6

I'm reversing some malware on an OSX VM when I noticed something peculiar. While stepping through the instructions, the instruction just after a int 0x80 gets skipped i.e. gets executed without me stepping through this.

Example:

 int 0x80
 inc eax ; <--- this gets skipped
 inc ecx ; <--- stepping resumes here

Why does this happen? Have you encountered something similar to this?

Improve this question

1 Answer 1

Reset to default
12

When single-stepping through code, the T flag is set so that the CPU can break after the instruction completes execution. When an interrupt occurs, the state of the T flag is placed on the stack, and used when the iret instruction is executed by the handler. However, the iret instruction is one of a few instructions that causes a one-instruction delay in the triggering of the T flag, due to legacy issues relating to the initialization of the stack.

So the skipped instruction is executing but you can't step into it (but if you set a breakpoint at that location and run to that point instead, then you will get a break).

Improve this answer
3
  • +1. Didn't sound like the OP was interested in those low-level details, but now I understand why you were arguing that my answer didn't contain the information asked for. But it turns out I misread the question. Thanks for pointing it out.
    – 0xC0000022L ♦
    Commented Apr 29, 2013 at 17:09
  • Do we observe the same behavior in other OSes ? *BSD, Linux, OpenSolaris, ... ?
    – perror
    Commented Apr 29, 2013 at 18:04
  • @perror: should for all practical purposes whenever an interrupt handler is used and therefore iret is used.
    – 0xC0000022L ♦
    Commented Apr 29, 2013 at 19:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.