Re: Detecting SoftICE ?

Hi Bruce,

you may have a look at crackz's pages for usual tricks concerning Sice de=
tection (http://www.woodmann.com/crackz/Tutorials/Protect.htm#detectsofti=
ce)

However, please have a look at the following routines:

First, we can use int 68h to check the "magic" value 0x0F386 (=3D debugge=
r present). Then, we may also check the interrupt descriptor table and se=
e if there is a handler installed for INT 68h.

__inline bool IsSICELoaded() {
	_asm {
		mov ah, 0x43
		int 0x68
		cmp ax, 0x0F386 // Will be set by all system debuggers.
		jz out_

		xor ax, ax	// check the IDT
		mov es, ax
		mov bx, word ptr es:[0x68*4]
		mov es, word ptr es:[0x68*4+2]
		mov eax, 0x0F43FC80
		cmp eax, dword ptr es:[ebx]
		jnz out_
		jmp normal_
	normal_:
		xor eax, eax
		leave
		ret
	out_:
		mov eax, 0x1
		leave
		ret
	}
	return false;
}

If a debugger is not present AX will be 4300h.

Then, as you said, the CreateFile function may be used to check if the Si=
ce device driver is loaded... It should be working with the latest versio=
ns anyway...

/*
	Function: IsSoftIceNTLoaded
	Description: Like the previous one but for use under Win NT only
	Returns: true if SoftIce is loaded
*/

__inline BOOL IsSoftIceNTLoaded() {
	HANDLE hFile=3DCreateFile( "\\\\.\\NTICE",
				GENERIC_READ | GENERIC_WRITE,
				FILE_SHARE_READ | FILE_SHARE_WRITE,
				NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);

	if(hFile!=3DINVALID_HANDLE_VALUE) { CloseHandle(hFile); return true; }
		return false;=20
	}


Or maybe the dedicated function "IsDebuggerPresent" will detect it (I hav=
en't tested it with Sice yet)
http://msdn.microsoft.com/library/en-us/debug/base/isdebuggerpresent.asp

BOOL IsDebuggerPresent(void);


But, if your Sice is patched, it may already include protections against =
those "anti-debugging" features. In this case, you should use your own im=
agination to detect it :)


--=20
_______________________________________
Thierry Haven - Xmco Partners
Consultant S=E9curit=E9 / Test d'intrusion

web  : http://www.xmcopartners.com=20


Bruce Klein wrote:
>=20
> Hello all,
> =20
> I am writing a Win32 DLL and am currently trying to detect if SoftICE i=
s present.
> =20
> I am trying the "classic" detection methods and for my version of SoftI=
CE (4.3.2) under Windows XP, so far no method has succeeded at detecting =
it.
> =20
> The methods I am trying are well described in Viega & Messier's "Secure=
 Programming Cookbook" and all over the net.  One is the "Meltice" techni=
que that looks for a virtual device named "\.\\NTICE"; the other uses the=
 "Boundschecker" method that uses int 3, with "BCHK"=20
> in a register.
> =20
> I am having no luck with either method. Perhaps because the methods are=
 obsolete with the current version of SoftICE. Perhaps because I'm doing =
something stupid.
> =20
> Given the above, I have two questions I'm hoping someone can answer:
>     - Does anyone know a method to detect today's SoftICE?
>     - Do the other methods even work (and for what versions)?
> =20
> I'd be happy to post the small source or answer any further questions.
> =20
> Thanks in advance.
>=20