-2

While reading a book it mentioned that the following code is usually used to as an antidebugger

mov     eax,   large fs:18h
mov     eax,   [eax+30h]
movzx   eax,   byte ptr [eax+2]
retn

I don't understand what are the keywords large , byte, ptr and retn. I am new learner of assembly and its usage in malware.

closed as off-topic by Jason Geffner, usr2564301, perror, 0xec, ixje Aug 6 '14 at 6:12

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions asking for help reverse-engineering a specific system are off-topic unless they demonstrate an understanding of the concepts involved and clearly identify a specific problem." – Jason Geffner, usr2564301, 0xec, ixje
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 5
    i dont undestand what is the function of "large , byte, prt, retn" - i'm afraid you still have a lot more to learn before you'd understand any answer to your question. – Guntram Blohm Aug 5 '14 at 18:33
  • 2
    From your original post (which was edited out by @perror) - "I was supposed to accept the code as it is without further understanding". If that's indeed the case, then you should throw out that book and get a better one. – Jason Geffner Aug 5 '14 at 20:55
  • 1
    Your book, or your copied code, contains typos. [eax 30h] is not valid assembler. – usr2564301 Aug 5 '14 at 22:12
  • I tried to make this question a bit better (a lot of work... indeed). Even if it was extremely badly asked, I think that this anti-debug trick (and the answer of broadway) worth to be mentioned. I propose to reopen the question now. – perror Aug 6 '14 at 16:54
7

The syntax is incorrect, but the code is basically what IsDebuggerPresent does.

  1. Get a pointer to the TEB (located at fs:18h)
  2. Get a pointer to the PEB (located at teb+30h)
  3. Check the BeingDebugged flag (located at peb+2)

The syntax should be something like:

mov     eax, large fs:18h
mov     eax, [eax+30h]
movzx   eax, byte ptr [eax+2]

If you don't understand assembler syntax, though, you're generally going to have a bad time when analyzing malware.

Not the answer you're looking for? Browse other questions tagged or ask your own question.