About anti-SoftICE tricks

<TABLE width=500>
<TBODY>
& V; ]0 y6 C% K$ a; I3 y<TR>
<TD><PRE>Method 01
7 k" i6 f) [( {: o7 |=========
3 `) G5 z' g9 V( E3 ?' _$ U3 {4 B2 r
8 B% ~' x; _# }$ l' j# g. d3 m2 LThis method of detection of SoftICE (as well as the following one) is
used by the majority of packers/encryptors found on Internet.
It seeks the signature of BoundsChecker in SoftICE

8 k# r4 q0 d9 G! y& U5 B    mov     ebp, 04243484Bh        ; 'BCHK'
2 Z$ `' `9 K  y    mov     ax, 04h
    int     3      
8 U' G  L3 C; P8 ?" d    cmp     al,4
    jnz     SoftICE_Detected

___________________________________________________________________________

Method 02
* I1 s7 {/ k/ L=========
8 q( L" @' P; s( m# O2 G
1 n, C) Y; X1 ]" x) lStill a method very much used (perhaps the most frequent one).  It is used
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,
& V! F& z5 \# n) E2 S1 L" \or execute SoftICE commands...
0 L7 g6 F/ c3 _# p2 d+ _( A8 [It is also used to crash SoftICE and to force it to execute any commands
2 w+ y& N% y' R6 T* o. r(HBOOT...) :-((  

Here is a quick description:
; k8 S, I, d- k7 K- s  b9 J-AX = 0910h   (Display string in SIce windows)
-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)
-AX = 0912h   (Get breakpoint infos)
* _  C& i( i  Z3 v+ o, R% Z-AX = 0913h   (Set Sice breakpoints)
- w/ ?& \4 J) q4 R+ B. L-AX = 0914h   (Remove SIce breakoints)
! h0 f; E7 x* O
Each time you'll meet this trick, you'll see:
+ M5 @/ I2 {) v: A- j' N" r-SI = 4647h
-DI = 4A4Dh
Which are the 'magic values' used by SoftIce.
" f  ~; Q8 N9 Q- Z* @3 BFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.
! [* v  e% x! q# X- |( W) ]
Here is one example from the file "Haspinst.exe" which is the dongle HASP
4 T, x* c) ?  z, T4 gEnvelope utility use to protect DOS applications:

1 B/ @  B5 s8 T4 P
& f" C5 Z; `( a2 p4C19:0095   MOV    AX,0911  ; execute command.
4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).
8 U% v5 s5 a  o) _# F$ m) {4C19:009A   MOV    SI,4647  ; 1st magic value.
4C19:009D   MOV    DI,4A4D  ; 2nd magic value.
4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
/ K0 Y) h* _+ y/ Y# u4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute
4C19:00A4   INC    CX
6 @/ D: ~- G$ p  e# O5 _4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute
4C19:00A8   JB     0095     ; 6 different commands.
1 q0 E. C: o8 C$ a! M0 P& h4C19:00AA   JMP    0002     ; Bad_Guy jmp back.
4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)

/ f( N: F7 a% @The program will execute 6 different SIce commands located at ds:dx, which
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
6 ^$ m2 C8 c6 t6 R+ F
+ d9 y, r/ u) C2 `- L$ Y7 Z1 O* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
___________________________________________________________________________
) @. W1 T- K: c! W

% E  Q0 v9 @0 @7 q3 K  a" uMethod 03
& t1 Z9 ?; x, ~) |3 Z1 R4 {=========

Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
+ D, q7 c( p6 P9 S" N(API Get entry point)
; ~9 Q! ]0 W* n+ \7 o        

    xor     di,di
% B1 @' O7 a: y1 M! e. y  ~& a    mov     es,di
. b* e- r; b1 {3 L    mov     ax, 1684h      
) o" j  e3 j& v    mov     bx, 0202h       ; VxD ID of winice
- C( y; F9 a" s4 P    int     2Fh
    mov     ax, es          ; ES:DI -&gt; VxD API entry point
    add     ax, di
$ F* Z9 E' n) c4 v, O+ u5 W    test    ax,ax
4 D3 ^# D) l& P+ q8 a9 N  w+ }+ C+ }    jnz     SoftICE_Detected

7 {  y4 c/ }, X___________________________________________________________________________
* |# s8 N/ W9 |2 t0 E/ d- T. j
Method 04
=========

Method identical to the preceding one except that it seeks the ID of SoftICE
GFX VxD.
, Y" `% [/ ]  I( i, C. P3 i) x: G
    xor     di,di
9 D$ h4 W4 q- Q- z% z    mov     es,di
    mov     ax, 1684h      
5 `' v9 P2 v7 K% Q5 g    mov     bx, 7a5Fh       ; VxD ID of SIWVID
    int     2fh
+ ~6 Z$ p7 g5 d4 s- Z% K( v    mov     ax, es          ; ES:DI -&gt; VxD API entry point
6 y- c  |: C4 [, S) S% H    add     ax, di
3 k0 K$ p- J( }4 ^1 U) Z8 @( \    test    ax,ax
% y/ p5 }4 k1 _+ \0 X    jnz     SoftICE_Detected
7 f. Z% N1 [8 O; @
. y9 |! x2 ~0 ?  ^& V& p__________________________________________________________________________
1 M+ g9 ]" I7 ?; _" B
9 I& R- |; c+ w2 c" \4 z
Method 05
$ {, @1 X2 y3 S( c# d/ C=========
& Y' a8 z: m2 D) F. ]
Method seeking the 'magic number' 0F386h returned (in ax) by all system
debugger. It calls the int 41h, function 4Fh.
There are several alternatives.  
4 s$ G$ B# r( ]6 o; Y8 n; O. Q. B) |/ B
/ {, E' L( r. u: `2 q7 |The following one is the simplest:

    mov     ax,4fh
    int     41h
7 f3 H% i3 F0 D# |  B# x    cmp     ax, 0F386
& s" q9 ?' n: M/ E3 r: m    jz      SoftICE_detected


/ W; Z- i1 N! A! }' G# }; D; wNext method as well as the following one are 2 examples from Stone's
"stn-wid.zip" (www.cracking.net):
8 i7 i5 l# d& O) {6 n" ^8 W
' Q% \) A8 X" c1 Y, l    mov     bx, cs
! Y% q4 b' B2 l+ i    lea     dx, int41handler2
    xchg    dx, es:[41h*4]
2 i: S4 n: _. F# X% W    xchg    bx, es:[41h*4+2]
    mov     ax,4fh
    int     41h
    xchg    dx, es:[41h*4]
    xchg    bx, es:[41h*4+2]
    cmp     ax, 0f386h
    jz      SoftICE_detected
. t8 S' _% r& W% J0 I+ }/ g4 [
int41handler2 PROC
    iret
int41handler2 ENDP
) a5 J0 i, R9 O# V$ c

_________________________________________________________________________


! W) T0 P1 L* ]; tMethod 06
=========

4 T! S$ g8 ]' k5 Y9 g8 @2 w3 J  j
) b' _2 n9 M  s2nd method similar to the preceding one but more difficult to detect:

5 N" _! Z5 i: b. A
int41handler PROC
3 k) M, x5 z/ U& A3 V7 j    mov     cl,al
    iret
. V, _( z" {9 H( J& J0 I% w" T2 Oint41handler ENDP
2 h' ^1 g/ P  `3 a0 ~; ~$ i! I; ]

# K* ]7 B4 _1 M9 l' Y1 r- e- L: Z    xor     ax,ax
    mov     es,ax
! y3 i' p8 b% j+ J+ q" X8 l8 d) L$ M    mov     bx, cs
# w& _& i) l/ V    lea     dx, int41handler
. t! _/ E* D  g! _    xchg    dx, es:[41h*4]
1 N! J) i* h3 N) Y2 ~    xchg    bx, es:[41h*4+2]
$ x2 h+ v5 s- ^, ?+ m    in      al, 40h
    xor     cx,cx
    int     41h
    xchg    dx, es:[41h*4]
    xchg    bx, es:[41h*4+2]
    cmp     cl,al
    jnz     SoftICE_detected
& V- K4 F2 P+ d, g0 E
_________________________________________________________________________

3 a0 t) i+ \1 g+ p/ k* NMethod 07
=========

! q/ K. K$ M* I' X* [+ W* QMethod of detection of the WinICE handler in the int68h (V86)

+ F2 I+ k+ A8 L- s+ w" F/ t    mov     ah,43h
    int     68h
6 w8 x2 z; Q; b8 r% g8 I& u    cmp     ax,0F386h
" p2 `; H5 ^' J' _# E; u4 b/ B8 o    jz      SoftICE_Detected


=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
% e. u& L( i9 R* c8 T   app like this:

) x" K  Z2 r$ ^# {- |   BPX exec_int if ax==68
6 H" |; t+ Z% a" D   (function called is located at byte ptr [ebp+1Dh] and client eip is
   located at [ebp+48h] for 32Bit apps)
# t7 m& S& |) }$ L# [! y__________________________________________________________________________

2 F( T- x6 B( g7 X* X
Method 08
=========
0 }+ z3 g( z+ T: D0 M
It is not a method of detection of SoftICE but a possibility to crash the
system by intercepting int 01h and int 03h and redirecting them to another
5 u. |: T$ O7 Q0 O- A& Wroutine.
& p$ `6 a3 E5 {0 R9 T# `It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
$ e0 g( C6 }0 i2 `/ \% f/ Cto the new routine to execute (hangs computer...)
) Z% R+ E+ p( F4 D4 S
    mov     ah, 25h
* e( y6 O2 i1 \. x7 T# k/ W    mov     al, Int_Number (01h or 03h)
    mov     dx, offset New_Int_Routine
    int     21h
# w& M3 P/ m, Q3 N2 O6 {1 S* y
8 F6 D1 ?0 ~" W* a9 A; H# z__________________________________________________________________________

Method 09
4 D; E# w) i* t0 i2 k' V" n=========
# }# i) }+ w2 \' ?2 F& ~" S% Y
7 x# _  _0 u! B- r% a" u$ Y1 gThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
8 p: p6 W; k" f5 n9 sperformed in ring0 (VxD or a ring3 app using the VxdCall).
* o7 s! A( C; x! N2 `+ oThe Get_DDB service is used to determine whether or not a VxD is installed
for the specified device and returns a Device Description Block (in ecx) for
that device if it is installed.

: ]# d, w. `9 ]# |& P1 k! i   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID
   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
# a# V: W5 A0 t$ `3 z6 I   VMMCall Get_DDB
6 g7 E/ A3 n+ f# G3 ?   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed
  P$ }! z; d' W' M$ g
Note as well that you can easily detect this method with SoftICE:
; Q' `( \, Z/ B9 _! _   bpx Get_DDB if ax==0202 || ax==7a5fh

__________________________________________________________________________

Method 10
$ p5 J, m" ]; m=========

=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with
  SoftICE while the option is enable!!
1 B. W) s3 R8 r+ V" x: h
This trick is very efficient:
5 `+ Y8 S  @2 I0 E/ Q# y- Nby checking the Debug Registers, you can detect if SoftICE is loaded
( Y$ a* |# K9 u# c' C, K(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
4 M0 O5 I3 v0 g* y' @+ w& ythere are some memory breakpoints set (dr0 to dr3) simply by reading their
value (in ring0 only). Values can be manipulated and or changed as well
$ S. z5 y3 I- W; M(clearing BPMs for instance)
3 x5 Y8 P: D/ ~6 j
__________________________________________________________________________

Method 11
=========

This method is most known as 'MeltICE' because it has been freely distributed
+ ?; f4 I: }  T0 d3 c1 Z. ]5 r! svia www.winfiles.com. However it was first used by NuMega people to allow
! b7 E' ]' W1 Q+ x/ m, Q% C; u' U4 ESymbol Loader to check if SoftICE was active or not (the code is located
inside nmtrans.dll).
3 x9 {- k) q% K; H& x
& C: T6 ?# `% x- u: f( ZThe way it works is very simple:
. B; N- V" T; TIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
3 |3 }2 i) D0 I! [WinNT) with the CreateFileA API.
, \) n/ o) l4 ?4 y: v
; w% k2 v! O: J: AHere is a sample (checking for 'SICE'):
$ ?/ f- l  o, f2 E) j" S6 Z; Y" Z
BOOL IsSoftIce95Loaded()
& T0 _2 _$ f& U{
2 R/ A) O7 e$ f, h+ ]) \; y% D$ T& y   HANDLE hFile;  
   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
  ~  v  s$ ~5 w0 v: r                      FILE_SHARE_READ | FILE_SHARE_WRITE,
                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
. [! T/ M# G/ Z0 k   if( hFile != INVALID_HANDLE_VALUE )
# T' Y  d: d" j% Y) [) i- v   {
# B% Z: d7 y% \+ b* o2 E" b  |      CloseHandle(hFile);
6 x) {3 C, X& o; L- j      return TRUE;
+ L, D' E. ?1 w; B% _, M3 y2 z   }
7 l/ v; [6 r% g# Q( |8 `, R3 ?$ ?# n   return FALSE;
}

Although this trick calls the CreateFileA function, don't even expect to be
2 e: w. H# z. w. T4 K& Qable to intercept it by installing a IFS hook: it will not work, no way!
In fact, after the call to CreateFileA it will get through VWIN32 0x001F
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
and then browse the DDB list until it find the VxD and its DDB_Control_Proc
  |8 [( ~- x7 c$ n9 gfield.
In fact, its purpose is not to load/unload VxDs but only to send a
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
to the VxD Control_Dispatch proc (how the hell a shareware soft could try
to load/unload a non-dynamically loadable driver such as SoftICE ;-).
' s" s) ^2 L: }9 w- `4 iIf the VxD is loaded, it will always clear eax and the Carry flag to allow
$ D( _+ }2 `- \# ]its handle to be opened and then, will be detected.
You can check that simply by hooking Winice.exe control proc entry point
while running MeltICE.
  _, M6 ~# T/ [- L9 b- W6 E
7 ^/ n; o, H! j0 f6 o
  00401067:  push      00402025    ; \\.\SICE
- h% }& b( `" o. a' z5 ~; T# P  0040106C:  call      CreateFileA
  00401071:  cmp       eax,-001
  00401074:  je        00401091


. r5 X! Z( ], H$ `% a& g6 z* zThere could be hundreds of BPX you could use to detect this trick.
* y* v. [: O; K7 |; |-The most classical one is:
( w( c8 \$ Z( V2 |2 a/ n  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||
$ R' ^) ?/ J+ W, |- \% w% L    *(esp-&gt;4+4)=='NTIC'

-The most exotic ones (could be very slooooow :-(
   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
     ;will break 3 times :-(
6 r" Y5 @3 D3 h! M3 R; t
  W  V1 T2 o2 P' d-or (a bit) faster:
   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
. B6 s+ e% f! t3 q; r" m
   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  
     ;will break 3 times :-(

-Much faster:
   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'

Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
function to do the same job:
: Z: H- X+ e! v$ g
8 s2 T$ ?  A6 h1 A   push    00                        ; OF_READ
' F5 F6 s( E" ]; e2 ?   mov     eax,[00656634]            ; '\\.\SICE',0
   push    eax
$ b6 I" [6 w& ^: R5 w   call    KERNEL32!_lopen
   inc     eax
   jnz     00650589                  ; detected
* C: R3 v5 f+ h$ f% E   push    00                        ; OF_READ
7 Y) E: ]2 u! Y3 W5 D   mov     eax,[00656638]            ; '\\.\SICE'
) s7 d" m8 {' `) ~. B, _   push    eax
* V' L, m; X/ I7 h- u: @: @' ]   call    KERNEL32!_lopen
   inc     eax
  s& H2 D: Y! ^9 m# R   jz      006505ae                  ; not detected

  C4 K# O* K) s
__________________________________________________________________________
7 [3 ~! D- ~/ d. k
) h. N# a* U, C4 l5 w: b2 WMethod 12
  Z1 v7 h% R2 ?1 v) X=========
/ V8 Q& ?; b; J. o7 x
- e* J6 }, R" `3 x. }This trick is similar to int41h/4fh Debugger installation check (code 05
; Y2 F; S4 x' N- z&amp; 06) but very limited because it's only available for Win95/98 (not NT)
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.

8 @: \* v5 U# y! a   push  0000004fh         ; function 4fh
7 e, V2 A2 r3 E* h   push  002a002ah         ; high word specifies which VxD (VWIN32)
7 d; i& Y# K! Z                           ; low word specifies which service
+ C- [( u$ Z) r- K6 `/ ]5 G. N% p                             (VWIN32_Int41Dispatch)
2 E1 _% a$ ~# x7 T. M- G   call  Kernel32!ORD_001  ; VxdCall
2 N- [% ?/ G& z* {8 P$ ?# g   cmp   ax, 0f386h        ; magic number returned by system debuggers
6 g8 X6 u; v$ I8 q( y. y2 {9 h5 W   jz    SoftICE_detected
3 }  x% D' F' R& y
1 i2 w2 @4 N, K0 y9 k& [Here again, several ways to detect it:
( X6 {& U* X2 @, F6 C
    BPINT 41 if ax==4f

. @% a& h. I8 `" b    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one
6 |' \  r: ]7 O1 q4 B$ ~" X/ @
    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A
" W& M: N" I9 F* i7 i
: N: C& f4 d2 R! V: N8 \5 o' z    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!

__________________________________________________________________________
" t1 K8 a! @4 H. E
6 B1 D& V2 K9 XMethod 13
3 _4 I# v% t( ~/ q=========
* M% S5 i( \4 d# h
) j% T1 q% E! b9 C0 M% Q2 FNot a real method of detection, but a good way to know if SoftICE is
3 j1 p1 g3 D  M7 o! Qinstalled on a computer and to locate its installation directory.
It is used by few softs which access the following registry keys (usually #2) :
3 K* A. d& a# a; Q& V" W5 v
& ?4 d& [+ f; o) s. G-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
\Uninstall\SoftICE
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
\App Paths\Loader32.Exe

9 h# ]0 }; A' a# ]* L3 E
/ b/ x7 J3 ^, A! b- w) nNote that some nasty apps could then erase all files from SoftICE directory
(I faced that once :-(

Useful breakpoint to detect it:

     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'
, m% k0 {: c) l
% O' W, j$ T! B__________________________________________________________________________
' z. A4 p! |; n9 h
/ E4 L7 ^! c& F% X
Method 14
  m* \! k  c/ |4 f* K' T' g=========
) n% w- S  Y* I, _
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
3 ^* ~8 U: i9 e0 P- y3 T& U7 kis to determines whether a debugger is running on your system (ring0 only).

1 P& O/ D, P; ^) g   VMMCall Test_Debug_Installed
   je      not_installed
- c5 i) |& }# p4 m) I
! c; F7 `9 z! T" q2 F3 p9 Z% sThis service just checks a flag.
" I1 T6 m# t5 S- o</PRE></TD></TR></TBODY></TABLE>