3 ms·

What am I missing here, isn't int3 used for debugging purposes?

• burfog 9y ago
  One use of int3 is debugging. That is the originally intended use. You can use it for other things. It gets used for multi-threaded self-modifying code. Simply modifying the code can cause a crash due to an intermediate state. There are caches and there is an instruction prefetcher. To deal with this, first write out an int3 on the first byte of the instruction you wish to replace. The CPU is careful not to screw up in this case because int3 has to work for debugging. Next, update the rest of the instruction as desired, and then write the first byte over the int3. If the int3 happens to get hit by the other thread, just have the debug exception do nothing. The carefulness around int3 will stop speculation. That is what is needed for a retpoline. People have also used int3 for things related to copy protection. You could be silly and write an OS that used int3 to do system calls.
  • rjzzleep 9y ago
    Perfect, thanks for the summary.
  • jacquesm 9y ago
    > If the int3 happens to get hit by the other thread, just have the debug exception do nothing. Doesn't that potentially crash the other thread because the rest of the instruction is still there?
    • burfog 9y ago
      No, but it might if something other than an int3 were used. The particular byte value being written actually matters on some Intel processors. You have to first put 0xCC over the first byte of the opcode you want to modify. You can then freely mess with the rest of the instruction. After that, you make the first byte be what you actually want. There is a discussion about it on the linux-kernel mailing list. Maybe you can find it.