About anti-SoftICE tricks

<TABLE width=500>
6 C7 g; ^( O$ F' o<TBODY>
, b* f. f) s4 Q6 D6 U<TR>
0 L$ C9 i6 B# W" k# x<TD><PRE>Method 01
9 T6 u5 E" Z6 A8 ], Y5 u=========

' r4 ]% O; [% S: ]This method of detection of SoftICE (as well as the following one) is
0 z% g5 P$ d0 \, Yused by the majority of packers/encryptors found on Internet.
It seeks the signature of BoundsChecker in SoftICE

  x: T/ `  N4 F! N$ i9 E4 f  Q    mov     ebp, 04243484Bh        ; 'BCHK'
* }+ A, P! A2 H    mov     ax, 04h
    int     3      
    cmp     al,4
1 Y" a6 }( g: v( ]3 L  l  p9 ^" h0 ]    jnz     SoftICE_Detected

___________________________________________________________________________
, j0 u+ X" t0 i0 w0 v0 E# k
, w+ ?. p, T" |Method 02
=========
  k" I+ c& ~% w
. B' i# q3 }  ^0 ]! d& dStill a method very much used (perhaps the most frequent one).  It is used
" L* V1 b0 V- Ato get SoftICE 'Back Door commands' which gives infos on Breakpoints,
0 X/ I+ H, {; i1 for execute SoftICE commands...
It is also used to crash SoftICE and to force it to execute any commands
1 q' ]- I! a( A3 l# u- A! A$ z(HBOOT...) :-((  
! T# x/ u7 t2 x2 P4 J# q" S0 l$ |
5 I3 [- g$ d& Z, sHere is a quick description:
# _+ {( t2 h; o# H% u-AX = 0910h   (Display string in SIce windows)
- Y5 s& Y9 ]0 b6 P1 R9 H# S7 J: p/ z-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)
-AX = 0912h   (Get breakpoint infos)
-AX = 0913h   (Set Sice breakpoints)
-AX = 0914h   (Remove SIce breakoints)
: W9 ^6 h( g( R& \2 S
  g+ v+ |- ?) d/ b9 e. `% lEach time you'll meet this trick, you'll see:
2 {& k+ f6 A5 a$ H; H! i-SI = 4647h
-DI = 4A4Dh
2 {( q" ^2 }; kWhich are the 'magic values' used by SoftIce.
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.

+ K! E7 ]7 ~! z' CHere is one example from the file "Haspinst.exe" which is the dongle HASP
' P9 d7 m( ]/ Q# m2 Z( L6 fEnvelope utility use to protect DOS applications:

/ T! O% Y: [, j3 e: h. f
4C19:0095   MOV    AX,0911  ; execute command.
2 P4 X2 r7 v$ `. n0 i4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).
1 v# t1 x- J. r  d2 J4C19:009A   MOV    SI,4647  ; 1st magic value.
2 X/ T- D8 ]- W  O$ u4C19:009D   MOV    DI,4A4D  ; 2nd magic value.
4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute
4C19:00A4   INC    CX
4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute
4C19:00A8   JB     0095     ; 6 different commands.
4C19:00AA   JMP    0002     ; Bad_Guy jmp back.
) U$ ?: M' f8 z! V4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)
# {- T9 q, h  d* _3 q
) _* O1 ~0 E# [" lThe program will execute 6 different SIce commands located at ds:dx, which
( Q1 I3 Y8 C  C( w- jare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
6 i) ]' l, `" U4 C- h
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
___________________________________________________________________________


Method 03
* u, w" l- p3 @. x( y4 Z/ m9 b6 ^=========

- D! {; P4 z/ U7 c% S" ^# ]# Z5 GLess used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
(API Get entry point)
- ?+ Z' z! e' _, I        
2 P1 n% D. c0 E& Z
8 e- z  p7 L3 E3 J; ~5 J; s6 s" X    xor     di,di
    mov     es,di
( u9 ^2 ~' X0 g1 D8 k    mov     ax, 1684h      
1 h2 C9 \* l7 V) _: N# _3 D    mov     bx, 0202h       ; VxD ID of winice
    int     2Fh
& g* v; u- o0 p$ p- }3 E8 q    mov     ax, es          ; ES:DI -&gt; VxD API entry point
, ^7 |. K/ ^1 a% ~  h" e/ [3 S    add     ax, di
    test    ax,ax
    jnz     SoftICE_Detected

( s2 c# r2 E, @; z___________________________________________________________________________

Method 04
% x# N! y$ q! z- Z$ o=========
. V, M0 N9 q: J  V7 f# ?
Method identical to the preceding one except that it seeks the ID of SoftICE
GFX VxD.

    xor     di,di
8 q8 I3 S9 b8 |6 O( R    mov     es,di
    mov     ax, 1684h      
    mov     bx, 7a5Fh       ; VxD ID of SIWVID
    int     2fh
7 u3 N- \) `6 D- D3 e" O$ z/ r1 a    mov     ax, es          ; ES:DI -&gt; VxD API entry point
    add     ax, di
- K% l  `& v/ I/ w3 h$ P% @* v    test    ax,ax
0 n  O' h/ E$ q6 S7 H6 ^& o; u, u2 F" x    jnz     SoftICE_Detected

__________________________________________________________________________


Method 05
=========
- v* E4 w" L( l- X3 p0 H1 ^: T
Method seeking the 'magic number' 0F386h returned (in ax) by all system
8 O, H" c8 c6 |% G# h1 C/ _debugger. It calls the int 41h, function 4Fh.
1 H  \; \% x, M; o& D( ^There are several alternatives.  
+ a) K$ y5 W7 }8 j% Z
The following one is the simplest:

# D  T' t: w' v. y  _' |4 q( G/ i    mov     ax,4fh
    int     41h
    cmp     ax, 0F386
    jz      SoftICE_detected


Next method as well as the following one are 2 examples from Stone's
5 ?2 u7 b$ @' s"stn-wid.zip" (www.cracking.net):

    mov     bx, cs
: q' x. j4 o- G3 E$ j/ m! b    lea     dx, int41handler2
. a0 R% `8 i# c- W    xchg    dx, es:[41h*4]
    xchg    bx, es:[41h*4+2]
7 R6 p8 @1 X' q! F$ h$ k- Z7 W6 x    mov     ax,4fh
    int     41h
    xchg    dx, es:[41h*4]
  R6 b% z) a) g0 L, E7 L    xchg    bx, es:[41h*4+2]
    cmp     ax, 0f386h
    jz      SoftICE_detected

int41handler2 PROC
3 B0 h. o/ I) C; c! x/ d  j2 Q    iret
) b0 J- N: M. Jint41handler2 ENDP

  R" H+ L7 R# G, J, g6 Q' Y
_________________________________________________________________________
% T3 `& A+ M8 T, ?5 P7 Z

5 n4 Z* t# q, h% }+ O5 qMethod 06
=========
; q. L# E$ U! A
! f& n% Z5 x9 P4 r' J& `* z- m% \7 t: i
2nd method similar to the preceding one but more difficult to detect:
- o1 ^( M1 N$ Y
8 L/ k. I2 Y0 c* F: |+ j
int41handler PROC
    mov     cl,al
4 w$ f: E$ }4 k    iret
: {8 h7 Q' A8 b/ B" h/ x3 g6 Xint41handler ENDP

3 ~& k" ?% O, C. N) e& {
    xor     ax,ax
    mov     es,ax
    mov     bx, cs
8 S5 E: n9 J6 k" D: X    lea     dx, int41handler
; R0 ?1 @% j! a' S. Y    xchg    dx, es:[41h*4]
3 p' x/ V+ L1 Q% |1 |% L    xchg    bx, es:[41h*4+2]
1 I1 d# A' ^1 Y) A    in      al, 40h
    xor     cx,cx
# U( O/ P$ D4 [4 [- }6 _0 h8 `    int     41h
    xchg    dx, es:[41h*4]
4 n: ^; H3 Y- T$ o    xchg    bx, es:[41h*4+2]
    cmp     cl,al
! c1 [2 I* J* y, v3 z3 S, H6 g    jnz     SoftICE_detected
5 B7 X) Y; n9 u7 m1 t! D2 m5 u
_________________________________________________________________________
0 e. {6 g, q- Q3 r
  p2 B( ~, Z0 m4 m6 F5 T! oMethod 07
( W8 k: G" ~9 z6 ^$ L' W& I' B=========
9 _9 q& E# H' f3 J  ~
Method of detection of the WinICE handler in the int68h (V86)
1 Y7 D8 V; e! t4 R1 s
3 ?* k$ _2 U" H* k    mov     ah,43h
    int     68h
; G) d: s& o0 ?6 _' s  i, U) X    cmp     ax,0F386h
3 x9 P, I: y2 d    jz      SoftICE_Detected


=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
   app like this:
* @) N( j' e4 F& A  |; Q1 g
   BPX exec_int if ax==68
  X4 ?* l- A4 c/ m6 c$ T* K+ k   (function called is located at byte ptr [ebp+1Dh] and client eip is
' o' }- g6 F: t2 ?+ O   located at [ebp+48h] for 32Bit apps)
, u3 g+ L! A0 l) _( c) G; t  A1 p__________________________________________________________________________

& f& [; @4 p& x7 ^% w+ e- K
* c; V; \1 ~4 u1 ]+ NMethod 08
' s+ ?" O8 c$ k) U3 p2 y/ J2 L+ b=========

It is not a method of detection of SoftICE but a possibility to crash the
system by intercepting int 01h and int 03h and redirecting them to another
8 ~. ^# s2 c8 A. G& J  rroutine.
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
7 Y; L# A; X9 qto the new routine to execute (hangs computer...)

    mov     ah, 25h
    mov     al, Int_Number (01h or 03h)
    mov     dx, offset New_Int_Routine
    int     21h
/ b7 G# a6 j/ D3 L) r( P
__________________________________________________________________________

  t9 z4 i! g- {2 e5 qMethod 09
4 S+ A9 i# D8 z$ H; y=========
. K+ [4 V" E! k
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
' E" l+ Q! P. hperformed in ring0 (VxD or a ring3 app using the VxdCall).
The Get_DDB service is used to determine whether or not a VxD is installed
for the specified device and returns a Device Description Block (in ecx) for
$ w; {% h& _: Vthat device if it is installed.

; R/ F' C6 K# A* Z& V: H   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID
3 f0 `. g. R' `. L  V   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
   VMMCall Get_DDB
   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed
5 r; P, Q5 @' p* X/ ~+ r2 E; }
Note as well that you can easily detect this method with SoftICE:
   bpx Get_DDB if ax==0202 || ax==7a5fh

: v$ O0 U& }9 d/ X; T__________________________________________________________________________
) Y2 l8 _0 B. b8 I
  n3 u: M: y4 L' RMethod 10
=========
- Y2 d' f( u+ B  Q4 k3 X; K
8 u$ M) P, B; A2 M=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with
  SoftICE while the option is enable!!
! ?: L6 |  L* U- P" u
% D7 J. A# J7 P1 ?  E5 `7 MThis trick is very efficient:
by checking the Debug Registers, you can detect if SoftICE is loaded
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
- m4 f6 j: E% m" Rthere are some memory breakpoints set (dr0 to dr3) simply by reading their
value (in ring0 only). Values can be manipulated and or changed as well
7 L4 |0 x8 B7 a4 l(clearing BPMs for instance)
2 ^9 B9 C+ e6 e: ^- n$ |
__________________________________________________________________________

Method 11
8 `& i3 Z, Z; j% C6 S- a1 y8 |=========

) ^- n" ~. i& p8 pThis method is most known as 'MeltICE' because it has been freely distributed
via www.winfiles.com. However it was first used by NuMega people to allow
2 H2 i& D/ J* G% C% HSymbol Loader to check if SoftICE was active or not (the code is located
9 n- k) H. Z- n$ ?9 n- w! cinside nmtrans.dll).
5 B! _: k' \  }. R, e8 Z
2 U9 s  v6 ^4 w- C* d8 n4 YThe way it works is very simple:
$ z  [& C% m& g/ ]- `It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
WinNT) with the CreateFileA API.
; O1 F: z2 `$ E' h. k0 E
  |/ F6 v8 i# [Here is a sample (checking for 'SICE'):
3 l' U- @& i9 N
BOOL IsSoftIce95Loaded()
+ A* O0 k2 l7 V( H{
   HANDLE hFile;  
' Z, g2 w0 l) o$ e  P   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
                      FILE_SHARE_READ | FILE_SHARE_WRITE,
                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
   if( hFile != INVALID_HANDLE_VALUE )
' H- m; g: F$ M, `2 ~   {
  P8 X& O0 t2 I; R5 y1 a      CloseHandle(hFile);
      return TRUE;
   }
" ~& b9 T) v3 E) R7 L, R" Y   return FALSE;
8 Q- J5 i; e: R* X. J}

# T) q  h0 Z* l7 C; P4 e" X) o; h4 MAlthough this trick calls the CreateFileA function, don't even expect to be
able to intercept it by installing a IFS hook: it will not work, no way!
In fact, after the call to CreateFileA it will get through VWIN32 0x001F
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
% q2 z9 ]- P  ^6 Y8 u$ G8 jand then browse the DDB list until it find the VxD and its DDB_Control_Proc
# Y, E7 ?* x! ^; kfield.
5 x. R' `3 {$ W8 [. {In fact, its purpose is not to load/unload VxDs but only to send a
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
to the VxD Control_Dispatch proc (how the hell a shareware soft could try
, S2 Z0 n1 S+ _+ u0 [to load/unload a non-dynamically loadable driver such as SoftICE ;-).
" o4 M3 `' k7 \  m2 EIf the VxD is loaded, it will always clear eax and the Carry flag to allow
) n, N, ?! `$ W' Y5 Zits handle to be opened and then, will be detected.
You can check that simply by hooking Winice.exe control proc entry point
while running MeltICE.


  00401067:  push      00402025    ; \\.\SICE
  0040106C:  call      CreateFileA
  00401071:  cmp       eax,-001
  00401074:  je        00401091
& @5 h+ R4 t' W5 B1 Z$ O
; ~6 o" S. x  h* h
% N) Z! y1 _& l4 UThere could be hundreds of BPX you could use to detect this trick.
+ q' F: K- A3 P6 |: a# Y# M2 m-The most classical one is:
% V& @7 Y7 ]0 D. @8 U) N& a  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||
# h1 O# t: t4 T$ J, a    *(esp-&gt;4+4)=='NTIC'
: y% k  E2 U  o) @' c
-The most exotic ones (could be very slooooow :-(
( C. `% z: T& y1 [, z   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
     ;will break 3 times :-(

  A9 c9 f' E: ?/ r( f9 P-or (a bit) faster:
# C$ ^9 k' D! Z2 j% A' k   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')

   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  
     ;will break 3 times :-(
1 r- ?7 W  s" z( U
-Much faster:
   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'

  C) O5 S' c# E: \8 Z& ]Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
function to do the same job:
. h9 t3 ]) f8 \  f4 i1 F) U
   push    00                        ; OF_READ
3 n' M3 o  ?2 q! O7 X  h   mov     eax,[00656634]            ; '\\.\SICE',0
   push    eax
   call    KERNEL32!_lopen
   inc     eax
; d& _" o9 f4 \, v) _$ X5 r, h   jnz     00650589                  ; detected
7 n" l$ z( u/ L' j. Z( c   push    00                        ; OF_READ
& R5 @# c& s3 [- g  c$ F6 \   mov     eax,[00656638]            ; '\\.\SICE'
/ B3 E! W) ^/ t, P: G- w# W9 Q   push    eax
9 K8 @* v9 i4 Z* z   call    KERNEL32!_lopen
( Z6 |7 m* R6 E0 B+ }   inc     eax
   jz      006505ae                  ; not detected
, C. Q+ k" X! b9 x- z! D8 i- f
$ g2 U, V& v, a7 G3 s- R- ]6 M
% x- H0 @+ Y- _4 q__________________________________________________________________________

. s; z6 H9 n" n, E* sMethod 12
=========

  Z3 M1 u& e4 i& w( _7 i+ g$ mThis trick is similar to int41h/4fh Debugger installation check (code 05
&amp; 06) but very limited because it's only available for Win95/98 (not NT)
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.

   push  0000004fh         ; function 4fh
& v5 V2 G8 O$ F- C, w( v   push  002a002ah         ; high word specifies which VxD (VWIN32)
                           ; low word specifies which service
7 M$ G3 N, M. A) X* L: S                             (VWIN32_Int41Dispatch)
* I; }1 I) p4 Y8 z   call  Kernel32!ORD_001  ; VxdCall
, |, L( o1 [, V# l5 C   cmp   ax, 0f386h        ; magic number returned by system debuggers
9 Q! K0 R" |. S2 k% W   jz    SoftICE_detected

. C2 t* r. M; k3 ]; S: aHere again, several ways to detect it:

    BPINT 41 if ax==4f

# E9 i) u& c$ {    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one

" ~: b5 x) Y3 |; j- _7 r    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A
+ S: [% L/ }9 e" M( _
' Q, ^. c2 W2 b5 c0 E# X! Z, a3 X    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!
6 Y5 d3 m1 w! `" V1 {
__________________________________________________________________________
- H, e- n. W% Y% ?; v! N
Method 13
) W# V7 s7 Z6 [. s% o=========

Not a real method of detection, but a good way to know if SoftICE is
& i8 I* |9 N) B8 R. ?" d8 Minstalled on a computer and to locate its installation directory.
It is used by few softs which access the following registry keys (usually #2) :
5 a  s% g4 b' T7 k6 ]9 P* \
: z$ Q7 B7 ^, [; Z  G& I+ L9 L-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
. J8 F9 F5 _: b) T6 M\Uninstall\SoftICE
0 b9 G2 |( s9 P6 |% K3 r-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
\App Paths\Loader32.Exe


Note that some nasty apps could then erase all files from SoftICE directory
(I faced that once :-(
5 I2 a& Q* f. `2 {' q- o
/ I3 _# l1 m: A  |% R- ?! x* v* VUseful breakpoint to detect it:
0 s. u$ L: ?; D- X5 I/ ?
     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'

__________________________________________________________________________

2 r& g* d5 U5 y9 T; }! H
" B3 B, g2 J, p% f& cMethod 14
6 B4 j, t- t! G( D9 `4 R4 }* p* C=========
4 ~( L% m/ ]( s* S) U
2 N3 {4 z; w/ _. @5 ]A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
is to determines whether a debugger is running on your system (ring0 only).
5 s( u, ^4 ?; J+ C8 O/ s
   VMMCall Test_Debug_Installed
   je      not_installed
# T) P. G3 d' t
This service just checks a flag.
</PRE></TD></TR></TBODY></TABLE>