INT 0x2D
When the instruction INT2D is executed, the exception EXCEPTION_BREAKPOINT is raised. Windows uses the EIP register as an exception address and then increments the EIP register value. Windows also examines the value of the EAX register while INT2D is executed.
Code Snippets
BOOL IsDebuggerPresent_Int2d()
{
__try
{
__asm int 0x2d
}
__except(1)
{
return FALSE;
}
return TRUE;
}Description
Original source code available here: https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/Interrupt_0x2d.cpp
#include "pch.h"
#include "Interrupt_0x2d.h"
/*
The Interrupt_0x2d function will check to see if a debugger is attached to the current process. It does this by setting up
SEH and using the Int 2D instruction which will only cause an exception if there is no debugger. Also when used in OllyDBG
it will skip a byte in the disassembly which could be used to detect the debugger.
Vectored Exception Handling is used here because SEH is an anti-debug trick in itself.
*/
extern "C" void __int2d();
static BOOL SwallowedException = TRUE;
static LONG CALLBACK VectoredHandler(
_In_ PEXCEPTION_POINTERS ExceptionInfo
)
{
SwallowedException = FALSE;
if (ExceptionInfo->ExceptionRecord->ExceptionCode == EXCEPTION_BREAKPOINT)
{
//The Int 2D instruction already increased EIP/RIP so we don't do that (although it wouldnt hurt).
return EXCEPTION_CONTINUE_EXECUTION;
}
return EXCEPTION_CONTINUE_SEARCH;
}
BOOL Interrupt_0x2d()
{
PVOID Handle = AddVectoredExceptionHandler(1, VectoredHandler);
SwallowedException = TRUE;
__int2d();
RemoveVectoredExceptionHandler(Handle);
return SwallowedException;
}Detection Rules
rule Detect_Interrupt: AntiDebug {
meta:
description = "Detect Interrupt instruction"
author = "Unprotect"
comment = "Experimental rule / the rule can be slow to use"
strings:
$int3 = { CC }
$intCD = { CD }
$int03 = { 03 }
$int2D = { 2D }
$ICE = { F1 }
condition:
uint16(0) == 0x5A4D and filesize < 1000KB and any of them
}