About anti-SoftICE tricks

<TABLE width=500>
<TBODY>
<TR>
2 N# n4 l  \, [/ c7 Q" j$ m; x<TD><PRE>Method 01
# x- Y/ t1 J1 c. j9 B' e2 H=========
6 c6 u2 h3 t9 H9 R$ w
' X& j9 x7 s: P8 c0 w" s% Y, FThis method of detection of SoftICE (as well as the following one) is
used by the majority of packers/encryptors found on Internet.
It seeks the signature of BoundsChecker in SoftICE

+ q1 h. }/ ]/ n) U+ a    mov     ebp, 04243484Bh        ; 'BCHK'
* p4 f0 F% _" C+ h    mov     ax, 04h
    int     3      
    cmp     al,4
0 T1 P! K) [/ ~& n8 I: t' H" k4 ?    jnz     SoftICE_Detected
! i/ l9 J5 |3 l
) {: x$ q% U5 B+ t___________________________________________________________________________
) h0 S: h# W0 S; y7 L" F4 E9 r
Method 02
=========

Still a method very much used (perhaps the most frequent one).  It is used
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,
! z  W5 z" k, `3 Q3 C) H8 dor execute SoftICE commands...
3 g6 Z/ ]: E  ]8 pIt is also used to crash SoftICE and to force it to execute any commands
(HBOOT...) :-((  

9 H, s( d6 x4 g# G% O+ S5 \: h- HHere is a quick description:
-AX = 0910h   (Display string in SIce windows)
) F, A5 @" S! C' e4 a9 n. i5 q-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)
' u# C; d7 ]; i: q# P, d; T-AX = 0912h   (Get breakpoint infos)
-AX = 0913h   (Set Sice breakpoints)
-AX = 0914h   (Remove SIce breakoints)
7 Q9 x# ^0 P- u# O" k& U
Each time you'll meet this trick, you'll see:
-SI = 4647h
1 P1 `( V7 L. h( x$ ^# P& W" b. t-DI = 4A4Dh
Which are the 'magic values' used by SoftIce.
8 E, E+ V: k: B: G! R, t. RFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.
7 \7 Q3 ?, ~/ q! X2 d9 n
Here is one example from the file "Haspinst.exe" which is the dongle HASP
Envelope utility use to protect DOS applications:
4 N* R3 y+ f3 B# J% S' n0 j- Q  H: R

7 I6 O9 P2 a3 t. h2 F4C19:0095   MOV    AX,0911  ; execute command.
/ K- A0 o* m' X( A$ U4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).
8 P, f( t6 `- B3 T! i! e4C19:009A   MOV    SI,4647  ; 1st magic value.
0 B2 _5 P$ \6 [/ f8 E- m; S# o4C19:009D   MOV    DI,4A4D  ; 2nd magic value.
4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute
: `; O* }5 x( T: x4C19:00A4   INC    CX
0 ]; L) [2 P( i+ b0 \4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute
4C19:00A8   JB     0095     ; 6 different commands.
: Q* [! T6 [; n! e0 e( y4C19:00AA   JMP    0002     ; Bad_Guy jmp back.
4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)

The program will execute 6 different SIce commands located at ds:dx, which
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
/ v, }! Y( }+ l* r$ r( P3 ^2 \
& ]4 p% Q1 Z4 x; V* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
___________________________________________________________________________

% j$ @( `6 A$ p5 l7 C4 \3 k
; I) @2 S( Z# n. _0 {: ~5 {Method 03
=========

Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
(API Get entry point)
4 Y: y6 m, t# Z' u- N' o* y        

; h; e- b7 J  v4 ^/ f. I3 x9 S    xor     di,di
    mov     es,di
; p- H  }) H& l, G. I8 s, Y% r    mov     ax, 1684h      
    mov     bx, 0202h       ; VxD ID of winice
2 K8 ~- ~6 j( G6 z: P    int     2Fh
    mov     ax, es          ; ES:DI -&gt; VxD API entry point
    add     ax, di
" m& Z) ~4 E/ {" a    test    ax,ax
9 G! ^+ ~) K8 j  L% J/ _    jnz     SoftICE_Detected

7 y+ }2 [- R+ S0 Y6 u/ H___________________________________________________________________________

9 ]- E: m% v% `Method 04
=========
+ t! K" I9 b) G; w' j
Method identical to the preceding one except that it seeks the ID of SoftICE
GFX VxD.

; M- b$ m9 i" P5 s    xor     di,di
    mov     es,di
    mov     ax, 1684h      
+ f( c+ {( C1 i* W    mov     bx, 7a5Fh       ; VxD ID of SIWVID
    int     2fh
, S! @$ Y* s& }8 v* E5 I    mov     ax, es          ; ES:DI -&gt; VxD API entry point
    add     ax, di
    test    ax,ax
8 P5 j: P' N: R" Y& {$ o# W    jnz     SoftICE_Detected
' _2 Q0 ]6 V& S& `( T' D* ]2 L  Z
# o* _" k8 x+ J2 R__________________________________________________________________________
! J: x* |6 E5 f5 y7 Q2 N+ W
+ Z* y8 o7 c. ?/ ]  d. m6 s
Method 05
, n' w! v# m: F=========

: t3 F' B( A- |  IMethod seeking the 'magic number' 0F386h returned (in ax) by all system
/ S, ~/ f# G) z0 edebugger. It calls the int 41h, function 4Fh.
7 D2 F- R: E1 u) T2 L$ jThere are several alternatives.  
8 q! y5 C8 `  ~% ~
The following one is the simplest:

6 u* n# Y, L! i( H8 t    mov     ax,4fh
/ P2 c3 f5 S4 b  a    int     41h
    cmp     ax, 0F386
    jz      SoftICE_detected

/ K! U7 V+ o( F' I4 K. k1 u; i5 N
( k! E  R* T' W" v, qNext method as well as the following one are 2 examples from Stone's
! D1 H7 @! p6 o$ o"stn-wid.zip" (www.cracking.net):

9 _) D6 m5 v; x    mov     bx, cs
    lea     dx, int41handler2
8 I6 x. P8 U& I' V6 a/ e    xchg    dx, es:[41h*4]
    xchg    bx, es:[41h*4+2]
    mov     ax,4fh
    int     41h
    xchg    dx, es:[41h*4]
" ]# h; P2 U$ I5 v: t    xchg    bx, es:[41h*4+2]
    cmp     ax, 0f386h
, S. ~8 d4 k, W0 H) M4 n  P    jz      SoftICE_detected

int41handler2 PROC
    iret
  ]% z1 H7 }% I2 C& N% lint41handler2 ENDP
2 i) d7 ~" |( ]' {- t9 Q
0 u7 H+ R+ @9 u/ ^* U" E
_________________________________________________________________________
' ^4 U5 q  C0 g; ^  C! S* A

3 O2 ?1 H3 s! y. ^, @- ZMethod 06
=========

3 B1 d1 _; K9 j
2nd method similar to the preceding one but more difficult to detect:
  S0 o& a" y) {1 p: T
/ \8 a  n! l$ i1 V  m* Y, U/ u
int41handler PROC
    mov     cl,al
    iret
5 @) {" O8 S$ }" ~1 L' x4 Iint41handler ENDP


    xor     ax,ax
    mov     es,ax
) j: i8 q* l6 X9 D3 R& G  ?, [    mov     bx, cs
    lea     dx, int41handler
    xchg    dx, es:[41h*4]
    xchg    bx, es:[41h*4+2]
  a6 K) j+ v9 }6 a    in      al, 40h
    xor     cx,cx
5 K% u+ n' I9 w7 X    int     41h
) c  \% X0 w$ @! C3 f: X) d8 \    xchg    dx, es:[41h*4]
    xchg    bx, es:[41h*4+2]
2 m. S4 o7 D# Y8 x4 U; l9 P    cmp     cl,al
( \; ~4 J, E- J( X6 c1 U# H$ y2 L" T    jnz     SoftICE_detected
! T* a3 ^3 O: v& a1 ~: F; [+ T' Q; B
_________________________________________________________________________
8 ~4 W) W  T* j# I' B4 n8 P
Method 07
/ g6 l# T. l4 n7 p/ B& n# \5 k4 P* b=========

Method of detection of the WinICE handler in the int68h (V86)
4 Y* l; s# H$ q  F7 S
    mov     ah,43h
    int     68h
1 K0 a0 [% o; h    cmp     ax,0F386h
    jz      SoftICE_Detected
+ l6 C3 I) Y. D1 l- f" }5 z5 `+ J

1 Q" a, R% d" o  d/ b  M3 j9 B=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
   app like this:

5 `/ T! X$ H. i9 u. `1 I   BPX exec_int if ax==68
   (function called is located at byte ptr [ebp+1Dh] and client eip is
0 F$ S) X* J1 q& Q8 x3 T" N; E" _. j   located at [ebp+48h] for 32Bit apps)
__________________________________________________________________________
* T; m8 ?" j8 [5 L  q9 ?
  o( T7 ?* b* _+ M& d
Method 08
=========

8 _" e6 q4 O4 C- W: q  CIt is not a method of detection of SoftICE but a possibility to crash the
2 b) G* v- \; t: G  T. M# msystem by intercepting int 01h and int 03h and redirecting them to another
routine.
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
' C- J. E8 r. M3 |* c" \5 Wto the new routine to execute (hangs computer...)

    mov     ah, 25h
    mov     al, Int_Number (01h or 03h)
- d$ Z# e) a# q, ]  b1 m# N5 [    mov     dx, offset New_Int_Routine
    int     21h

  I) K5 A) l& q+ [: c2 e+ h__________________________________________________________________________
; \) W; g0 t4 d. a+ u# I7 ~7 u; `
Method 09
=========
9 [% J) G/ J2 ]& n' l
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
performed in ring0 (VxD or a ring3 app using the VxdCall).
The Get_DDB service is used to determine whether or not a VxD is installed
: E. f8 L6 n* m( F1 hfor the specified device and returns a Device Description Block (in ecx) for
+ K+ w4 J5 y1 M/ o* I* [( Vthat device if it is installed.

   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID
   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
   VMMCall Get_DDB
   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed

) H7 B, O$ C& {  Q/ ^2 V3 ~Note as well that you can easily detect this method with SoftICE:
+ s/ e+ t5 H* G) }   bpx Get_DDB if ax==0202 || ax==7a5fh
" w' g0 A/ c9 n/ w/ k
__________________________________________________________________________

8 E* l) E+ ^$ }( W  S3 E) SMethod 10
% _9 N& A+ i9 }$ W* I=========
. k8 r: ?' ?! J1 V9 d8 P1 m
4 w# `8 ]- @( z  `& f=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with
  SoftICE while the option is enable!!
: {1 u; Q0 e0 s+ s# {- p0 S
This trick is very efficient:
  ]$ ~' L; n1 Y$ l# ?- c" yby checking the Debug Registers, you can detect if SoftICE is loaded
/ i! a5 ]8 A+ d7 j5 ?. o(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
there are some memory breakpoints set (dr0 to dr3) simply by reading their
& O. ]; ?3 \( E) o( ], a7 b+ q" Zvalue (in ring0 only). Values can be manipulated and or changed as well
% X8 l, u+ e4 ~2 k& _(clearing BPMs for instance)

__________________________________________________________________________
- |5 J+ _* {2 z# e  L: G2 ?+ _: M' g# N
- I8 V- y  b# r5 g8 M& ?8 Q" Z6 h: LMethod 11
' n" N: y$ I3 ^/ h: _$ w' V' t. B=========
# K) E' f) |: t) a1 e
This method is most known as 'MeltICE' because it has been freely distributed
via www.winfiles.com. However it was first used by NuMega people to allow
$ a0 [* K9 h9 t1 ]Symbol Loader to check if SoftICE was active or not (the code is located
inside nmtrans.dll).
  R9 i  Q9 p5 y$ |5 S5 D% Y8 G
The way it works is very simple:
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
WinNT) with the CreateFileA API.
6 G9 y- b$ Z9 F1 t0 X
Here is a sample (checking for 'SICE'):
& ~3 f( B& ?0 E+ s
6 W1 }. ?" x/ p' K6 W; f& Y( YBOOL IsSoftIce95Loaded()
3 S7 K) O) s* |" \8 q{
   HANDLE hFile;  
& D% A  W& G$ G& S0 m9 R   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
                      FILE_SHARE_READ | FILE_SHARE_WRITE,
6 T1 ~1 x7 u7 Y  K5 B9 z& W! [  i. i                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
( e+ ~7 x+ t3 F$ [0 f1 ^   if( hFile != INVALID_HANDLE_VALUE )
   {
) T& J, p4 [! M      CloseHandle(hFile);
      return TRUE;
: `( _# O3 P8 Y0 c. Y) C( y' s7 f   }
8 w4 D% \! o- k7 [   return FALSE;
}

Although this trick calls the CreateFileA function, don't even expect to be
able to intercept it by installing a IFS hook: it will not work, no way!
In fact, after the call to CreateFileA it will get through VWIN32 0x001F
" ^; ^( Z" M3 xservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
and then browse the DDB list until it find the VxD and its DDB_Control_Proc
" T6 a2 ~+ F; y$ J2 i1 Hfield.
  B0 E# t4 L! t! N! c8 hIn fact, its purpose is not to load/unload VxDs but only to send a
, b5 C6 o9 L+ M* fW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
to the VxD Control_Dispatch proc (how the hell a shareware soft could try
to load/unload a non-dynamically loadable driver such as SoftICE ;-).
4 w0 I% R4 G) r& g4 \& N2 SIf the VxD is loaded, it will always clear eax and the Carry flag to allow
0 E6 C# I3 W" P% D' X8 Jits handle to be opened and then, will be detected.
- ]6 |* e2 N9 E6 ~  pYou can check that simply by hooking Winice.exe control proc entry point
while running MeltICE.
# v8 t: [  }$ l) J+ ]: x9 \. Z

  00401067:  push      00402025    ; \\.\SICE
  0040106C:  call      CreateFileA
  00401071:  cmp       eax,-001
" I7 D2 ]7 R6 ?- B9 \, X3 N  00401074:  je        00401091

, U5 p4 z" O) v' B' \# s
There could be hundreds of BPX you could use to detect this trick.
-The most classical one is:
  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||
+ Z3 o+ v& |! w1 X& I( ?' v) D    *(esp-&gt;4+4)=='NTIC'

-The most exotic ones (could be very slooooow :-(
, U4 Q, w4 \2 R/ K% n! S; i   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
4 R9 L4 n" u- G     ;will break 3 times :-(
4 e  S$ x7 Z$ ~5 C, h( s0 z
-or (a bit) faster:
# u) e) b6 Q" z   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')

   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  
     ;will break 3 times :-(

-Much faster:
   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'

1 P9 W& P3 h' e; N* aNote also that some programs (like AZPR3.00) use de old 16-bit _lopen
function to do the same job:

   push    00                        ; OF_READ
; i! }/ Q; l5 c- A, w% v( u   mov     eax,[00656634]            ; '\\.\SICE',0
: v# o7 j) Y: d+ O4 Z7 r4 @& Q   push    eax
2 Z9 [+ d8 h- T: c3 _0 ^   call    KERNEL32!_lopen
( `7 h! ]# R% ^* _  g; z   inc     eax
9 T; I$ G3 F3 ], b# B# @   jnz     00650589                  ; detected
4 g9 @8 k. \% B% h   push    00                        ; OF_READ
4 p; f+ C# W4 u3 Q8 }5 Z1 T; {   mov     eax,[00656638]            ; '\\.\SICE'
   push    eax
   call    KERNEL32!_lopen
   inc     eax
& e4 i% q! }  \0 Z: c   jz      006505ae                  ; not detected
0 `# [  R! y7 n
. [( w* I0 d7 T% ~
__________________________________________________________________________

: S: ?# q( }- ~Method 12
" r, ]1 M6 G- h/ _. L=========
* n: s+ [+ q" N% _- C* j" W4 \
This trick is similar to int41h/4fh Debugger installation check (code 05
&amp; 06) but very limited because it's only available for Win95/98 (not NT)
6 [4 M/ e; d: [* Xas it uses the VxDCall backdoor. This detection was found in Bleem Demo.
, ^$ [5 v5 |8 n, e
9 [* j9 \6 _1 M4 r+ Y$ e% k1 J   push  0000004fh         ; function 4fh
   push  002a002ah         ; high word specifies which VxD (VWIN32)
, D1 u% U' [9 x/ s                           ; low word specifies which service
                             (VWIN32_Int41Dispatch)
   call  Kernel32!ORD_001  ; VxdCall
( S# V& e. B; n7 a/ D   cmp   ax, 0f386h        ; magic number returned by system debuggers
   jz    SoftICE_detected
2 \3 A, q; }! ^7 D
Here again, several ways to detect it:
+ o) `0 W/ F* t0 W6 ~( v! S
1 M2 r) W/ O& R, i. Z    BPINT 41 if ax==4f

# `4 B4 G- m( L% {; Q5 h% Q    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one

    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A

    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!
# O( ^" r* q1 _; M# Q0 q+ l
1 _& e: U% A$ |4 I7 i3 D__________________________________________________________________________
& V( s' @+ g  @+ b1 F
0 h, q4 ?. Q4 [: L5 F3 iMethod 13
=========
; A4 F0 s% y; G- M% n7 A& `1 F
Not a real method of detection, but a good way to know if SoftICE is
installed on a computer and to locate its installation directory.
It is used by few softs which access the following registry keys (usually #2) :
7 R+ @! G5 m. w+ t, h$ J) X8 O# I  ~
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
& M- G0 w3 ]' n7 l: C# {' h; k\Uninstall\SoftICE
* x# }/ \# L2 t-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
. E4 N+ M  U8 w3 O-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
6 N% Q8 A% O* ^! Z+ \9 s9 D\App Paths\Loader32.Exe


" _: D- O! u5 u6 T* ]  E9 s+ kNote that some nasty apps could then erase all files from SoftICE directory
" M4 H3 K3 z  |" H2 z(I faced that once :-(
2 S2 T) A7 ~. j
6 i7 O3 _1 X0 ^Useful breakpoint to detect it:

2 w( }# G  b8 C     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'
6 C' m; }  [$ ?+ A
__________________________________________________________________________
' Z: t5 g* V, ?) j8 z

  b4 P2 f5 ]8 M0 z9 M1 @. J" }Method 14
=========

A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
2 B1 Y7 S& u# S% {2 A  |is to determines whether a debugger is running on your system (ring0 only).
" N' H# d' n1 P6 ]. r$ D4 e: J
   VMMCall Test_Debug_Installed
   je      not_installed
, @5 o$ S- H! l+ }. g
This service just checks a flag.
( d* G, {: r. H( x5 l</PRE></TD></TR></TBODY></TABLE>