ICE 0xF1

Created the Wednesday 22 June 2022. Updated 5 months, 1 week ago.

ICEBP is an undocumented instruction that serves as a single byte interrupt 1, generating a single step exception. It can be used to detect if the program is traced.

Technique Identifier


Technique Tags

0xf1 icebp

Code Snippets

BOOL IsDebuggerPresent_IceBp()
        __asm __emit 0xF1 
        return FALSE; 
    return TRUE;

Detection Rules

rule Detect_Interrupt: AntiDebug {
        description = "Detect Interrupt instruction"
        author = "Unprotect"
        comment = "Experimental rule / the rule can be slow to use"
        $int3 = { CC }
        $intCD = { CD }
        $int03 = { 03 }
        $int2D = { 2D }
        $ICE = { F1 }
       uint16(0) == 0x5A4D and filesize < 1000KB and any of them
    name: execute anti-debugging instructions
    namespace: anti-analysis/anti-debugging/debugger-detection
    scope: function
      - Anti-Behavioral Analysis::Debugger Detection::Anti-debugging Instructions [B0001.034]
      - Practical Malware Analysis Lab 16-03.exe_:0x401300
    - or:
      - count(mnemonic(rdtsc)): 2 or more
      - mnemonic: icebp

Additional Resources

External Links

Subscribe to our Newsletter

The information entered into this form is mandatory. It will be subjected to computer processing. It is processed by computer in order to support our users and readers. The recipients of the data will be :

According to the Data Protection Act of January 6th, 1978, you have at any time, a right of access to and rectification of all of your personal data. If you wish to exercise this right and gain access to your personal data, please write to Thomas Roccia at

You may also oppose, for legitimate reasons, the processing of your personal data.