ICE 0xF1
ICEBP is an undocumented instruction that serves as a single byte interrupt 1, generating a single step exception. It can be used to detect if the program is traced.
Code Snippets
BOOL IsDebuggerPresent_IceBp()
{
__try
{
__asm __emit 0xF1
}
__except(1)
{
return FALSE;
}
return TRUE;
}Detection Rules
rule Detect_Interrupt: AntiDebug {
meta:
description = "Detect Interrupt instruction"
author = "Unprotect"
comment = "Experimental rule / the rule can be slow to use"
strings:
$int3 = { CC }
$intCD = { CD }
$int03 = { 03 }
$int2D = { 2D }
$ICE = { F1 }
condition:
uint16(0) == 0x5A4D and filesize < 1000KB and any of them
}rule:
meta:
name: execute anti-debugging instructions
namespace: anti-analysis/anti-debugging/debugger-detection
authors:
- moritz.raabe@mandiant.com
scope: function
mbc:
- Anti-Behavioral Analysis::Debugger Detection::Anti-debugging Instructions [B0001.034]
examples:
- Practical Malware Analysis Lab 16-03.exe_:0x401300
features:
- or:
- count(mnemonic(rdtsc)): 2 or more
- mnemonic: icebp