-2

While reading a book it mentioned that the following code is usually used to as an antidebugger 

mov     eax,   large fs:18h
mov     eax,   [eax+30h]
movzx   eax,   byte ptr [eax+2]
retn

I don't understand what are the keywords large , byte, ptr and retn. I am new learner of assembly and its usage in malware.

Improve this question
4
  • 5
    i dont undestand what is the function of "large , byte, prt, retn" - i'm afraid you still have a lot more to learn before you'd understand any answer to your question.
    – Guntram Blohm
    Aug 5, 2014 at 18:33
  • 2
    From your original post (which was edited out by @perror) - "I was supposed to accept the code as it is without further understanding". If that's indeed the case, then you should throw out that book and get a better one.
    – Jason Geffner
    Aug 5, 2014 at 20:55
  • 1
    Your book, or your copied code, contains typos. [eax 30h] is not valid assembler.
    – Jongware
    Aug 5, 2014 at 22:12
  • I tried to make this question a bit better (a lot of work... indeed). Even if it was extremely badly asked, I think that this anti-debug trick (and the answer of broadway) worth to be mentioned. I propose to reopen the question now.
    – perror
    Aug 6, 2014 at 16:54

1 Answer 1

Reset to default
8

The syntax is incorrect, but the code is basically what IsDebuggerPresent does.

  1. Get a pointer to the TEB (located at fs:18h)
  2. Get a pointer to the PEB (located at teb+30h)
  3. Check the BeingDebugged flag (located at peb+2)

The syntax should be something like:

mov     eax, large fs:18h
mov     eax, [eax+30h]
movzx   eax, byte ptr [eax+2]

If you don't understand assembler syntax, though, you're generally going to have a bad time when analyzing malware.

Improve this answer
1

Not the answer you're looking for? Browse other questions tagged or ask your own question.