About anti-SoftICE tricks

<TABLE width=500>
<TBODY>
, p) F2 `* V- Q+ Q/ \" ]<TR>
8 P- L" u/ P# u8 p% O+ k<TD><PRE>Method 01
1 h# {  b6 F+ O5 b=========
  B' n6 d7 l6 b) E3 W1 |/ {$ P
# U$ S7 a, \, LThis method of detection of SoftICE (as well as the following one) is
used by the majority of packers/encryptors found on Internet.
It seeks the signature of BoundsChecker in SoftICE
& p$ e+ f' u) m
    mov     ebp, 04243484Bh        ; 'BCHK'
    mov     ax, 04h
    int     3      
    cmp     al,4
    jnz     SoftICE_Detected
; H/ N2 s* B* ?% m
& i8 y% V* `$ c___________________________________________________________________________

Method 02
=========

" y( A; V" I' c# \/ ?& CStill a method very much used (perhaps the most frequent one).  It is used
* E8 e7 b' t# ]- a' {! E" `' qto get SoftICE 'Back Door commands' which gives infos on Breakpoints,
or execute SoftICE commands...
* m0 Z& x* d: A9 I" X! \  F2 eIt is also used to crash SoftICE and to force it to execute any commands
(HBOOT...) :-((  

( x  c( e( m% lHere is a quick description:
-AX = 0910h   (Display string in SIce windows)
-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)
-AX = 0912h   (Get breakpoint infos)
-AX = 0913h   (Set Sice breakpoints)
' A1 f7 B( u. Y, H0 V-AX = 0914h   (Remove SIce breakoints)
. o( W$ A( v" @7 l: q6 o
3 s$ J/ }) d3 fEach time you'll meet this trick, you'll see:
8 p) b( W- m: p-SI = 4647h
) f7 y4 R5 D; K2 E-DI = 4A4Dh
Which are the 'magic values' used by SoftIce.
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.
6 Q+ u+ Z  ?* ?) O
Here is one example from the file "Haspinst.exe" which is the dongle HASP
4 i- ]1 a( C- ?Envelope utility use to protect DOS applications:
$ R* f+ D, K7 ^- v' I5 N1 F

( p  A8 o0 V. o1 J4C19:0095   MOV    AX,0911  ; execute command.
4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).
: U! ?: p# O* M2 t/ u4C19:009A   MOV    SI,4647  ; 1st magic value.
/ Q/ G! Y: Z! f& l5 G4C19:009D   MOV    DI,4A4D  ; 2nd magic value.
4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute
4C19:00A4   INC    CX
4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute
4C19:00A8   JB     0095     ; 6 different commands.
1 k$ y7 W$ O! h# B4C19:00AA   JMP    0002     ; Bad_Guy jmp back.
, ]' c' o" B! z& q5 z4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)

1 \8 g2 ?/ `9 Z" E/ nThe program will execute 6 different SIce commands located at ds:dx, which
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
) d" R) A8 y) S( r; B8 a* ]' x
5 H2 ?5 L3 z! G( I! Q% m7 n* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
___________________________________________________________________________
9 T, E  W, h" G0 {

Method 03
=========
; p" f: r' H& {3 v5 g5 P
/ J" i9 N5 g5 ]  k& `Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
(API Get entry point)
        
% `4 b% f2 N) J8 ]' @5 |
0 P' Y; w6 l8 n* \2 X8 {    xor     di,di
+ E5 ~) |- ^6 N! a9 m7 T    mov     es,di
    mov     ax, 1684h      
. O6 d2 I8 y  Q( j5 U8 Q( R- L# m5 v$ x    mov     bx, 0202h       ; VxD ID of winice
    int     2Fh
9 ^6 T' ]+ W, F& X! u7 `    mov     ax, es          ; ES:DI -&gt; VxD API entry point
    add     ax, di
    test    ax,ax
    jnz     SoftICE_Detected

- [( j2 Z- E/ b2 Q' S, Z8 T7 Z5 X___________________________________________________________________________

Method 04
=========
5 ~# K, d$ [* s# h: |# @$ l
5 L  d- H9 a' ]Method identical to the preceding one except that it seeks the ID of SoftICE
GFX VxD.
0 U; K  [* J4 p2 i% m. ]( S
    xor     di,di
( Q, N2 ~" x' u  t* @# t    mov     es,di
    mov     ax, 1684h      
% a& E  Z& ~  H# J, i, p7 m    mov     bx, 7a5Fh       ; VxD ID of SIWVID
    int     2fh
    mov     ax, es          ; ES:DI -&gt; VxD API entry point
) ~4 A! _- y9 i# M4 i    add     ax, di
    test    ax,ax
    jnz     SoftICE_Detected
+ [3 @. }8 a( i! z
/ p; O( W% S9 V# g- k9 c! X__________________________________________________________________________

& l) x. s9 h" _8 z5 t0 ]+ A: \% T
Method 05
7 U5 g7 Z9 f! j" V=========
4 L5 z8 c. {$ H0 Y# A8 N5 L
Method seeking the 'magic number' 0F386h returned (in ax) by all system
debugger. It calls the int 41h, function 4Fh.
- A6 N1 M" z- Q$ X* n* XThere are several alternatives.  

The following one is the simplest:
+ |% A. C5 D$ Q! {' l
    mov     ax,4fh
    int     41h
) T* K4 K: l& L    cmp     ax, 0F386
; ~9 q2 S2 p' i+ Y- ~' I    jz      SoftICE_detected

* t0 y7 ]7 S' N7 _4 s" m
. I* T6 Y% Y$ Q3 d6 {* Z9 MNext method as well as the following one are 2 examples from Stone's
4 o0 ]: Z2 \; `1 l) x3 i"stn-wid.zip" (www.cracking.net):

    mov     bx, cs
6 a! h5 V9 F4 Y1 V    lea     dx, int41handler2
    xchg    dx, es:[41h*4]
    xchg    bx, es:[41h*4+2]
$ E, \* B  i( E& l8 k( G7 b' E    mov     ax,4fh
' Q9 h3 L" {2 l  e7 Y2 [  r+ K    int     41h
9 R7 a& T' l, q    xchg    dx, es:[41h*4]
+ Z+ A6 X3 t9 M    xchg    bx, es:[41h*4+2]
4 O  S' v- u3 D. Y! v& h    cmp     ax, 0f386h
. c- ?7 R  J, h& Z. H6 i    jz      SoftICE_detected

' m. T5 t/ I& |$ nint41handler2 PROC
5 B% [9 A% x- f% ^' m. y    iret
int41handler2 ENDP

0 J. U6 a, d0 J
_________________________________________________________________________


3 X1 r7 k% E9 x; K$ [Method 06
=========
9 ]  N# w7 n( e$ q( m) M+ D) d

2 ?5 h% m( k6 z2 m+ \2nd method similar to the preceding one but more difficult to detect:
& h' ^# _* `* i" O
$ R9 c4 W) b) P8 t% Q: ]
& D1 j1 b- W5 I; T0 sint41handler PROC
8 Q7 Z- M+ T8 j; p0 F) [, Q! ~    mov     cl,al
- p5 Q, c# h% ^, O( |& W3 z    iret
int41handler ENDP


! t! {: U8 z5 X* ]0 d    xor     ax,ax
    mov     es,ax
    mov     bx, cs
* W+ {, R9 S) r8 }/ D5 c    lea     dx, int41handler
2 ]7 \" P$ Y( l/ h    xchg    dx, es:[41h*4]
2 c% y& f+ I6 _# y    xchg    bx, es:[41h*4+2]
    in      al, 40h
    xor     cx,cx
    int     41h
: w7 r! w3 {& ^1 v8 q, H! S    xchg    dx, es:[41h*4]
    xchg    bx, es:[41h*4+2]
6 x9 O$ ?+ s$ g+ w1 S  r; J" A    cmp     cl,al
( @7 m  m+ h" V; x    jnz     SoftICE_detected
4 V% D4 J: ?. k9 V+ `5 u1 a" \* C7 |
7 ]# _: U5 K) U( ]6 T_________________________________________________________________________
3 N+ w' z$ W/ L7 N
  y4 S- P6 A3 X1 W5 S- FMethod 07
8 u6 W  [7 o. S& L=========
& i9 @1 G6 O* r. W/ ^9 f5 ^7 `4 U
Method of detection of the WinICE handler in the int68h (V86)
3 C/ I4 d$ M7 m1 |. |
, D) _0 L' t. B    mov     ah,43h
: D8 t2 V3 o7 B) e) d- [- ?8 i6 U    int     68h
" N: S0 G4 H# D8 Z1 y1 \$ W5 @    cmp     ax,0F386h
- P0 w* ]4 A$ n" u7 o4 {    jz      SoftICE_Detected
5 }) D3 x1 ~) X9 Z% }/ s/ n5 J
3 ]* x. A" s" F4 p% P
=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
  L! T7 h* J  @$ ~   app like this:

  a, q9 [( D  a   BPX exec_int if ax==68
   (function called is located at byte ptr [ebp+1Dh] and client eip is
   located at [ebp+48h] for 32Bit apps)
__________________________________________________________________________
$ k6 h) g2 Z* O, h

2 z' f! J/ j0 o6 j" Y  p! FMethod 08
5 N9 N& P8 o6 f$ n' }+ _=========
+ E$ t& J' G* b6 W# \* r/ b
It is not a method of detection of SoftICE but a possibility to crash the
$ k; m% Z# f$ d, w1 T8 {system by intercepting int 01h and int 03h and redirecting them to another
routine.
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
9 H0 Q. q3 H5 [+ p3 j- q9 U' [to the new routine to execute (hangs computer...)
8 I4 `3 j% @4 b8 f: i; c# ?
    mov     ah, 25h
    mov     al, Int_Number (01h or 03h)
+ B6 g0 ~& x4 v    mov     dx, offset New_Int_Routine
' h5 R; ^# d+ k1 {9 a# ~* x2 ^! [    int     21h

__________________________________________________________________________
' t. R! N* G- @5 k! _/ }+ K
% c& a& `: e3 h+ l( o# nMethod 09
5 m7 X5 p1 k7 J, h=========
1 |5 D  k6 B4 }/ r* b0 S! \) t% k
: h( }; X6 _" I3 w, bThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
performed in ring0 (VxD or a ring3 app using the VxdCall).
The Get_DDB service is used to determine whether or not a VxD is installed
1 V" P# s$ u0 y/ f/ [7 z& ifor the specified device and returns a Device Description Block (in ecx) for
that device if it is installed.

   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID
4 M6 X0 E3 k1 c) Y0 ~# g; r( s   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
   VMMCall Get_DDB
   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed
5 F- O( h5 F& b& m
Note as well that you can easily detect this method with SoftICE:
   bpx Get_DDB if ax==0202 || ax==7a5fh

__________________________________________________________________________
, e# R1 n# Q/ r6 Q
4 H4 s2 Z. }8 Z/ @) eMethod 10
=========

=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with
& C5 d2 j2 s$ p. r2 X  SoftICE while the option is enable!!
* V, Y: d/ m: Z, `! W9 t
This trick is very efficient:
) @" a: @7 j- B0 I. q; ~by checking the Debug Registers, you can detect if SoftICE is loaded
6 [8 U# ^$ [/ r* h(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
8 T2 u; Y) t! U* W! m3 wthere are some memory breakpoints set (dr0 to dr3) simply by reading their
7 R) e: ~/ T$ avalue (in ring0 only). Values can be manipulated and or changed as well
(clearing BPMs for instance)

__________________________________________________________________________

$ `3 |. y' C2 J- l$ A, BMethod 11
6 L1 m! f. W+ l=========

( m& A' o, `, h2 U- M* z/ vThis method is most known as 'MeltICE' because it has been freely distributed
) o- M# A0 ]" b/ X3 R5 lvia www.winfiles.com. However it was first used by NuMega people to allow
; z7 H: d  [" {4 M9 I$ k- G1 i( H8 CSymbol Loader to check if SoftICE was active or not (the code is located
+ D6 B) B; f9 p: q" Kinside nmtrans.dll).

0 c7 J. O0 @$ Y5 oThe way it works is very simple:
/ M& u) I  O: a/ A9 zIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
) M% Y8 W: r% r$ ?WinNT) with the CreateFileA API.
7 ?; n# Z6 m0 y* q7 r! K: `
Here is a sample (checking for 'SICE'):

0 ~0 W' `/ Z- K( F/ G: w& k- vBOOL IsSoftIce95Loaded()
{
9 {, k5 T8 }. F0 u. Y7 J   HANDLE hFile;  
" P( [4 L# x4 B9 v- b) h   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
                      FILE_SHARE_READ | FILE_SHARE_WRITE,
4 S2 }2 h3 d+ z, ^# [# U8 a1 E4 a                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
% K1 a0 T9 t8 W; N* y# O7 ]+ a" K* N   if( hFile != INVALID_HANDLE_VALUE )
/ w$ _% a5 I, x1 J  G   {
( {( C. E8 t2 M4 }" q; K) }8 [, Y      CloseHandle(hFile);
      return TRUE;
   }
   return FALSE;
, S" w: |; u8 e" @2 L}
, j* q- h$ @# i7 K4 J/ Z
Although this trick calls the CreateFileA function, don't even expect to be
) o  h$ G0 Y7 p9 g6 @2 F+ \able to intercept it by installing a IFS hook: it will not work, no way!
In fact, after the call to CreateFileA it will get through VWIN32 0x001F
' z1 \9 Z; m  S0 [7 p4 Zservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
1 r. U, j2 i6 p: D, ^  T  Land then browse the DDB list until it find the VxD and its DDB_Control_Proc
field.
In fact, its purpose is not to load/unload VxDs but only to send a
! p% @: Z. I& U! fW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
: E3 v0 F6 K" l, a; i1 j  i+ Mto the VxD Control_Dispatch proc (how the hell a shareware soft could try
to load/unload a non-dynamically loadable driver such as SoftICE ;-).
If the VxD is loaded, it will always clear eax and the Carry flag to allow
8 I( ~1 U! T; b' gits handle to be opened and then, will be detected.
' _/ k- b/ ^: N8 l+ w- ]You can check that simply by hooking Winice.exe control proc entry point
while running MeltICE.


7 ^- Z/ u$ ^' i; p5 ]. Z# D: t  00401067:  push      00402025    ; \\.\SICE
  0040106C:  call      CreateFileA
  00401071:  cmp       eax,-001
  00401074:  je        00401091


+ u/ }; ^* b  t1 }' \- ZThere could be hundreds of BPX you could use to detect this trick.
-The most classical one is:
  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||
; z: R# v- o; n  z+ k( P3 J    *(esp-&gt;4+4)=='NTIC'
9 i. c3 E2 M  ?/ U1 Q* L
-The most exotic ones (could be very slooooow :-(
  k4 A7 t) {) L   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
     ;will break 3 times :-(
0 r% ]) d9 I# r& `% C0 g) r
-or (a bit) faster:
   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')

   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  
     ;will break 3 times :-(
/ ]" T5 I7 H# t! B! B
-Much faster:
/ ^& Y6 s2 `: x# V) j5 Q: f   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'

) E: V( X" _% ~* z' _Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
function to do the same job:
. T4 u) A4 K4 @. p$ }! G6 T
   push    00                        ; OF_READ
   mov     eax,[00656634]            ; '\\.\SICE',0
   push    eax
   call    KERNEL32!_lopen
   inc     eax
: Q0 z5 |% C+ h' A% n   jnz     00650589                  ; detected
   push    00                        ; OF_READ
   mov     eax,[00656638]            ; '\\.\SICE'
   push    eax
1 B6 F+ N  x, i+ a1 k1 D   call    KERNEL32!_lopen
5 ^2 R/ W% \9 R9 ^* U/ A1 Z   inc     eax
   jz      006505ae                  ; not detected
# Z+ k+ r  p0 |, R
4 r& O- [( i2 k
__________________________________________________________________________

Method 12
=========

This trick is similar to int41h/4fh Debugger installation check (code 05
* y3 Z8 P0 O4 R&amp; 06) but very limited because it's only available for Win95/98 (not NT)
" S1 ~* x. T$ h( f/ D3 ?3 o) has it uses the VxDCall backdoor. This detection was found in Bleem Demo.
# A7 T. @( u& o
' J2 l6 C. b, r* V' ]& |   push  0000004fh         ; function 4fh
   push  002a002ah         ; high word specifies which VxD (VWIN32)
                           ; low word specifies which service
                             (VWIN32_Int41Dispatch)
; _) A( G2 P3 D+ I. P0 r: h3 `   call  Kernel32!ORD_001  ; VxdCall
   cmp   ax, 0f386h        ; magic number returned by system debuggers
   jz    SoftICE_detected

Here again, several ways to detect it:
8 `) ]0 M) \# M4 y# X7 y$ x7 |
    BPINT 41 if ax==4f

: H% s, C* g" P% n- M    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one

. z6 K) O0 y, B6 D; T    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A
% w; Z' Q6 @7 T4 }& {/ l: T! p
2 q! c7 J1 f4 s, h5 [& _8 b0 R0 K    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!
* q" @8 C, _# S9 i
( L/ I( R8 B5 [2 q; O) C__________________________________________________________________________
/ c* |0 p8 U9 O1 F5 I/ q' y
Method 13
=========

) A6 Q6 \0 r$ W) Q- W) t8 L  dNot a real method of detection, but a good way to know if SoftICE is
7 m: H( X: I4 L4 U! O( kinstalled on a computer and to locate its installation directory.
It is used by few softs which access the following registry keys (usually #2) :
6 C" _- l1 ^/ T( B4 R
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
' L, e9 y: z/ E5 r7 s\Uninstall\SoftICE
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
- f& \+ d! q0 e& J/ H5 y% |+ g-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
( C. l7 S% ?. t2 N; r2 P, ?4 N\App Paths\Loader32.Exe
% V8 L5 {8 r' S+ x$ a- j; ~

" x: I/ k7 n! m" I" }Note that some nasty apps could then erase all files from SoftICE directory
( B( M9 v" g, j) }: Y* m- N(I faced that once :-(

8 D& t0 W! ^, }Useful breakpoint to detect it:

     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'

__________________________________________________________________________
, s5 R! k4 ?( Y5 a& r* t6 t
: R8 k* Q+ d3 j5 K6 H
Method 14
=========

A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
is to determines whether a debugger is running on your system (ring0 only).
0 e3 b; N1 a. t3 K, v
   VMMCall Test_Debug_Installed
   je      not_installed
6 v+ B2 e6 A- ^0 Q! L
# S2 t. s' y6 yThis service just checks a flag.
  F$ w8 K* \' F& ~5 D0 {8 r9 r</PRE></TD></TR></TBODY></TABLE>