About anti-SoftICE tricks

<TABLE width=500>
. I7 [7 H) B3 c% L# F5 P* E<TBODY>
<TR>
" |3 a" b/ X$ G# `! ]<TD><PRE>Method 01
=========

This method of detection of SoftICE (as well as the following one) is
used by the majority of packers/encryptors found on Internet.
It seeks the signature of BoundsChecker in SoftICE

    mov     ebp, 04243484Bh        ; 'BCHK'
    mov     ax, 04h
    int     3      
+ ^2 x1 Z7 K8 l    cmp     al,4
    jnz     SoftICE_Detected

___________________________________________________________________________

3 O' l! ~9 k$ S9 R4 KMethod 02
=========

Still a method very much used (perhaps the most frequent one).  It is used
; o$ \4 @0 m% [1 f; hto get SoftICE 'Back Door commands' which gives infos on Breakpoints,
or execute SoftICE commands...
: ~4 `4 S! K% E" G( K- C1 eIt is also used to crash SoftICE and to force it to execute any commands
(HBOOT...) :-((  
7 R& C: I+ D5 S2 `: S* f& u- J5 C
/ G8 b# D" |1 s2 EHere is a quick description:
" I" T9 x+ |7 |' Y& S$ \-AX = 0910h   (Display string in SIce windows)
-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)
-AX = 0912h   (Get breakpoint infos)
-AX = 0913h   (Set Sice breakpoints)
' V# y9 E$ y, B/ p: B+ X+ q  c-AX = 0914h   (Remove SIce breakoints)

Each time you'll meet this trick, you'll see:
-SI = 4647h
-DI = 4A4Dh
6 M/ \2 O* g0 x  rWhich are the 'magic values' used by SoftIce.
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.
/ x* g  W# [3 U- x
Here is one example from the file "Haspinst.exe" which is the dongle HASP
Envelope utility use to protect DOS applications:


4C19:0095   MOV    AX,0911  ; execute command.
4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).
4C19:009A   MOV    SI,4647  ; 1st magic value.
6 Y9 c$ W: F0 e  h, d4C19:009D   MOV    DI,4A4D  ; 2nd magic value.
6 K1 P, P5 e0 [/ P; e: L$ y4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
9 A7 `/ V; D9 v3 O: X5 x( `8 p4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute
- A0 X5 L3 k! o* S9 Q9 g4C19:00A4   INC    CX
8 |$ {( S/ s/ Y$ u4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute
4C19:00A8   JB     0095     ; 6 different commands.
4C19:00AA   JMP    0002     ; Bad_Guy jmp back.
4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)

. S8 T/ c! U& {" D1 KThe program will execute 6 different SIce commands located at ds:dx, which
/ o8 K, G$ k7 U! Q. a* kare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
' @2 l$ p2 Y3 V: @
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
* S8 `3 _# G  @" A4 A___________________________________________________________________________


Method 03
=========
( \; u, L# i3 {" h) {) u' M: L6 V
' W. V7 l2 X+ u8 m  P' QLess used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
(API Get entry point)
        
# {9 f; \9 Y8 d: S9 n& i
    xor     di,di
    mov     es,di
    mov     ax, 1684h      
) r- R+ Q$ s; ?    mov     bx, 0202h       ; VxD ID of winice
    int     2Fh
    mov     ax, es          ; ES:DI -&gt; VxD API entry point
    add     ax, di
+ `/ g" {1 k/ Q    test    ax,ax
    jnz     SoftICE_Detected

' Z  \% f$ t* F. w1 M/ u! w* A___________________________________________________________________________

; g# p* `) R" m* g- b# j$ k+ a6 wMethod 04
=========
+ v( E# @3 k5 }1 k
Method identical to the preceding one except that it seeks the ID of SoftICE
' W7 Z, v  d* g. Z# d) `GFX VxD.
3 n5 \9 U9 B6 ^* I, \# k
    xor     di,di
    mov     es,di
    mov     ax, 1684h      
    mov     bx, 7a5Fh       ; VxD ID of SIWVID
4 |0 ~* d( s4 i5 ]$ H    int     2fh
    mov     ax, es          ; ES:DI -&gt; VxD API entry point
    add     ax, di
' G) K. [# V6 c4 f4 F& `    test    ax,ax
3 u& W) }; E# T    jnz     SoftICE_Detected
7 a6 x( g6 c- E' S
2 \6 ]6 k( v* ~  t: m6 z8 R% ]% L__________________________________________________________________________


3 Y0 s. g& E+ a+ N3 t7 R4 @/ h6 mMethod 05
=========

; m' d! \- }* DMethod seeking the 'magic number' 0F386h returned (in ax) by all system
+ o' [, F( A  q9 c: P9 |# Zdebugger. It calls the int 41h, function 4Fh.
+ p+ [7 p4 ^! l& xThere are several alternatives.  
' @- D" z$ W1 Y1 f: x# ?
: u* X+ v1 C& |$ bThe following one is the simplest:

, {* r: ?* l. R( a0 h    mov     ax,4fh
    int     41h
    cmp     ax, 0F386
    jz      SoftICE_detected
4 D, u1 }' G% |* M' h9 S& c
6 E$ V' ~4 F  j! t9 z
  |& w5 H3 m$ B) f+ X7 A6 W, cNext method as well as the following one are 2 examples from Stone's
"stn-wid.zip" (www.cracking.net):

    mov     bx, cs
8 a" K  H$ s. E! r) j    lea     dx, int41handler2
    xchg    dx, es:[41h*4]
    xchg    bx, es:[41h*4+2]
; D% s" O* T" c2 |' O( [% T5 G    mov     ax,4fh
9 ]6 ^; O2 _6 G. O8 `8 Y    int     41h
, X3 _9 a9 M% W    xchg    dx, es:[41h*4]
$ P6 q9 m  K) J$ y- E' L- h2 ~    xchg    bx, es:[41h*4+2]
    cmp     ax, 0f386h
    jz      SoftICE_detected
( Z$ Q5 r0 `0 ]$ A1 y
0 V( b( u- u# }5 Iint41handler2 PROC
# r* o" D+ \, O' m. M4 t% U5 w    iret
int41handler2 ENDP


. B( R) _; Z: O2 H. Z; j" ]0 ^_________________________________________________________________________
& e. p' _3 A+ J- o
; U3 Q) L( Q5 k4 j. F
) |3 W; x) t$ V- C9 y1 e6 ~Method 06
=========


2nd method similar to the preceding one but more difficult to detect:
0 ?( Y$ k5 l* ]5 }% Z2 N
( o, l5 o  k+ M8 ]0 c( t( C1 C
6 g. k. d9 X, s+ `2 y) Sint41handler PROC
    mov     cl,al
- L) a( p: b4 k' l8 a9 X    iret
3 z2 C$ R7 d' oint41handler ENDP
  C5 m2 f' s  a, \, k; e6 p
3 S( Q& ?  ~1 \' t! n' H6 H
    xor     ax,ax
    mov     es,ax
    mov     bx, cs
0 h8 f5 d! c9 O3 \2 u3 q    lea     dx, int41handler
% l9 H0 }; p  P5 j5 v) @    xchg    dx, es:[41h*4]
% X( M7 p" X! b  o: ~# T    xchg    bx, es:[41h*4+2]
    in      al, 40h
" [0 ?9 i* i; Q' r9 G4 \1 N    xor     cx,cx
    int     41h
    xchg    dx, es:[41h*4]
    xchg    bx, es:[41h*4+2]
8 }2 {2 G, k% Y# z; c( _    cmp     cl,al
    jnz     SoftICE_detected
) L8 j' ~8 T; k9 G% q
_________________________________________________________________________
# S+ a% H- N* D; ?1 g5 l
Method 07
! e3 W3 P! d1 E) Y5 C=========

Method of detection of the WinICE handler in the int68h (V86)
& o0 i. K! c3 ^2 d+ F
    mov     ah,43h
6 l( q9 X! @2 X5 y2 }- H    int     68h
    cmp     ax,0F386h
# g$ T4 l+ P' P  }    jz      SoftICE_Detected


=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
8 n$ b& Q7 k; L# v2 r9 `2 X8 C   app like this:
* i+ c: ^8 c& L; n) u' I
   BPX exec_int if ax==68
   (function called is located at byte ptr [ebp+1Dh] and client eip is
/ o7 h6 h6 ]  ^5 @  X   located at [ebp+48h] for 32Bit apps)
2 o2 e) H  d" n9 G) R+ ~__________________________________________________________________________

* u6 w7 e/ _1 D5 y1 U0 O
Method 08
=========
3 N) h; }4 u; }/ V1 d8 D6 p4 p
2 W( T' v3 V$ I- b. mIt is not a method of detection of SoftICE but a possibility to crash the
system by intercepting int 01h and int 03h and redirecting them to another
routine.
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
to the new routine to execute (hangs computer...)

    mov     ah, 25h
$ s" O- u3 p  L+ L4 B    mov     al, Int_Number (01h or 03h)
* N: s# S! t$ @2 n+ Q: ?2 z! W! F    mov     dx, offset New_Int_Routine
    int     21h

__________________________________________________________________________

Method 09
4 c3 S- x" j1 A* w1 a  I9 A=========

; K; N0 m1 ^: p- `This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
/ Q, [  ~2 j9 M" z  A- h. fperformed in ring0 (VxD or a ring3 app using the VxdCall).
% v) q) V& L& P* MThe Get_DDB service is used to determine whether or not a VxD is installed
for the specified device and returns a Device Description Block (in ecx) for
that device if it is installed.

   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID
   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
   VMMCall Get_DDB
+ f* R' p; r* d   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed
# W* F5 s9 _2 d7 S0 B
3 q- M* ~- y) }1 F/ VNote as well that you can easily detect this method with SoftICE:
   bpx Get_DDB if ax==0202 || ax==7a5fh
  r  n2 s: b; h% Y, a
- k- w3 w6 x# T  R: k1 }__________________________________________________________________________

9 Y4 ^' f7 k& y. NMethod 10
=========
8 B( T  |: D/ ~1 q8 Y
+ ^" k0 w0 a5 [" G=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with
  SoftICE while the option is enable!!
  p- N( K; z/ d3 ~. _9 y# T* G: t5 z
3 X; n) B% V! cThis trick is very efficient:
by checking the Debug Registers, you can detect if SoftICE is loaded
! {% ?4 H4 i' ~(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
$ d0 }5 S# b) }* [+ y; G1 |there are some memory breakpoints set (dr0 to dr3) simply by reading their
value (in ring0 only). Values can be manipulated and or changed as well
& b9 b1 l* t1 @(clearing BPMs for instance)
0 z% P5 @! ?' g' n4 R& |8 o
4 g2 M0 K' S, n8 u$ S5 `__________________________________________________________________________

Method 11
# R3 w) _7 v" X# L; E' N2 T=========

' }: Y1 J' c% x9 W' H5 n4 N! IThis method is most known as 'MeltICE' because it has been freely distributed
via www.winfiles.com. However it was first used by NuMega people to allow
: t2 n  Q7 G4 O0 }Symbol Loader to check if SoftICE was active or not (the code is located
inside nmtrans.dll).
! k3 j: `+ w, w+ [6 }- @- H4 t
' G; O6 Q. f0 W8 EThe way it works is very simple:
. }8 [! y) w4 B) x8 vIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
. q" @0 A7 x0 x2 Z: v) e5 v- b& WWinNT) with the CreateFileA API.
1 C# ]2 S$ @; v8 u% ^) k
Here is a sample (checking for 'SICE'):

BOOL IsSoftIce95Loaded()
6 A, w1 c( h. Y; e3 ~3 l{
; f8 {9 l1 o  L9 S( I( @& i* a   HANDLE hFile;  
: J. m5 w+ b, j# _" ~7 Z1 k   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
0 O9 Z. g+ N3 T  L3 Q7 U                      FILE_SHARE_READ | FILE_SHARE_WRITE,
                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
& N3 J) ^/ N) L% q9 m   if( hFile != INVALID_HANDLE_VALUE )
   {
1 }' A  C' l( ^+ m      CloseHandle(hFile);
      return TRUE;
! m0 m- u% e* B5 b, |8 b! h   }
   return FALSE;
}
7 E/ I3 {+ c1 y$ z7 _
2 r' G$ I+ y& ^3 K/ N8 M% o1 qAlthough this trick calls the CreateFileA function, don't even expect to be
able to intercept it by installing a IFS hook: it will not work, no way!
- u% s3 n9 O9 g) V8 aIn fact, after the call to CreateFileA it will get through VWIN32 0x001F
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
and then browse the DDB list until it find the VxD and its DDB_Control_Proc
field.
In fact, its purpose is not to load/unload VxDs but only to send a
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
to the VxD Control_Dispatch proc (how the hell a shareware soft could try
to load/unload a non-dynamically loadable driver such as SoftICE ;-).
If the VxD is loaded, it will always clear eax and the Carry flag to allow
its handle to be opened and then, will be detected.
5 g& M1 P- O' kYou can check that simply by hooking Winice.exe control proc entry point
while running MeltICE.

* W2 E6 j6 q$ q1 @& G  m" N
  00401067:  push      00402025    ; \\.\SICE
  0040106C:  call      CreateFileA
1 u" U; M0 b2 V' z$ b  00401071:  cmp       eax,-001
  00401074:  je        00401091
) w/ g) \# l) w' h  l! J

There could be hundreds of BPX you could use to detect this trick.
9 n" J0 [) n- E* N5 X-The most classical one is:
  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||
    *(esp-&gt;4+4)=='NTIC'

-The most exotic ones (could be very slooooow :-(
# O- N( J3 f, \5 B' u   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
& P; @+ l, J. L1 l1 N( d+ v  ^     ;will break 3 times :-(

-or (a bit) faster:
   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
+ F5 v0 H# w6 \) E* b5 n+ m
   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  
0 w: ]8 s: w$ h2 d     ;will break 3 times :-(

. b( g( j! H1 Y1 x3 `: ?$ X-Much faster:
. [0 m7 @' B+ X: f   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'
, Z9 J+ \1 e; B6 _. M) A1 U# O
2 L; p0 y( D* o8 s3 h0 ~Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
4 ]: X% {" e! f  X( Pfunction to do the same job:
. \! W7 A* g( A! P; C
, B& E5 e' I  Y) M8 Q( ~   push    00                        ; OF_READ
   mov     eax,[00656634]            ; '\\.\SICE',0
! E) o, o6 `0 @4 D9 g   push    eax
   call    KERNEL32!_lopen
   inc     eax
4 z7 S, W6 V+ z) W* f4 W   jnz     00650589                  ; detected
) T( H$ {) j& O) ?   push    00                        ; OF_READ
   mov     eax,[00656638]            ; '\\.\SICE'
   push    eax
$ `1 k1 R! v) t1 }5 m( L   call    KERNEL32!_lopen
   inc     eax
   jz      006505ae                  ; not detected
3 e4 I- J8 o' x" K

__________________________________________________________________________

Method 12
- b' s+ j8 o7 F& v) n  a* U=========
7 S! K: U; b+ W. _4 x
/ p: V, j0 m4 OThis trick is similar to int41h/4fh Debugger installation check (code 05
( Y, W, @+ d$ |. d5 i! C6 M0 L&amp; 06) but very limited because it's only available for Win95/98 (not NT)
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.
* A( f3 W+ l# X0 r7 E; s
8 I6 C! J! X6 p' u4 l/ K- K   push  0000004fh         ; function 4fh
   push  002a002ah         ; high word specifies which VxD (VWIN32)
: B8 \9 Q$ H) M) w- t                           ; low word specifies which service
                             (VWIN32_Int41Dispatch)
6 @8 Y, `2 a: _( [* }   call  Kernel32!ORD_001  ; VxdCall
$ Q- A/ B3 ^! Z- P. w  P   cmp   ax, 0f386h        ; magic number returned by system debuggers
0 H; h: x, {$ }# |8 z4 G8 d   jz    SoftICE_detected
; _1 Q4 S' l3 e+ L
Here again, several ways to detect it:

    BPINT 41 if ax==4f
8 G. w* ^9 p) g3 [0 Q) P7 q
    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one
4 o9 {3 G  W8 ^  e" I  H
    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A
+ M" b( ]( S" [+ X, {3 S
    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!
( {7 b  n; k9 S: B2 u
__________________________________________________________________________
0 `" h7 e9 ^; x& h
Method 13
=========

Not a real method of detection, but a good way to know if SoftICE is
installed on a computer and to locate its installation directory.
It is used by few softs which access the following registry keys (usually #2) :

& r& O, S1 t4 g! c5 U-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
\Uninstall\SoftICE
- [: s8 z  D% F& ~! G# \-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
\App Paths\Loader32.Exe

; y& r$ \" q% a& G
Note that some nasty apps could then erase all files from SoftICE directory
" d( d, s2 v6 ~(I faced that once :-(
  ]; h2 b) N( P
Useful breakpoint to detect it:

     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'
3 l: x3 [& z# a* \1 n- O- Q* o  U
__________________________________________________________________________

; l" `  h0 k0 `# {
Method 14
=========
9 @4 O- c1 B+ ]) M
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
is to determines whether a debugger is running on your system (ring0 only).
- F- ?8 \  L& p! z
   VMMCall Test_Debug_Installed
   je      not_installed

- L7 j8 j. I7 m! G6 O8 X5 TThis service just checks a flag.
</PRE></TD></TR></TBODY></TABLE>