Only way I know is to use the very latest softdevice (eg S130V2) which has two useful functions, sd_ble_gatts_initial_user_handle_get which tells you where the first non-system handle is to be found and sd_ble_gatts_attr_get which gives you the UUID and metadata for a given handle. Using those you can iterate the system handles and find the ones you're looking for.
Previous to that revision of the SD, I don't believe there's a way to do it apart from figuring out where a given SD revision actually puts them and then assuming for that revision that it's fixed.
The softdevice was out of Alpha a few weeks ago, it's already a release version. The SDK, now that is lagging and still only works with the pre 2.0.0.7-alpha SD which is a shame. There was a post yesterday from a Nordic employee saying 'this month', so not too long now.
