About anti-SoftICE tricks

<TABLE width=500>
<TBODY>
# @! ]) _9 ?. s( a/ j/ G<TR>
<TD><PRE>Method 01
=========
! o: ]9 g0 h3 W9 n1 F
' m+ G5 C9 G+ f; L& r  MThis method of detection of SoftICE (as well as the following one) is
used by the majority of packers/encryptors found on Internet.
: r! m( u; A, r  e1 fIt seeks the signature of BoundsChecker in SoftICE
+ r) K0 S& R8 \. f
    mov     ebp, 04243484Bh        ; 'BCHK'
; \/ J0 x! b' H: j+ i    mov     ax, 04h
, w: @! N- N9 k& Z% Q    int     3      
  K' L  ?6 C& J+ H3 {& K8 D    cmp     al,4
    jnz     SoftICE_Detected

0 f1 Y' a4 i5 f( }___________________________________________________________________________

Method 02
) D) v" \0 ^/ q! f- X6 r, W=========

$ f& J+ _; A% _. k( {Still a method very much used (perhaps the most frequent one).  It is used
4 P3 K  N- U4 hto get SoftICE 'Back Door commands' which gives infos on Breakpoints,
# H& W/ O- O4 b) D' |or execute SoftICE commands...
It is also used to crash SoftICE and to force it to execute any commands
) y. ]( q. y/ r# d(HBOOT...) :-((  
& }# H. @2 X5 u: C3 |4 D( b
" m. N; k4 n4 I% ]4 JHere is a quick description:
* _0 U" [; k3 J/ D6 E  N-AX = 0910h   (Display string in SIce windows)
-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)
-AX = 0912h   (Get breakpoint infos)
-AX = 0913h   (Set Sice breakpoints)
-AX = 0914h   (Remove SIce breakoints)

1 A; A5 {: [% D% A4 b+ OEach time you'll meet this trick, you'll see:
0 }6 \8 ?! L9 M; O5 D-SI = 4647h
. W/ N3 g/ p$ k+ }$ o8 i-DI = 4A4Dh
Which are the 'magic values' used by SoftIce.
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.
, R+ a# S! r3 C8 E3 p, V. j
Here is one example from the file "Haspinst.exe" which is the dongle HASP
Envelope utility use to protect DOS applications:

1 w/ L4 K' p9 \7 t
4C19:0095   MOV    AX,0911  ; execute command.
; k$ W/ j& N* D; T" T4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).
4C19:009A   MOV    SI,4647  ; 1st magic value.
4C19:009D   MOV    DI,4A4D  ; 2nd magic value.
4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute
4C19:00A4   INC    CX
4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute
4C19:00A8   JB     0095     ; 6 different commands.
- A# Y9 \' C; E4C19:00AA   JMP    0002     ; Bad_Guy jmp back.
3 y3 ~: F& _5 n! n* w- r4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)
' C7 o3 x( J9 U6 O+ U
1 ~! K7 ?5 d/ Y- W/ wThe program will execute 6 different SIce commands located at ds:dx, which
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.

. F5 ?) P# q) s- m8 o* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
# X# }0 M$ n8 W2 ]8 _7 O% k/ D___________________________________________________________________________
! e' H9 w* _& F. I# g
4 y  w) I& l- A( Y" E
Method 03
=========

Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
(API Get entry point)
# K. U# Z+ Z& t        
) J6 `6 _% n; a
! E. n. r0 @. g9 j' a    xor     di,di
* p! M, K$ N7 y' N    mov     es,di
0 G7 \1 R# e/ y5 O* L. S    mov     ax, 1684h      
    mov     bx, 0202h       ; VxD ID of winice
' G* J" F7 d1 _& }( Y# P, u7 k    int     2Fh
    mov     ax, es          ; ES:DI -&gt; VxD API entry point
    add     ax, di
& }$ f; O  y8 F    test    ax,ax
2 e5 S/ n" J  Z) |4 [: L    jnz     SoftICE_Detected

$ j  `9 B- b5 p6 L___________________________________________________________________________

Method 04
! L- \, \- E4 A0 {0 d=========
- O7 b  [- J- g+ `
Method identical to the preceding one except that it seeks the ID of SoftICE
, s" b/ K- I) O/ ?' n9 G" Q( j4 tGFX VxD.
1 V' g% s3 e- U9 }% v" X' L1 A
    xor     di,di
6 P& o4 D0 w  S    mov     es,di
    mov     ax, 1684h      
# U. t8 W) ?7 T6 Q    mov     bx, 7a5Fh       ; VxD ID of SIWVID
* L- u+ ]( r$ {# M# J& f2 d3 A    int     2fh
    mov     ax, es          ; ES:DI -&gt; VxD API entry point
8 L# B6 S9 D8 _/ l+ m    add     ax, di
9 l6 w, M, Z/ R  _, `7 q7 e6 b    test    ax,ax
% ~! i& G; O( j% D3 y, y) \+ K    jnz     SoftICE_Detected

__________________________________________________________________________

3 w7 D8 }7 x! [" a
6 d6 n4 ^& f8 \; Z6 j# r5 O1 UMethod 05
: t) g$ i. s/ D$ w8 o' H0 d# Y4 B5 H=========

Method seeking the 'magic number' 0F386h returned (in ax) by all system
0 H1 ~* d; {( s/ ]3 V9 K) `debugger. It calls the int 41h, function 4Fh.
There are several alternatives.  

The following one is the simplest:

    mov     ax,4fh
    int     41h
    cmp     ax, 0F386
# y( y9 g. c* |5 t4 K7 S4 @9 P    jz      SoftICE_detected


Next method as well as the following one are 2 examples from Stone's
' t' p# w. q( f/ S+ T9 e) s"stn-wid.zip" (www.cracking.net):
$ G+ v- ^3 K. W4 k( w1 ]7 n* \$ ~) G
    mov     bx, cs
+ D. L& H2 {, z6 \9 [    lea     dx, int41handler2
    xchg    dx, es:[41h*4]
  v  g! n9 I) R% R    xchg    bx, es:[41h*4+2]
    mov     ax,4fh
    int     41h
  O1 _- B0 f  i# Q    xchg    dx, es:[41h*4]
    xchg    bx, es:[41h*4+2]
! Z9 |0 _/ a' w$ K& Q    cmp     ax, 0f386h
    jz      SoftICE_detected
. T0 J% r, {7 V6 ?6 F: h& s2 ^
int41handler2 PROC
! W- B+ L" g3 X: I9 n7 c+ b! V    iret
int41handler2 ENDP
1 B( E' ^. m3 K# W+ [
* a9 M9 }+ y( q" T+ w2 Q
_________________________________________________________________________


Method 06
=========

% {4 c& y  B8 ^) C! @! k
2nd method similar to the preceding one but more difficult to detect:
  N+ A) g  {* O9 R
; o  e) q7 z9 @2 p
% k0 Q. P, S3 n7 J4 a9 C( M/ ?int41handler PROC
; x9 ?& z% Y  C2 @% v    mov     cl,al
; P/ L# U- R. W0 i4 m    iret
int41handler ENDP

: B9 W# r! S' J+ n2 w. ?1 B' t
; G' p$ D) n4 A7 A) I    xor     ax,ax
    mov     es,ax
    mov     bx, cs
" \) M7 q# Q! j7 Q' }- ~! s    lea     dx, int41handler
- p3 P3 i  V' g) ^/ ~    xchg    dx, es:[41h*4]
. N- `5 E% L( g: B$ s    xchg    bx, es:[41h*4+2]
    in      al, 40h
! O# }3 |, U( _2 ^0 b    xor     cx,cx
+ ~0 r$ u. ?  {( s& j6 `    int     41h
    xchg    dx, es:[41h*4]
- J3 }! m. O; G0 u$ {" x    xchg    bx, es:[41h*4+2]
+ ?/ M- |- W* f& c6 x0 [" k( n    cmp     cl,al
    jnz     SoftICE_detected
' I9 D5 ^' `0 U
. U1 h5 `& I0 U" x6 f* }% j_________________________________________________________________________

Method 07
=========

3 g$ N, K3 K# R6 y) A7 HMethod of detection of the WinICE handler in the int68h (V86)
- |# U; b9 ?) [
    mov     ah,43h
    int     68h
9 T7 g( t4 }2 C/ x) {! g! r! L5 H    cmp     ax,0F386h
    jz      SoftICE_Detected

! r- K: Y# ?% b$ f
& x& a2 B6 |) g' d' d; ^" H=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
   app like this:
6 D! M, @, I6 V2 X6 R! X
% W& i4 l- Q7 O7 Z" D5 G* q" J/ n   BPX exec_int if ax==68
! f# @% a. X- L/ y: c* R   (function called is located at byte ptr [ebp+1Dh] and client eip is
) W/ G- d9 T/ K* T" q   located at [ebp+48h] for 32Bit apps)
. P5 x$ }+ h) j# l1 f) Q: H__________________________________________________________________________


* f  _' C6 a: j1 g4 LMethod 08
  w6 a3 ^# I( r=========

+ }; ?: @' f# {9 uIt is not a method of detection of SoftICE but a possibility to crash the
system by intercepting int 01h and int 03h and redirecting them to another
7 N! h9 {* P9 E8 {' R5 ]routine.
$ S/ x! b  A& YIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
to the new routine to execute (hangs computer...)
; K1 {6 \9 r5 U. W# J. U# e8 q
    mov     ah, 25h
    mov     al, Int_Number (01h or 03h)
" G  U; W/ |# c! @    mov     dx, offset New_Int_Routine
6 w: C, A3 y# f( x    int     21h

0 E6 N, g9 J" a__________________________________________________________________________

8 K* ?& x  |. `" ~& ^6 `. b! uMethod 09
2 `, M9 ]8 u- o+ A=========

/ d( A/ Z( j/ q- ^This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
/ ~9 p0 v8 y4 Iperformed in ring0 (VxD or a ring3 app using the VxdCall).
The Get_DDB service is used to determine whether or not a VxD is installed
for the specified device and returns a Device Description Block (in ecx) for
that device if it is installed.

# t/ q, @5 c# e7 P' w   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID
   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
6 `6 [4 o0 w) s   VMMCall Get_DDB
1 s& g/ t" F* E0 F   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed

7 c8 V9 U2 |5 P% G& I( Q$ }# {Note as well that you can easily detect this method with SoftICE:
   bpx Get_DDB if ax==0202 || ax==7a5fh
2 Z" P* W$ D; i' G$ G1 ?
__________________________________________________________________________
- R! {% H6 k& r# X
7 y6 w- N1 k) i1 m+ aMethod 10
+ y! h, l" ?6 e2 A5 x7 B% ?=========
# U* ^1 v8 |3 b. E' y( s- q- D
=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with
  SoftICE while the option is enable!!

This trick is very efficient:
by checking the Debug Registers, you can detect if SoftICE is loaded
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
0 g3 m$ H+ K7 V; v/ s. O/ bthere are some memory breakpoints set (dr0 to dr3) simply by reading their
) ^  |; ~' z: cvalue (in ring0 only). Values can be manipulated and or changed as well
* _+ s& v' T7 t5 @, O(clearing BPMs for instance)
8 l/ v7 Y- O0 o9 Z( N  n
__________________________________________________________________________
$ W# W+ r2 a: X( X2 Z* z" s5 ^
) i  K/ m6 o" f; ?" G& H1 KMethod 11
$ l% n3 y, ?5 O% t) y=========
' E) |( U1 B7 x3 ^' B5 f
This method is most known as 'MeltICE' because it has been freely distributed
# P! B3 K1 Z: L' J2 }! svia www.winfiles.com. However it was first used by NuMega people to allow
5 M! R9 l2 G, B+ c! [, |; `Symbol Loader to check if SoftICE was active or not (the code is located
inside nmtrans.dll).

The way it works is very simple:
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
WinNT) with the CreateFileA API.

Here is a sample (checking for 'SICE'):
1 p6 z* y. V: W8 S4 Y1 o
BOOL IsSoftIce95Loaded()
{
   HANDLE hFile;  
7 b% p3 G& Z2 Y0 u* {   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
                      FILE_SHARE_READ | FILE_SHARE_WRITE,
                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
   if( hFile != INVALID_HANDLE_VALUE )
( q  c! c! b8 I* i: M   {
! z8 w' K: C7 }      CloseHandle(hFile);
+ S& o5 e8 {: b) w      return TRUE;
   }
   return FALSE;
}

Although this trick calls the CreateFileA function, don't even expect to be
- ~. y. a2 d" n5 |; ]able to intercept it by installing a IFS hook: it will not work, no way!
5 z( V8 L& ~# IIn fact, after the call to CreateFileA it will get through VWIN32 0x001F
' S* X7 s; h+ n$ `. g% A* t1 ~. Tservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
" n: X( }) s/ m  W2 _1 {% x3 Mand then browse the DDB list until it find the VxD and its DDB_Control_Proc
field.
In fact, its purpose is not to load/unload VxDs but only to send a
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
to the VxD Control_Dispatch proc (how the hell a shareware soft could try
to load/unload a non-dynamically loadable driver such as SoftICE ;-).
If the VxD is loaded, it will always clear eax and the Carry flag to allow
: z% q( Q' V" Tits handle to be opened and then, will be detected.
You can check that simply by hooking Winice.exe control proc entry point
9 f: P6 [/ J7 _5 z( e* H5 i9 Kwhile running MeltICE.
- F# c, h8 ?+ D8 q5 p, U) W/ U

  00401067:  push      00402025    ; \\.\SICE
  0040106C:  call      CreateFileA
  00401071:  cmp       eax,-001
  00401074:  je        00401091


! Z& `4 f) Y5 ]! r9 n- XThere could be hundreds of BPX you could use to detect this trick.
9 l4 i' }% Z! q" y# j: p-The most classical one is:
; N/ @, _: v* g/ s4 v: P6 a  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||
7 V: q& f2 n2 a0 S0 O7 N    *(esp-&gt;4+4)=='NTIC'
2 i) C) u. v+ i' X7 x, j6 c/ w" w
-The most exotic ones (could be very slooooow :-(
( f2 [1 M0 n4 V& t9 D- z   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
" L3 S; W- @4 h8 p     ;will break 3 times :-(

* f+ n: H" ~' H# M% U! g; N( ^-or (a bit) faster:
   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
+ q( y  |0 t  b, H, D# x% O) d! Y
5 i" }/ k3 k; i: }3 h8 A" C   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  
6 V+ ?: x- x2 ~% n, {! p) t     ;will break 3 times :-(

5 I& O! Q$ U% Q- h+ o# U9 z* V. m-Much faster:
/ p; a; n' m2 S. Z* l' i5 t   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'

. m% v5 X2 y5 u! X5 ^Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
- q8 ~. W$ F; A  l) P1 Mfunction to do the same job:

5 v- U2 O  J( w  u' C; @   push    00                        ; OF_READ
3 U+ l0 \0 m" z/ c* s   mov     eax,[00656634]            ; '\\.\SICE',0
$ t% d8 q% T% Q1 h& f" P) R3 t, K   push    eax
8 W) S/ I& O  P9 u7 u* X   call    KERNEL32!_lopen
   inc     eax
   jnz     00650589                  ; detected
! u7 ^9 t4 d- K* L: y   push    00                        ; OF_READ
   mov     eax,[00656638]            ; '\\.\SICE'
/ A- q1 W+ s, U# r8 |   push    eax
5 \! Q5 @' {0 a+ v% r- }8 W   call    KERNEL32!_lopen
: D7 N4 w2 \1 b   inc     eax
   jz      006505ae                  ; not detected

" G/ @2 I1 Z4 R) }! b4 S+ T9 R
2 U; Y5 v- x# e! X__________________________________________________________________________

7 _8 O2 j) z: S6 yMethod 12
=========
# g' j! N% b" I1 @6 ]+ k
This trick is similar to int41h/4fh Debugger installation check (code 05
&amp; 06) but very limited because it's only available for Win95/98 (not NT)
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.
! g% v5 E6 l2 C- v8 k9 ~  J
: `+ h# j7 |' v6 ^' _" n  T   push  0000004fh         ; function 4fh
8 A% k4 T# S3 i& v: L' d   push  002a002ah         ; high word specifies which VxD (VWIN32)
5 V' c  i2 g. Z8 l8 ?3 X                           ; low word specifies which service
, q& D) m$ e: O8 g; m- }                             (VWIN32_Int41Dispatch)
   call  Kernel32!ORD_001  ; VxdCall
   cmp   ax, 0f386h        ; magic number returned by system debuggers
; C  q4 r" `% x' {9 J5 r7 M' g   jz    SoftICE_detected

: w! O! f5 H! @2 W; m" b/ SHere again, several ways to detect it:
$ r8 S* K8 w# O  i6 O2 K' U
5 }' M; S5 R0 b    BPINT 41 if ax==4f
- `% D5 Z2 i+ d( r" H4 T
, C5 G2 Z  S" G) M    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one

& n) V( G4 j7 b    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A

* b$ w. ~- w* T" k1 C    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!
8 `) X/ @) P2 J, S+ |' `
__________________________________________________________________________

Method 13
=========
) R; }: b8 r" J/ l; L" E+ H# {+ H
6 w1 y1 s+ v/ u% v# ENot a real method of detection, but a good way to know if SoftICE is
. M9 p0 F# |5 k- V( N6 Qinstalled on a computer and to locate its installation directory.
It is used by few softs which access the following registry keys (usually #2) :
. E* f' P2 _1 f- i9 I# w- m
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
\Uninstall\SoftICE
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
\App Paths\Loader32.Exe
( M( S! Q3 i0 G9 I: Z, u+ x! w* d

( ^3 z! ~! H( wNote that some nasty apps could then erase all files from SoftICE directory
(I faced that once :-(

Useful breakpoint to detect it:
& Z5 Y( h3 m3 b  |( ~
0 w  |) f6 e4 P, r     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'

. |6 ^; l6 E! T. [__________________________________________________________________________

" r5 F& m! i; N
Method 14
=========
6 F( u7 }; {& o: f5 F
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
+ V3 J" V- q7 C; Y% kis to determines whether a debugger is running on your system (ring0 only).

5 s& }  o  u4 M( {4 l6 b* f  Q   VMMCall Test_Debug_Installed
2 L/ B0 l7 R% e" A  O2 b/ m   je      not_installed
2 N2 [* b; D- k" g/ c  F+ L. Z( ]
This service just checks a flag.
% ?" A0 J; y* I* F8 z" [</PRE></TD></TR></TBODY></TABLE>