I'm reversing a program that uses a lot of BREAK
/int 3
(Linux). I guess that the code contains something like:
void sigtrap_func(int sig) { (some stuff..) }
int main()
{
signal(SIGTRAP, sigtrap_func);
(some stuff)
asm("int 3");
(and so on)
asm("int 3");
etc..
I replaced all SIGTRAP
by NOP
s and the program behave differently than with them. So, I'm sure that something is done inside the sigtrap
function.
How can I find this function just with the assembler ?