About anti-SoftICE tricks

<TABLE width=500>
0 ]& K2 ?5 X  \5 c: n0 }2 h5 Y<TBODY>
  @5 H1 B/ P/ X5 O<TR>
<TD><PRE>Method 01
=========

This method of detection of SoftICE (as well as the following one) is
used by the majority of packers/encryptors found on Internet.
0 N) K5 `( {, b0 N' BIt seeks the signature of BoundsChecker in SoftICE
, J' X7 L: o! ^6 {0 r1 f& P
    mov     ebp, 04243484Bh        ; 'BCHK'
    mov     ax, 04h
6 X% Q. T; w* C3 W+ m- Z  q) I! S# d    int     3      
    cmp     al,4
, c0 a0 h& s5 x# l    jnz     SoftICE_Detected

6 E  q. A7 f+ N, m8 e4 d___________________________________________________________________________
8 j8 R! F$ `, x& B* A- c9 H* f% i
Method 02
=========

2 |' K$ E, o4 r; x# j% H6 ~3 U! CStill a method very much used (perhaps the most frequent one).  It is used
  \/ `* N$ n1 @6 R. G/ v# @to get SoftICE 'Back Door commands' which gives infos on Breakpoints,
: I- t! w+ n( }8 N" H$ Sor execute SoftICE commands...
It is also used to crash SoftICE and to force it to execute any commands
; c; _' M6 r% u3 p% p5 x(HBOOT...) :-((  
) h' p& W( u: o' [" n- S
6 x4 k* {6 K) k* Y5 H( j+ e: `Here is a quick description:
-AX = 0910h   (Display string in SIce windows)
7 J5 _1 S7 Q, X, y) ]. Q2 [1 ~3 _-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)
-AX = 0912h   (Get breakpoint infos)
-AX = 0913h   (Set Sice breakpoints)
-AX = 0914h   (Remove SIce breakoints)

Each time you'll meet this trick, you'll see:
-SI = 4647h
9 E9 V% ~" Q2 h& x-DI = 4A4Dh
Which are the 'magic values' used by SoftIce.
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.
% ]" d1 N( b# v+ d$ S
Here is one example from the file "Haspinst.exe" which is the dongle HASP
% _4 j/ J" M0 O4 q7 v' ?Envelope utility use to protect DOS applications:


4C19:0095   MOV    AX,0911  ; execute command.
4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).
2 m, H+ r6 |2 F8 h- K/ e, x4C19:009A   MOV    SI,4647  ; 1st magic value.
4C19:009D   MOV    DI,4A4D  ; 2nd magic value.
4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute
4C19:00A4   INC    CX
0 j+ C! V6 ]) [4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute
  X; ]4 B: d2 h+ G, y5 ]& |0 U4C19:00A8   JB     0095     ; 6 different commands.
2 {. n$ Y# r: Z- f7 v( y( Z: i) M4C19:00AA   JMP    0002     ; Bad_Guy jmp back.
4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)

$ o. e6 z2 Q6 Y5 t$ @5 K% r: RThe program will execute 6 different SIce commands located at ds:dx, which
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
* S8 o3 G* c& d% I8 w0 ?
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
4 A' i/ D; u' Z7 Z5 d___________________________________________________________________________


Method 03
7 F' d  @  p- S0 m0 |' H2 m=========

4 H& @8 U1 }1 l) y( U& c$ O$ FLess used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
2 J3 X0 W: S9 z+ y# E(API Get entry point)
        
# F4 Z, O6 |& w: ~% J4 B  H
' ]* I+ A9 X( ~2 V4 H    xor     di,di
  ]+ a7 g8 u# ?+ t0 g2 x1 i" z    mov     es,di
    mov     ax, 1684h      
0 W& S* o$ w8 e! P$ P1 g2 [    mov     bx, 0202h       ; VxD ID of winice
    int     2Fh
    mov     ax, es          ; ES:DI -&gt; VxD API entry point
    add     ax, di
. u, q) C# {- n    test    ax,ax
. X9 c! b! k+ N2 q& \    jnz     SoftICE_Detected
, {# {: o4 s5 E* ]* g  F
___________________________________________________________________________
2 O' \: {$ E' w4 k/ t& T. m
" d, Y0 W1 t7 w2 G) kMethod 04
=========
4 C9 n  g9 }  e; z, U0 r0 }1 E2 ?
Method identical to the preceding one except that it seeks the ID of SoftICE
GFX VxD.
# F9 V' P+ t' G2 I; l
9 {, l, w$ s; @3 Y    xor     di,di
    mov     es,di
& u. v0 f" `/ ]! P0 P* B    mov     ax, 1684h      
5 I9 u# S0 {1 n& W    mov     bx, 7a5Fh       ; VxD ID of SIWVID
  y+ |+ k3 H: W; K  @2 M( Q' |. g    int     2fh
    mov     ax, es          ; ES:DI -&gt; VxD API entry point
    add     ax, di
    test    ax,ax
    jnz     SoftICE_Detected

5 L3 x; g; h( D7 k, x1 Q__________________________________________________________________________


6 r; K6 \& h! q* m! K, h' e! z# g: gMethod 05
=========
% r$ _6 n5 Z# k$ l7 x6 v5 m" [
Method seeking the 'magic number' 0F386h returned (in ax) by all system
debugger. It calls the int 41h, function 4Fh.
, K  r! k- \* r- RThere are several alternatives.  

) f# A2 d8 ?! U% r9 N6 R5 G5 FThe following one is the simplest:

    mov     ax,4fh
1 i) O5 ^( k* @" l) W    int     41h
% p; ~/ B+ p& j9 K    cmp     ax, 0F386
6 g, P. L! }% r8 u3 j2 T    jz      SoftICE_detected
$ c/ U& [1 d1 }5 M
; u7 X) Z% l. y3 q& i" k( c
Next method as well as the following one are 2 examples from Stone's
"stn-wid.zip" (www.cracking.net):
$ t2 F) N/ ]$ k, j% r9 ?; ^
    mov     bx, cs
    lea     dx, int41handler2
0 G7 j: N  H! _9 j: Y    xchg    dx, es:[41h*4]
# ~" Z( }4 C5 G% k9 v0 H/ g    xchg    bx, es:[41h*4+2]
. F/ l# o3 ?' D4 @$ _' k    mov     ax,4fh
    int     41h
    xchg    dx, es:[41h*4]
    xchg    bx, es:[41h*4+2]
    cmp     ax, 0f386h
    jz      SoftICE_detected

int41handler2 PROC
2 `1 U9 i. W, V; @% X' e$ D6 x    iret
; U2 E7 \3 E: V0 K1 Mint41handler2 ENDP


_________________________________________________________________________
' p8 @; g1 V  D6 v2 N+ P

Method 06
: \1 [9 @  V& k8 Z: M=========
6 A$ s! \" L8 Q+ v# w, H
% N! p# ], c% R. H
" p; _0 H$ X  |2nd method similar to the preceding one but more difficult to detect:

% h0 s0 z! O# d
int41handler PROC
    mov     cl,al
+ N1 M( [0 V% U# C* x$ N& s# d    iret
" Y: n0 g9 W+ S$ z/ U  W$ gint41handler ENDP
: }" s+ d* C4 r) b

    xor     ax,ax
# X# L1 M5 `2 j& L    mov     es,ax
    mov     bx, cs
* p9 {% P4 ?4 T    lea     dx, int41handler
    xchg    dx, es:[41h*4]
, F( ^; c- z- k! L" m    xchg    bx, es:[41h*4+2]
; C$ l9 K- o$ H  K+ s& D* j' k    in      al, 40h
3 |& i% K! T2 i7 D4 ^6 z4 {3 D    xor     cx,cx
    int     41h
% V( c. J+ I1 S+ j- N  Z+ @    xchg    dx, es:[41h*4]
6 H; V) [) X! v% C7 g, I    xchg    bx, es:[41h*4+2]
/ p2 I' S9 b1 }) M    cmp     cl,al
: Z2 [' T9 O! [; j% P    jnz     SoftICE_detected

_________________________________________________________________________

Method 07
=========
. |3 P- m' B: @
Method of detection of the WinICE handler in the int68h (V86)
. D: h7 K6 H8 _% J
    mov     ah,43h
    int     68h
    cmp     ax,0F386h
    jz      SoftICE_Detected

0 E. M- k; F, y& X  l
=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
   app like this:

   BPX exec_int if ax==68
6 ?" S: W5 j, t. f/ `# ]/ y7 |   (function called is located at byte ptr [ebp+1Dh] and client eip is
6 d5 c0 m7 ?3 i   located at [ebp+48h] for 32Bit apps)
__________________________________________________________________________
! J' }9 {2 h$ `4 P
- H- H/ `6 H" r. X5 Y' r6 I
Method 08
6 R! T( H3 }5 W3 v- G* X=========

# W3 }1 H2 Q# m% yIt is not a method of detection of SoftICE but a possibility to crash the
% ]- Y  Y# [9 L3 b) dsystem by intercepting int 01h and int 03h and redirecting them to another
  d" ~! v! i7 {$ ^" o! h1 a5 ^% Yroutine.
! s* K  ?+ d: z$ s6 ~2 X" H5 wIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
$ W) D  x" `2 v; S* `5 Q( r# sto the new routine to execute (hangs computer...)
; L) k4 s7 \1 ^5 U
    mov     ah, 25h
    mov     al, Int_Number (01h or 03h)
" X4 c  B7 |& w2 l+ w- l    mov     dx, offset New_Int_Routine
    int     21h

__________________________________________________________________________

Method 09
=========

This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
) t1 f& \# U8 r, Iperformed in ring0 (VxD or a ring3 app using the VxdCall).
% V. E1 C) h& ]4 NThe Get_DDB service is used to determine whether or not a VxD is installed
for the specified device and returns a Device Description Block (in ecx) for
3 K, ]/ |% }: C4 Z  J0 ]0 V; `( nthat device if it is installed.
9 g* _# w# c  _: y. r3 x
   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID
, U, d! I% U3 u* {, k2 b, c( r   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
   VMMCall Get_DDB
6 Q8 v7 L* |! A, t8 b8 o$ a$ O   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed

2 k. W( S3 M9 E! `! rNote as well that you can easily detect this method with SoftICE:
  V6 O; e0 E# m8 G5 [0 [3 m   bpx Get_DDB if ax==0202 || ax==7a5fh
% ^! W+ W+ ?" `+ o7 n0 g+ b
__________________________________________________________________________

+ d. M& p3 o+ |2 W2 K' k3 j& R' B& qMethod 10
( w, q; @5 _* Z+ h. f9 V=========
( b  W- {* @: V% N4 d! K) e
) X2 _7 [: Y0 w4 o* g=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with
( l$ p, c. g, o$ {$ y  SoftICE while the option is enable!!

8 h& C  ^4 |( S$ B8 qThis trick is very efficient:
by checking the Debug Registers, you can detect if SoftICE is loaded
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
there are some memory breakpoints set (dr0 to dr3) simply by reading their
6 E0 G& y  }8 o% ^( s3 |value (in ring0 only). Values can be manipulated and or changed as well
(clearing BPMs for instance)

__________________________________________________________________________
# f0 q6 q# j4 h& N( p0 L: r; X
# m$ F# f' g' Y+ z% c; nMethod 11
" B3 k# `3 W/ d=========
' e8 Z* ?9 B6 Z' U3 l3 U
9 ?, g& M  i- {- }7 r% LThis method is most known as 'MeltICE' because it has been freely distributed
* n; V- b0 ]( C8 lvia www.winfiles.com. However it was first used by NuMega people to allow
3 a! d, m% w; L$ K. NSymbol Loader to check if SoftICE was active or not (the code is located
+ n+ a7 ~" \8 N* r+ l! b: jinside nmtrans.dll).
7 ^2 }& j1 j/ ?/ Q* y
9 g  @% r" @5 h) YThe way it works is very simple:
5 U3 o6 G0 f7 u7 LIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
4 e2 h+ \; W4 m4 L, y. g$ i: D# b# l- rWinNT) with the CreateFileA API.

, l9 \% A6 e* r$ HHere is a sample (checking for 'SICE'):
& F1 z  _6 G* v
BOOL IsSoftIce95Loaded()
9 t3 C5 b) h2 _! |{
4 F$ u" n. H0 C' g# w. }& a   HANDLE hFile;  
   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
                      FILE_SHARE_READ | FILE_SHARE_WRITE,
- ~8 r! F  l0 h. a                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
   if( hFile != INVALID_HANDLE_VALUE )
% b# n  y2 N! m   {
7 o( H# A' j5 @; S$ b% r      CloseHandle(hFile);
, [! J1 C' E% N3 |7 K8 t) t7 @      return TRUE;
! E- ]$ k, y3 I& {. v, \   }
   return FALSE;
7 X& s0 J3 E. o6 y& g- [+ w}

Although this trick calls the CreateFileA function, don't even expect to be
able to intercept it by installing a IFS hook: it will not work, no way!
4 O* M# U9 W0 W# o" B5 L/ sIn fact, after the call to CreateFileA it will get through VWIN32 0x001F
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
and then browse the DDB list until it find the VxD and its DDB_Control_Proc
6 v$ J4 H  I! O. W  R3 [field.
In fact, its purpose is not to load/unload VxDs but only to send a
' r$ f, w: r7 e4 }- i0 ~W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
: }% h! q) z! u- P0 Ato the VxD Control_Dispatch proc (how the hell a shareware soft could try
to load/unload a non-dynamically loadable driver such as SoftICE ;-).
3 @3 B: V; z& }" u- C! iIf the VxD is loaded, it will always clear eax and the Carry flag to allow
; W( b7 V. E" x; t3 eits handle to be opened and then, will be detected.
: \0 K9 x3 ?" s4 B- }$ j: @! fYou can check that simply by hooking Winice.exe control proc entry point
while running MeltICE.

  V# t8 R3 p$ n! Q' o' s/ E. q, T7 p; P
9 }. w* P2 Z. }3 l  00401067:  push      00402025    ; \\.\SICE
  0040106C:  call      CreateFileA
  00401071:  cmp       eax,-001
5 ?. W8 Y# t. H: L  00401074:  je        00401091

1 ]5 c; R6 D# v  q! H$ Z
There could be hundreds of BPX you could use to detect this trick.
-The most classical one is:
" N; X+ E5 _; O  U2 M7 Q  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||
) M# E/ B# F9 Z. V  ]    *(esp-&gt;4+4)=='NTIC'

$ C- J" a3 R; @; _- a-The most exotic ones (could be very slooooow :-(
   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
     ;will break 3 times :-(

-or (a bit) faster:
' l0 T! w1 I. A9 C! W. @, Y! P   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
1 f% G& I  p+ X$ G% u4 M
; ^( f: T7 H0 b" v. F5 \* m   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  
     ;will break 3 times :-(
: {, W- @4 \6 f/ j; T/ r
-Much faster:
   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'

+ X5 ]6 _/ u7 K, x' ONote also that some programs (like AZPR3.00) use de old 16-bit _lopen
function to do the same job:

, s, ^4 s  |8 x   push    00                        ; OF_READ
   mov     eax,[00656634]            ; '\\.\SICE',0
. @# L" _2 a1 u' x. |4 y- P, Z   push    eax
; E: V+ l1 n& s% Y, ~. d' q   call    KERNEL32!_lopen
   inc     eax
" x# ~+ s9 g$ B  T4 Q4 f- W3 Q   jnz     00650589                  ; detected
   push    00                        ; OF_READ
6 V) r( m$ W2 v& a0 t   mov     eax,[00656638]            ; '\\.\SICE'
6 ?/ L: D+ d0 X/ Q   push    eax
# L! O" R4 Z( W! v4 q   call    KERNEL32!_lopen
   inc     eax
   jz      006505ae                  ; not detected
3 H5 R0 ?* Z$ j5 B3 t! C  x
; m/ p' {5 t! w' U, z+ |
# Q$ U0 _$ |: {% u; j" Z__________________________________________________________________________
' y7 x8 |* G& ?
Method 12
=========

This trick is similar to int41h/4fh Debugger installation check (code 05
) x& p1 N/ z2 A0 a: @0 a; ]&amp; 06) but very limited because it's only available for Win95/98 (not NT)
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.
# Y1 o( d- b7 Q3 r! |1 t
   push  0000004fh         ; function 4fh
   push  002a002ah         ; high word specifies which VxD (VWIN32)
                           ; low word specifies which service
0 c: n7 E" @1 Y9 t% }$ X- V% m                             (VWIN32_Int41Dispatch)
   call  Kernel32!ORD_001  ; VxdCall
" e1 h4 B4 @" }, `   cmp   ax, 0f386h        ; magic number returned by system debuggers
$ {- e4 k: [4 L2 [) u" u, o   jz    SoftICE_detected

Here again, several ways to detect it:
; V8 j! u; E) T) l7 P' ^, A8 R. p, Q
    BPINT 41 if ax==4f

    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one
5 ~. x. ]" ?2 O# Q: {5 d
' _1 y- O. j: `    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A

! l# }6 [; m+ L  C& z    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!
/ f8 ~0 O# U2 j! q% o; o5 o
__________________________________________________________________________

6 @/ {( |" n2 W- k, ]Method 13
- c" _. p; z/ a, d=========

9 Z4 B' I/ ^2 u6 O  rNot a real method of detection, but a good way to know if SoftICE is
installed on a computer and to locate its installation directory.
It is used by few softs which access the following registry keys (usually #2) :
  D, {% R9 S( R- c
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
\Uninstall\SoftICE
' H7 y$ R+ r: S4 X4 H-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
\App Paths\Loader32.Exe
6 F8 u' K. k( n7 d; q

Note that some nasty apps could then erase all files from SoftICE directory
6 r- q7 A1 v' s  @(I faced that once :-(

  f' p% C- s$ z: S' J8 vUseful breakpoint to detect it:
" x6 \5 z& g( l; G; c
     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'
" z1 g& B8 u; M7 i& R
__________________________________________________________________________

5 e+ J4 Z: j* p& B
7 R: P) [  `/ N. I5 OMethod 14
=========

A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
, h5 R* i0 G# H2 r  N0 Bis to determines whether a debugger is running on your system (ring0 only).

   VMMCall Test_Debug_Installed
   je      not_installed
/ \8 {! c' u5 q0 c  e; _1 Q
This service just checks a flag.
</PRE></TD></TR></TBODY></TABLE>