Only way I know is to use the very latest softdevice (eg S130V2) which has two useful functions, sd_ble_gatts_initial_user_handle_get which tells you where the first non-system handle is to be found and sd_ble_gatts_attr_get which gives you the UUID and metadata for a given handle. Using those you can iterate the system handles and find the ones you're looking for.
Previous to that revision of the SD, I don't believe there's a way to do it apart from figuring out where a given SD revision actually puts them and then assuming for that revision that it's fixed.
