About anti-SoftICE tricks

<TABLE width=500>
<TBODY>
/ O: ~/ y; e5 o  H<TR>
2 E# L# W( W" n: p( y( \4 C  X8 l<TD><PRE>Method 01
( [# q5 Q  F% `=========
% q: o: A: d1 \$ Q+ r8 V& Y# U& ], j
This method of detection of SoftICE (as well as the following one) is
used by the majority of packers/encryptors found on Internet.
It seeks the signature of BoundsChecker in SoftICE

9 F0 B5 T" D. G5 S% P    mov     ebp, 04243484Bh        ; 'BCHK'
: B& a6 o' ~0 e5 r9 F    mov     ax, 04h
    int     3      
    cmp     al,4
5 ]4 b$ p. \1 T0 y+ D    jnz     SoftICE_Detected

___________________________________________________________________________

2 R4 S( I3 y7 a/ v" {: A; MMethod 02
7 v- f7 ]/ {: H3 q0 F2 i( |" T% o=========

Still a method very much used (perhaps the most frequent one).  It is used
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,
2 ^5 Q' X0 r" t8 ^+ z1 ~! Xor execute SoftICE commands...
9 N; Y$ j1 G# w( qIt is also used to crash SoftICE and to force it to execute any commands
(HBOOT...) :-((  

* M- o3 k4 Z. k  u3 A2 bHere is a quick description:
; o* u% c+ Z' R) v-AX = 0910h   (Display string in SIce windows)
+ h+ b+ V4 e3 d" P  T- N9 u% h- u" a-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)
6 G* h& x* ~9 d-AX = 0912h   (Get breakpoint infos)
-AX = 0913h   (Set Sice breakpoints)
-AX = 0914h   (Remove SIce breakoints)
: f2 I$ p' r' y
  y& R( |4 Z- w( z/ _Each time you'll meet this trick, you'll see:
: s% I1 W9 O4 z$ Y1 R, B-SI = 4647h
. t, g* d1 N# [/ ?. X& b6 p-DI = 4A4Dh
Which are the 'magic values' used by SoftIce.
+ U/ A! v# U- {# p6 P* I5 e8 M/ aFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.
6 i; I  L: W. L$ \: E
Here is one example from the file "Haspinst.exe" which is the dongle HASP
Envelope utility use to protect DOS applications:


/ g( k1 p* b6 J+ h8 K( O+ `. _4C19:0095   MOV    AX,0911  ; execute command.
4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).
, m" L5 ?( a- M% d4C19:009A   MOV    SI,4647  ; 1st magic value.
4C19:009D   MOV    DI,4A4D  ; 2nd magic value.
4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
+ E2 B6 q) B; U+ H6 W4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute
4C19:00A4   INC    CX
7 [- d# ?& k9 _! M& N6 y4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute
4C19:00A8   JB     0095     ; 6 different commands.
+ @7 I/ t. s4 c# P- B% L% S2 ^0 H4C19:00AA   JMP    0002     ; Bad_Guy jmp back.
4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)
" y% @' @  o% [0 n) ]! v0 F4 u3 h
5 a% [+ d6 E) E! dThe program will execute 6 different SIce commands located at ds:dx, which
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
5 ^5 {7 _( h- L/ n, ~3 q" N
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
___________________________________________________________________________
- W# ]+ e7 }* r' \' a. t

& m. Q! f" H$ a- R- t: q4 uMethod 03
! Q, O" U' @. ~- b=========
" O* o8 r  |9 m0 R+ P
Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
(API Get entry point)
/ x* ^( U' C: K4 r        

    xor     di,di
$ _. |. A( R/ {, d4 V+ ^    mov     es,di
% r8 i* T1 \. r    mov     ax, 1684h      
    mov     bx, 0202h       ; VxD ID of winice
    int     2Fh
    mov     ax, es          ; ES:DI -&gt; VxD API entry point
    add     ax, di
    test    ax,ax
6 C: ]( p* F( u    jnz     SoftICE_Detected
# G1 a! E4 V* I! k# O! t! Y
+ q8 r  N, R" X' k___________________________________________________________________________
: S6 ^0 F1 t& y" t
7 _/ M0 A, K0 _9 z9 w. n- EMethod 04
=========
1 I5 k2 w" {/ S+ d+ V& @
5 f! y( _% `, }  f7 M, qMethod identical to the preceding one except that it seeks the ID of SoftICE
GFX VxD.
- a/ f/ Q) }4 E# A/ H7 O3 @' N2 M
8 a/ u9 A8 |2 }. q  k7 ~$ `# p    xor     di,di
    mov     es,di
    mov     ax, 1684h      
    mov     bx, 7a5Fh       ; VxD ID of SIWVID
    int     2fh
! }5 M" u% |* N( ]" G8 k    mov     ax, es          ; ES:DI -&gt; VxD API entry point
4 q9 m8 y8 u* u7 X6 ~% M8 N    add     ax, di
    test    ax,ax
" v( ^% ^' ?" N% `( m8 U5 u    jnz     SoftICE_Detected

! ?. e2 U/ M+ m__________________________________________________________________________
- L( p2 q2 C1 x8 N; }5 y: ?/ h) u

Method 05
& m$ d3 W: L7 O4 Y0 Z( N=========

+ _; E4 p+ e3 _( g# SMethod seeking the 'magic number' 0F386h returned (in ax) by all system
debugger. It calls the int 41h, function 4Fh.
There are several alternatives.  
" W5 t. W6 [- z4 W& V
The following one is the simplest:
  {) D8 V# o: @! E' ^2 l. N
    mov     ax,4fh
0 P/ d) r7 X! \8 `5 r- U3 K* @7 G    int     41h
    cmp     ax, 0F386
    jz      SoftICE_detected
* i/ Z+ r  Q3 R

Next method as well as the following one are 2 examples from Stone's
"stn-wid.zip" (www.cracking.net):
9 H/ L2 G$ _# F
    mov     bx, cs
% K3 S4 e# b8 Y7 |% ?8 Z    lea     dx, int41handler2
    xchg    dx, es:[41h*4]
& \& `" l! p+ b5 ?    xchg    bx, es:[41h*4+2]
) X% P2 g% g$ c" o    mov     ax,4fh
    int     41h
$ R" `. K' e0 b7 G9 k/ M% \    xchg    dx, es:[41h*4]
. r# N, |# z- V' [2 c    xchg    bx, es:[41h*4+2]
    cmp     ax, 0f386h
    jz      SoftICE_detected
: J6 H$ B, ^/ z% {# i5 O) e- @+ ?4 S% f
int41handler2 PROC
# [! }  W5 z  V    iret
5 k: h7 |; z7 K, C2 I# Eint41handler2 ENDP
+ i0 J- x/ E0 H& M2 |( l8 W
  W/ f" c& W8 G) t3 h7 P; J) K4 B
_________________________________________________________________________
5 W' k1 k4 y# a( l. e4 ^$ a* h% F  b
# R; ?& i2 ^% H5 |9 ^  j: p
Method 06
6 w. |. ^: S# \2 Z7 _=========
% w4 h5 V( P, E0 |* R

2nd method similar to the preceding one but more difficult to detect:

& A* L8 @' ~! J% F( q7 E) t) y
4 j8 }4 V" f8 \' |: _) v* oint41handler PROC
" v) e  r% u* ]3 E3 |4 ]2 Y    mov     cl,al
2 I+ V: |2 v0 L( t+ W4 H9 {    iret
int41handler ENDP


    xor     ax,ax
    mov     es,ax
    mov     bx, cs
* ?! K: b( K9 r    lea     dx, int41handler
) C% N/ A, x5 V    xchg    dx, es:[41h*4]
5 U' Q1 m& @( x  G$ x* m    xchg    bx, es:[41h*4+2]
    in      al, 40h
+ T8 I  F9 q6 }' T    xor     cx,cx
    int     41h
, c/ `: ~3 H4 G, r4 |    xchg    dx, es:[41h*4]
    xchg    bx, es:[41h*4+2]
5 ?1 \  j, B* H    cmp     cl,al
    jnz     SoftICE_detected
/ t' `- [' d& M6 p4 |
_________________________________________________________________________
, i" r& ]; i7 P0 S/ E
% T( K/ E6 G3 L9 F9 S# n+ d$ s" LMethod 07
, N4 r* s( S1 ]+ v  b. B8 o* N% K=========

+ X4 L" P) }) J3 ^3 QMethod of detection of the WinICE handler in the int68h (V86)

1 K0 z3 V9 \" b+ M    mov     ah,43h
    int     68h
7 j2 O+ {- ?' x, U! F    cmp     ax,0F386h
    jz      SoftICE_Detected


% s4 {3 v- |* H/ Y" }=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
   app like this:

   BPX exec_int if ax==68
   (function called is located at byte ptr [ebp+1Dh] and client eip is
4 Q- p! W1 h# e8 K3 w: x  T: A  f   located at [ebp+48h] for 32Bit apps)
8 X/ c% A# L# p+ f( u( V7 Z4 n__________________________________________________________________________
  A+ |  }  H' l" j

Method 08
6 z1 {/ v4 A) a=========
) j  a4 X7 h8 @' [8 n
It is not a method of detection of SoftICE but a possibility to crash the
$ K+ U. q5 X6 @! ]4 C' Ssystem by intercepting int 01h and int 03h and redirecting them to another
+ J+ U) e. n- p: a% O# Z8 Broutine.
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
0 L# t6 W. k. H- d" K2 t! L9 E. Uto the new routine to execute (hangs computer...)

$ `' E% K. r1 w- v    mov     ah, 25h
- i1 V" c; h) q) l. E" S. ~, E    mov     al, Int_Number (01h or 03h)
0 Q* U' @( j- b- }7 r    mov     dx, offset New_Int_Routine
# p  e. E/ q3 V    int     21h
+ L7 U! d$ Z* c: W8 b5 O4 T* E' {
__________________________________________________________________________
' p3 I" Z/ E& A- N& y2 m& N, K  ^
) f9 H: O! h& Q8 `% u8 A* I6 R" D& nMethod 09
1 Z6 I+ B8 ^3 g: ^$ n& Z) r=========
( n7 F8 v6 ~- U( n) O6 c! w
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
9 ]: S* l1 o% V" Pperformed in ring0 (VxD or a ring3 app using the VxdCall).
& q) S3 ?0 Z4 L9 c, q/ HThe Get_DDB service is used to determine whether or not a VxD is installed
for the specified device and returns a Device Description Block (in ecx) for
" q/ A! o7 ^! h& g. mthat device if it is installed.

   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID
   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
$ s' R0 m3 \! e9 m   VMMCall Get_DDB
   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed
3 \* a" l6 m: \- y0 k3 z) e
Note as well that you can easily detect this method with SoftICE:
. ^% u- z! U$ ~; W. A   bpx Get_DDB if ax==0202 || ax==7a5fh
+ d# S" M0 L% Z' w7 ]9 K
__________________________________________________________________________
+ d, N& ~1 a; `& X0 w1 z
7 x1 x7 H- B- H5 x. }Method 10
7 f+ D- A* Y+ l* g2 C) ~3 Q% _=========

=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with
  SoftICE while the option is enable!!

/ N! @  I: v$ |  Y% l8 Z: m/ B' L1 {This trick is very efficient:
9 X9 |3 ]% _4 L1 G9 V% cby checking the Debug Registers, you can detect if SoftICE is loaded
! J2 G( o% G  Q$ X- l! A(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
there are some memory breakpoints set (dr0 to dr3) simply by reading their
9 R, f# W# j" H6 u" hvalue (in ring0 only). Values can be manipulated and or changed as well
& ^1 I3 H* `2 j7 n" j(clearing BPMs for instance)

: }" `% q1 y# j* o& }* ~__________________________________________________________________________

; B7 b# H9 S  HMethod 11
=========

3 O: m% a( z6 d+ T, i0 EThis method is most known as 'MeltICE' because it has been freely distributed
% k, T9 m3 v. N# n$ {" fvia www.winfiles.com. However it was first used by NuMega people to allow
6 z4 @* a, u7 H& p8 P! a+ T& I' eSymbol Loader to check if SoftICE was active or not (the code is located
0 K$ o( ~0 h4 u/ p* winside nmtrans.dll).

The way it works is very simple:
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
+ F& d1 l" ?& o8 [. b) SWinNT) with the CreateFileA API.
9 c; a) e. a* D, A1 z. S
Here is a sample (checking for 'SICE'):
/ f/ z/ E% ]# R  T+ }
BOOL IsSoftIce95Loaded()
. G$ W% [) f" F' ~8 I{
$ ~6 Y6 H( z- }( M4 P0 N& X) O) N   HANDLE hFile;  
, t" N( S/ P6 k; g* ^- Q   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
1 }: w& N( P( C/ F- F) D                      FILE_SHARE_READ | FILE_SHARE_WRITE,
7 y+ Y  D) y4 L) N                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
   if( hFile != INVALID_HANDLE_VALUE )
  u6 |+ i/ b$ g6 c5 ]7 @) a   {
) P" U" X* U: h" R8 W+ ^" i/ L      CloseHandle(hFile);
      return TRUE;
   }
   return FALSE;
}

Although this trick calls the CreateFileA function, don't even expect to be
able to intercept it by installing a IFS hook: it will not work, no way!
In fact, after the call to CreateFileA it will get through VWIN32 0x001F
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
and then browse the DDB list until it find the VxD and its DDB_Control_Proc
3 }# P+ T1 `& Dfield.
5 l0 q+ m. P7 X" |& m  ^" y5 fIn fact, its purpose is not to load/unload VxDs but only to send a
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
to the VxD Control_Dispatch proc (how the hell a shareware soft could try
to load/unload a non-dynamically loadable driver such as SoftICE ;-).
4 ?5 |$ w8 i, ^9 h% ]2 F7 LIf the VxD is loaded, it will always clear eax and the Carry flag to allow
; J8 Y/ p% t- C' Hits handle to be opened and then, will be detected.
$ b7 g% w7 ^2 C4 n$ {, b5 VYou can check that simply by hooking Winice.exe control proc entry point
while running MeltICE.
6 K4 k6 Q: F" }' _- d6 \5 T3 C
9 n7 f) _9 l. \; P- `
  00401067:  push      00402025    ; \\.\SICE
: ^8 Z! R! j/ P0 k7 a, [  0040106C:  call      CreateFileA
  00401071:  cmp       eax,-001
3 L9 T# x% a) P  00401074:  je        00401091

) `: E- r/ O# J1 e! I8 ?5 k7 q
There could be hundreds of BPX you could use to detect this trick.
2 o1 @1 K5 S+ J9 K-The most classical one is:
6 T* e% j( t' ^' ?/ A/ F( H  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||
& ?! U! r: C% q    *(esp-&gt;4+4)=='NTIC'
, R' r5 H8 {/ a5 k  \% I# E
8 J4 @; C2 h. _  I5 F5 `) d3 L6 b-The most exotic ones (could be very slooooow :-(
2 v! a% y* O( P' ^   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
9 W- X( _9 j7 H; u5 g% ~     ;will break 3 times :-(
( |' V  S. P$ V9 f2 ?6 T- h
6 K2 v; J; w" ?% G8 Q* Z-or (a bit) faster:
; ~. Q- P0 r$ k/ c$ P1 \; o   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')

$ ], T4 l- i; j8 d   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  
) R1 g* i+ Y- Q7 [- y% G! s4 X     ;will break 3 times :-(

-Much faster:
, v2 m% w& f: I% A0 x, D7 @  F$ n3 f   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'
; w7 a! L3 }( K( _( F& z3 m( v3 g. O
% Z9 Q7 A! R3 f9 c/ ]! n+ fNote also that some programs (like AZPR3.00) use de old 16-bit _lopen
# `2 r' F: J+ x8 s5 v% ?  h7 Ofunction to do the same job:

   push    00                        ; OF_READ
* b7 O( ^! o3 E9 {5 m# J   mov     eax,[00656634]            ; '\\.\SICE',0
   push    eax
   call    KERNEL32!_lopen
   inc     eax
   jnz     00650589                  ; detected
% [. [( K  B2 N/ ^9 Y6 A   push    00                        ; OF_READ
   mov     eax,[00656638]            ; '\\.\SICE'
+ w6 H! g9 A' ~   push    eax
   call    KERNEL32!_lopen
4 W' ~6 s0 R; X+ B1 B% I7 ~& b8 M   inc     eax
% `% q* ^3 w5 s   jz      006505ae                  ; not detected

* r( _8 ^5 a3 P' P# U8 E5 F
__________________________________________________________________________
; z$ t- y2 A" T7 _* Y
Method 12
=========
+ f& `! q  Q- H1 _* p' Q% p
5 O1 @- z0 J% j- I8 }  g' qThis trick is similar to int41h/4fh Debugger installation check (code 05
% k  B6 N# ]1 a' X8 d  r# z&amp; 06) but very limited because it's only available for Win95/98 (not NT)
/ _, {0 k2 l4 g  J+ Zas it uses the VxDCall backdoor. This detection was found in Bleem Demo.

   push  0000004fh         ; function 4fh
   push  002a002ah         ; high word specifies which VxD (VWIN32)
                           ; low word specifies which service
1 I/ x  `9 V/ k, b1 m                             (VWIN32_Int41Dispatch)
   call  Kernel32!ORD_001  ; VxdCall
" {. C* m( e3 |  M: D1 p   cmp   ax, 0f386h        ; magic number returned by system debuggers
  A. r! u2 ^9 v( r' v7 c   jz    SoftICE_detected
. B4 l1 S3 |9 H  D8 P
  \' r5 `$ a/ m% K" AHere again, several ways to detect it:

4 R* z) V2 j% J" `    BPINT 41 if ax==4f

% b. h0 O& R/ F9 a) |    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one

* X- v# i& D  s    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A
9 Z9 i1 M1 V' [: \+ T9 z/ e( R0 H
    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!

__________________________________________________________________________

( ~# ~+ i+ f7 E3 S  HMethod 13
=========

3 n0 K' W5 a1 j1 ]- [& X6 U/ i/ \* l; KNot a real method of detection, but a good way to know if SoftICE is
& B- h. E" @6 h# k& M$ `installed on a computer and to locate its installation directory.
It is used by few softs which access the following registry keys (usually #2) :
  o# G3 T. t/ n8 v5 d# ~
8 X# s' a1 l3 k+ s2 L-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
$ k  j: G$ C5 ^- i9 u  d\Uninstall\SoftICE
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
\App Paths\Loader32.Exe


& g3 r' t* T" W+ W4 dNote that some nasty apps could then erase all files from SoftICE directory
. h5 b% x4 k! p  h(I faced that once :-(

) Q) s/ ?( R+ |! r4 ~Useful breakpoint to detect it:

     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'
2 X1 s* p" {+ n9 ]+ A8 \, u4 |
' Q  s5 U; N9 h' q/ C" a__________________________________________________________________________
8 q$ J8 P3 i2 Z
& r9 y% E. a; V! s% M
Method 14
9 W1 F& b9 I% b=========
  }# E, O( C- _, d8 g! D
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
is to determines whether a debugger is running on your system (ring0 only).

( A* n3 p1 @  j   VMMCall Test_Debug_Installed
   je      not_installed
) K% n; e& }2 B; n
5 K6 q0 z/ c" l# h' l. \. Q: `6 GThis service just checks a flag.
- G) S" F5 z2 s0 W# C</PRE></TD></TR></TBODY></TABLE>