Log in

View Full Version : use INT 1 to detect SoftICE


Solomon
December 5th, 2001, 04:04
I saw a prog uses the following code(from SplAj several months ago) to detect debugger:

INT 1
CMP AL, 51H
jz SoftICE_not_found

int 1 is a single-step interrupt. I just can't understand the magic byte 0x51. Any description about it? Thx

tsehp
December 5th, 2001, 04:32
int 1 triggers sice handler if loaded.
this ax value could have been set by the program's own handler.
But if sice is loaded, the program's seh handler will not be called, that makes the point.

Solomon
December 5th, 2001, 05:10
I got it. thx