What is the reason behind the byte scission (the next immediate byte following "int 2d" is skipped) behaviour when executing INT 0x2D? I came across this article http://www.drdobbs.com/monitoring-nt-debug-services/184416239 but still cannot understand what is the reason for Windows to skip the byte. Any explanation is welcome. Thanks.
The full details of the behavior are described here: http://pferrie.host22.com/papers/antidebug.pdf
Specifically, if the EAX register has the value of 1, 3, or 4 on all versions of Windows, or the value 5 on Windows Vista and later, then Windows will increase by one the exception address. Finally, it issues an EXCEPTION_BREAKPOINT (0x80000003) exception if a debugger is present.
The skipped byte is intended to pass information to the kernel-mode component, but the mechanism is not used by default.