- #1
Stephanus
- 1,316
- 104
Dear PF Forum,
How does debugger in x86 process trace with single trap interrupt?
Supposed I have a simple program like this.
And a debugger would like to trace line 0103: mov BX,0020.
So it has to single trap this instruction.
So, after hooking int 1.
Then does the debugger do something like this?
And after this the int 1 handler restore the value that was in [0102] and process debugging procedure?
I have suspected that, but I need a clear confirmation. Perhaps anyone has any idea?
Thank you very much
How does debugger in x86 process trace with single trap interrupt?
Supposed I have a simple program like this.
Code:
0100 B81000 mov AX,0010
0103 BB2000 mov BX,0020
0106 B93000 mov CX,0030
0109 BA4000 mov DX,0040
010C CD20 int 20
So it has to single trap this instruction.
So, after hooking int 1.
Then does the debugger do something like this?
Code:
mov byte ptr [0102],9D ; the opcode for POPF
pushf
pop AX ; save the flag register int AX
or AX,100h ; set the TF bit
push ax
jmp 0102
I have suspected that, but I need a clear confirmation. Perhaps anyone has any idea?
Thank you very much