About anti-SoftICE tricks

<TABLE width=500>
<TBODY>
$ R5 N+ n. G. w8 P8 D2 n( [  X/ B<TR>
<TD><PRE>Method 01
=========

2 ]: z4 n/ A8 o% EThis method of detection of SoftICE (as well as the following one) is
' z. i) x1 i/ c4 P# I7 Aused by the majority of packers/encryptors found on Internet.
It seeks the signature of BoundsChecker in SoftICE

    mov     ebp, 04243484Bh        ; 'BCHK'
' b. z! h1 }+ o: X+ L5 h$ K    mov     ax, 04h
    int     3      
2 F. ]5 F) a) n: ?( h    cmp     al,4
    jnz     SoftICE_Detected

4 M9 C! h. \! B; J2 D$ D___________________________________________________________________________

& O% c6 s' ?$ G* K: G/ E+ N2 YMethod 02
=========
' k/ C- s$ u6 q4 r  l; ?
% o4 _' t' O* s  g8 V' }, LStill a method very much used (perhaps the most frequent one).  It is used
! E# {: p$ K$ x4 H- H( pto get SoftICE 'Back Door commands' which gives infos on Breakpoints,
or execute SoftICE commands...
( L  `9 ^1 I  ?* DIt is also used to crash SoftICE and to force it to execute any commands
/ B+ Q" }. E) J8 K! \+ |& H# K  f(HBOOT...) :-((  
$ Y2 F: p: ~. _. T' i5 u
8 w6 z( @& s! y; n- h: bHere is a quick description:
-AX = 0910h   (Display string in SIce windows)
3 b) e' V2 Y$ B4 s& v' N-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)
-AX = 0912h   (Get breakpoint infos)
-AX = 0913h   (Set Sice breakpoints)
-AX = 0914h   (Remove SIce breakoints)
  V. _5 m+ |( t/ o, U8 I5 ?" w  l
7 l2 V) E" k1 JEach time you'll meet this trick, you'll see:
4 j4 R" n/ w  q+ f3 Q4 i) Z-SI = 4647h
; h/ n, ?- t; P. D4 F1 c' R-DI = 4A4Dh
Which are the 'magic values' used by SoftIce.
- X# @& H* \, `8 Q4 m( mFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.

/ l. U7 `( [) m( ^( [/ rHere is one example from the file "Haspinst.exe" which is the dongle HASP
8 r$ ^3 L1 i* i* d0 EEnvelope utility use to protect DOS applications:

1 }3 w$ c( J% `; @% a0 D1 V/ W& f
: }+ D. I+ W$ G4 X. k/ I/ n4C19:0095   MOV    AX,0911  ; execute command.
" N. w' e( S, Z; `" p$ i$ m+ t- g4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).
4C19:009A   MOV    SI,4647  ; 1st magic value.
4C19:009D   MOV    DI,4A4D  ; 2nd magic value.
  U, k% r" N1 \) J# _* n4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute
4C19:00A4   INC    CX
4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute
) b* U9 Q: A: h; ~0 k4C19:00A8   JB     0095     ; 6 different commands.
4 b* W8 b( }' `+ }; m4C19:00AA   JMP    0002     ; Bad_Guy jmp back.
- J* }/ }: G6 n+ I9 x/ z4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)

The program will execute 6 different SIce commands located at ds:dx, which
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.

* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
1 _8 z; o; B# G___________________________________________________________________________


Method 03
=========
5 |$ D! \- J( ]
Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
(API Get entry point)
        

    xor     di,di
    mov     es,di
    mov     ax, 1684h      
* G( S# V/ k% X    mov     bx, 0202h       ; VxD ID of winice
; A5 P7 g4 N, J+ n5 F    int     2Fh
    mov     ax, es          ; ES:DI -&gt; VxD API entry point
    add     ax, di
    test    ax,ax
# a0 E# v1 T: F# T6 I# x    jnz     SoftICE_Detected

7 u  c- s! \2 w) i1 ]: W___________________________________________________________________________
1 c5 n+ L5 K, u: W
$ d) X5 n3 Z4 u5 tMethod 04
& ~/ o5 ^& P7 m  u( ?5 z=========
* ~4 g5 K, _3 i% p
Method identical to the preceding one except that it seeks the ID of SoftICE
GFX VxD.

# M! Q+ b7 L& {' e    xor     di,di
8 m# V* W) H* @6 Y2 J7 H    mov     es,di
    mov     ax, 1684h      
, W$ e; x9 ^9 {$ W* G; F    mov     bx, 7a5Fh       ; VxD ID of SIWVID
    int     2fh
& n5 `$ h, ~2 Q/ v. U2 M; f6 Y9 D    mov     ax, es          ; ES:DI -&gt; VxD API entry point
    add     ax, di
    test    ax,ax
! \3 o$ Y  D2 W* k! N; f2 k7 h5 B    jnz     SoftICE_Detected

__________________________________________________________________________
% p) ]3 t/ X( a0 O5 b: W% R
+ }' `4 p: d8 ~8 x6 Z% h
; d) k& r6 a3 F; aMethod 05
=========

3 B9 Y: [4 f& \5 kMethod seeking the 'magic number' 0F386h returned (in ax) by all system
2 Q2 b/ M2 w+ Z+ p- G$ e2 r1 t! ~debugger. It calls the int 41h, function 4Fh.
There are several alternatives.  

$ n1 g4 D# ~' a9 ~" G  K$ w2 |# pThe following one is the simplest:
& u5 K6 x7 r0 I' g2 Y9 R
4 B8 }  X3 [! g( o, @# _1 v* U    mov     ax,4fh
    int     41h
    cmp     ax, 0F386
    jz      SoftICE_detected
7 m! |* S8 ~& @- h- C  [

5 p" }* r6 d% h, a. d% LNext method as well as the following one are 2 examples from Stone's
"stn-wid.zip" (www.cracking.net):

    mov     bx, cs
    lea     dx, int41handler2
; ?: }' \" e) [1 [! E    xchg    dx, es:[41h*4]
" z+ D1 }  b0 O5 r$ Z    xchg    bx, es:[41h*4+2]
    mov     ax,4fh
$ P; a/ Z+ a- Q, c/ D- l) l/ W- E    int     41h
    xchg    dx, es:[41h*4]
+ H$ N: a' |( _- L# @7 ^    xchg    bx, es:[41h*4+2]
    cmp     ax, 0f386h
6 h) l! k4 A- x: B4 r# T    jz      SoftICE_detected

int41handler2 PROC
    iret
  b# C7 H3 Q* b5 [6 mint41handler2 ENDP


! g  e* C( }1 b1 J% N_________________________________________________________________________
  h& ~) H2 Z! a; z9 u  N

Method 06
=========

' N! K8 G. C3 w% L0 L
/ ^! n' R, ]. m. }( [2nd method similar to the preceding one but more difficult to detect:
( R. c3 G, A; G3 R8 }8 R4 x2 D
% X0 {7 ]  g% S3 j$ I( E
) |5 L/ r0 E) b, ]. j6 b9 pint41handler PROC
    mov     cl,al
    iret
int41handler ENDP

3 f! u- J$ Q2 T% C& }
: @/ F+ H& A/ F* U7 {9 u7 j    xor     ax,ax
9 d' p/ W4 s/ H, x$ k    mov     es,ax
* Q4 }8 K  j* E: _0 }8 |    mov     bx, cs
    lea     dx, int41handler
    xchg    dx, es:[41h*4]
    xchg    bx, es:[41h*4+2]
    in      al, 40h
    xor     cx,cx
    int     41h
    xchg    dx, es:[41h*4]
    xchg    bx, es:[41h*4+2]
    cmp     cl,al
+ Q" ~4 y8 W0 p4 d    jnz     SoftICE_detected

4 S+ {/ a) g! ]5 a* S4 m, G_________________________________________________________________________

Method 07
  `! `, |/ Q8 J. ]+ u3 v=========

Method of detection of the WinICE handler in the int68h (V86)

- \7 u' I* t$ T' `  m8 d    mov     ah,43h
    int     68h
* M3 j# q0 ^* F* G# q+ n; C! l    cmp     ax,0F386h
    jz      SoftICE_Detected
7 L: l& W' q- u( e( T5 _6 D

=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
   app like this:

- G5 B) q2 g% f! v+ C   BPX exec_int if ax==68
   (function called is located at byte ptr [ebp+1Dh] and client eip is
   located at [ebp+48h] for 32Bit apps)
4 v4 E, @4 S+ K# d__________________________________________________________________________
8 _% e% A3 }5 Z9 H4 }

Method 08
3 u. w  G2 B3 p4 i=========

It is not a method of detection of SoftICE but a possibility to crash the
system by intercepting int 01h and int 03h and redirecting them to another
2 _2 k9 u4 n4 zroutine.
9 M) h+ }$ B  F9 VIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
to the new routine to execute (hangs computer...)

    mov     ah, 25h
4 v6 L! g/ Q' y4 |* ~2 l    mov     al, Int_Number (01h or 03h)
    mov     dx, offset New_Int_Routine
7 h; ~  w  x! D1 w+ G: l/ S    int     21h
0 c2 |, u( x% T% Y: i* S* t+ C4 e
2 O7 K: H% M& h7 M__________________________________________________________________________
0 O, W$ j2 c9 j& f
Method 09
=========

This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
performed in ring0 (VxD or a ring3 app using the VxdCall).
The Get_DDB service is used to determine whether or not a VxD is installed
for the specified device and returns a Device Description Block (in ecx) for
8 [; o( I3 f1 V! ~8 G8 Dthat device if it is installed.

   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID
- S: p0 A8 L4 ]& x$ l+ C  C   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
, l% p4 \3 v- `, c, T+ c+ N5 T$ ?6 T   VMMCall Get_DDB
. |, }: N& F$ G9 I7 U   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed

Note as well that you can easily detect this method with SoftICE:
   bpx Get_DDB if ax==0202 || ax==7a5fh
4 F2 p! U# H& `) Q& U6 Q; F+ W# M
7 P( ]' d/ T% `; ~6 v__________________________________________________________________________

$ Z4 w, M3 n7 _' p: m9 S0 g8 Q$ v3 @Method 10
=========
* l0 j  z6 e# Y' U, c9 ^4 }* M
=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with
  SoftICE while the option is enable!!

( ]3 A3 G) e1 C. j1 C$ AThis trick is very efficient:
' o6 M/ r' }1 ]1 M$ ?1 u: P3 v5 Jby checking the Debug Registers, you can detect if SoftICE is loaded
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
there are some memory breakpoints set (dr0 to dr3) simply by reading their
7 O; Y* N* n" t$ c: y) Y- x% ]value (in ring0 only). Values can be manipulated and or changed as well
6 l1 x. d, d* g4 \(clearing BPMs for instance)
! \% A5 |- c! Q& `1 ]  a7 F' r8 v8 H: S
. n( _9 u; k$ r' a, R% F__________________________________________________________________________
" e7 L9 k* T3 o& R8 Q* h
Method 11
=========
% O, `7 U9 Z+ g8 e# S2 T$ L$ w
0 u- }8 I1 j/ l( n: Z  I9 FThis method is most known as 'MeltICE' because it has been freely distributed
via www.winfiles.com. However it was first used by NuMega people to allow
) U  s$ B3 @+ N3 J7 z- fSymbol Loader to check if SoftICE was active or not (the code is located
inside nmtrans.dll).

The way it works is very simple:
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
WinNT) with the CreateFileA API.
/ c, x$ q7 T# D. e% P) [
Here is a sample (checking for 'SICE'):
( p  X- o+ o( |& a( R
5 E, [2 ~& q( q) T2 mBOOL IsSoftIce95Loaded()
{
( s4 v) a) ]0 G   HANDLE hFile;  
; l# I- ?. k4 k7 H5 r( \& A   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
                      FILE_SHARE_READ | FILE_SHARE_WRITE,
9 p0 M7 l' H9 O7 F4 C% T                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
; e/ _8 ]! O, q9 e   if( hFile != INVALID_HANDLE_VALUE )
9 ]/ n3 e$ [( J9 V9 c   {
9 N0 f+ w; V2 h" L) Y      CloseHandle(hFile);
! b0 b; }; ^- l6 r) f9 r, h3 K$ {      return TRUE;
, [) D& ^4 X% V* }; R. A+ c   }
' {: Z0 X5 z4 o; a1 J& t! F/ W   return FALSE;
}
4 N, T. p1 N& T3 q& }. b. `
  A1 V. f. a& C$ F; x7 P& uAlthough this trick calls the CreateFileA function, don't even expect to be
able to intercept it by installing a IFS hook: it will not work, no way!
- S3 p+ P# [% wIn fact, after the call to CreateFileA it will get through VWIN32 0x001F
4 l  W) V% i8 r4 p* Aservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
and then browse the DDB list until it find the VxD and its DDB_Control_Proc
field.
/ O7 q$ k3 r& N/ Y" W2 S7 o- rIn fact, its purpose is not to load/unload VxDs but only to send a
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
# v4 V1 ]5 S8 @% M5 S: R7 cto the VxD Control_Dispatch proc (how the hell a shareware soft could try
to load/unload a non-dynamically loadable driver such as SoftICE ;-).
If the VxD is loaded, it will always clear eax and the Carry flag to allow
6 V9 S+ X5 d1 `1 [its handle to be opened and then, will be detected.
2 B% Q$ E# j* A# W2 A% O' y' K+ v6 GYou can check that simply by hooking Winice.exe control proc entry point
while running MeltICE.
3 C) A7 X6 Q! y& _5 U

1 v% L9 f7 T+ `9 E3 u  00401067:  push      00402025    ; \\.\SICE
" m/ u1 ]& J, h* Y! S- i" _  0040106C:  call      CreateFileA
  00401071:  cmp       eax,-001
0 O0 B; R( N1 e4 Y  00401074:  je        00401091
( J7 b& C; v( t9 z0 L+ \; |' x+ Y
8 W7 ~" h, O% h" s3 x2 Q, ?. F) P
There could be hundreds of BPX you could use to detect this trick.
8 Z4 J2 I; X$ Q, x; u+ |-The most classical one is:
* a3 d2 f$ O" @8 Y- U' [; |  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||
    *(esp-&gt;4+4)=='NTIC'

/ q9 ?4 s1 B6 ?+ O. |-The most exotic ones (could be very slooooow :-(
   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
     ;will break 3 times :-(

$ [' s% g) j% B% s+ p; i+ {-or (a bit) faster:
, k1 n& s7 h' \   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
6 V  j/ v; l. p9 l& s
   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  
, _/ j9 c! g9 N) ^; c4 Y* `     ;will break 3 times :-(

: A" x* w# X8 ?+ Z2 D-Much faster:
   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'
4 Z7 j& Z/ h9 F
! t+ F3 Y" A: INote also that some programs (like AZPR3.00) use de old 16-bit _lopen
2 d/ l9 E9 J- Z" Xfunction to do the same job:

   push    00                        ; OF_READ
   mov     eax,[00656634]            ; '\\.\SICE',0
( j' G1 ?; p+ t: b   push    eax
$ c0 n7 `" r4 R1 ]% Z, o& L   call    KERNEL32!_lopen
   inc     eax
   jnz     00650589                  ; detected
0 b0 A# x' U! P6 J/ H2 g8 J   push    00                        ; OF_READ
( ?5 u- s$ a$ @( d+ O+ u   mov     eax,[00656638]            ; '\\.\SICE'
   push    eax
9 R! E# m. O6 t6 s0 \" z1 [0 w6 v   call    KERNEL32!_lopen
% \9 n* y6 [: |8 G3 H5 g   inc     eax
% T! t9 I; b9 W# S( p   jz      006505ae                  ; not detected
/ T& u- @! m% q- V% X1 Q5 k

, H: i3 ]0 _0 t" M- Z; P. h" R' C' A__________________________________________________________________________
- {& @$ e! y/ p+ }
8 J* _& I* t, ~' y4 A) qMethod 12
, R, ~, f9 L- [, |4 @/ p=========

This trick is similar to int41h/4fh Debugger installation check (code 05
&amp; 06) but very limited because it's only available for Win95/98 (not NT)
; Q+ w- q9 ~1 t2 ]& V* E) j# gas it uses the VxDCall backdoor. This detection was found in Bleem Demo.

3 p: P9 ^1 y2 v   push  0000004fh         ; function 4fh
   push  002a002ah         ; high word specifies which VxD (VWIN32)
                           ; low word specifies which service
- M3 J+ h* _' p6 f$ D/ o% i& O  s                             (VWIN32_Int41Dispatch)
   call  Kernel32!ORD_001  ; VxdCall
   cmp   ax, 0f386h        ; magic number returned by system debuggers
   jz    SoftICE_detected

4 _& D7 ?8 ?" g, g9 eHere again, several ways to detect it:

    BPINT 41 if ax==4f
8 O! R7 H" K8 F5 F2 H. }
" f( V" Y  X8 e: T" |5 j    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one
' z: U% Z' @4 f# R& j. i- t5 u2 m
    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A
7 [  v8 Z6 l- U
    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!
% u" t, Y' {* L# y/ T. c
, C$ T6 x4 h+ A) b) i% X__________________________________________________________________________

' P) J0 N' E% K/ iMethod 13
  x* J: Y" _' c=========

Not a real method of detection, but a good way to know if SoftICE is
/ L) `7 y* u/ r* }* j$ T" O* ?installed on a computer and to locate its installation directory.
It is used by few softs which access the following registry keys (usually #2) :

-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
\Uninstall\SoftICE
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
- s) ]. A# y( ^7 Q9 ^: C9 {-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
\App Paths\Loader32.Exe

/ C: u* d9 ?/ @7 Q5 m% Z' a. T
Note that some nasty apps could then erase all files from SoftICE directory
(I faced that once :-(

Useful breakpoint to detect it:

; c/ B; @8 h! A2 f; x6 ]' A* X     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'

# S! n! z( _$ u! ~__________________________________________________________________________

- b, }- Z, X0 T$ N2 T
Method 14
( k: M5 Y/ ~( U& f9 M3 x  z5 P; ^=========
; r' {1 P& v6 O6 q9 E# ^# z
% ]: z7 M) Q7 I4 e$ t9 HA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
- s! e+ u2 {$ i1 }3 |9 \is to determines whether a debugger is running on your system (ring0 only).
. ]! K8 y6 |+ Y4 u, b
   VMMCall Test_Debug_Installed
   je      not_installed

. P( g' [( Q  |, H8 C' x' f! ]This service just checks a flag.
</PRE></TD></TR></TBODY></TABLE>