About anti-SoftICE tricks

<TABLE width=500>
8 R4 u5 d" `3 U# _( l<TBODY>
* m# Z2 j, X# e5 d5 Z- j  ~<TR>
, Y0 K9 h; Z2 V) G% b2 V9 r<TD><PRE>Method 01
8 H, [: Y  h/ L9 \5 |* h6 |* ]' X=========

This method of detection of SoftICE (as well as the following one) is
& n# P) X4 R( E* H* ?used by the majority of packers/encryptors found on Internet.
+ X; Y, D8 `; ^4 cIt seeks the signature of BoundsChecker in SoftICE

! y* a" |$ @& W( M# ?8 m    mov     ebp, 04243484Bh        ; 'BCHK'
3 s$ @5 B9 N3 F+ m7 E4 h    mov     ax, 04h
$ Y% R; ]* j% w. F; E    int     3      
1 ]! r1 ]+ n1 e+ O) O/ l$ O$ `    cmp     al,4
    jnz     SoftICE_Detected
3 W% s8 m: Z) ]) C
___________________________________________________________________________

Method 02
=========
/ _. k  Q! G' s2 [  n
Still a method very much used (perhaps the most frequent one).  It is used
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,
! G8 {# `7 k/ |or execute SoftICE commands...
It is also used to crash SoftICE and to force it to execute any commands
) S; R+ d7 |7 W" T) u0 u) Q" u(HBOOT...) :-((  
) `( y; D# P' {1 t2 Z. U$ D
+ i1 j7 V  B# u/ G) gHere is a quick description:
-AX = 0910h   (Display string in SIce windows)
- H: x& R* U& x7 y-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)
  s, y' \2 L( k9 z+ w5 f: I-AX = 0912h   (Get breakpoint infos)
-AX = 0913h   (Set Sice breakpoints)
0 |5 b5 R+ O# Q/ r-AX = 0914h   (Remove SIce breakoints)

Each time you'll meet this trick, you'll see:
-SI = 4647h
0 H7 \1 P# P- i4 l" l-DI = 4A4Dh
& i. G7 k* I1 c, Y. TWhich are the 'magic values' used by SoftIce.
5 B, t% F; i+ h+ ?; k. o, iFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.
$ S+ o# F) ?: s' b* U) \
Here is one example from the file "Haspinst.exe" which is the dongle HASP
Envelope utility use to protect DOS applications:
6 t/ A. R1 n! m- w

  A7 y  {6 F' k8 H4C19:0095   MOV    AX,0911  ; execute command.
4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).
+ h! ]/ J' J& G! B3 G- }! u4C19:009A   MOV    SI,4647  ; 1st magic value.
4C19:009D   MOV    DI,4A4D  ; 2nd magic value.
8 Z7 _1 x) P* a, Z3 B4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute
4C19:00A4   INC    CX
4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute
4C19:00A8   JB     0095     ; 6 different commands.
4C19:00AA   JMP    0002     ; Bad_Guy jmp back.
4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)

7 |* v; S" B9 n- W0 @7 X, M5 zThe program will execute 6 different SIce commands located at ds:dx, which
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
- b) l; f1 t4 G( k0 G2 s
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
! O0 T; n, o4 n0 ?4 I___________________________________________________________________________
" |% z* ]- O% r7 `
" q2 B8 W; ^2 [, S1 S$ e8 o
Method 03
  O/ a+ E+ c5 R6 O, O. v& g, U' z=========
" T' a; `4 ]$ c, R1 g
3 U& E  G# F' x. t' D: W* M4 LLess used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
; O' I2 e1 Y, b/ d) J(API Get entry point)
        

    xor     di,di
$ t) v& \& w8 v. e    mov     es,di
7 n$ s+ j$ |7 D8 [, G0 y    mov     ax, 1684h      
    mov     bx, 0202h       ; VxD ID of winice
    int     2Fh
! c( `# c1 v" T) G  O/ ~, |    mov     ax, es          ; ES:DI -&gt; VxD API entry point
' t6 [9 b4 `" ~) V    add     ax, di
    test    ax,ax
! Z8 Q; {) K4 R% T! S    jnz     SoftICE_Detected

___________________________________________________________________________
1 S/ G7 m; g) ^) t1 |
Method 04
=========
# P* N8 v: g0 ]6 K& X% r
( I- z; s8 G9 O: z5 YMethod identical to the preceding one except that it seeks the ID of SoftICE
) F, B4 t4 {, Z" RGFX VxD.

) M2 y7 m- X+ E. P, m3 Z. r' f    xor     di,di
- a: G: e3 c; z    mov     es,di
# ]% C( M; e8 c  r7 i( H, R2 I# _    mov     ax, 1684h      
& J/ H3 S4 C1 D" d    mov     bx, 7a5Fh       ; VxD ID of SIWVID
! Z/ o  `* n* X# A# x% a/ n2 \, J    int     2fh
- b( }' n; ]: e& h+ e0 T0 z    mov     ax, es          ; ES:DI -&gt; VxD API entry point
    add     ax, di
    test    ax,ax
    jnz     SoftICE_Detected
6 Z' n8 j4 e% X$ z0 f/ c) @+ ?; T
! c. q+ U5 b/ b__________________________________________________________________________


% ]/ f" g5 |/ _+ _2 ]7 f! Z6 dMethod 05
=========
$ t) h9 \0 E8 I$ N
- e" g' z% v$ ^' l/ D; }7 ~4 ]5 HMethod seeking the 'magic number' 0F386h returned (in ax) by all system
" I  U/ M0 q' _, r% g9 D' {6 Odebugger. It calls the int 41h, function 4Fh.
4 y4 O( L9 ?9 G4 r$ ]% @There are several alternatives.  

The following one is the simplest:
$ m: i7 ^& o% R' L
    mov     ax,4fh
- R) v+ C8 j- p, b& Q% x9 J: {    int     41h
    cmp     ax, 0F386
5 W) g5 s! x/ d. V' x$ j    jz      SoftICE_detected
! u5 J3 L  [0 R! a4 O' _) |

Next method as well as the following one are 2 examples from Stone's
"stn-wid.zip" (www.cracking.net):
0 u+ @: d! _  y6 n+ m
    mov     bx, cs
7 o0 C. G  a' f  q: j7 {    lea     dx, int41handler2
9 c% c; M" L8 j- @2 x/ H0 ^4 q    xchg    dx, es:[41h*4]
    xchg    bx, es:[41h*4+2]
    mov     ax,4fh
! _6 G( ^% G4 V* W    int     41h
    xchg    dx, es:[41h*4]
    xchg    bx, es:[41h*4+2]
    cmp     ax, 0f386h
    jz      SoftICE_detected

int41handler2 PROC
* C. V3 g: }" G+ u    iret
; {, X& g: R& f- G5 D8 B2 cint41handler2 ENDP


: O  F- w% j. K1 m) v_________________________________________________________________________

* [) o5 i" C& N  [6 V" a) D6 s
Method 06
- z( @' P! b6 P=========
0 u& l+ P0 v: W7 L: d# d. Q! V
6 @6 e) E" C8 {% x' z; m& y: ]/ Z
2nd method similar to the preceding one but more difficult to detect:

1 D0 U8 ^( y2 G! x1 @2 j
int41handler PROC
) @/ d: `6 g5 [) S    mov     cl,al
    iret
2 n2 ~/ D6 L! n7 R/ L/ x- Iint41handler ENDP

# \! r1 S7 p/ S
1 n' R' f+ p  S  ]1 J& M7 ^    xor     ax,ax
    mov     es,ax
    mov     bx, cs
    lea     dx, int41handler
    xchg    dx, es:[41h*4]
    xchg    bx, es:[41h*4+2]
) V$ \0 `" S+ _* i    in      al, 40h
  s" I9 I  O( }    xor     cx,cx
    int     41h
    xchg    dx, es:[41h*4]
  G* [) J9 z/ K( N3 b8 b: G0 x  F    xchg    bx, es:[41h*4+2]
& T* e, s* j* M) v4 E' h    cmp     cl,al
    jnz     SoftICE_detected
: l" |# H! \( [% `1 H
7 c$ p- T4 e9 i, I) `_________________________________________________________________________
# G+ u( L9 i1 Q, t4 b
- u! B2 g/ e! I" E% \Method 07
=========

7 i* ~! J' p7 g9 oMethod of detection of the WinICE handler in the int68h (V86)

' Q8 g% i- w: @0 E2 j    mov     ah,43h
    int     68h
    cmp     ax,0F386h
% P/ ]& d/ y) V; u; C+ D0 |    jz      SoftICE_Detected

% d* h3 h8 k; @' o4 O
$ M0 c# M- [* s6 T8 Z7 w=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
   app like this:

   BPX exec_int if ax==68
   (function called is located at byte ptr [ebp+1Dh] and client eip is
   located at [ebp+48h] for 32Bit apps)
__________________________________________________________________________
$ S- r! v$ q  M' A! O
! h5 U" @5 |2 N( H
! r- O/ Q! r* c+ vMethod 08
# E1 e3 T' g5 z) F: ]: A=========
6 I' y( ~5 w4 b
* I# R6 }* q! A# `  E3 {4 P3 JIt is not a method of detection of SoftICE but a possibility to crash the
system by intercepting int 01h and int 03h and redirecting them to another
4 }. ?* o' T; Aroutine.
3 Q$ F5 \) _3 ]8 C# }: }7 N! cIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
to the new routine to execute (hangs computer...)
) S+ W7 o+ x+ N! p- T$ N
    mov     ah, 25h
- n; ^! U, g% a: w) }; t    mov     al, Int_Number (01h or 03h)
7 Z5 h# G& U- ^    mov     dx, offset New_Int_Routine
    int     21h

__________________________________________________________________________
6 {; p' w+ |/ P
Method 09
=========

2 F5 b; @4 f, y) s6 YThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
performed in ring0 (VxD or a ring3 app using the VxdCall).
, ]& L. }7 K4 n2 S! ~  rThe Get_DDB service is used to determine whether or not a VxD is installed
for the specified device and returns a Device Description Block (in ecx) for
that device if it is installed.

6 D4 v: O, b) s/ C* H% q! \/ L! Q   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID
* `5 h' q2 N# r8 C+ l' s   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
% ^% C- ]: r. ]7 Q2 K* C8 U: R# R   VMMCall Get_DDB
   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed
% f0 B5 S9 l( m$ f
9 b! Q  f3 ?1 H- K4 PNote as well that you can easily detect this method with SoftICE:
6 I/ n- e( `8 I. n/ z: J. J   bpx Get_DDB if ax==0202 || ax==7a5fh
5 h" S( r3 M  y& B/ s9 l
__________________________________________________________________________

Method 10
=========

( A% W: ^7 {7 k8 |  p=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with
  SoftICE while the option is enable!!

This trick is very efficient:
by checking the Debug Registers, you can detect if SoftICE is loaded
, f* A, K( v4 a9 u(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
6 ~& ~& o3 @, M$ N: L$ ythere are some memory breakpoints set (dr0 to dr3) simply by reading their
value (in ring0 only). Values can be manipulated and or changed as well
(clearing BPMs for instance)

__________________________________________________________________________
! q3 l7 H$ V# [
6 _  X2 C) e* bMethod 11
=========

( D' T) M5 V% U$ Q  u% _This method is most known as 'MeltICE' because it has been freely distributed
& a+ n+ @' ?% e: Y; }via www.winfiles.com. However it was first used by NuMega people to allow
# ]. y  `  |- r  W1 tSymbol Loader to check if SoftICE was active or not (the code is located
inside nmtrans.dll).

6 \. `- m/ u  I7 kThe way it works is very simple:
, G- p. q1 J6 H  u  r/ |" a% }It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
, X! J$ G6 i$ N+ _WinNT) with the CreateFileA API.
3 E# F& f& K! ~
Here is a sample (checking for 'SICE'):
0 ]  h# ~: o: V  K
) z9 F* m6 k7 \% u7 vBOOL IsSoftIce95Loaded()
{
/ f/ p! m: l$ R2 Q7 g6 N5 X1 D% [$ E   HANDLE hFile;  
" i4 ~8 ?' V1 D3 b9 `   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
                      FILE_SHARE_READ | FILE_SHARE_WRITE,
                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
, z3 N' x# `. ?0 p: n" {& a   if( hFile != INVALID_HANDLE_VALUE )
   {
      CloseHandle(hFile);
      return TRUE;
0 O7 b9 \0 f) W+ h   }
5 L7 R# Z( [+ V   return FALSE;
. i1 I% ?9 [* n7 G# k+ _}
! o  _5 u- u  K; `- E
2 P/ S1 x* t9 g3 ]$ e9 MAlthough this trick calls the CreateFileA function, don't even expect to be
able to intercept it by installing a IFS hook: it will not work, no way!
In fact, after the call to CreateFileA it will get through VWIN32 0x001F
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
) b) c' {# p2 oand then browse the DDB list until it find the VxD and its DDB_Control_Proc
" K( j) E1 h  Y6 ufield.
) X8 B$ @9 ~9 w" R2 `, TIn fact, its purpose is not to load/unload VxDs but only to send a
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
to the VxD Control_Dispatch proc (how the hell a shareware soft could try
to load/unload a non-dynamically loadable driver such as SoftICE ;-).
$ P; e8 ~* _6 u  _* e; L. |6 @If the VxD is loaded, it will always clear eax and the Carry flag to allow
4 f  ^- B# v, V2 Kits handle to be opened and then, will be detected.
You can check that simply by hooking Winice.exe control proc entry point
9 s  K) x; ^# twhile running MeltICE.
- v$ q) ~# X6 i  Q) t
5 Z1 b' p& _! U) w* k* _8 p% W
  00401067:  push      00402025    ; \\.\SICE
5 P* D6 E9 L3 F- \# v# N/ e5 @  0040106C:  call      CreateFileA
  00401071:  cmp       eax,-001
" L  E4 d6 A5 a9 [0 G( m  W  00401074:  je        00401091
1 Z% y, ?" u" I( z% |4 n
) t& ^( q' m5 F! C' X) V
There could be hundreds of BPX you could use to detect this trick.
-The most classical one is:
  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||
    *(esp-&gt;4+4)=='NTIC'

3 n8 I" R! d6 Q. j+ s: E  d* Z$ X-The most exotic ones (could be very slooooow :-(
: I7 s" A& `- D0 ]  G. N5 d   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
$ M0 S2 p) v$ b1 E7 ~& e; T     ;will break 3 times :-(

/ X6 k5 U2 o) \/ f  g" |& Y1 x, z; Q-or (a bit) faster:
   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')

   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  
     ;will break 3 times :-(

% s0 z9 A/ d7 b8 Y% y- }-Much faster:
( Y6 F/ v$ J: R+ n6 M   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'

6 v  X$ P" v1 p- z. z( Z* ZNote also that some programs (like AZPR3.00) use de old 16-bit _lopen
0 \' A3 D  N" X1 i/ ^" a9 vfunction to do the same job:
" d2 F1 E# X/ F$ I8 ~
   push    00                        ; OF_READ
   mov     eax,[00656634]            ; '\\.\SICE',0
   push    eax
' P7 k0 \4 a+ N7 a/ w8 w7 w! A2 }   call    KERNEL32!_lopen
   inc     eax
& t9 H3 e4 T- E' Y* S7 V   jnz     00650589                  ; detected
   push    00                        ; OF_READ
  _) k$ [% j9 F, F* K7 z   mov     eax,[00656638]            ; '\\.\SICE'
# L+ N% F  `7 y8 N+ k5 [   push    eax
   call    KERNEL32!_lopen
   inc     eax
# V& `9 k; E' r# u, m) \1 c, F& F. I   jz      006505ae                  ; not detected


! `$ O0 y7 j' s5 Z- A! C__________________________________________________________________________

Method 12
=========

This trick is similar to int41h/4fh Debugger installation check (code 05
5 `! f) k. K5 s8 ?1 t* o$ |0 }- g3 v&amp; 06) but very limited because it's only available for Win95/98 (not NT)
4 e5 N  n4 u/ H" l/ e5 }2 e& las it uses the VxDCall backdoor. This detection was found in Bleem Demo.

$ O, z3 l2 K4 V/ m4 {   push  0000004fh         ; function 4fh
   push  002a002ah         ; high word specifies which VxD (VWIN32)
/ Q9 f; S2 G6 k, u7 W4 w7 U$ j                           ; low word specifies which service
                             (VWIN32_Int41Dispatch)
   call  Kernel32!ORD_001  ; VxdCall
   cmp   ax, 0f386h        ; magic number returned by system debuggers
   jz    SoftICE_detected

Here again, several ways to detect it:
5 p$ Y; k5 H0 y8 {- s
    BPINT 41 if ax==4f

) H2 x6 J2 n# c0 E    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one
: c* v( I+ |8 c
( }3 f# a( W4 g! T& v# ]# H    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A

8 P$ B1 R$ J5 d; j' l/ w+ c    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!
" c4 |; R$ O$ E& v- J
3 s6 w4 a4 t9 W2 w__________________________________________________________________________
5 A- K; S3 _$ u- N# x. v$ w
1 c+ p* Z" [8 `Method 13
/ d4 [/ J) e/ R' k=========

Not a real method of detection, but a good way to know if SoftICE is
installed on a computer and to locate its installation directory.
3 A5 B& c2 k+ Q) m$ UIt is used by few softs which access the following registry keys (usually #2) :
: }  s) f9 N5 ?/ H
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
\Uninstall\SoftICE
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
1 v& J9 U5 B, a: p-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
\App Paths\Loader32.Exe
% Q- G, ?: }' {+ L+ l4 z

Note that some nasty apps could then erase all files from SoftICE directory
(I faced that once :-(

Useful breakpoint to detect it:

6 \  `7 {& Z1 v# v1 E  \9 r) R     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'
3 m4 r6 _: u9 o3 y8 {
__________________________________________________________________________
, S9 E: k/ ?9 D5 h5 p
0 [% Y; y' t: {
Method 14
7 V) p4 E8 J! R. l- H=========
0 v/ l3 h1 h% k' Z4 H2 h7 G
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
is to determines whether a debugger is running on your system (ring0 only).

   VMMCall Test_Debug_Installed
   je      not_installed
& }0 n  ~' X* c9 \' b
This service just checks a flag.
; m6 w5 }& O6 d6 A3 s' L</PRE></TD></TR></TBODY></TABLE>