How int3 looks like in C

Question

This is assembly code that can catch debugger with int 3 :

MOV ECX, ExceptionHandler

MOV DWORD PTR FS:[0], ExceptionHandler

INT3
      ///there is debugger!!!

ExceptionHandler:
       ////no debugger

When programmer write a C program , which code he write that compile to this trap?

I use Windows with x86

Answer 1

#include <stdio.h>
#include <windows.h>
#include <intrin.h>
void main (void) 
{
    __try 
    {
        __debugbreak();
    } 
    __except( GetExceptionCode() == 
        EXCEPTION_BREAKPOINT ? EXCEPTION_EXECUTE_HANDLER :EXCEPTION_CONTINUE_SEARCH ) 
    {
        printf("executed out of debugger\n");
        exit(1);
    }
    printf("executed inside debugger\n");
    exit(2);
}

disassembly of main() without handler

0:000> uf .
int3!main [xxx\int3.cpp @ 6]:
    6 01381000 55              push    ebp
    6 01381001 8bec            mov     ebp,esp
    6 01381003 6afe            push    0FFFFFFFEh
    6 01381005 68d0573c01      push    offset int3!__rtc_tzz+0x8 (013c57d0)
    6 0138100a 6820213801      push    offset int3!_except_handler4 (01382120)
    6 0138100f 64a100000000    mov     eax,dword ptr fs:[00000000h]
    6 01381015 50              push    eax
    6 01381016 83c4f0          add     esp,0FFFFFFF0h
    6 01381019 53              push    ebx
    6 0138101a 56              push    esi
    6 0138101b 57              push    edi
    6 0138101c a104703c01      mov     eax,dword ptr [int3!__security_cookie (013c7004)]
    6 01381021 3145f8          xor     dword ptr [ebp-8],eax
    6 01381024 33c5            xor     eax,ebp
    6 01381026 50              push    eax
    6 01381027 8d45f0          lea     eax,[ebp-10h]
    6 0138102a 64a300000000    mov     dword ptr fs:[00000000h],eax
    6 01381030 8965e8          mov     dword ptr [ebp-18h],esp
    7 01381033 c745fc00000000  mov     dword ptr [ebp-4],0
    9 0138103a cc              int     3
   10 0138103b c745fcfeffffff  mov     dword ptr [ebp-4],0FFFFFFFEh
   10 01381042 eb45            jmp     int3!main+0x89 (01381089)

int3!main+0x89 [xxx\int3.cpp @ 17]:
   17 01381089 68bce13b01      push    offset int3!__xt_z+0x2c (013be1bc)
   17 0138108e e85d000000      call    int3!printf (013810f0)
   17 01381093 83c404          add     esp,4
   18 01381096 6a02            push    2
   18 01381098 e8dec00100      call    int3!exit (0139d17b)
   0:000> da 13be1bc
   013be1bc  "executed inside debugger."

handler will be called if there is no debugger

:\>int3.exe
executed out of debugger

:\>cdb  -g -c "g;q" int3.exe  | grep -i executed
executed inside debugger

:\>