About anti-SoftICE tricks

<TABLE width=500>
; b( \! ]6 c: O<TBODY>
' m) I$ ], X9 \' f<TR>
' T; q; }) P  y, f. x<TD><PRE>Method 01
9 \* W- b. P1 ^=========
' @0 b* h7 C, z2 t* i
; i! S- O: V$ c0 Y/ ?# VThis method of detection of SoftICE (as well as the following one) is
( T; \# p9 q, h8 Yused by the majority of packers/encryptors found on Internet.
4 c: Z: e9 }4 ?" F8 W" JIt seeks the signature of BoundsChecker in SoftICE
, P  R$ @7 M, d( ^
    mov     ebp, 04243484Bh        ; 'BCHK'
1 g) s  |/ {7 s* B, l* W+ [# K+ p    mov     ax, 04h
    int     3      
    cmp     al,4
7 y! Z7 S0 x7 q' t! K    jnz     SoftICE_Detected

___________________________________________________________________________

8 H6 u( }3 I" c5 [& d; k* B. k# m& ]Method 02
=========

Still a method very much used (perhaps the most frequent one).  It is used
$ n4 v1 R, T( M6 \# f0 ito get SoftICE 'Back Door commands' which gives infos on Breakpoints,
# @! c/ U$ J- t% x/ B: N# ?or execute SoftICE commands...
It is also used to crash SoftICE and to force it to execute any commands
(HBOOT...) :-((  

Here is a quick description:
: N5 D+ q2 A3 T' z/ O-AX = 0910h   (Display string in SIce windows)
-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)
-AX = 0912h   (Get breakpoint infos)
-AX = 0913h   (Set Sice breakpoints)
-AX = 0914h   (Remove SIce breakoints)

Each time you'll meet this trick, you'll see:
0 I- ^( i: S6 v, G$ U4 r0 t# w-SI = 4647h
; Z9 w3 [1 s, Z9 S! Y0 _2 x! z9 s* p-DI = 4A4Dh
Which are the 'magic values' used by SoftIce.
9 u; n- X% ^) T! W! ]For more informations, see "Ralf Brown Interrupt list" chapter int 03h.
0 X$ ~$ R' R# x$ N9 z
Here is one example from the file "Haspinst.exe" which is the dongle HASP
" w; n0 B) M# `6 r3 [3 m3 }Envelope utility use to protect DOS applications:
( H3 {8 s7 j2 m- t3 E

4C19:0095   MOV    AX,0911  ; execute command.
4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).
' N! |# ]. p' Y) Z2 V8 d5 k4C19:009A   MOV    SI,4647  ; 1st magic value.
4C19:009D   MOV    DI,4A4D  ; 2nd magic value.
4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute
4C19:00A4   INC    CX
* y; E* U( @* |7 K! q4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute
4C19:00A8   JB     0095     ; 6 different commands.
  S' z/ W( d' u) J# {4C19:00AA   JMP    0002     ; Bad_Guy jmp back.
$ L) f# R, Z' M/ N/ A  \  W) A5 r4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)
/ s& x, F6 v* Z8 x  I
The program will execute 6 different SIce commands located at ds:dx, which
: S) `0 l0 x1 {0 ?: r& `( Ware: LDT, IDT, GDT, TSS, RS, and ...HBOOT.

6 |+ U) P! n0 Q/ K; r* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
8 Z, A" A& ^; j/ D- K___________________________________________________________________________
& L$ Y, J" ~; J' R$ r) o0 u$ e2 p

Method 03
=========
$ G4 ^# l* i( n, b! d8 l2 u
Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
(API Get entry point)
        

* |( y) e. h7 y3 L, R% e, z% n: U. j    xor     di,di
    mov     es,di
    mov     ax, 1684h      
6 F+ u7 Q( R; J" @- B& z    mov     bx, 0202h       ; VxD ID of winice
    int     2Fh
1 g9 \* u9 E# u1 a  n5 C' M+ i    mov     ax, es          ; ES:DI -&gt; VxD API entry point
    add     ax, di
    test    ax,ax
    jnz     SoftICE_Detected

4 r/ p. |4 s5 m  V/ g' P5 N___________________________________________________________________________
( r) W0 ~5 p; n' p
Method 04
) `- @9 t6 w& b: P9 u4 w" J=========
6 M; }9 W5 A* s" c$ \# g8 R' ?/ U
Method identical to the preceding one except that it seeks the ID of SoftICE
, ]/ {. b* B1 D0 YGFX VxD.
/ I' c- E0 ], ]! }- z- L; j
; n5 p0 G$ B) b. [' S5 O    xor     di,di
    mov     es,di
    mov     ax, 1684h      
! s! @: w4 W) ?6 @    mov     bx, 7a5Fh       ; VxD ID of SIWVID
    int     2fh
    mov     ax, es          ; ES:DI -&gt; VxD API entry point
, i/ d% |, |6 W8 j% C0 N    add     ax, di
2 \( F2 n0 H$ @# ?& X, n5 J3 U2 t    test    ax,ax
2 r/ h0 A9 s7 J3 P$ T" o2 j2 P    jnz     SoftICE_Detected
! N7 J& y) ^* b
__________________________________________________________________________

0 H, R$ j) V0 X/ _
2 T& N" J7 \1 zMethod 05
=========

Method seeking the 'magic number' 0F386h returned (in ax) by all system
/ Q' L  w* q" S9 i, Rdebugger. It calls the int 41h, function 4Fh.
7 @( F4 U8 ~) V7 b1 {There are several alternatives.  

The following one is the simplest:
- H0 i# U9 W( W6 E- v0 B
+ _& J" E0 a! ?$ b% w% [* {6 J7 |    mov     ax,4fh
    int     41h
    cmp     ax, 0F386
3 f- i5 ~+ m; z. T! a$ K3 ~    jz      SoftICE_detected

! y- L/ Q9 `% t8 ?1 q
+ s& c' V4 U8 e( n% qNext method as well as the following one are 2 examples from Stone's
+ }% c! z! Q( e5 l/ }6 O. o"stn-wid.zip" (www.cracking.net):

    mov     bx, cs
0 Q4 \) ^8 x" W) T+ \    lea     dx, int41handler2
    xchg    dx, es:[41h*4]
    xchg    bx, es:[41h*4+2]
    mov     ax,4fh
' S  ?4 |& A( q9 S$ q7 i: z$ `    int     41h
    xchg    dx, es:[41h*4]
    xchg    bx, es:[41h*4+2]
/ Y  Q. P, I6 r    cmp     ax, 0f386h
    jz      SoftICE_detected
; m1 a/ B. I  M
, R3 [5 ?8 v- x0 d& o- Mint41handler2 PROC
: ]" P% k; f7 M5 B6 [  A8 [" {0 \    iret
! A" L% z" f( lint41handler2 ENDP


9 F1 ~' ~  m/ o4 x* z: t5 f& d  b_________________________________________________________________________
8 s7 V( v$ h& {! t3 {
$ z. h8 l! V9 ^# W. ^
Method 06
) c, h5 ]; ?- Z; }# \& X=========
. t' W( A- r3 [7 R& Q

2nd method similar to the preceding one but more difficult to detect:
6 }+ q7 D2 i( X
- |1 ?4 `+ F. s5 f8 H; `" J: m
int41handler PROC
; g8 g  a4 }" H    mov     cl,al
    iret
' U/ x# F' @, l( Iint41handler ENDP
" }2 p1 J# R! J

    xor     ax,ax
    mov     es,ax
    mov     bx, cs
    lea     dx, int41handler
    xchg    dx, es:[41h*4]
$ h# ~- D3 ~, ?: _7 `9 f2 d4 n  D+ b    xchg    bx, es:[41h*4+2]
    in      al, 40h
. a/ b; L. H. ~0 U1 J& f    xor     cx,cx
    int     41h
% Z2 t: M$ f2 G    xchg    dx, es:[41h*4]
/ p- U1 T1 _9 S' e# q    xchg    bx, es:[41h*4+2]
8 R/ l/ g4 Q/ D& Q9 u* ~7 {    cmp     cl,al
    jnz     SoftICE_detected

% h8 ]! b& n, @6 i* H_________________________________________________________________________

Method 07
=========
3 y  w0 Z0 [# I. g& Y% o" B
Method of detection of the WinICE handler in the int68h (V86)

    mov     ah,43h
4 ~; h- d8 d  n0 h$ S    int     68h
    cmp     ax,0F386h
0 S% n* ~+ A0 D& V/ [4 w    jz      SoftICE_Detected


=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
" N1 Q" ^; L% J2 }   app like this:
6 C; z9 T  u$ v  e- {
   BPX exec_int if ax==68
   (function called is located at byte ptr [ebp+1Dh] and client eip is
" C8 O( f1 d. V) f1 B   located at [ebp+48h] for 32Bit apps)
__________________________________________________________________________

$ g, }) ^, ]) X: C1 A* G
& l* F2 W0 ?+ K8 j' C% o. PMethod 08
9 _* y# q% Y  o& g  y=========
, U# V+ ^; v* s3 l
It is not a method of detection of SoftICE but a possibility to crash the
system by intercepting int 01h and int 03h and redirecting them to another
routine.
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
  C5 j6 |5 N& Z6 j# sto the new routine to execute (hangs computer...)

    mov     ah, 25h
    mov     al, Int_Number (01h or 03h)
    mov     dx, offset New_Int_Routine
    int     21h

__________________________________________________________________________

) n( j- M! G1 {- u' i4 T, rMethod 09
=========

This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
- @: B& D1 A3 v' G( [6 o5 Q/ Fperformed in ring0 (VxD or a ring3 app using the VxdCall).
The Get_DDB service is used to determine whether or not a VxD is installed
- }3 U' H% J+ D5 u, \9 L) |for the specified device and returns a Device Description Block (in ecx) for
1 d4 G5 v; u4 z2 vthat device if it is installed.
' l) w2 d4 J& Q$ j  Y3 `
3 N% e! d. y+ ?* c, W3 N( k   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID
   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
. ~. i# k5 _/ V+ b' C0 K+ J( a   VMMCall Get_DDB
! Z, A5 V' \* r  `   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed
: ?* K2 i- w9 g1 w6 _$ |
Note as well that you can easily detect this method with SoftICE:
   bpx Get_DDB if ax==0202 || ax==7a5fh
" o3 q) s" y! f9 e" }; ]/ e  {
8 h7 U% s) A6 ?$ F__________________________________________________________________________
& p( K" u) J' [. r: d4 U
) G4 m5 n. i8 ?4 D. l# q; lMethod 10
  D  u3 o- I; K" R7 Z9 Q=========

=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with
; r; P! L4 ]; E1 m6 @3 D5 w  SoftICE while the option is enable!!

This trick is very efficient:
by checking the Debug Registers, you can detect if SoftICE is loaded
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
there are some memory breakpoints set (dr0 to dr3) simply by reading their
" ^5 L: X; E) h' ]value (in ring0 only). Values can be manipulated and or changed as well
(clearing BPMs for instance)

__________________________________________________________________________
1 l+ f+ B" P2 \( |, H0 C. r5 }
Method 11
=========

This method is most known as 'MeltICE' because it has been freely distributed
% f4 O% |& o7 z! d  g  Jvia www.winfiles.com. However it was first used by NuMega people to allow
Symbol Loader to check if SoftICE was active or not (the code is located
# ^5 ^) c0 l6 E& K& ginside nmtrans.dll).
" R* x8 n1 K  z0 c9 v- q# y- C
6 K, q- R/ H+ F) Q* IThe way it works is very simple:
0 f* k0 l' S1 O1 B* y# }9 ]& ]It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
# R) ^- S. c# A. {$ N( n/ jWinNT) with the CreateFileA API.
- T% u. L( c# ]# x6 e
Here is a sample (checking for 'SICE'):
8 G1 f' U' g  ?. n7 O7 Z; O0 m
BOOL IsSoftIce95Loaded()
; J: `! B# q! ~{
" w4 R6 x" Y& F5 a   HANDLE hFile;  
3 |' ~$ |. ^. ]   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
$ F8 e' x- Y- t! n) H: }- n# u1 F                      FILE_SHARE_READ | FILE_SHARE_WRITE,
9 r2 H- ]9 O) i- }) ]                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
   if( hFile != INVALID_HANDLE_VALUE )
   {
      CloseHandle(hFile);
# S* d6 d* ~7 D: ]5 {* u% E8 F      return TRUE;
: t4 {* s( a, |: `, ^" X" v   }
: U# L& G- `0 k0 Y: {% v& H   return FALSE;
}

Although this trick calls the CreateFileA function, don't even expect to be
able to intercept it by installing a IFS hook: it will not work, no way!
In fact, after the call to CreateFileA it will get through VWIN32 0x001F
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
, ?9 O: R# X8 z1 H, X: v4 T" H4 |and then browse the DDB list until it find the VxD and its DDB_Control_Proc
field.
In fact, its purpose is not to load/unload VxDs but only to send a
2 y* j- P& H; c# [+ A! Z2 iW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
to the VxD Control_Dispatch proc (how the hell a shareware soft could try
  Z1 ~. |7 Q* q0 A+ o, K  yto load/unload a non-dynamically loadable driver such as SoftICE ;-).
If the VxD is loaded, it will always clear eax and the Carry flag to allow
1 B9 B6 D4 H, i) e  g8 R. Wits handle to be opened and then, will be detected.
You can check that simply by hooking Winice.exe control proc entry point
while running MeltICE.
3 {/ T$ t) Z/ k6 i0 i$ I

) @/ h& \9 {  w) d, o' U  00401067:  push      00402025    ; \\.\SICE
  0040106C:  call      CreateFileA
  00401071:  cmp       eax,-001
  00401074:  je        00401091
* s1 O4 {1 `) a9 l4 W" E9 ]" e

/ |6 J# |$ v# o2 m; Q4 WThere could be hundreds of BPX you could use to detect this trick.
-The most classical one is:
  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||
6 O$ n( ^; Z; c5 F    *(esp-&gt;4+4)=='NTIC'

4 s# f; X3 t1 P- k. ^-The most exotic ones (could be very slooooow :-(
   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
+ l$ S# O8 ?% X( h+ P2 D9 ?# f$ H$ R     ;will break 3 times :-(
& A. y/ W* D) Z$ _! m  W
) V$ y+ u4 q; V0 n. Z& v+ j2 m7 C3 K+ A-or (a bit) faster:
$ z+ S; X2 l$ I* p- c4 U& }   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
4 V* J$ Q6 F9 y
( k/ n: u: M3 W. h   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  
     ;will break 3 times :-(
* s2 M3 [3 z/ u! L3 X
6 R) Q: B5 w& v. T/ `" C1 ?-Much faster:
   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'

. Y/ v+ \& I+ G4 {. L( aNote also that some programs (like AZPR3.00) use de old 16-bit _lopen
function to do the same job:

8 H3 ~! x0 X- [   push    00                        ; OF_READ
+ n6 A$ l- w$ Z  n' M% O4 f" w   mov     eax,[00656634]            ; '\\.\SICE',0
* n2 h# n; D1 r3 N, j$ J   push    eax
* Q3 B/ c+ h& P& v2 J1 A   call    KERNEL32!_lopen
   inc     eax
( i6 U% ]$ z8 P- _% [   jnz     00650589                  ; detected
   push    00                        ; OF_READ
   mov     eax,[00656638]            ; '\\.\SICE'
5 O  L. f+ ]" B9 G   push    eax
+ K$ o3 E9 d- a   call    KERNEL32!_lopen
   inc     eax
   jz      006505ae                  ; not detected

$ S# F, O" y2 D- L+ e8 [
__________________________________________________________________________
! w2 K: Q/ m1 F/ a6 J% T
2 u* X* \0 o! u9 x0 bMethod 12
=========
3 o5 ]# v2 h. m: u2 M8 j
/ _5 P0 g% _* p+ TThis trick is similar to int41h/4fh Debugger installation check (code 05
5 L5 n5 T+ ?5 A, m4 y1 [, z&amp; 06) but very limited because it's only available for Win95/98 (not NT)
6 W+ G: E7 H5 B1 X- _8 X+ e* Cas it uses the VxDCall backdoor. This detection was found in Bleem Demo.

" o- O$ o# k  w3 Y- E9 r1 u   push  0000004fh         ; function 4fh
6 G! d" A8 ^; A% F# P% M   push  002a002ah         ; high word specifies which VxD (VWIN32)
$ A8 F! X2 h" V1 B( ]                           ; low word specifies which service
                             (VWIN32_Int41Dispatch)
   call  Kernel32!ORD_001  ; VxdCall
3 S4 `* A: x9 j- y( L8 n* H   cmp   ax, 0f386h        ; magic number returned by system debuggers
( }. G1 _6 K# _% F   jz    SoftICE_detected

# Z: E9 P4 w- i! I* [  _Here again, several ways to detect it:

# Q8 S/ n0 n- F' X- N* R/ F3 x# `+ y* W    BPINT 41 if ax==4f
) ]$ L6 f: F) V: n2 S, Q
0 |* Z( @/ j! Z    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one
8 o4 v( W2 c8 P- l* E
    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A
8 G8 M4 n/ f- t5 `
5 j) `9 v5 d0 r/ C2 c    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!
4 M+ d6 z9 y8 }! d! `
__________________________________________________________________________

/ X" T' D, Z$ Z- d- wMethod 13
=========

, _9 W5 h8 C% m7 Z; |: hNot a real method of detection, but a good way to know if SoftICE is
8 o+ f" E. Y- S" B) minstalled on a computer and to locate its installation directory.
6 r6 h1 S( f: |It is used by few softs which access the following registry keys (usually #2) :

-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
\Uninstall\SoftICE
+ E- R+ g) I1 G, e) j-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
\App Paths\Loader32.Exe
, B4 G# O2 c3 B. B3 V( o
" v( k8 H8 _) B5 b6 H# F& j
Note that some nasty apps could then erase all files from SoftICE directory
(I faced that once :-(

* C8 W  ]: ?$ {Useful breakpoint to detect it:
6 _3 s: q$ k, ^- p  y+ e' a. D0 T- u
     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'

' I4 P1 l1 w( _! i0 H1 I7 @__________________________________________________________________________
. b% D- h' T* a; n
" F; w7 v+ Z' w. R- @( d5 e" B
Method 14
=========

A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
7 ]9 Y4 A# X9 t* Ais to determines whether a debugger is running on your system (ring0 only).

: w; H7 v4 w' |8 |7 R: c* y   VMMCall Test_Debug_Installed
   je      not_installed

2 X. F' {/ [9 R, rThis service just checks a flag.
</PRE></TD></TR></TBODY></TABLE>