INT 0x2D

Created the Wednesday 22 June 2022. Updated 1 month ago.

When the instruction INT2D is executed, the exception EXCEPTION_BREAKPOINT is raised. Windows uses the EIP register as an exception address and then increments the EIP register value. Windows also examines the value of the EAX register while INT2D is executed.

Technique Identifiers

U0129 B0001.006

Technique Tag

int2d

Code Snippets

BOOL IsDebuggerPresent_Int2d()
{
    __try
    { 
        __asm int 0x2d 
    }
    __except(1)
    {
        return FALSE;
    }
    return TRUE;
}

Description

Original source code available here: https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/Interrupt_0x2d.cpp

#include "pch.h"

#include "Interrupt_0x2d.h"

/*
The Interrupt_0x2d function will check to see if a debugger is attached to the current process. It does this by setting up
SEH and using the Int 2D instruction which will only cause an exception if there is no debugger. Also when used in OllyDBG
it will skip a byte in the disassembly which could be used to detect the debugger.
Vectored Exception Handling is used here because SEH is an anti-debug trick in itself.
*/

extern "C" void __int2d();

static BOOL SwallowedException = TRUE;

static LONG CALLBACK VectoredHandler(
	_In_ PEXCEPTION_POINTERS ExceptionInfo
)
{
	SwallowedException = FALSE;
	if (ExceptionInfo->ExceptionRecord->ExceptionCode == EXCEPTION_BREAKPOINT)
	{
		//The Int 2D instruction already increased EIP/RIP so we don't do that (although it wouldnt hurt).
		return EXCEPTION_CONTINUE_EXECUTION;
	}
	return EXCEPTION_CONTINUE_SEARCH;
}

BOOL Interrupt_0x2d()
{
	PVOID Handle = AddVectoredExceptionHandler(1, VectoredHandler);
	SwallowedException = TRUE;
	__int2d();
	RemoveVectoredExceptionHandler(Handle);
	return SwallowedException;
}

Detection Rules

                                    rule Detect_Interrupt: AntiDebug {
    meta: 
        description = "Detect Interrupt instruction"
        author = "Unprotect"
        comment = "Experimental rule / the rule can be slow to use"
    strings:
        $int3 = { CC }
        $intCD = { CD }
        $int03 = { 03 }
        $int2D = { 2D }
        $ICE = { F1 }
    condition:   
       uint16(0) == 0x5A4D and filesize < 1000KB and any of them
}

Additional Resources

External Links

The resources provided below are associated links that will give you even more detailed information and research on current evasion technique. It is important to note that, while these resources may be helpful, it is important to exercise caution when following external links. As always, be careful when clicking on links from unknown sources, as they may lead to malicious content.