
& e+ l+ G2 H8 Z9 k& J& k9 K' z=========
, R; ~; v* S) K+ x3 V
This trick is similar to int41h/4fh Debugger installation check (code 05
&amp; 06) but very limited because it's only available for Win95/98 (not NT)
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.
7 [- }5 a+ E& \0 y
   push  0000004fh         ; function 4fh
   push  002a002ah         ; high word specifies which VxD (VWIN32)
                           ; low word specifies which service
                             (VWIN32_Int41Dispatch)
, d0 O, M$ u3 F7 k   call  Kernel32!ORD_001  ; VxdCall
+ N+ [: I9 T+ [0 b( S/ l4 C& [   cmp   ax, 0f386h        ; magic number returned by system debuggers
   jz    SoftICE_detected

6 P5 x% c' S; S. m+ g1 {6 J4 U% jHere again, several ways to detect it:
5 m) \# {- ?- W0 u) `$ K
    BPINT 41 if ax==4f
8 u- ~: I' {% C1 x0 w( Y; A( C3 v: z
    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one

    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A
' |$ M8 D! u4 h6 |- X7 h, u
$ f1 o3 Q8 i8 D! g$ I    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!
7 v5 _/ g0 S; P6 C% Z
3 B  }# C, b8 P__________________________________________________________________________

( g% z# ~! {; M# Y9 F$ c8 f% RMethod 13
3 v4 i! O  {# s=========
; _# D, [8 z. T& T
9 t; J% ?: I# \: i# v4 u  DNot a real method of detection, but a good way to know if SoftICE is
installed on a computer and to locate its installation directory.
It is used by few softs which access the following registry keys (usually #2) :

-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
( ~3 f+ ]# k+ D  E+ K/ O\Uninstall\SoftICE
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
* w, j+ m9 S' J8 h\App Paths\Loader32.Exe


5 }- V+ X2 r0 Z9 FNote that some nasty apps could then erase all files from SoftICE directory
(I faced that once :-(

Useful breakpoint to detect it:

     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'

7 R+ A$ Z$ O/ _, \) m__________________________________________________________________________
+ \( F6 ^5 ^- M" C8 y' w( M4 z

Method 14
=========

A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
is to determines whether a debugger is running on your system (ring0 only).

8 V( B. x) h: W- ^: _* F   VMMCall Test_Debug_Installed
   je      not_installed

This service just checks a flag.
  t6 K+ l$ e+ N3 Q" H</PRE></TD></TR></TBODY></TABLE>