Debugging

The x86 Interrupt Descriptor Table

On Intel x86 platforms, the interrupt handlers INT 1 and INT3 of the Interrupt Descriptor Table (IDT) are used to support debugging (instruction-level single-stepping and breakpoints, respectively).

Phrack 59:4Handling Interrupt Descriptor Table for fun and profit

This article explains the internals of IDT.

Phrack 59:10Execution path analysis: finding kernel based rootkits

provides more details on manipulating the IDT.

Intel CPU debug registers

Phrack 65:8Mistifying the debugger, ultimate stealthiness

This article explains the DR debug registers on Intel x86 systems, their use and abuse.

Reverse engineering Skype

Reverse engineering Skype has required creation of a new kernel-level debugger: http://rr0d.droids-corp.org/ .
The slides explain its design and challenges involved.

Talks on reverse engineering Skype:

Unless otherwise stated, the content of this page is licensed under Creative Commons Attribution-ShareAlike 3.0 License