I understand that on x86,
INT 1 is used for single-stepping and
INT 3 is used for setting breakpoints, and some other interrupt (usually 0x80 for Linux and 0x2E for Windows) used to be used for system calls.
If a piece of malware hooks the Interrupt Descriptor Table (IDT) and substitutes its own
INT 1 and
INT 3 handlers that perform system call-like functionality, how can I use a debugger to trace its execution? Or am I stuck with using static-analysis tools?