About anti-SoftICE tricks

<TABLE width=500>
% H$ [- u. Q- W* s<TBODY>
/ `* `% w( n+ r: b5 F<TR>
<TD><PRE>Method 01
=========
2 T' J2 a7 P4 y6 N: i+ L- i
This method of detection of SoftICE (as well as the following one) is
6 O% q! R; k3 g: q5 Vused by the majority of packers/encryptors found on Internet.
/ X* W$ s* ^0 p! T3 C, CIt seeks the signature of BoundsChecker in SoftICE

; a- X3 q5 s# |: ]0 S2 u) Y    mov     ebp, 04243484Bh        ; 'BCHK'
    mov     ax, 04h
    int     3      
    cmp     al,4
9 U/ t: `2 n1 d, ~% p  N    jnz     SoftICE_Detected
: G' I2 G4 I2 r! I. M* n& ?& g9 e+ I
___________________________________________________________________________
1 N! N8 |' |/ N
/ Q  `7 }; a$ V' f. ZMethod 02
=========

Still a method very much used (perhaps the most frequent one).  It is used
8 l; {$ A. Z/ P1 F$ bto get SoftICE 'Back Door commands' which gives infos on Breakpoints,
& w. M2 ?$ u. [or execute SoftICE commands...
3 y, E3 k* A# E/ WIt is also used to crash SoftICE and to force it to execute any commands
% O/ V1 a) ^$ u) R4 M(HBOOT...) :-((  

. {3 t, a2 V. R) A9 h$ NHere is a quick description:
-AX = 0910h   (Display string in SIce windows)
  d0 ?$ {% H+ d# R, v: p/ H-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)
$ c1 }) _# z6 w( G% `5 [- y5 ^$ T-AX = 0912h   (Get breakpoint infos)
-AX = 0913h   (Set Sice breakpoints)
8 p) \" \5 H8 |" Q0 ^-AX = 0914h   (Remove SIce breakoints)

Each time you'll meet this trick, you'll see:
-SI = 4647h
-DI = 4A4Dh
Which are the 'magic values' used by SoftIce.
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.
5 l9 w* f& U% y2 K6 X8 g5 }& u
1 v: _& g& D9 I4 d- Y  k' ^' BHere is one example from the file "Haspinst.exe" which is the dongle HASP
Envelope utility use to protect DOS applications:
1 M) m! @5 n$ E. y* [6 F+ C
+ j! a0 k( K4 j7 E' X
4C19:0095   MOV    AX,0911  ; execute command.
) R$ L. J) S# A# F3 h1 |4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).
4C19:009A   MOV    SI,4647  ; 1st magic value.
4C19:009D   MOV    DI,4A4D  ; 2nd magic value.
4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
5 |  l8 z. v0 _6 A% X7 I4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute
4C19:00A4   INC    CX
4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute
4C19:00A8   JB     0095     ; 6 different commands.
4C19:00AA   JMP    0002     ; Bad_Guy jmp back.
& b: c4 |& w$ d" r9 Y2 U" v4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)
7 y8 u- W3 ^# w; F
* z+ ]2 J+ X  C4 n" w: u/ MThe program will execute 6 different SIce commands located at ds:dx, which
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
- v$ a) X9 w: i. }5 Z# {
$ w% C3 j6 F1 B, h% J- }* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
  Y/ _$ ^7 g3 q, k$ Y) r5 d___________________________________________________________________________
6 z7 U. M: k" z3 j% r

) e6 a! z. b) S6 }3 s* |Method 03
' d1 @, K% S0 y, R=========

Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
6 l! m2 c' X/ a2 Z  G' o8 X! [(API Get entry point)
        

& f" S2 Z$ {  e' R+ g% i    xor     di,di
( W, w/ r; U" u( }2 o( {    mov     es,di
    mov     ax, 1684h      
    mov     bx, 0202h       ; VxD ID of winice
$ L( ]* t4 u; K1 u$ B1 w4 I    int     2Fh
    mov     ax, es          ; ES:DI -&gt; VxD API entry point
- I. ?& G, |1 |$ d- ]( E    add     ax, di
9 D; P" k8 y5 c& B2 _: C& a) ], _    test    ax,ax
    jnz     SoftICE_Detected
, j; e. J5 J* H( }  u7 R# j( ?
1 u3 n' `- M. m1 K$ E- F, L___________________________________________________________________________

' x- N; s4 a. F7 x) z  \Method 04
=========
& b5 _! e. ~& W, B/ r
Method identical to the preceding one except that it seeks the ID of SoftICE
  B& T: P+ N8 w5 H8 X: ~- GGFX VxD.
" S* G, n0 i' Q. d6 }' K2 `
    xor     di,di
' M1 y8 ^' g8 A7 f( H& r    mov     es,di
: g- v: f+ G& B$ Q) N/ |) v) S    mov     ax, 1684h      
1 U3 ?- w0 K+ q: n    mov     bx, 7a5Fh       ; VxD ID of SIWVID
1 T4 u# P$ P$ I. y# f    int     2fh
    mov     ax, es          ; ES:DI -&gt; VxD API entry point
    add     ax, di
: [& p" L7 F4 h( T    test    ax,ax
    jnz     SoftICE_Detected

__________________________________________________________________________

( R/ o1 F3 h4 j( ]7 l
Method 05
( N: k$ S7 I2 w* C3 I=========
6 S8 S. q+ r( \4 \- u
Method seeking the 'magic number' 0F386h returned (in ax) by all system
debugger. It calls the int 41h, function 4Fh.
1 L% C1 H5 X( w3 R: b7 b: y% fThere are several alternatives.  
# A0 K: d2 b' x/ z: l7 F8 A
* r/ x: V, [, j& q8 T! a9 I, CThe following one is the simplest:

2 g3 I8 }' Q, \: A( `2 z    mov     ax,4fh
    int     41h
    cmp     ax, 0F386
4 F* ^6 m! l" u3 `+ w    jz      SoftICE_detected

: X0 j* C1 p+ i
0 i8 Y: T; a" G# |& N$ B4 iNext method as well as the following one are 2 examples from Stone's
  o9 c$ V" ?5 |( M9 A"stn-wid.zip" (www.cracking.net):
. B7 Y  ^4 A: N: q
    mov     bx, cs
    lea     dx, int41handler2
: @; }2 f2 x: Y9 ?) @    xchg    dx, es:[41h*4]
" a: v/ x! Q1 J: S( @    xchg    bx, es:[41h*4+2]
    mov     ax,4fh
    int     41h
    xchg    dx, es:[41h*4]
" r5 L9 V. \' j4 D; R: ~* V1 K4 N    xchg    bx, es:[41h*4+2]
    cmp     ax, 0f386h
  P1 e7 ^/ I1 G    jz      SoftICE_detected

7 a) l8 p) Z/ S; Q$ b. W; aint41handler2 PROC
, L; j  i3 ~* G    iret
0 W. O& ~2 `/ g" s0 [int41handler2 ENDP
1 r$ |$ z5 N! X* a) S
9 _) @7 B6 [4 ?6 d. W" c: d% J
6 J( K) G% r$ x8 I4 P( u( x_________________________________________________________________________
& D! u7 U4 }( V9 Q2 b+ ]

% K2 e& A5 b' i, R1 @Method 06
=========

" }: h+ I0 z" v6 }  s
- O  t# L& Z8 o: _5 A2nd method similar to the preceding one but more difficult to detect:


# }; ~% t0 f5 K2 Q, ?: O0 c6 Gint41handler PROC
2 C$ ?& L* u# R6 I8 S( L1 _    mov     cl,al
    iret
int41handler ENDP
! a, l. |. n( @! J& J- g8 g- M

, L0 {2 \" J+ Z! x    xor     ax,ax
    mov     es,ax
    mov     bx, cs
7 b1 M9 p0 Y9 r    lea     dx, int41handler
    xchg    dx, es:[41h*4]
    xchg    bx, es:[41h*4+2]
    in      al, 40h
    xor     cx,cx
    int     41h
; f3 X# U4 f- Z1 p: D" V! [$ B) w    xchg    dx, es:[41h*4]
    xchg    bx, es:[41h*4+2]
    cmp     cl,al
    jnz     SoftICE_detected
- T1 f% Z, k0 a/ M7 y
_________________________________________________________________________
7 s+ a3 e) H# M- _
Method 07
8 j% f1 d" u" F& i8 w1 B( b=========
9 L5 c- ~0 y( _9 a$ Y  y6 o$ Y
Method of detection of the WinICE handler in the int68h (V86)

0 O: x$ Z; ^4 w- U    mov     ah,43h
( \5 x) @  `, _1 r/ x/ \& T( z7 z    int     68h
  w* w0 S* g2 Y0 v    cmp     ax,0F386h
0 N. Z; [4 F& h" h! A; {/ e# t, @    jz      SoftICE_Detected
+ g, U: L2 M1 k
, C4 v' V4 s" \+ N* |
8 B3 i( i; D6 X% B) M=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
   app like this:
: d% X4 `* J; N2 [0 H* i' l4 g9 b
   BPX exec_int if ax==68
  T8 o! x' ^" p4 O- g( z3 I   (function called is located at byte ptr [ebp+1Dh] and client eip is
! E' D" e1 ~0 w+ A! N   located at [ebp+48h] for 32Bit apps)
# i! J  z( o7 _' e- B4 p  N1 A: g% |__________________________________________________________________________


Method 08
=========

It is not a method of detection of SoftICE but a possibility to crash the
! W+ v8 B3 o; y* A- K0 ysystem by intercepting int 01h and int 03h and redirecting them to another
, L" t) J/ ~! q: K6 kroutine.
# B; @7 i& q, c  ?+ ~. S  Z) U" I$ F! [It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
to the new routine to execute (hangs computer...)

# S, ?& \) Y- y/ r! J8 f    mov     ah, 25h
    mov     al, Int_Number (01h or 03h)
3 Q  w# @0 }+ [2 s1 _4 l+ [! l" t    mov     dx, offset New_Int_Routine
    int     21h
! r. r+ e2 o: J& Q
__________________________________________________________________________

Method 09
  ?6 z; J* D5 t, k5 k9 f=========
: J6 e/ W& P4 Y" V: t% ^* O  I% X
+ @* b/ m) k, A1 q( }6 uThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
# \' B- A% S6 v- T. o$ K$ a4 m/ Vperformed in ring0 (VxD or a ring3 app using the VxdCall).
The Get_DDB service is used to determine whether or not a VxD is installed
for the specified device and returns a Device Description Block (in ecx) for
that device if it is installed.

   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID
   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
   VMMCall Get_DDB
   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed

Note as well that you can easily detect this method with SoftICE:
/ o5 l, `3 J& y9 B1 C   bpx Get_DDB if ax==0202 || ax==7a5fh

1 H. s5 `( i" s2 j7 u__________________________________________________________________________
) T7 k2 x( Z# V* S1 j
Method 10
) r& l7 v( r8 e) E9 s2 M) |=========

=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with
! u2 J3 u. E7 D4 U  SoftICE while the option is enable!!
' N$ z3 Q' z0 \$ z: {( K/ y+ \
5 R% B) t8 ?: uThis trick is very efficient:
( \2 |, S2 K# Y) K& S% Xby checking the Debug Registers, you can detect if SoftICE is loaded
- r. \$ @6 R" @. q3 ^7 Z% i(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
there are some memory breakpoints set (dr0 to dr3) simply by reading their
9 k* ?' P5 ?" Y9 A( t2 ivalue (in ring0 only). Values can be manipulated and or changed as well
(clearing BPMs for instance)

__________________________________________________________________________
8 r# q) v: P' J' ?/ L! C4 V  d1 S
Method 11
% R, ]0 Z1 j4 d6 [' g=========

This method is most known as 'MeltICE' because it has been freely distributed
via www.winfiles.com. However it was first used by NuMega people to allow
; q* A1 k8 C# i' kSymbol Loader to check if SoftICE was active or not (the code is located
( ~+ _% r! `- Z: Winside nmtrans.dll).
# r0 |2 V$ N% }* A
The way it works is very simple:
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
WinNT) with the CreateFileA API.
; ^4 Z& N6 N  k5 D; o" |1 [3 q4 m( c
Here is a sample (checking for 'SICE'):

- v; E& p; v8 B- A9 x% ~+ Z0 iBOOL IsSoftIce95Loaded()
2 K  {- L0 m$ a{
   HANDLE hFile;  
  M( x% q/ d- L; z+ \4 A# o8 {9 Q   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
5 X( R" u# b# W- N1 w: n                      FILE_SHARE_READ | FILE_SHARE_WRITE,
                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
. l) n$ P. Y# y9 J9 V   if( hFile != INVALID_HANDLE_VALUE )
# _$ p( ^# ]0 V1 R/ @. ]   {
: ?! U( x% `' g2 P" }! l      CloseHandle(hFile);
" h- y- R3 M7 K' G: T. {" L( @4 Y$ r      return TRUE;
   }
   return FALSE;
) Y; u' m2 n, @% P  p3 c  i% |}
# {* h/ h8 J/ |) U
, n& ?# W- F8 j1 n/ C- DAlthough this trick calls the CreateFileA function, don't even expect to be
able to intercept it by installing a IFS hook: it will not work, no way!
+ M7 C1 s4 K% s2 t- E& YIn fact, after the call to CreateFileA it will get through VWIN32 0x001F
3 N" Z1 g8 u; Pservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
. d6 X+ H- P" [4 j0 Y5 Iand then browse the DDB list until it find the VxD and its DDB_Control_Proc
field.
In fact, its purpose is not to load/unload VxDs but only to send a
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
to the VxD Control_Dispatch proc (how the hell a shareware soft could try
to load/unload a non-dynamically loadable driver such as SoftICE ;-).
If the VxD is loaded, it will always clear eax and the Carry flag to allow
its handle to be opened and then, will be detected.
6 n9 |' o9 V3 b) Q# W4 D6 SYou can check that simply by hooking Winice.exe control proc entry point
while running MeltICE.
9 `( O/ r. g9 n. w
. l1 l, ~1 H" M$ }
  00401067:  push      00402025    ; \\.\SICE
2 e2 C1 A* X7 Z- ^" u! _  0040106C:  call      CreateFileA
  00401071:  cmp       eax,-001
  00401074:  je        00401091
4 b: R) K. ?0 F+ m, z# d- Y
5 m) e4 a1 J  C
There could be hundreds of BPX you could use to detect this trick.
-The most classical one is:
  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||
0 ~* x5 U+ A# {1 G0 }5 z2 K    *(esp-&gt;4+4)=='NTIC'
8 |, n0 J- c8 d! `8 i2 {, e
( z; B% {  d  t$ I: f" S-The most exotic ones (could be very slooooow :-(
   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
( o* k% w) u- J9 n3 K     ;will break 3 times :-(
/ S9 s' b1 n) ?
-or (a bit) faster:
) O& K  P9 ?4 a2 N2 \   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
4 {: x  p" V0 F  k% R
   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  
     ;will break 3 times :-(

! M' R  S# a  t2 G  ?-Much faster:
   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'
. _: `' `5 R6 E
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
function to do the same job:

5 N! {% N: T. ~" |3 i   push    00                        ; OF_READ
+ f9 Z0 g4 G5 c5 o( |1 s9 o# X   mov     eax,[00656634]            ; '\\.\SICE',0
$ l% Q! c3 d: \. L. k4 r5 g$ C2 o0 D   push    eax
( V! B# m$ l. l/ N2 \. W2 p   call    KERNEL32!_lopen
- B* `5 J1 h5 x* J  V$ d   inc     eax
- N5 x" h2 ~3 \5 V) T   jnz     00650589                  ; detected
6 Z/ q3 V% ~( o5 q& X$ [0 u; x   push    00                        ; OF_READ
   mov     eax,[00656638]            ; '\\.\SICE'
   push    eax
1 R1 o2 k- ^; h6 m( c, J   call    KERNEL32!_lopen
  b  C5 ]2 n6 I) K. G$ Q- c   inc     eax
! {$ z8 ]0 x7 R# e2 a   jz      006505ae                  ; not detected
; E- D; A0 f6 M7 t9 x0 d
6 p; K1 Q0 j+ P! \2 y" ?$ |4 D& u) D
__________________________________________________________________________

Method 12
=========

4 v7 X. O* v8 N2 GThis trick is similar to int41h/4fh Debugger installation check (code 05
&amp; 06) but very limited because it's only available for Win95/98 (not NT)
( u$ K8 b8 @' x1 s- ?0 c. }$ L" e! zas it uses the VxDCall backdoor. This detection was found in Bleem Demo.

( t. O+ X6 N3 E+ \. P. [+ a6 I   push  0000004fh         ; function 4fh
   push  002a002ah         ; high word specifies which VxD (VWIN32)
9 R# |& g9 c- U. e' Q3 e- x                           ; low word specifies which service
: I7 {. y! K0 w5 J2 r* |7 Z* F, b                             (VWIN32_Int41Dispatch)
* E7 ]! |, v1 H/ L, }   call  Kernel32!ORD_001  ; VxdCall
   cmp   ax, 0f386h        ; magic number returned by system debuggers
4 y" S5 l& y4 Q) V! ]4 e" `   jz    SoftICE_detected
- b! e( F" a0 R6 }$ S3 s, q; e
7 o* M, v9 J5 P1 w$ `) aHere again, several ways to detect it:

    BPINT 41 if ax==4f
3 J0 ~; z& [9 G9 t
    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one

    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A

    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!

__________________________________________________________________________

7 E! ^- u# ]& |% S6 |# ^& h& }Method 13
% M4 g( i% B) p& n0 {9 M! O/ u. V=========
& B1 m2 M: l7 F8 F
: h" Z) @; Z( W, U0 qNot a real method of detection, but a good way to know if SoftICE is
installed on a computer and to locate its installation directory.
It is used by few softs which access the following registry keys (usually #2) :

-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
\Uninstall\SoftICE
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
* [7 d$ Y/ c; a-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
\App Paths\Loader32.Exe
! q+ G  u$ I' R
5 l2 _/ v  Y. y( x# f* ^, Z
Note that some nasty apps could then erase all files from SoftICE directory
(I faced that once :-(
" ?* g4 s4 q; j" t& n7 Y0 t$ y9 p
Useful breakpoint to detect it:
/ _( [$ T( T/ M: o% Z
( B+ a' h1 y! N: i5 A; D. ^     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'
/ Q; F9 `$ {  i0 \* B
5 p; i( A) }" u6 W& w$ P6 X! }__________________________________________________________________________
/ R  [- b. H9 K- T
6 k: Z: r0 Y( r; S+ ^6 \
Method 14
) j, g$ J. \0 e2 u* D=========
1 ~% r6 G& o- _* C% t- m( n' {
% F, m- p- M9 \: O5 eA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
is to determines whether a debugger is running on your system (ring0 only).
+ _+ v0 [  W) ]
+ |2 ~/ e* M6 D  `& D) ?9 t   VMMCall Test_Debug_Installed
   je      not_installed
! c$ W; z* q9 ~8 S  ~+ r
) Y: l8 m+ |2 `( y# U) z5 B& `This service just checks a flag.
" a" L, Z) v: N</PRE></TD></TR></TBODY></TABLE>