About anti-SoftICE tricks

<TABLE width=500>
<TBODY>
: v6 i2 W  _: P  L2 a1 l- p<TR>
<TD><PRE>Method 01
=========

This method of detection of SoftICE (as well as the following one) is
used by the majority of packers/encryptors found on Internet.
4 R) t* h' ^! X1 ?: C. {" i, U) FIt seeks the signature of BoundsChecker in SoftICE

    mov     ebp, 04243484Bh        ; 'BCHK'
    mov     ax, 04h
    int     3      
, j8 y5 h- z& D" ^    cmp     al,4
( \, m1 W5 f. Y. I" _& W& Q5 v    jnz     SoftICE_Detected
+ M& w) o7 R+ S. ]5 s+ {" K% E
2 }# `' [& {6 I3 y___________________________________________________________________________

Method 02
7 T$ o: [2 l3 B6 R& }( w=========

Still a method very much used (perhaps the most frequent one).  It is used
; U+ u; i) S+ |# M0 t; K# y2 sto get SoftICE 'Back Door commands' which gives infos on Breakpoints,
& \2 J" e" d9 E; W: N3 w( F* Ror execute SoftICE commands...
It is also used to crash SoftICE and to force it to execute any commands
(HBOOT...) :-((  

Here is a quick description:
7 t9 y$ d0 K4 A-AX = 0910h   (Display string in SIce windows)
-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)
6 Y. t: }3 q/ m( W) ~7 _$ {-AX = 0912h   (Get breakpoint infos)
-AX = 0913h   (Set Sice breakpoints)
' U5 g# I6 t3 w. j1 O5 N-AX = 0914h   (Remove SIce breakoints)

Each time you'll meet this trick, you'll see:
* i- U# }! M1 K-SI = 4647h
-DI = 4A4Dh
Which are the 'magic values' used by SoftIce.
% B( m4 Z$ z- T  E" J. [- YFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.

Here is one example from the file "Haspinst.exe" which is the dongle HASP
) n1 p9 X7 J, [1 D% s! B' cEnvelope utility use to protect DOS applications:
: h7 T& E6 x. B( I6 v3 \
) H. k0 N0 `5 y; U; Y- c
4C19:0095   MOV    AX,0911  ; execute command.
. Z4 |  P  o8 w/ v# }' j4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).
  I+ m; B& m4 a" f0 i0 }4C19:009A   MOV    SI,4647  ; 1st magic value.
4C19:009D   MOV    DI,4A4D  ; 2nd magic value.
4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute
3 l) N% I3 \& ?) z4C19:00A4   INC    CX
4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute
4C19:00A8   JB     0095     ; 6 different commands.
4C19:00AA   JMP    0002     ; Bad_Guy jmp back.
4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)
+ `; x+ u5 J: s, }
8 D! X$ R$ p5 S! rThe program will execute 6 different SIce commands located at ds:dx, which
. X% c5 S# n  A: yare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
) p; B1 N5 B) f  O" b7 ^
0 `+ E9 I( \. j' I* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
  ]3 [2 f6 E0 P7 j( y___________________________________________________________________________
& T; N# ^% h  J1 v) r# o

- ^2 R& V9 ]! u2 M. y8 U( y$ W* a9 qMethod 03
0 w8 q- A0 j: M; G+ z* B=========

/ ~  o1 S- ?( M+ N: m1 sLess used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
(API Get entry point)
. X( j% G1 L. d6 r  `/ i        
( Z7 [7 r; x8 ^9 _# `$ @3 {
    xor     di,di
- @3 m3 Y# g  \9 `    mov     es,di
    mov     ax, 1684h      
. ~5 }& ^9 s# `8 n& `  \! u! H    mov     bx, 0202h       ; VxD ID of winice
    int     2Fh
    mov     ax, es          ; ES:DI -&gt; VxD API entry point
$ t' ]3 D: g: [) G# T    add     ax, di
    test    ax,ax
5 w- a! {, B- F2 K    jnz     SoftICE_Detected
# p% F% y* }- Y2 ^! o2 p
& T" K8 g% E% z___________________________________________________________________________

Method 04
) U! ]' R- [. w9 Q3 }=========

Method identical to the preceding one except that it seeks the ID of SoftICE
GFX VxD.
0 `/ h6 w6 @; `. @4 N4 t
    xor     di,di
    mov     es,di
    mov     ax, 1684h      
    mov     bx, 7a5Fh       ; VxD ID of SIWVID
/ h9 `5 J+ E5 D2 N& Q, w    int     2fh
    mov     ax, es          ; ES:DI -&gt; VxD API entry point
& {* \$ n* q) `$ Y! l    add     ax, di
, c) Z# n" U, k  O! c$ c9 u  N    test    ax,ax
8 r; J0 \8 o. ^1 [" E    jnz     SoftICE_Detected
1 U& S/ u6 t6 k" H
' u5 v' X) {7 _) X/ Y! {__________________________________________________________________________
# L! @6 X& F7 i

Method 05
7 D+ b8 m) g, z' l7 r+ j=========
& `, h1 d4 w7 ]7 N9 W- Q
/ S6 [( Y1 f* `9 N% dMethod seeking the 'magic number' 0F386h returned (in ax) by all system
debugger. It calls the int 41h, function 4Fh.
There are several alternatives.  
2 P' r6 t- {) ?
The following one is the simplest:

    mov     ax,4fh
    int     41h
! v/ V' k  t1 M) S. c! M' ^+ n    cmp     ax, 0F386
    jz      SoftICE_detected
( ~8 b% \8 w7 G) O( v5 H$ C- {

Next method as well as the following one are 2 examples from Stone's
"stn-wid.zip" (www.cracking.net):

    mov     bx, cs
    lea     dx, int41handler2
    xchg    dx, es:[41h*4]
- }3 t/ }+ \: H  }    xchg    bx, es:[41h*4+2]
    mov     ax,4fh
4 Y  w2 g2 F5 ]- V' Q; @5 x    int     41h
3 \' g) h3 X2 R    xchg    dx, es:[41h*4]
) J  b" Z# B" D    xchg    bx, es:[41h*4+2]
/ j; w$ s! Y$ N    cmp     ax, 0f386h
# I! Z3 J5 g% ]) d+ i    jz      SoftICE_detected

8 _7 g, k! P' [8 \int41handler2 PROC
( U6 H# q# Z( P1 f6 }    iret
int41handler2 ENDP
8 Q$ Z/ Y! o: c: U& I; Y' P0 w( w& W
) v. f( s) x& D
_________________________________________________________________________


7 S, I& Q* a/ o8 WMethod 06
=========
6 C/ l, `( D% n2 j
/ }6 b' ?" N0 ]; G3 @( r
2nd method similar to the preceding one but more difficult to detect:

# \4 j# }; _- {( E6 G& W
int41handler PROC
( a5 ?- _9 i' z1 Q7 o" F3 @. t    mov     cl,al
    iret
  {5 q7 o( `* E$ lint41handler ENDP

, S/ K. \6 [5 V6 F. x/ ^; w
    xor     ax,ax
    mov     es,ax
    mov     bx, cs
    lea     dx, int41handler
    xchg    dx, es:[41h*4]
    xchg    bx, es:[41h*4+2]
3 b' s: s0 ]6 h9 k! e% u" B    in      al, 40h
    xor     cx,cx
! P( s( c, t. y% [$ u( e! p/ a    int     41h
    xchg    dx, es:[41h*4]
+ J" o, m9 d! v/ Z/ s4 q0 \    xchg    bx, es:[41h*4+2]
    cmp     cl,al
& W& n, r; Q# r7 \# p    jnz     SoftICE_detected

* x& O# G+ N0 h! |1 o/ ?) `_________________________________________________________________________
9 g( Q/ p+ H+ A, Q. H
+ Z2 e  q: U0 |Method 07
=========

6 O& h9 c$ o2 d1 lMethod of detection of the WinICE handler in the int68h (V86)

9 \/ }5 j1 a, Y    mov     ah,43h
    int     68h
& I, |$ }9 h7 M8 ^    cmp     ax,0F386h
2 r; s6 |$ I0 W5 K    jz      SoftICE_Detected
# z7 u, U  K3 i) i6 R

: \9 z: o- T' h=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
4 t0 A; `5 c* |* `% O' y* @% d   app like this:

0 l6 J6 f3 `2 T( |* a" y   BPX exec_int if ax==68
   (function called is located at byte ptr [ebp+1Dh] and client eip is
- U0 ?* n6 G, l( n   located at [ebp+48h] for 32Bit apps)
__________________________________________________________________________
4 B0 F3 r  |; v! A; e

Method 08
=========
; X# r: |+ U' @  b, q" ~
: r" \8 B3 Z  U8 hIt is not a method of detection of SoftICE but a possibility to crash the
4 @# v7 l' C. }% K8 Asystem by intercepting int 01h and int 03h and redirecting them to another
, ^/ `: X* j  o' P- t6 sroutine.
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
to the new routine to execute (hangs computer...)
2 ], ^# C9 p! g) }/ x3 U
    mov     ah, 25h
2 T8 ~5 m1 T/ H, m4 G: [6 J    mov     al, Int_Number (01h or 03h)
    mov     dx, offset New_Int_Routine
    int     21h

+ E* k1 s0 I& b* ?/ s. ~1 ?5 M7 s__________________________________________________________________________
% [9 c/ A5 q3 H9 t* ~8 X; u
" S3 Y2 d* x/ P7 Z; ~( r! \$ m$ r/ MMethod 09
; S) o6 t3 d; h8 v=========
8 {$ K5 s9 b1 g3 t3 `! S( A+ y
7 Y0 L8 w- Q# W9 V8 UThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
! ^9 _3 h7 E, Pperformed in ring0 (VxD or a ring3 app using the VxdCall).
The Get_DDB service is used to determine whether or not a VxD is installed
for the specified device and returns a Device Description Block (in ecx) for
. @3 U4 x. i! q5 b, C5 y6 x& qthat device if it is installed.

   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID
   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
5 o6 N7 q) l8 n, n   VMMCall Get_DDB
   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed

Note as well that you can easily detect this method with SoftICE:
" t' R: F3 _# k   bpx Get_DDB if ax==0202 || ax==7a5fh
* e# i6 B5 J, `8 h5 }, i
__________________________________________________________________________

9 u" U# F3 |% |# u7 b; AMethod 10
=========
- w1 I, u) [1 t6 v" ^# p- E9 X( o
1 o' s4 Y, J/ }6 V0 e=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with
  x/ W( S) y- D7 i9 Z  K* ?  SoftICE while the option is enable!!

2 v/ m9 S3 a$ R( sThis trick is very efficient:
) \! r- t1 R# ?! Pby checking the Debug Registers, you can detect if SoftICE is loaded
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
) Y. m8 I: M  ]+ w2 H2 {7 {5 x, rthere are some memory breakpoints set (dr0 to dr3) simply by reading their
. L5 |9 _" W! i( I+ }value (in ring0 only). Values can be manipulated and or changed as well
(clearing BPMs for instance)

__________________________________________________________________________
8 I- H( Q' D2 i
. W5 b& H, R) v9 f, W* N+ d/ @2 p4 e) hMethod 11
0 f- D! \% Y# g( ]+ o=========
, k- M. S/ t) P1 V+ ^
This method is most known as 'MeltICE' because it has been freely distributed
+ D' z4 M& t6 _0 Uvia www.winfiles.com. However it was first used by NuMega people to allow
+ T$ v7 _' t0 O; O  {Symbol Loader to check if SoftICE was active or not (the code is located
* @. U  ?" Q4 x: U5 q% m5 Z1 ainside nmtrans.dll).

The way it works is very simple:
: V- L/ V; r- KIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
& c( y7 N+ X% Y2 A1 ~# WWinNT) with the CreateFileA API.

Here is a sample (checking for 'SICE'):
! x: R" D9 {, @/ V
BOOL IsSoftIce95Loaded()
{
   HANDLE hFile;  
# ]: J1 \/ j$ ^' j  @. M   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
                      FILE_SHARE_READ | FILE_SHARE_WRITE,
                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
   if( hFile != INVALID_HANDLE_VALUE )
   {
      CloseHandle(hFile);
: B$ V# U2 i6 M' k! h      return TRUE;
   }
8 W8 i( c# o0 A% e6 ?  Z   return FALSE;
5 i5 E6 l5 H) i}

Although this trick calls the CreateFileA function, don't even expect to be
able to intercept it by installing a IFS hook: it will not work, no way!
In fact, after the call to CreateFileA it will get through VWIN32 0x001F
+ l8 t1 @1 r- N8 W7 Rservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
and then browse the DDB list until it find the VxD and its DDB_Control_Proc
field.
' |# w0 o. h9 FIn fact, its purpose is not to load/unload VxDs but only to send a
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
% V5 y) W: Y6 d  E9 cto the VxD Control_Dispatch proc (how the hell a shareware soft could try
4 S# `* E# A( B" S8 Kto load/unload a non-dynamically loadable driver such as SoftICE ;-).
If the VxD is loaded, it will always clear eax and the Carry flag to allow
; X3 z, b. s( g) r2 [# eits handle to be opened and then, will be detected.
0 g! v' L3 Z/ E  [( k' b' CYou can check that simply by hooking Winice.exe control proc entry point
7 Q) |) P/ q( a0 Q2 ?while running MeltICE.
# m$ Y7 N7 F. ~9 m
' J/ ~0 O3 N( W7 }
  00401067:  push      00402025    ; \\.\SICE
  {' i2 t. P( g- V* q' }& E  0040106C:  call      CreateFileA
  00401071:  cmp       eax,-001
2 ?4 l0 Q9 p+ j  00401074:  je        00401091

, s. o) y& X/ G+ D$ B
! h  U- w" V, T0 [& L! wThere could be hundreds of BPX you could use to detect this trick.
-The most classical one is:
3 Q5 M2 Y( S# I5 b0 I$ Z5 O7 t  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||
    *(esp-&gt;4+4)=='NTIC'
! F- ^; d/ v' {( J  j
-The most exotic ones (could be very slooooow :-(
4 D( H4 |. ?( {/ T- g   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
$ E# |/ u6 x0 N& Q     ;will break 3 times :-(

-or (a bit) faster:
   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
6 I- d  i8 r. h2 E: N
   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  
+ j: ^+ G( t3 w! J( E+ q6 K     ;will break 3 times :-(
6 @/ q- ]1 [: i8 P5 \
-Much faster:
   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'

$ L6 _6 _9 Z, l, }- \Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
function to do the same job:
9 r: ?! p5 R. N& `
6 c  v# x7 J+ T8 ^4 l   push    00                        ; OF_READ
   mov     eax,[00656634]            ; '\\.\SICE',0
( m& G' w: N6 z6 N/ e9 |   push    eax
4 M% S, \& g% j   call    KERNEL32!_lopen
. d* c( a% O, s' r   inc     eax
   jnz     00650589                  ; detected
   push    00                        ; OF_READ
  E- l& a+ X3 I7 Z% d; M   mov     eax,[00656638]            ; '\\.\SICE'
   push    eax
   call    KERNEL32!_lopen
4 J0 k6 F  E9 O4 ~   inc     eax
   jz      006505ae                  ; not detected

3 `2 v2 ]: J# H" H' [
4 P; _5 z4 l9 z9 `" C/ z( |: Y__________________________________________________________________________
8 k7 Z* T! {/ v3 Y9 ~$ l
Method 12
=========
3 ~9 [( F6 p# v3 d7 w# [
This trick is similar to int41h/4fh Debugger installation check (code 05
* ?1 Y2 m# O/ c+ R% N, k! m&amp; 06) but very limited because it's only available for Win95/98 (not NT)
' Z8 K9 d3 I* W5 bas it uses the VxDCall backdoor. This detection was found in Bleem Demo.

' n7 `. w& s; x6 b2 }; Y* \   push  0000004fh         ; function 4fh
7 Y& P" F% L8 @% ~# ?4 F   push  002a002ah         ; high word specifies which VxD (VWIN32)
8 n1 h9 A' t8 s8 P5 o0 |$ g                           ; low word specifies which service
                             (VWIN32_Int41Dispatch)
   call  Kernel32!ORD_001  ; VxdCall
: ?) ^! z- Y% j1 W" O3 d   cmp   ax, 0f386h        ; magic number returned by system debuggers
, b; M& Z# H0 {9 ^0 c   jz    SoftICE_detected

Here again, several ways to detect it:

    BPINT 41 if ax==4f
5 I  L( j3 e+ J% [; H2 I; t
    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one

8 t, |# P' D, {% R% |/ p    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A

3 D  o/ {1 a) s! B3 ?: a    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!

__________________________________________________________________________

Method 13
+ H" B, _1 D/ v5 u9 z' Z0 J" Z=========
9 I  X1 X$ k2 I; B
. o$ T- {2 U% n1 o- @0 vNot a real method of detection, but a good way to know if SoftICE is
installed on a computer and to locate its installation directory.
" ]; W, v" Y2 @7 e& L  r0 \# s9 QIt is used by few softs which access the following registry keys (usually #2) :
) r% k. y. \# x, U9 A- A
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
# m: V& c  ~1 _, p1 x0 {/ M; a\Uninstall\SoftICE
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
# W0 L. e, t4 b! D6 i\App Paths\Loader32.Exe
: h) A# `8 d- q' u5 u" O
6 k: I5 Y" j% Q
- b: K7 j3 U; p) I2 p; u& i6 uNote that some nasty apps could then erase all files from SoftICE directory
(I faced that once :-(
$ ?0 F" R% @$ w* G$ t/ |
Useful breakpoint to detect it:
7 ~% Y- r$ z8 J  \" v/ t- k
     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'
2 c1 n. d, F* t" i* s
__________________________________________________________________________

( j8 c) w6 _; u3 s( E
% f! x: `+ }9 L5 VMethod 14
=========
) C- y8 O1 T0 F. c! z" }
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
is to determines whether a debugger is running on your system (ring0 only).
, V4 W- t6 B5 [
   VMMCall Test_Debug_Installed
- s0 _. y  [* ?3 h* i   je      not_installed
7 F! q% V- ~( j. D- N! D- L
This service just checks a flag.
2 W! A7 u+ w; U1 D</PRE></TD></TR></TBODY></TABLE>