INT (x86 instruction)

INT is an assembly language instruction for x86 processors for generating a software interrupt. It takes one argument that must be a constant byte value. [cite web |url=http://developer.intel.com/design/pentiumii/manuals/243191.htm|title=Intel Architecture Software Developer's Manual, Volume 2: Instruction Set Reference Manual|accessdate=2007-07-13] (This should not be confused with the concept of a hardware interrupt.) Depending on the writer and the context, a software interrupt is usually referred to in hexadecimal, either with a prefix "0x" or the suffix "h" (i.e. interrupt 0x21, interrupt 21h).

When done in assembly language code, the instruction is written like this:

:INT "X"

Where "X" is the software interrupt that should be generated. For example:

:INT 0x40

Will generate interrupt 0x40. (See hexadecimal)

Real mode

When generating a software interrupt, the processor calls one of the 256 functions pointed to by the interrupt address table, which is located in the first 1024 bytes of memory while in real mode (See Interrupt vector). It is therefore entirely possible to use an x86-call instruction to call the interrupt-function manually.

One of the most useful DOS software interrupts was interrupt 0x21. By calling it with different parameters in the registers (mostly ah and al) you could access various IO operations, string output and more. A common computer virus behavior for computers running DOS was to hook the 0x21 interrupt by modifying the interrupt address table so that the virus code would be called before the interrupt. Then, an unsuspecting program would call the 0x21 interrupt and request for a file to be opened. The virus would check if the requested file was an executable, and then insert its code into it.

Most Unix systems and derivatives do not use software interrupts, with the exception of interrupt 0x80, used to make system calls. This is accomplished by entering a 32-bit value corresponding to a kernel function into the EAX register of the processor and then executing INT 0x80.

INT 3

The INT 3 instruction is defined for use by debuggers to temporarily replacean instruction in a running program, in order to set a breakpoint. Other INT instructionsare encoded using two bytes. This makes them unsuitable for use in patching instructions (which can be one byte long).

The opcode for INT 3 is 0xCC, as opposite from the opcode for INT "immediate"', which is 0xCD imm8. According to Intel documentation: "Intel and Microsoft assemblers will not generate the CD03 opcode from any mnemonic" and 0xCC has some special features, which are not shared by "the "normal" 2-byte opcode for INT 3 (CD03)" [IA-32 Arch. Software Developer’s Manual. Vol. 2A]

See also

*INT 10
*INT 13
*Interrupt
*BIOS interrupt call
*Ralf Brown's Interrupt List

References