Detecting SoftICE by Calling INT 68h

Here's a way to detect the presence of SoftICE in memory by calling INT contain the value 43h before calling INT be in the AX register. 68h. The AH register must 68h. If SoftICE is active in memory, the return value 0F386h will

This is a well-known method of detecting SoftICE that is safe and commonly used, but only in Windows 9x. You can see it in action, for example, in SafeDisc:

.386 

.MODEL FLAT,STDCALL locals 

jumps 

UNICODE=0 

include w32.inc 

Extrn SetUnhandledExceptionFilter : PROC .data 
message3 message2 delayESP previous .code db "Detection by calling 
INT 68h",0 db "SoftICE found",0 db "SoftICE not found",0 dd 0

;the ESP register saves here dd 0 ;the ESP register will save 
the address of the ;previous SEH service here 

Start: 

;-------------------------------------------------------------------------------------------------
;Sets SEH in case of an error 

;-------------------------------------------------------------------------------------------------

mov	[delayESP],esp
 

push offset error 

call SetUnhandledExceptionFilter 

mov	[previous], eax
 

;-------------------------------------------------------------------------------------------------

;The new address for Structured Exception Handling (SEH) is set here to ensure that in case of an 
;error, the program will continue from an error label and will end correctly. This is important 
;if, for example, the program calls an interrupt that will be performed correctly only if SoftICE 
;is active, but which will cause an error and crash the program if SoftICE is not active. Finally, 
;the previous SEH service address is saved. 

;-------------------------------------------------------------------------------------------------
   ah,43h int 68h push eax ;service number ;calls the INT 68h interruption ;saves the return value

;-------------------------------------------------------------------------------------------------
;Sets previous SEH service
;-------------------------------------------------------------------------------------------------
   push dword ptr [previous] 

call SetUnhandledExceptionFilter 

;-------------------------------------------------------------------------------------------------
;Sets the original SEH service address 

;-------------------------------------------------------------------------------------------------

pop   eax	;restores the return value
   cmp   ax, 0f386h	;tests to see whether the return value is
 

;a "magic number" 

;-------------------------------------------------------------------------------------------------
;If SoftICE is active in memory, the return value will be F386h in the AX register. 
;-------------------------------------------------------------------------------------------------

jz     jump	;if yes, the program jumps because SoftICE is
 

;active in memory 

continue: 

call MessageBoxA,0, offset message2,\ offset message1,0 

;if the return value was other than F386h, 

;SoftICE was not found, and an error message ;will be displayed. 

call ExitProcess, -1
   ;ends the program
 

jump: 

call MessageBoxA,0, offset message3,\ offset message1,0 

;prints a message that SoftICE was found. Any ;code may follow from this point. 

call ExitProcess, -1 

;ends the program
   error:
   ;starts a new SEH service in case of an error.
   mov   esp, [delayESP]
 

push offset continue ret 

;if an error occurs in the program, SEH ;ensures that the program will continue from the 
;error label. 

ends 

end Start 

;end of program