1

This is assembly code that can catch debugger with int 3 :

MOV ECX, ExceptionHandler

MOV DWORD PTR FS:[0], ExceptionHandler

INT3
      ///there is debugger!!!

ExceptionHandler:
       ////no debugger

When programmer write a C program , which code he write that compile to this trap?

I use Windows with x86

4
  • DebugBreak might help
    – sudhackar
    Jan 16 '19 at 7:49
  • 3
    how do you know it was written in C? Maybe it was just written in pure asm? Jan 16 '19 at 9:07
  • 1
    The __debugbreak intrinsic (pretty much equivalent to __asm int 3;) with VS is also an option. Problem is, you give way too little detail to provide a helpful answer. We can deduce this is for an IA-32 system, but that's about it. You don't indicate what OS you are targeting nor does this seem to be reverse-engineering related.
    – 0xC0000022L
    Jan 16 '19 at 11:44
  • @0xC0000022L I sorry, I use Windows with x86, what I looking is how can I simply write a c code that compile to int 3 and do if(inDebug) printf ("in debuge") else printf("not in debug") Jan 16 '19 at 17:11
2
#include <stdio.h>
#include <windows.h>
#include <intrin.h>
void main (void) 
{
    __try 
    {
        __debugbreak();
    } 
    __except( GetExceptionCode() == 
        EXCEPTION_BREAKPOINT ? EXCEPTION_EXECUTE_HANDLER :EXCEPTION_CONTINUE_SEARCH ) 
    {
        printf("executed out of debugger\n");
        exit(1);
    }
    printf("executed inside debugger\n");
    exit(2);
}

disassembly of main() without handler

0:000> uf .
int3!main [xxx\int3.cpp @ 6]:
    6 01381000 55              push    ebp
    6 01381001 8bec            mov     ebp,esp
    6 01381003 6afe            push    0FFFFFFFEh
    6 01381005 68d0573c01      push    offset int3!__rtc_tzz+0x8 (013c57d0)
    6 0138100a 6820213801      push    offset int3!_except_handler4 (01382120)
    6 0138100f 64a100000000    mov     eax,dword ptr fs:[00000000h]
    6 01381015 50              push    eax
    6 01381016 83c4f0          add     esp,0FFFFFFF0h
    6 01381019 53              push    ebx
    6 0138101a 56              push    esi
    6 0138101b 57              push    edi
    6 0138101c a104703c01      mov     eax,dword ptr [int3!__security_cookie (013c7004)]
    6 01381021 3145f8          xor     dword ptr [ebp-8],eax
    6 01381024 33c5            xor     eax,ebp
    6 01381026 50              push    eax
    6 01381027 8d45f0          lea     eax,[ebp-10h]
    6 0138102a 64a300000000    mov     dword ptr fs:[00000000h],eax
    6 01381030 8965e8          mov     dword ptr [ebp-18h],esp
    7 01381033 c745fc00000000  mov     dword ptr [ebp-4],0
    9 0138103a cc              int     3
   10 0138103b c745fcfeffffff  mov     dword ptr [ebp-4],0FFFFFFFEh
   10 01381042 eb45            jmp     int3!main+0x89 (01381089)

int3!main+0x89 [xxx\int3.cpp @ 17]:
   17 01381089 68bce13b01      push    offset int3!__xt_z+0x2c (013be1bc)
   17 0138108e e85d000000      call    int3!printf (013810f0)
   17 01381093 83c404          add     esp,4
   18 01381096 6a02            push    2
   18 01381098 e8dec00100      call    int3!exit (0139d17b)
   0:000> da 13be1bc
   013be1bc  "executed inside debugger."

handler will be called if there is no debugger

:\>int3.exe
executed out of debugger

:\>cdb  -g -c "g;q" int3.exe  | grep -i executed
executed inside debugger

:\>
0

This site is temporarily in read only mode and not accepting new answers.

Not the answer you're looking for? Browse other questions tagged .