About anti-SoftICE tricks

<TABLE width=500>
7 g: m' ^" t/ R- @+ E1 t<TBODY>
$ ?; N0 }& I3 o, o  b+ A<TR>
: k. `9 F3 U. U, }# f<TD><PRE>Method 01
  u' g; r9 l. ]$ B- r=========
+ Y) e7 G% o4 B
This method of detection of SoftICE (as well as the following one) is
9 f4 r3 U' }9 w/ D" Tused by the majority of packers/encryptors found on Internet.
It seeks the signature of BoundsChecker in SoftICE
6 Z2 D4 L& @- N* z, E
    mov     ebp, 04243484Bh        ; 'BCHK'
    mov     ax, 04h
; ?& l  T+ l$ R9 O2 P+ e    int     3      
    cmp     al,4
    jnz     SoftICE_Detected

___________________________________________________________________________
/ A; V* d5 w4 a" a/ J. G
Method 02
: l& Z% w0 i( L=========

  D: [, i3 Q' ?" _2 v* QStill a method very much used (perhaps the most frequent one).  It is used
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,
" ?0 p0 w# f6 e0 Z; Nor execute SoftICE commands...
1 N9 H1 r1 O  \; d9 d( JIt is also used to crash SoftICE and to force it to execute any commands
(HBOOT...) :-((  

Here is a quick description:
( |0 R/ U2 h5 F  H, ]! f% Z-AX = 0910h   (Display string in SIce windows)
-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)
( ^% [5 g4 F4 g7 K-AX = 0912h   (Get breakpoint infos)
' k2 Z2 ?/ O7 P-AX = 0913h   (Set Sice breakpoints)
-AX = 0914h   (Remove SIce breakoints)
. p$ m2 v( h  P  G) ~
9 G. D+ K: p, Q8 T$ X9 R% HEach time you'll meet this trick, you'll see:
! G6 V& u( D" a, ^-SI = 4647h
4 Y, t9 r: W0 Q: e& M( M3 N1 @-DI = 4A4Dh
$ Z! d1 [' D( L5 v; j- IWhich are the 'magic values' used by SoftIce.
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.

4 W/ `/ y  E( N; q' e; iHere is one example from the file "Haspinst.exe" which is the dongle HASP
Envelope utility use to protect DOS applications:
5 Q$ D/ L/ _7 C5 C4 Q; ^

  D. p9 \, R: h: O4C19:0095   MOV    AX,0911  ; execute command.
$ {2 D$ u6 q1 _5 v4 ]+ x- {+ f' g0 Y' i4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).
( p* P$ I$ `% \7 R% G- m4C19:009A   MOV    SI,4647  ; 1st magic value.
  p3 Q0 G  f3 D4C19:009D   MOV    DI,4A4D  ; 2nd magic value.
4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
& A: h  d' A+ z0 B4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute
4C19:00A4   INC    CX
/ P% ~3 F4 L4 N: O& Y* c4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute
. e' B  I# C& K4 {% w8 a4C19:00A8   JB     0095     ; 6 different commands.
4C19:00AA   JMP    0002     ; Bad_Guy jmp back.
, Y  h) U" S1 y+ q# h; @4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)
6 k9 c) B1 z6 `9 U! ~
The program will execute 6 different SIce commands located at ds:dx, which
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
" h/ m7 \3 \0 \, Z  Z7 {
3 V1 i/ Y$ n1 R9 T2 b. L+ v( S* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
___________________________________________________________________________
, Y, ~, s4 y9 z( M1 B4 p2 B
- J/ b6 R+ Y5 l2 p/ C  c; s2 |$ d
( Y9 S+ T; p' P; L. C5 ZMethod 03
=========
  H4 k: P; B0 p- g
Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
( b9 w" c" B' S! k# q! B* z(API Get entry point)
        
9 h3 t2 v7 N* a- g. }7 q4 `  x
  `$ V4 b" d% r+ y$ e. {) k) d    xor     di,di
4 ^( h3 w$ ^( _9 a0 r    mov     es,di
    mov     ax, 1684h      
    mov     bx, 0202h       ; VxD ID of winice
    int     2Fh
2 w8 y8 b: ~7 t2 J7 v. b5 a- b    mov     ax, es          ; ES:DI -&gt; VxD API entry point
) ]- Z) h1 w4 m0 B    add     ax, di
) X0 y1 D( H# v4 C0 c    test    ax,ax
    jnz     SoftICE_Detected
4 _. `8 S5 X5 w& o- D; s
2 r" F) o5 r- g5 P+ n5 j2 K  C% C___________________________________________________________________________

Method 04
=========
, K7 y6 R. G) F3 j3 r
  q  z/ k  s6 W% c! C6 MMethod identical to the preceding one except that it seeks the ID of SoftICE
GFX VxD.

    xor     di,di
    mov     es,di
! H! R- a% x. H# c6 X    mov     ax, 1684h      
+ L5 c# S9 T+ o1 y' L7 ]    mov     bx, 7a5Fh       ; VxD ID of SIWVID
' o# G1 q  z4 B8 b    int     2fh
4 J3 t0 ~+ h9 [5 ]3 v    mov     ax, es          ; ES:DI -&gt; VxD API entry point
    add     ax, di
( M3 ^. k+ a& v    test    ax,ax
    jnz     SoftICE_Detected

- z& w: g* g( \. g. Z) D% s__________________________________________________________________________

0 {! V6 G8 g# \) @
8 e* ~/ ]. j1 e& FMethod 05
=========
& e9 f2 [* {8 `, J5 E' ?
Method seeking the 'magic number' 0F386h returned (in ax) by all system
6 q2 Z8 c. q, D$ [. hdebugger. It calls the int 41h, function 4Fh.
There are several alternatives.  
. U& t3 u: r" [
. G8 G7 z7 z' T  @: }  k) w+ ^3 gThe following one is the simplest:
3 m9 c! f1 }. A! ~( @
. ^0 \" l& }' R4 Q* s( ?. N% o* T; e% `    mov     ax,4fh
    int     41h
    cmp     ax, 0F386
6 A. C/ z! K! G" c    jz      SoftICE_detected
0 Q' _0 ~7 [& e) ~# `9 P9 @/ h
9 @3 u$ T, B0 K6 L6 o" S: f
9 T( T& x1 K/ L* _Next method as well as the following one are 2 examples from Stone's
0 o. x, Z! C1 u# m+ B8 e5 i"stn-wid.zip" (www.cracking.net):

* `  z: m% s! W    mov     bx, cs
    lea     dx, int41handler2
    xchg    dx, es:[41h*4]
    xchg    bx, es:[41h*4+2]
    mov     ax,4fh
    int     41h
$ q. L$ c' ~. P$ V/ L    xchg    dx, es:[41h*4]
    xchg    bx, es:[41h*4+2]
    cmp     ax, 0f386h
    jz      SoftICE_detected
3 R- A9 \! h1 l9 A, E2 Z
2 _& U& y3 B6 \int41handler2 PROC
    iret
) ^+ B$ e, i  s* Q/ t0 x0 Lint41handler2 ENDP
9 r4 ?  S% X3 h$ z  |! e- O

' l1 D% o3 Y) f# t_________________________________________________________________________
  [2 B* s" |+ k# v8 e
! V2 j- p1 G( ^+ _  B) P' K: P
: C, r3 u7 S5 KMethod 06
) V1 ^; g$ A% M! ^=========
5 G. l" _% _, u4 @: {" Z

2nd method similar to the preceding one but more difficult to detect:


int41handler PROC
    mov     cl,al
) C9 |; b  x- E- u8 K3 s( f    iret
$ z/ O0 h( B4 i& g8 Z3 S9 mint41handler ENDP
" c, t) G- o6 o
1 G# f) E' ]: @$ p. _( [7 p: g3 Q
    xor     ax,ax
% Q) b, W3 k. b& w    mov     es,ax
    mov     bx, cs
# J0 z9 Y5 f+ Z3 A( f    lea     dx, int41handler
: x- l7 h9 @0 _% E0 J    xchg    dx, es:[41h*4]
    xchg    bx, es:[41h*4+2]
    in      al, 40h
1 q% U6 w+ y* A: E! z; V    xor     cx,cx
    int     41h
    xchg    dx, es:[41h*4]
, G) ~. [$ a: y; R% P$ O+ f$ F5 y    xchg    bx, es:[41h*4+2]
    cmp     cl,al
    jnz     SoftICE_detected

_________________________________________________________________________

6 [. e- _3 i; _: j7 z0 h! DMethod 07
=========
$ u$ f# g; u' Z0 w8 R, o! B
) \% f6 h) ^5 I3 e8 NMethod of detection of the WinICE handler in the int68h (V86)
# {9 G% T) ]1 g
    mov     ah,43h
    int     68h
& H* C8 `9 I5 x    cmp     ax,0F386h
    jz      SoftICE_Detected
" B* V1 C1 M( H$ z

=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
; N. k7 t. X; t  y* t   app like this:
, ?7 x' U6 o3 M( y
   BPX exec_int if ax==68
   (function called is located at byte ptr [ebp+1Dh] and client eip is
   located at [ebp+48h] for 32Bit apps)
$ B# n2 V& S/ n: J5 e' I3 L" q__________________________________________________________________________


Method 08
: V% S, @0 Z, O0 \. l) r# N# R=========
. Y6 l. _8 Z9 f% S5 N
* W6 n- n: N& F5 H/ xIt is not a method of detection of SoftICE but a possibility to crash the
system by intercepting int 01h and int 03h and redirecting them to another
$ n& N8 r/ k, J& ~+ N  h- |routine.
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
to the new routine to execute (hangs computer...)

    mov     ah, 25h
    mov     al, Int_Number (01h or 03h)
& Q  M; s4 s' o1 r    mov     dx, offset New_Int_Routine
    int     21h
: t# x! ~$ r) Q" w, i+ v
__________________________________________________________________________
7 t% ]! P9 J" a  ^) Q6 z2 D8 W( X9 a
) c* l! V) F9 J7 M) |6 _Method 09
6 K) E, ?, r+ ~  S9 x& A3 O=========

This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
) Z, }; i8 ]7 nperformed in ring0 (VxD or a ring3 app using the VxdCall).
; u9 h3 [# J1 D; E. F# f- pThe Get_DDB service is used to determine whether or not a VxD is installed
for the specified device and returns a Device Description Block (in ecx) for
4 D- g0 o6 B# L$ Ithat device if it is installed.
0 w/ p  k& I) T! z) i! t% x
( D; t  ]) e  `4 E" r) S  _# X   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID
7 S8 L. i) E8 Y5 n' G   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
   VMMCall Get_DDB
   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed
; U: v' G! m1 X8 L
  j1 y" n, C% z4 H6 O, I( DNote as well that you can easily detect this method with SoftICE:
& e: F/ X' b& A   bpx Get_DDB if ax==0202 || ax==7a5fh

& ~8 G* ?3 u; F0 U, ]2 a1 T$ l- s; E5 V__________________________________________________________________________

Method 10
=========
; ?8 c. L5 z% f% X
2 Y& N9 J$ c7 x=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with
  SoftICE while the option is enable!!

This trick is very efficient:
by checking the Debug Registers, you can detect if SoftICE is loaded
8 o! G% ]. l5 k% S8 W, `, W: A, D(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
+ p& r4 n9 E- w3 U% I. ~$ Gthere are some memory breakpoints set (dr0 to dr3) simply by reading their
value (in ring0 only). Values can be manipulated and or changed as well
/ K5 b& B8 z, x8 {: Q* ^% Q(clearing BPMs for instance)

__________________________________________________________________________
% G2 o6 N5 G' S2 I4 x
Method 11
( k: }3 w3 n9 D; R" l: c=========

This method is most known as 'MeltICE' because it has been freely distributed
: j6 s0 `3 g+ L& a" }5 ]via www.winfiles.com. However it was first used by NuMega people to allow
Symbol Loader to check if SoftICE was active or not (the code is located
inside nmtrans.dll).
& d3 S, S  ^5 Y
The way it works is very simple:
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
" ?. T* t0 E3 q4 nWinNT) with the CreateFileA API.
! }  {5 J+ [" ~& {
  [) ~, d/ X$ A7 q, V/ X0 O7 mHere is a sample (checking for 'SICE'):
* @8 T, ?7 z1 [8 i2 [3 H. D
2 u5 N  j* O1 \5 N6 |BOOL IsSoftIce95Loaded()
8 ]: ?+ [4 F' w{
   HANDLE hFile;  
  ?( D1 z  `; L) [9 x( n   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
                      FILE_SHARE_READ | FILE_SHARE_WRITE,
, l- e  ]8 Y; G7 Y, L( T5 N                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
   if( hFile != INVALID_HANDLE_VALUE )
& B' K8 P6 e$ x+ G* E, Y7 k$ u   {
      CloseHandle(hFile);
      return TRUE;
4 d5 h8 C' p8 D3 Z: O2 N+ n7 |   }
, r# [6 D! ^7 y6 a: K/ I# d   return FALSE;
% G! K2 d0 z. Z% L7 M# }}

Although this trick calls the CreateFileA function, don't even expect to be
able to intercept it by installing a IFS hook: it will not work, no way!
In fact, after the call to CreateFileA it will get through VWIN32 0x001F
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
and then browse the DDB list until it find the VxD and its DDB_Control_Proc
field.
* Z5 A" h/ S9 \& D# pIn fact, its purpose is not to load/unload VxDs but only to send a
; `% n& o' o2 KW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
. ^1 r6 E( z8 c, Ato the VxD Control_Dispatch proc (how the hell a shareware soft could try
% s) X, {- C! j5 ]to load/unload a non-dynamically loadable driver such as SoftICE ;-).
& c. ~/ b& r+ a  o: ~$ GIf the VxD is loaded, it will always clear eax and the Carry flag to allow
its handle to be opened and then, will be detected.
) d0 r) z1 a; ?5 f# EYou can check that simply by hooking Winice.exe control proc entry point
while running MeltICE.
/ _3 o/ _) f1 A- J
) ?! h3 h) O+ [9 @+ S0 v- `
) W" W: H* ]3 ?& }" c  00401067:  push      00402025    ; \\.\SICE
  0040106C:  call      CreateFileA
  00401071:  cmp       eax,-001
  00401074:  je        00401091


$ i4 }! B5 M( ^. m  @There could be hundreds of BPX you could use to detect this trick.
-The most classical one is:
& ~; P& F( G' T$ U+ c( i1 F& S  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||
    *(esp-&gt;4+4)=='NTIC'

-The most exotic ones (could be very slooooow :-(
   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
: m6 {; z( ?* G4 y6 L& ]4 r     ;will break 3 times :-(
6 D, H) M3 l* Y0 f+ d6 C* ^
9 n/ I9 p# V/ N5 V-or (a bit) faster:
   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
" }$ ~8 u. c* }" V2 N
   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  
8 t$ ~8 X' H6 o9 L' y     ;will break 3 times :-(

5 l/ }# H  ?$ f; O-Much faster:
6 D. u+ q$ J% G. J; P   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'

+ d' c/ x1 m$ a% Q5 YNote also that some programs (like AZPR3.00) use de old 16-bit _lopen
% @5 ]8 Z  M" f; hfunction to do the same job:
  \- E, f' t) D. k3 @0 W# [5 [" b
   push    00                        ; OF_READ
   mov     eax,[00656634]            ; '\\.\SICE',0
& V' }( F% X4 s3 c  G7 |   push    eax
   call    KERNEL32!_lopen
   inc     eax
   jnz     00650589                  ; detected
/ t, q' p" Y2 ~   push    00                        ; OF_READ
, r- x4 j9 @! s" V; b   mov     eax,[00656638]            ; '\\.\SICE'
8 i) }- Q8 ?  |( [# h4 b8 k. }: _% Q   push    eax
3 v1 u6 e* w) G# D! h  N   call    KERNEL32!_lopen
   inc     eax
   jz      006505ae                  ; not detected
  _5 A/ i) q) @+ x7 Y' R

& V& j7 A" b! l/ j# c# w__________________________________________________________________________

+ d( y& U' i1 a1 w) S1 |Method 12
=========
7 K, ~- k# X5 R  Z0 _6 W5 u
# C- g$ i. K; ~! h9 C! CThis trick is similar to int41h/4fh Debugger installation check (code 05
, W; k; ?% U: a6 q- H$ ]6 V7 w&amp; 06) but very limited because it's only available for Win95/98 (not NT)
$ X! I/ O' Q& E3 s. pas it uses the VxDCall backdoor. This detection was found in Bleem Demo.
: G2 z5 }7 p  Y5 A+ [
; m& w: X5 Q8 D8 r% ~   push  0000004fh         ; function 4fh
1 N0 v6 k. t( [   push  002a002ah         ; high word specifies which VxD (VWIN32)
                           ; low word specifies which service
                             (VWIN32_Int41Dispatch)
   call  Kernel32!ORD_001  ; VxdCall
  h1 w0 `5 n, Y+ x( k* x   cmp   ax, 0f386h        ; magic number returned by system debuggers
   jz    SoftICE_detected

Here again, several ways to detect it:
" ~) R3 H0 C3 T0 l( H7 b! W
    BPINT 41 if ax==4f

$ U/ a( C2 p$ ~- t: T$ M& e    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one

% ^& _6 Q/ D7 ?    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A

    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!
6 e, _: y* }; _& m' K  @
__________________________________________________________________________

Method 13
=========
* P  v. m# u$ |4 o; Z& d
Not a real method of detection, but a good way to know if SoftICE is
installed on a computer and to locate its installation directory.
It is used by few softs which access the following registry keys (usually #2) :
% c1 P$ }4 w- [" {! c
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
$ T  q0 P$ {) [0 }7 j, Z% z\Uninstall\SoftICE
- G9 b1 R" j9 b9 C5 r-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
\App Paths\Loader32.Exe
* Z/ J6 u7 A- ?' r

. g- `3 x& ~3 QNote that some nasty apps could then erase all files from SoftICE directory
(I faced that once :-(
9 u0 K& N; P# b1 r! R3 @
+ K2 w; U! w: U2 X4 ~Useful breakpoint to detect it:
( U" ]1 _6 k8 ?, \+ g9 u
     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'

; @: A( A. }' A- T__________________________________________________________________________


Method 14
=========
5 [2 E: ^. l7 P, r, I5 \( I+ \
3 V. T4 G! P, K' r, N) w3 oA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
3 z8 T9 }1 \7 Z" r' z1 Jis to determines whether a debugger is running on your system (ring0 only).
  p6 Q6 \0 M  E5 ^
2 a2 F& y( N8 D/ B3 g* ]' Y( y   VMMCall Test_Debug_Installed
   je      not_installed

# J! x  O4 x( \; I& ^! _9 W- y, ]This service just checks a flag.
$ c( ?( ]0 Q9 l: l9 L) n' O. ]</PRE></TD></TR></TBODY></TABLE>