1

What is the reason behind the byte scission (the next immediate byte following "int 2d" is skipped) behaviour when executing INT 0x2D? I came across this article http://www.drdobbs.com/monitoring-nt-debug-services/184416239 but still cannot understand what is the reason for Windows to skip the byte. Any explanation is welcome. Thanks.

2
  • 2
    The DrDobbs article does not mention 'byte scission' at all, which seems to be a term invented by Dr Fu in relation to a peculiarity/quirk in Windows (see Peter Ferrie's paper which explains it in detail).
    – DarthGizka
    May 31 '16 at 10:53
  • Thanks! That answer the question. Yeah, I know that the Dr Dobbs article didn't not mention "byte scission". That is the only article I came across after searching for mechanism behind INT 0x2D after reading about it on Dr Fu's blog. The other articles on the net usually only mention that a byte will be skipped without explanation. Hence this question. Thanks for pointing me to Peter Ferrie's paper.
    – xyz
    May 31 '16 at 23:22
1

The full details of the behavior are described here: http://pferrie.host22.com/papers/antidebug.pdf

Specifically, if the EAX register has the value of 1, 3, or 4 on all versions of Windows, or the value 5 on Windows Vista and later, then Windows will increase by one the exception address. Finally, it issues an EXCEPTION_BREAKPOINT (0x80000003) exception if a debugger is present.

The skipped byte is intended to pass information to the kernel-mode component, but the mechanism is not used by default.

2
  • Thanks. When you say the skipped byte is intended to pass information to kernel-mode component, specifically what information? Is it an undocumented feature of Windows kernel? I am still puzzle why do INT 0x2D need to behave the way it does. Comparatively the behaviour of INT 3 seem more understandable.
    – xyz
    Jun 6 '16 at 11:50
  • you can pass any single-byte value to the kernel, as a "parameter" to the interrupt, along with register values. This is not possible using int 3 style. Jun 26 '16 at 15:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.