INT 0x2D

When the instruction INT2D is executed, the exception EXCEPTION_BREAKPOINT is raised. Windows uses the EIP register as an exception address and then increments the EIP register value. Windows also examines the value of the EAX register while INT2D is executed.

Technique Identifiers

U0129 B0001.006

Technique Tag

int2d

Featured Windows API's

Below, you will find a list of the most commonly used Windows API's that are currently utilized by malware authors for current evasion technique. This list is meant to provide an overview of the API's that are commonly used for this purpose. If there are any API's that you feel should be included on this list, please do not hesitate to contact us. We will be happy to update the list and provide any additional information or documentation that may be helpful.

Evasion Categories

Anti-Debugging

Code Snippets

BOOL IsDebuggerPresent_Int2d()
{
    __try
    { 
        __asm int 0x2d 
    }
    __except(1)
    {
        return FALSE;
    }
    return TRUE;
}

About Author Open Snippet

Author: External / Target Platform: Windows

Description

Original source code available here: https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/Interrupt_0x2d.cpp

#include "pch.h"

#include "Interrupt_0x2d.h"

/*
The Interrupt_0x2d function will check to see if a debugger is attached to the current process. It does this by setting up
SEH and using the Int 2D instruction which will only cause an exception if there is no debugger. Also when used in OllyDBG
it will skip a byte in the disassembly which could be used to detect the debugger.
Vectored Exception Handling is used here because SEH is an anti-debug trick in itself.
*/

extern "C" void __int2d();

static BOOL SwallowedException = TRUE;

static LONG CALLBACK VectoredHandler(
	_In_ PEXCEPTION_POINTERS ExceptionInfo
)
{
	SwallowedException = FALSE;
	if (ExceptionInfo->ExceptionRecord->ExceptionCode == EXCEPTION_BREAKPOINT)
	{
		//The Int 2D instruction already increased EIP/RIP so we don't do that (although it wouldnt hurt).
		return EXCEPTION_CONTINUE_EXECUTION;
	}
	return EXCEPTION_CONTINUE_SEARCH;
}

BOOL Interrupt_0x2d()
{
	PVOID Handle = AddVectoredExceptionHandler(1, VectoredHandler);
	SwallowedException = TRUE;
	__int2d();
	RemoveVectoredExceptionHandler(Handle);
	return SwallowedException;
}

About Author Open Snippet

Author: External / Target Platform: Windows

Detection Rules

rule Detect_Interrupt: AntiDebug {
    meta: 
        description = "Detect Interrupt instruction"
        author = "Unprotect"
        comment = "Experimental rule / the rule can be slow to use"
    strings:
        $int3 = { CC }
        $intCD = { CD }
        $int03 = { 03 }
        $int2D = { 2D }
        $ICE = { F1 }
    condition:   
       uint16(0) == 0x5A4D and filesize < 1000KB and any of them
}

Contributor

Thomas Roccia (fr0gger)

Additional Resources

External Links

The resources provided below are associated links that will give you even more detailed information and research on current evasion technique. It is important to note that, while these resources may be helpful, it is important to exercise caution when following external links. As always, be careful when clicking on links from unknown sources, as they may lead to malicious content.

Matching Samples 10 most recent

Sample Name	Matching Techniques	First Seen	Last Seen
USBWatcher.exe	7	2026-04-18	9 hours, 3 minutes ago
CVE-2026-20817_PoC.exe	8	2026-04-09	1 week, 2 days ago
Raid.exe	7	2026-04-08	1 week, 2 days ago
b2a17fbdf536bd79dba9eb5e4ea3...0fdd7eb07ca6c5bdf73de001.exe	11	2026-04-07	1 week, 4 days ago
XClient1.exe	4	2026-04-04	2 weeks ago
2_5339247083163523934.exe	6	2026-03-27	3 weeks, 1 day ago
rootkit.exe	10	2026-03-24	3 weeks, 4 days ago
spread.exe	6	2026-03-24	3 weeks, 4 days ago
ngen.exe	7	2026-03-20	4 weeks, 1 day ago
write.exe	5	2026-03-20	4 weeks, 1 day ago

View All

Created

June 22, 2022

Last Revised

March 24, 2026