Detecting SoftICE by Calling INT 3h

This is one of the most well known anti-debugging tricks, and it uses a back door in SoftICE itself. It works in all versions of Windows, and it is based on calling INT 3h with registers containing the following values: EAX=04h and EBP=4243484Bh. This is actually the "BCHK" string. If SoftICE is active in memory, the EAX register will contain a value other than 4.

This trick has often been used in the code of various compression and encoding programs, and it is well known because of its wide use. When used well, it may cause trouble even for the more experienced crackers.

.386 

.MODEL FLAT,STDCALL 

locals jumps 

UNICODE=0 

include w32.inc 

Extrn SetUnhandledExceptionFilter : 
PROC .data 
message3 message2 delayESP previous 
.code db "Detection by calling INT 3h",0 
db "SoftICE found",0 db "SoftICE not found",0 dd 0

;the ESP register is saved here. dd 0 ;the ESP register will save the address of the 

;previous SEH service here. 

Start: 

;------------------------------------------------------------------------------------------------

-;Sets SEH in case of an error 

;-------------------------------------------------------------------------------------------------

mov	[delayESP], esp
 

push offset error 

call SetUnhandledExceptionFilter 

mov	[previous], eax
 

;-------------------------------------------------------------------------------------------------

;The new address for Structured Exception Handling (SEH) is set here to ensure that in case of an 

;error, the program will continue from an error label and will end correctly. This is important 

;if, for example, the program calls an interrupt that will be performed correctly only if SoftICE 

;is active, but which will cause an error and crash the program if SoftICE is not active. 

;Finally, the previous SEH service address is saved. 

;-------------------------------------------------------------------------------------------------
   eax,4 mov   ebp,"BCHK" int 3h push eax ;"magic" values to be found ;whether SoftICE is active

 ;calls the INT 3h interruption ;saves the return value 

;-------------------------------------------------------------------------------------------------

;Sets previous SEH service 

;-------------------------------------------------------------------------------------------------
   push dword ptr [previous] 

call SetUnhandledExceptionFilter 

;-------------------------------------------------------------------------------------------------

;Sets the original SEH service address 

;-------------------------------------------------------------------------------------------------
   pop   eax cmp   eax,4 jnz   jump 
   continue: ;restores the return value

 ;tests to see whether eax was changed ;if it was changed, SoftICE is active ;in memory

call MessageBoxA,0, offset message2,\ offset message1,0 

;-------------------------------------------------------------------------------------------------

;If the return value is 4 SoftICE wasn't found and the program prints out an error message.

 ;-------------------------------------------------------------------------------------------------
   call ExitProcess, -1 

;ends program 

jump: 

call MessageBoxA,0, offset message3,\ offset message1,0 

;-------------------------------------------------------------------------------------------------

;Displays a message that SoftICE was found; any code may follow this point.

 ;-------------------------------------------------------------------------------------------------
call ExitProcess, -1 

;ends program 

error: 

;starts a new SEH service in case of an error.
   mov   esp, [delayESP]
 

push offset continue ret 

;-------------------------------------------------------------------------------------------------

;If an error occurs in the program, SEH will ensure that the program will continue from the ;error label. 

;-------------------------------------------------------------------------------------------------ends 

end Start	

;end of program