About anti-SoftICE tricks

<TABLE width=500>
% p% _+ Z1 t7 E. U" a) d<TBODY>
<TR>
<TD><PRE>Method 01
=========

# |$ d7 i, A: z* qThis method of detection of SoftICE (as well as the following one) is
* y9 S/ u9 a3 ~8 Dused by the majority of packers/encryptors found on Internet.
It seeks the signature of BoundsChecker in SoftICE

    mov     ebp, 04243484Bh        ; 'BCHK'
    mov     ax, 04h
7 f9 z  u9 H$ E" S# i    int     3      
% X$ N5 H! o: b3 O    cmp     al,4
    jnz     SoftICE_Detected

6 r# i% Y# p8 G9 e# z___________________________________________________________________________

- E" ~  S) h4 \% fMethod 02
=========
1 O) [, v! K1 i5 V9 m& ^
8 q/ C, f: s5 }7 N5 g0 CStill a method very much used (perhaps the most frequent one).  It is used
/ @5 Q% w$ [0 s7 K5 ]to get SoftICE 'Back Door commands' which gives infos on Breakpoints,
. }9 x# y% L6 m" I( P: E: xor execute SoftICE commands...
, o1 ], T5 d' v" G% z2 @6 bIt is also used to crash SoftICE and to force it to execute any commands
9 z. D; h1 L2 z- C6 a(HBOOT...) :-((  

Here is a quick description:
-AX = 0910h   (Display string in SIce windows)
9 Y/ g. r( B# U) v2 T9 w; R-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)
: k$ u9 J% A6 G0 Z3 B& L7 m' d-AX = 0912h   (Get breakpoint infos)
& H, ]8 z1 g, w7 z# ~6 K5 ^-AX = 0913h   (Set Sice breakpoints)
. m. f' h2 r) c5 H* Q6 B-AX = 0914h   (Remove SIce breakoints)
- N' e+ M* J" ]5 y  Q
Each time you'll meet this trick, you'll see:
7 U( F7 D. q5 M* ^# L-SI = 4647h
-DI = 4A4Dh
Which are the 'magic values' used by SoftIce.
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.

$ u4 Z7 T; H& V' p  ]" EHere is one example from the file "Haspinst.exe" which is the dongle HASP
4 @! g4 W. u5 t/ \9 d7 u/ rEnvelope utility use to protect DOS applications:


1 b0 N4 a" J. Z7 h* L5 [4 b4C19:0095   MOV    AX,0911  ; execute command.
$ X% F4 f" B4 ~7 a9 Z% B+ w: N4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).
4C19:009A   MOV    SI,4647  ; 1st magic value.
4C19:009D   MOV    DI,4A4D  ; 2nd magic value.
4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute
4C19:00A4   INC    CX
4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute
8 M1 Z- f& z9 r+ i. ^4C19:00A8   JB     0095     ; 6 different commands.
5 z3 q) U& j/ h2 G9 C4C19:00AA   JMP    0002     ; Bad_Guy jmp back.
4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)

The program will execute 6 different SIce commands located at ds:dx, which
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
) }$ n* O: n% [& y9 h( {. m
7 {) y# Y, E/ A; W. J* U! @* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
___________________________________________________________________________


Method 03
=========
" a, L* Q$ P' u, s0 }7 Q
Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
9 d& c; Z3 b" b% f7 P- h5 ~. O(API Get entry point)
4 K/ F2 `. T& l8 k4 E        
- E5 i+ V. y  {! R  u& P8 K9 z& ^
- l7 c9 m; X* v& u) f    xor     di,di
3 y6 K, z/ A+ w, A+ H% ?) s    mov     es,di
    mov     ax, 1684h      
1 r( R" M! b5 O/ Q    mov     bx, 0202h       ; VxD ID of winice
    int     2Fh
    mov     ax, es          ; ES:DI -&gt; VxD API entry point
    add     ax, di
    test    ax,ax
9 ~: h- F2 ?' g  P4 W" w    jnz     SoftICE_Detected

___________________________________________________________________________
; j: P0 c* u/ m/ x5 S
Method 04
=========
4 k" s& v1 ], ]$ ^" S, a
Method identical to the preceding one except that it seeks the ID of SoftICE
3 r2 U  K) D+ ^7 g! S! T' x4 jGFX VxD.

    xor     di,di
& b2 X5 p0 L8 [" e( |    mov     es,di
    mov     ax, 1684h      
    mov     bx, 7a5Fh       ; VxD ID of SIWVID
    int     2fh
) m" h2 u/ g' j* A0 p, r# A    mov     ax, es          ; ES:DI -&gt; VxD API entry point
    add     ax, di
" ]5 j' P/ k$ `4 @( R6 [- ^    test    ax,ax
    jnz     SoftICE_Detected

__________________________________________________________________________
! t" l% K. b4 W  R

Method 05
. Z9 S+ |# h5 }- k=========
% X) v- ~* r1 @( y7 U
3 w9 ?( R1 m$ \/ M# qMethod seeking the 'magic number' 0F386h returned (in ax) by all system
7 n7 N) K3 F6 E2 m$ Qdebugger. It calls the int 41h, function 4Fh.
, F) Y7 {) b. kThere are several alternatives.  

/ o' o0 F8 O# G. h: G7 B1 d+ t3 _The following one is the simplest:
  i1 T+ s1 @. B
    mov     ax,4fh
5 A4 y" W% S/ {! j- G% Q( w    int     41h
) [/ U1 {: G" p# r; d6 L    cmp     ax, 0F386
    jz      SoftICE_detected
- e, @% Y5 X- J; Z. n1 r

Next method as well as the following one are 2 examples from Stone's
4 {$ d3 W5 G/ {% C"stn-wid.zip" (www.cracking.net):
, J- K0 W8 W  s; F& `
    mov     bx, cs
  g$ _, Z* Y6 B8 }    lea     dx, int41handler2
    xchg    dx, es:[41h*4]
7 D% `1 P4 e! E6 H    xchg    bx, es:[41h*4+2]
    mov     ax,4fh
3 N" y/ u: X1 e7 }( E    int     41h
6 L6 T  s9 Y8 }. A0 o. H9 r    xchg    dx, es:[41h*4]
    xchg    bx, es:[41h*4+2]
    cmp     ax, 0f386h
    jz      SoftICE_detected

' J) {7 y% Q& ~, Tint41handler2 PROC
    iret
, p# W. d7 r. `8 c2 Y/ R9 b: yint41handler2 ENDP
* @- Y" B. w+ l) a- C/ {$ }

_________________________________________________________________________
( @8 V" z8 G6 z% B7 v' ~1 ?
/ P1 Q  ?) m4 u& p
Method 06
* E1 T( p4 O5 B% X7 \' g=========


. l5 p/ A) H6 X! A. c& C2nd method similar to the preceding one but more difficult to detect:

2 O" x) Z% X- j/ y% T  T
int41handler PROC
. D* B0 E* U) _1 w    mov     cl,al
# x6 T% Q) h  G0 W6 D9 ]    iret
int41handler ENDP

1 t1 q/ v- p( F+ B% W5 }+ f& J9 C
    xor     ax,ax
4 A/ F6 a# Y. S0 L  E    mov     es,ax
    mov     bx, cs
    lea     dx, int41handler
. T6 h1 R# U* n    xchg    dx, es:[41h*4]
    xchg    bx, es:[41h*4+2]
    in      al, 40h
    xor     cx,cx
" H8 x$ F) N$ o+ @& U    int     41h
    xchg    dx, es:[41h*4]
    xchg    bx, es:[41h*4+2]
    cmp     cl,al
    jnz     SoftICE_detected

_________________________________________________________________________

5 w0 `! y/ F% SMethod 07
=========

Method of detection of the WinICE handler in the int68h (V86)
2 V0 c3 F' c) ]
    mov     ah,43h
    int     68h
    cmp     ax,0F386h
    jz      SoftICE_Detected
: M# v1 W+ A+ R5 B; ~
- V7 a  i5 p5 {) d# ?
=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
   app like this:
0 L4 ]2 a" p" R7 [+ w' L
. n/ F6 m3 S' D/ e9 d9 w, `   BPX exec_int if ax==68
, ~- B  H! Z$ \7 }9 c7 c6 M9 A1 A   (function called is located at byte ptr [ebp+1Dh] and client eip is
   located at [ebp+48h] for 32Bit apps)
) C+ c$ x" @8 C1 y, Z! m* ~__________________________________________________________________________
: g+ A# i4 t5 X/ _' a

" u0 i/ G. K0 l  T4 jMethod 08
( w# v# b) `! b7 y7 H& M=========
( j# B$ d& k) k9 G$ b% R) \8 M
It is not a method of detection of SoftICE but a possibility to crash the
system by intercepting int 01h and int 03h and redirecting them to another
) j# D* {( a( \2 Aroutine.
8 J3 S* h8 g) X; x; hIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
to the new routine to execute (hangs computer...)
! h4 @. L  h& z: g. B" L
    mov     ah, 25h
' [: e: C0 f, v7 }/ I2 A% y* w    mov     al, Int_Number (01h or 03h)
/ e( Q2 V2 O( H  y% h3 w4 c    mov     dx, offset New_Int_Routine
' A9 z2 n0 c6 |& s    int     21h

2 ^+ ?- b1 u4 H( r__________________________________________________________________________
5 y" k$ X% \8 \; ]8 S' _
Method 09
0 X( p1 u9 [) E" y9 m; C0 m. d=========

: [, N2 V" V' c% ^+ wThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
1 @9 V6 [6 i3 z3 j  _4 Zperformed in ring0 (VxD or a ring3 app using the VxdCall).
" X9 O: e; j: kThe Get_DDB service is used to determine whether or not a VxD is installed
for the specified device and returns a Device Description Block (in ecx) for
: J0 f: e. @0 B, ethat device if it is installed.
! I8 @4 f, @  L1 n
' U* Z& Q& U  m+ _! [/ \) Y! E8 Q0 v   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID
   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
: W  L9 u5 Y6 y' t5 J% s   VMMCall Get_DDB
   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed

Note as well that you can easily detect this method with SoftICE:
/ I% R9 A/ d+ [8 w8 @) c' A; ~. U4 R3 R: B   bpx Get_DDB if ax==0202 || ax==7a5fh

__________________________________________________________________________
- M# _) p- @# q9 ^' f/ P
! C3 d9 ?) A% W) S; s% DMethod 10
9 C: j+ e9 W5 W( D8 U+ c8 M0 }=========

, z1 z6 P+ D, L5 q5 K=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with
/ w5 H+ v  g9 o  SoftICE while the option is enable!!
" H; [+ F1 O/ @
$ l' Z4 n7 F0 S6 Z, lThis trick is very efficient:
by checking the Debug Registers, you can detect if SoftICE is loaded
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
there are some memory breakpoints set (dr0 to dr3) simply by reading their
0 T% A6 u- _; J8 |value (in ring0 only). Values can be manipulated and or changed as well
3 u7 o- R/ d; H7 E(clearing BPMs for instance)

4 d+ a2 |( v7 D$ u& x__________________________________________________________________________

Method 11
2 x: K9 B) I7 l2 G3 _% n=========
& A0 F- ]: ?; s* ^8 z  q* m; R% P
This method is most known as 'MeltICE' because it has been freely distributed
" \" I& Z  z! P. z+ v2 jvia www.winfiles.com. However it was first used by NuMega people to allow
9 h' U2 b  p8 i  o# H  }Symbol Loader to check if SoftICE was active or not (the code is located
6 x. c& t7 k& ?inside nmtrans.dll).

The way it works is very simple:
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
WinNT) with the CreateFileA API.

0 N; S, |2 x  E6 r' N/ o  fHere is a sample (checking for 'SICE'):
- `, h* C: a1 ~3 z# K$ \
BOOL IsSoftIce95Loaded()
{
   HANDLE hFile;  
   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
8 ?: b# h; \: `* j  W) g/ O                      FILE_SHARE_READ | FILE_SHARE_WRITE,
                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
   if( hFile != INVALID_HANDLE_VALUE )
& P! `8 B% C: d% j9 ?0 x   {
7 X# t- W- c  P" w( X9 A7 n* `& T      CloseHandle(hFile);
      return TRUE;
   }
+ Q5 j  U' C( w# s" X   return FALSE;
}
5 A8 m& }  U5 P0 F1 d6 L) L
" ]- ^1 Z0 H7 q  N, a- rAlthough this trick calls the CreateFileA function, don't even expect to be
) o) M) y& m: c& w) iable to intercept it by installing a IFS hook: it will not work, no way!
" t$ @: U6 M2 |2 h" vIn fact, after the call to CreateFileA it will get through VWIN32 0x001F
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
- a6 Z2 R( R: p, k8 yand then browse the DDB list until it find the VxD and its DDB_Control_Proc
field.
In fact, its purpose is not to load/unload VxDs but only to send a
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
to the VxD Control_Dispatch proc (how the hell a shareware soft could try
to load/unload a non-dynamically loadable driver such as SoftICE ;-).
If the VxD is loaded, it will always clear eax and the Carry flag to allow
its handle to be opened and then, will be detected.
6 @5 N& J4 ]* TYou can check that simply by hooking Winice.exe control proc entry point
while running MeltICE.


! X$ H: G8 ?" @2 \  00401067:  push      00402025    ; \\.\SICE
# \$ x) @5 Y  I, j+ H  0040106C:  call      CreateFileA
& j% }. v- q6 r8 t! ]3 {  00401071:  cmp       eax,-001
  00401074:  je        00401091


6 O* j/ j# F* o8 F' kThere could be hundreds of BPX you could use to detect this trick.
-The most classical one is:
- ~0 ^! d  A( l) p. {' w' s# g  _  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||
    *(esp-&gt;4+4)=='NTIC'

/ X7 J! Z0 p. C& n2 C  i-The most exotic ones (could be very slooooow :-(
- ]& c1 V( b5 q: y   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
. s5 C3 E! Y9 e1 `& @     ;will break 3 times :-(
( Y/ |0 t8 B+ ^) O
-or (a bit) faster:
; i. p6 g# W0 d" R: G1 k   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')

   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  
% H5 {: S: @2 Y' b. H     ;will break 3 times :-(

-Much faster:
: H8 L3 J4 `* z; T6 l; n  U   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'
0 {" Q* x. p5 I
5 A% ?0 ^8 N7 p3 A0 QNote also that some programs (like AZPR3.00) use de old 16-bit _lopen
function to do the same job:

, {. J) P/ m( Z0 I" y/ R6 [: V# V   push    00                        ; OF_READ
) K+ x' z* i( F! a" U' e2 l6 c   mov     eax,[00656634]            ; '\\.\SICE',0
2 g4 |* I, |/ R% i3 Y   push    eax
- t* F1 C& ^! t; e% u) i( E   call    KERNEL32!_lopen
6 {5 P, {, F/ k1 x   inc     eax
7 ]$ \( n. B2 T2 S" n7 {  G   jnz     00650589                  ; detected
   push    00                        ; OF_READ
   mov     eax,[00656638]            ; '\\.\SICE'
   push    eax
   call    KERNEL32!_lopen
   inc     eax
   jz      006505ae                  ; not detected
" `4 `5 i, w& L- v( J+ N1 `- T# \

7 X3 S% _; n/ T# v5 b: T3 P1 b7 X# n) `__________________________________________________________________________
% h9 F- U/ O6 @
Method 12
=========
% @* `6 L9 J6 ^* q1 ~
This trick is similar to int41h/4fh Debugger installation check (code 05
&amp; 06) but very limited because it's only available for Win95/98 (not NT)
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.
9 b6 c' i5 O. o; J& j* Q" V
+ ]) l; z' ~" u. Q' m* o& q   push  0000004fh         ; function 4fh
   push  002a002ah         ; high word specifies which VxD (VWIN32)
                           ; low word specifies which service
% V+ V! G! {* ^" O8 x                             (VWIN32_Int41Dispatch)
   call  Kernel32!ORD_001  ; VxdCall
   cmp   ax, 0f386h        ; magic number returned by system debuggers
   jz    SoftICE_detected

1 ?' A- J1 O* P! [Here again, several ways to detect it:
- B& W+ P7 N  {- f0 f
    BPINT 41 if ax==4f
3 L* r. ~% b7 [. [$ A# D
3 i$ m* \- _+ a! s5 f    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one
* Z  {9 N. Q. h; e* ?; C1 G, w+ g
    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A
' l- c% r; ?7 h6 C& R
3 Z* L/ ^4 A0 h0 c3 `1 m; p    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!

__________________________________________________________________________

9 i! i. c( r" J' |% TMethod 13
=========

Not a real method of detection, but a good way to know if SoftICE is
$ z0 ^/ C, K9 e% c/ |; E9 Oinstalled on a computer and to locate its installation directory.
It is used by few softs which access the following registry keys (usually #2) :
0 k/ p/ H( R' A
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
: h% ~8 q/ u4 w" ]/ K\Uninstall\SoftICE
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
( P! @3 H) H) M) g% H9 k-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
) @2 `( f; z& ~: b: D/ Z7 K; ~/ w\App Paths\Loader32.Exe


9 D2 V8 F" }, U, B: O3 I9 CNote that some nasty apps could then erase all files from SoftICE directory
& p" O; e. u9 g$ N5 G8 H- {) @(I faced that once :-(
7 |/ g9 v8 P8 |# E% s
$ ]$ _, X- A5 f  U. Z1 B* P8 U% kUseful breakpoint to detect it:

9 D4 y* u: Y& b  ~; h  H: Q& [     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'

__________________________________________________________________________
# a$ H" {; Z3 D! r

# X: u) f& J! N. g) i! P) u: NMethod 14
2 i4 J2 P: u3 l) A5 p" t=========
* Z; t) `6 {6 ]4 x0 i
9 k3 Y. ]- P: A, cA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
: N- H$ j+ ]! h% dis to determines whether a debugger is running on your system (ring0 only).

* M$ g( B% [8 ^8 o! F   VMMCall Test_Debug_Installed
' |3 i6 ?9 m6 _. s  E- }& o3 h, W$ y   je      not_installed

. b" w6 I: C$ T! W* u6 Q# ^This service just checks a flag.
5 v2 ?8 p# d* H: F1 A( Y5 {* }</PRE></TD></TR></TBODY></TABLE>