About anti-SoftICE tricks

<TABLE width=500>
3 [: }1 G$ n0 U+ \6 f. o) h3 K4 I<TBODY>
<TR>
<TD><PRE>Method 01
+ Q# p* u% K9 `6 o* F/ `& F=========

$ G( E" R8 w# I% t6 ZThis method of detection of SoftICE (as well as the following one) is
! ]# E3 N8 d4 t  ~6 Fused by the majority of packers/encryptors found on Internet.
It seeks the signature of BoundsChecker in SoftICE
9 [! n' W9 b) N. z% Z$ s; k* e/ k
    mov     ebp, 04243484Bh        ; 'BCHK'
    mov     ax, 04h
" w+ f- l1 a1 F/ N- w# k    int     3      
8 a8 B3 A7 P/ Y# u6 z' ^$ ?/ b2 G: t    cmp     al,4
    jnz     SoftICE_Detected
. L  U  \9 H- _0 @8 x7 a
: w+ f* y" r$ x9 B* }, Z& t- q___________________________________________________________________________

Method 02
: \2 ]" I7 W" W, H0 I, N4 X7 Q=========
2 {) s/ P7 Y" ^2 W5 B; {# ]
; k0 j- t% J- S- c1 u- qStill a method very much used (perhaps the most frequent one).  It is used
( C5 D+ _: l' U% W! d' Gto get SoftICE 'Back Door commands' which gives infos on Breakpoints,
! G( t" ]6 G2 E- J2 Bor execute SoftICE commands...
It is also used to crash SoftICE and to force it to execute any commands
' g$ |# g1 r. }5 F- {3 z4 T0 t(HBOOT...) :-((  
" T3 {  ^* [" `$ D* Z9 g$ i5 W) l2 \1 T
Here is a quick description:
4 D* U9 |+ N3 U6 v) s8 c-AX = 0910h   (Display string in SIce windows)
8 q, S. g0 ]% S: i0 t-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)
-AX = 0912h   (Get breakpoint infos)
-AX = 0913h   (Set Sice breakpoints)
-AX = 0914h   (Remove SIce breakoints)
* V6 M" ?& c) s# ]& _  F6 M
+ b) V' X; g. o/ nEach time you'll meet this trick, you'll see:
-SI = 4647h
-DI = 4A4Dh
! f* e9 T9 W, B8 B: f9 @( |& |+ m* EWhich are the 'magic values' used by SoftIce.
# N4 J# X* i! _) e, W* C/ {For more informations, see "Ralf Brown Interrupt list" chapter int 03h.
. b5 U% n/ M6 m' T( a* m  N5 ?
Here is one example from the file "Haspinst.exe" which is the dongle HASP
7 T1 L6 S4 B# p; ?3 i# t) gEnvelope utility use to protect DOS applications:


9 h# y; t% c/ _+ z, ?4C19:0095   MOV    AX,0911  ; execute command.
4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).
4C19:009A   MOV    SI,4647  ; 1st magic value.
4C19:009D   MOV    DI,4A4D  ; 2nd magic value.
4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute
0 ?# n0 S2 ~) K% f- V' H4C19:00A4   INC    CX
7 f0 q! S; M9 N6 m) K2 c: P1 ~4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute
2 F& P. f* d  U4C19:00A8   JB     0095     ; 6 different commands.
. t  a) G: L% w' f: d4C19:00AA   JMP    0002     ; Bad_Guy jmp back.
: d5 B) k9 w' }, E8 ]' r3 e4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)
3 o4 N. f0 ?) R' V
The program will execute 6 different SIce commands located at ds:dx, which
3 ~7 v* k. B7 f) X" o* Sare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.

8 ~* x5 h/ R9 Q7 h* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
___________________________________________________________________________


Method 03
=========

Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
(API Get entry point)
        
- Y, d3 w+ I, a! W+ X* v/ z) t
    xor     di,di
    mov     es,di
8 f8 L' j7 F+ ?    mov     ax, 1684h      
    mov     bx, 0202h       ; VxD ID of winice
    int     2Fh
    mov     ax, es          ; ES:DI -&gt; VxD API entry point
    add     ax, di
    test    ax,ax
! y8 L7 B9 ~3 ~2 @    jnz     SoftICE_Detected
2 o- \( H4 T6 i0 y( _8 p2 |
___________________________________________________________________________
! V; Y) z6 j+ F+ `: F
( \" T; p8 S% m+ ]Method 04
1 [" D( |5 x) S6 P) @=========
: }4 k. B7 s* c( x3 M0 [
$ I( r! K* X3 Q# g# UMethod identical to the preceding one except that it seeks the ID of SoftICE
+ U/ P# _# M' y( uGFX VxD.

9 u( b( f. Z' l7 j1 {# {$ Z7 N; f    xor     di,di
% f/ j% Y6 Y- f6 j. G1 \' e3 I0 m    mov     es,di
    mov     ax, 1684h      
    mov     bx, 7a5Fh       ; VxD ID of SIWVID
/ {2 _3 H+ Y4 ^. [, [. ?    int     2fh
) e% {3 g, \. ^7 d    mov     ax, es          ; ES:DI -&gt; VxD API entry point
0 d; L/ N# }4 G! _' P0 d. ^    add     ax, di
, {$ }0 x: o2 ~, x    test    ax,ax
# v5 w2 H# `& p; y, w, {    jnz     SoftICE_Detected

__________________________________________________________________________
2 L+ g# {9 [, L7 O8 k- S5 p
; g# J) E$ z+ B  A' t! \
Method 05
=========

Method seeking the 'magic number' 0F386h returned (in ax) by all system
/ S6 ]! C; S) Q) xdebugger. It calls the int 41h, function 4Fh.
5 H* D; O: g/ iThere are several alternatives.  

( ~3 m7 ~2 W, RThe following one is the simplest:

    mov     ax,4fh
% y! q/ G$ V/ U    int     41h
    cmp     ax, 0F386
! k1 D$ T, Q) M    jz      SoftICE_detected
6 m9 d  f3 R- l4 v8 c3 U, o! A6 Z
4 S; j6 {/ Q" f  x% R2 b
Next method as well as the following one are 2 examples from Stone's
"stn-wid.zip" (www.cracking.net):
. t; z( f, f0 N9 C1 ?
! f* h6 M8 C; M7 m    mov     bx, cs
    lea     dx, int41handler2
' W# ?( q/ e% |" n* n    xchg    dx, es:[41h*4]
    xchg    bx, es:[41h*4+2]
) ?6 y# a8 i; Y    mov     ax,4fh
    int     41h
    xchg    dx, es:[41h*4]
    xchg    bx, es:[41h*4+2]
    cmp     ax, 0f386h
    jz      SoftICE_detected
, B/ I% x1 B) H! o# _7 Y6 t% b
% a1 v' q& C) k# S+ ?' l' Q$ uint41handler2 PROC
* u7 I( k& {) I- L% F' @    iret
int41handler2 ENDP
' F% s/ v7 ?3 X$ j; M$ z
$ R8 g1 b/ Y* ^1 F
) O& M3 N- P7 d& T0 H_________________________________________________________________________

8 e& r5 \; c* }! Y3 b
6 d8 H% }  ~4 q$ p: M- K1 zMethod 06
; J" k; n% l! h7 Z0 R=========
; K! x" h' g! ]- S9 J2 Q

! j. r# ?/ j' I1 ?2nd method similar to the preceding one but more difficult to detect:
3 ]6 j9 K9 ?) ~4 N  _

5 K0 F$ x( u9 j- Z! T' oint41handler PROC
    mov     cl,al
- k) p" O0 l2 R% V    iret
int41handler ENDP
0 [& d5 w; g: T5 M; j# M# a

    xor     ax,ax
0 Y2 ?( V" S( p9 l: e    mov     es,ax
* S, g0 O) K5 d% V6 P- z, P, }    mov     bx, cs
    lea     dx, int41handler
    xchg    dx, es:[41h*4]
0 H3 n1 A0 g2 l6 A) V    xchg    bx, es:[41h*4+2]
    in      al, 40h
    xor     cx,cx
    int     41h
    xchg    dx, es:[41h*4]
    xchg    bx, es:[41h*4+2]
7 b6 N5 j. J$ r- A    cmp     cl,al
    jnz     SoftICE_detected
2 \/ f" `+ c3 R* G6 t0 B# q- E
_________________________________________________________________________
- P" ^, U+ w/ d
Method 07
=========
, e1 v$ L' n1 f0 H" B% Z
2 C4 L- p; w, q  ZMethod of detection of the WinICE handler in the int68h (V86)
" L: i1 v" C3 y  O( u
    mov     ah,43h
    int     68h
    cmp     ax,0F386h
    jz      SoftICE_Detected

$ _) T# Z. w6 j4 V' ?- d2 b
: x- R9 P8 U- _6 R8 s! d* g=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
% H. ^3 ^" t+ P1 e   app like this:
9 x% V) v' s  I. \
   BPX exec_int if ax==68
   (function called is located at byte ptr [ebp+1Dh] and client eip is
( ^' {2 S+ F7 V5 R& p2 D   located at [ebp+48h] for 32Bit apps)
1 U" a6 A: C) F' [% ^__________________________________________________________________________

& E$ t' K8 @" J, C5 }
+ K* S+ {2 v  d) M5 K; u/ e* WMethod 08
5 n9 J9 X* K) E! v$ |( J2 U  ^=========
6 u+ s& h% f5 N
It is not a method of detection of SoftICE but a possibility to crash the
# T3 G2 ?: {: O) B; d* [system by intercepting int 01h and int 03h and redirecting them to another
& X+ w6 u4 c$ e$ U! B2 sroutine.
1 D- x6 c8 r  t6 sIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
% Q' w# v( V) A6 ?to the new routine to execute (hangs computer...)

    mov     ah, 25h
3 ?) [# x, G3 c% o  a    mov     al, Int_Number (01h or 03h)
* P% R) |5 x6 W5 R8 B    mov     dx, offset New_Int_Routine
5 `, }+ h! y, X9 G/ S+ w% H5 b, n: W    int     21h

# a  t  F. _5 X* u1 b* W__________________________________________________________________________
- K& p$ r( @  y6 d  l% T. j
Method 09
=========
* Q: w7 d' ?& p5 r5 |/ E
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
performed in ring0 (VxD or a ring3 app using the VxdCall).
9 k2 m0 \7 ~' X* TThe Get_DDB service is used to determine whether or not a VxD is installed
for the specified device and returns a Device Description Block (in ecx) for
1 u+ y  F5 r! [% cthat device if it is installed.
% N! X1 i9 S1 ^: l$ x) u
1 X2 y3 S1 ~* [. m$ I   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID
   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
   VMMCall Get_DDB
. b) O/ N  ?8 \  w% s4 ]   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed

Note as well that you can easily detect this method with SoftICE:
1 i; d7 D5 _7 x: [   bpx Get_DDB if ax==0202 || ax==7a5fh

__________________________________________________________________________

Method 10
=========
3 z. e$ P( o2 |9 V+ e: D2 @5 p# l
=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with
+ f) T2 I8 S, k5 _; E9 q. ]  SoftICE while the option is enable!!
; x* T- X  m+ ~, ]( }
This trick is very efficient:
- @0 K" L! W# f% c5 Gby checking the Debug Registers, you can detect if SoftICE is loaded
  G) Q  ^/ p& W4 C: N9 }- c  U(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
! b5 |6 v( r: g5 M# lthere are some memory breakpoints set (dr0 to dr3) simply by reading their
value (in ring0 only). Values can be manipulated and or changed as well
6 o: M& u& B5 \/ n$ B, J0 L! t, @(clearing BPMs for instance)

__________________________________________________________________________

- Z/ H! B  T6 E5 sMethod 11
5 m/ K/ a, G9 m4 d4 c% n7 ~=========
7 I4 e. `: R5 q" P% C# Y
This method is most known as 'MeltICE' because it has been freely distributed
* X) R0 p0 p0 k6 @via www.winfiles.com. However it was first used by NuMega people to allow
Symbol Loader to check if SoftICE was active or not (the code is located
inside nmtrans.dll).

' U0 ]2 X6 g9 S, J* w- {) t; @The way it works is very simple:
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
5 u8 @+ g6 m/ c' fWinNT) with the CreateFileA API.
# t+ Q+ w! g& |8 B+ @/ d9 b
Here is a sample (checking for 'SICE'):

' q% Y2 {4 f, u. d6 N! T- KBOOL IsSoftIce95Loaded()
4 o% p* ?! g; J. e) v/ n& U3 M{
+ o4 k" X: Z. J: P6 y   HANDLE hFile;  
   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
                      FILE_SHARE_READ | FILE_SHARE_WRITE,
                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
4 K5 N  S$ s* S  i" E# f   if( hFile != INVALID_HANDLE_VALUE )
   {
& G' q# }6 P/ ?+ o0 M$ `" d      CloseHandle(hFile);
      return TRUE;
7 W8 v  {" p* A3 o/ Z   }
   return FALSE;
4 R" E6 n: z; L9 o}
' P9 G( ?2 q6 {7 e
Although this trick calls the CreateFileA function, don't even expect to be
/ L( E7 F, L! v: Z% n" t! \% qable to intercept it by installing a IFS hook: it will not work, no way!
In fact, after the call to CreateFileA it will get through VWIN32 0x001F
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
and then browse the DDB list until it find the VxD and its DDB_Control_Proc
# l, q/ ?9 Y% T3 F$ i* F8 \  \. zfield.
In fact, its purpose is not to load/unload VxDs but only to send a
+ B& x! `# e8 S9 {$ E; R2 rW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
% W* E* ?( K2 @3 z( I- Pto the VxD Control_Dispatch proc (how the hell a shareware soft could try
to load/unload a non-dynamically loadable driver such as SoftICE ;-).
If the VxD is loaded, it will always clear eax and the Carry flag to allow
its handle to be opened and then, will be detected.
' N/ B+ |, C2 ]5 W% BYou can check that simply by hooking Winice.exe control proc entry point
while running MeltICE.

$ R9 E0 G/ v5 B+ s4 `
  00401067:  push      00402025    ; \\.\SICE
  0040106C:  call      CreateFileA
; l" \6 f% @- j3 A: G2 |9 ~  00401071:  cmp       eax,-001
  00401074:  je        00401091


/ j  g5 r! @7 n- x; v( ?, R- sThere could be hundreds of BPX you could use to detect this trick.
0 o3 m! D+ E: P  T! }+ s1 s-The most classical one is:
4 \, ?/ I( ~' u9 E- @  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||
' i! b- D$ J& O. p4 k# r- f    *(esp-&gt;4+4)=='NTIC'
. x/ y; C$ F! |3 B) h" K1 u
-The most exotic ones (could be very slooooow :-(
   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
     ;will break 3 times :-(
, \0 o+ P, o* I* ~7 r* l
-or (a bit) faster:
7 S  ~$ e$ _4 |4 _4 [# ^   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
- i) `( R; a1 @2 I
/ I: C) X. }! P8 u1 d7 E+ _! ~   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  
     ;will break 3 times :-(
8 X3 v& d9 q% n+ {
; ?7 k$ G# r0 g" e. A-Much faster:
$ j1 ]; F) Y) \7 g% h2 f. E   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'

5 [, ~% o2 s$ _& N; I7 ONote also that some programs (like AZPR3.00) use de old 16-bit _lopen
function to do the same job:
8 ?/ Z$ g) e% {/ O
   push    00                        ; OF_READ
   mov     eax,[00656634]            ; '\\.\SICE',0
   push    eax
   call    KERNEL32!_lopen
" M# I0 z' n' m, t   inc     eax
# z) e+ G7 ^! Y+ q9 E7 r   jnz     00650589                  ; detected
   push    00                        ; OF_READ
+ b) j/ D- t% S) V' Q$ Z2 a   mov     eax,[00656638]            ; '\\.\SICE'
' C0 i2 V; l3 Q& w" P5 U  r) T   push    eax
   call    KERNEL32!_lopen
   inc     eax
   jz      006505ae                  ; not detected


# {% U+ W# k4 j$ l__________________________________________________________________________
& @8 h* L& }  f" S3 v; f0 @
, |; q2 M; ^' \$ `7 gMethod 12
=========

% p0 M8 ?6 T: e5 G5 z+ xThis trick is similar to int41h/4fh Debugger installation check (code 05
&amp; 06) but very limited because it's only available for Win95/98 (not NT)
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.

1 F# w. |% Z8 r$ j   push  0000004fh         ; function 4fh
   push  002a002ah         ; high word specifies which VxD (VWIN32)
                           ; low word specifies which service
                             (VWIN32_Int41Dispatch)
, n/ b+ Q+ u4 r3 G. H0 S3 V   call  Kernel32!ORD_001  ; VxdCall
5 j$ p5 [. l& S   cmp   ax, 0f386h        ; magic number returned by system debuggers
   jz    SoftICE_detected

Here again, several ways to detect it:

5 K* S: f4 k+ O5 ?    BPINT 41 if ax==4f
1 E" H; E( M* S# T
! J/ B- V' `: x4 Q# J0 ~    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one

    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A
0 i3 h, g: J; X& J2 E7 }9 l( k2 X
) V8 @$ z' C+ `$ x8 H# K  Y9 M    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!

# q1 P7 G: P: e# d( @7 [+ e$ S__________________________________________________________________________
" j5 U: O+ p  J: Z
% b8 ?6 F: }/ O/ U4 H5 y7 hMethod 13
1 N  j# F# k' `+ z  X! @9 V=========

7 G* C& T, _; s5 ?Not a real method of detection, but a good way to know if SoftICE is
installed on a computer and to locate its installation directory.
It is used by few softs which access the following registry keys (usually #2) :

-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
  b* R! v2 F% [0 z2 a- Q\Uninstall\SoftICE
1 h% h. G0 O) C- n; q# X-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
5 T2 x7 l$ e7 f8 f  z4 ^6 J& r-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
\App Paths\Loader32.Exe
. v! p& ^# r- n
( c) _% V$ t& z2 ]- m) h& X. }- y
Note that some nasty apps could then erase all files from SoftICE directory
(I faced that once :-(
  G; S  C) h; {+ @9 i9 C
- D  y2 H2 O7 XUseful breakpoint to detect it:
9 O$ v# k, e5 B. l. r' `$ s, d+ ?
) i7 t: d5 Q9 {' {/ C3 T6 U3 A     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'

__________________________________________________________________________
% R  i2 d* m) }, K! M6 o; m+ z- Z

Method 14
=========

A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
' Y. ^: ~- s$ C; g9 vis to determines whether a debugger is running on your system (ring0 only).

   VMMCall Test_Debug_Installed
   je      not_installed
1 s: c( \- t. B* l  B$ V
This service just checks a flag.
</PRE></TD></TR></TBODY></TABLE>