|
|
|
|
|
X86-intINT is an assembly language instruction for x86 processors for generating a software interrupts. It takes one argument that must be a constant byte value. (This should not be confused with the concept of a hardware interrupt.) Depending on the writer and the context, a software interrupt is usually referred to in hexadecimal, either with a prefix 0x or the suffix h (i.e. interrupt 0x21, interrupt 21h). When done in assembly language code, the instruction is written like this: -
INT X Where X is the software interrupt that should be generated. For example: -
INT 0x40 Will generate interrupt 0x40. (See hexadecimal) Realmode when generating a software interrupt, the processor calls one of the 256 functions pointed to by the interrupt address table (which is located in the first 2048 bytes of memory). It is therefore entirely possible to use a x86-call instruction to call the interrupt-function manually. One of the most useful software interrupts was interrupt 0x21. By calling it with different parameters in the registers (mostly ah and al) you could access various IO-operations, string output and more. A common way to make a virus for computers running DOS was to hook the 0x21 interrupt by modifying the interrupt address table so that the virus code would be called before the interrupt. Then an unsuspecting program would call the 0x21 interrupt and request for a file to be opened and the virus would check if the requested file was an executable and then insert its code into it. Most Unix systems and derivates do not use software interrupts, although Linux allows programs to use interrupt 0x80 to make system calls. This is accomplished by entering a 32-bit value corresponding to a kernel function into the EAX register of the processor and then executing INT 0x80.
|
 |
| |
|
|