0

This is assembly code that can catch debugger with int 3 :

MOV ECX, ExceptionHandler

MOV DWORD PTR FS:[0], ExceptionHandler

INT3
      ///there is debugger!!!

ExceptionHandler:
       ////no debugger

When programmer write a C program , which code he write that compile to this trap?

I use Windows with x86

  • DebugBreak might help – sudhackar Jan 16 at 7:49
  • 3
    how do you know it was written in C? Maybe it was just written in pure asm? – Paweł Łukasik Jan 16 at 9:07
  • The __debugbreak intrinsic (pretty much equivalent to __asm int 3;) with VS is also an option. Problem is, you give way too little detail to provide a helpful answer. We can deduce this is for an IA-32 system, but that's about it. You don't indicate what OS you are targeting nor does this seem to be reverse-engineering related. – 0xC0000022L Jan 16 at 11:44
  • @0xC0000022L I sorry, I use Windows with x86, what I looking is how can I simply write a c code that compile to int 3 and do if(inDebug) printf ("in debuge") else printf("not in debug") – g319909.nwytg.coM Jan 16 at 17:11
1
#include <stdio.h>
#include <windows.h>
#include <intrin.h>
void main (void) 
{
    __try 
    {
        __debugbreak();
    } 
    __except( GetExceptionCode() == 
        EXCEPTION_BREAKPOINT ? EXCEPTION_EXECUTE_HANDLER :EXCEPTION_CONTINUE_SEARCH ) 
    {
        printf("executed out of debugger\n");
        exit(1);
    }
    printf("executed inside debugger\n");
    exit(2);
}

disassembly of main() without handler

0:000> uf .
int3!main [xxx\int3.cpp @ 6]:
    6 01381000 55              push    ebp
    6 01381001 8bec            mov     ebp,esp
    6 01381003 6afe            push    0FFFFFFFEh
    6 01381005 68d0573c01      push    offset int3!__rtc_tzz+0x8 (013c57d0)
    6 0138100a 6820213801      push    offset int3!_except_handler4 (01382120)
    6 0138100f 64a100000000    mov     eax,dword ptr fs:[00000000h]
    6 01381015 50              push    eax
    6 01381016 83c4f0          add     esp,0FFFFFFF0h
    6 01381019 53              push    ebx
    6 0138101a 56              push    esi
    6 0138101b 57              push    edi
    6 0138101c a104703c01      mov     eax,dword ptr [int3!__security_cookie (013c7004)]
    6 01381021 3145f8          xor     dword ptr [ebp-8],eax
    6 01381024 33c5            xor     eax,ebp
    6 01381026 50              push    eax
    6 01381027 8d45f0          lea     eax,[ebp-10h]
    6 0138102a 64a300000000    mov     dword ptr fs:[00000000h],eax
    6 01381030 8965e8          mov     dword ptr [ebp-18h],esp
    7 01381033 c745fc00000000  mov     dword ptr [ebp-4],0
    9 0138103a cc              int     3
   10 0138103b c745fcfeffffff  mov     dword ptr [ebp-4],0FFFFFFFEh
   10 01381042 eb45            jmp     int3!main+0x89 (01381089)

int3!main+0x89 [xxx\int3.cpp @ 17]:
   17 01381089 68bce13b01      push    offset int3!__xt_z+0x2c (013be1bc)
   17 0138108e e85d000000      call    int3!printf (013810f0)
   17 01381093 83c404          add     esp,4
   18 01381096 6a02            push    2
   18 01381098 e8dec00100      call    int3!exit (0139d17b)
   0:000> da 13be1bc
   013be1bc  "executed inside debugger."

handler will be called if there is no debugger

:\>int3.exe
executed out of debugger

:\>cdb  -g -c "g;q" int3.exe  | grep -i executed
executed inside debugger

:\>

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.