Quote:
Here it gives int ,why ? what does it mean ?
INT (Interrupt) 3 is inserted by debuggers when setting a breakpoint. Once that is hit, the debugger takes control and removes the INT 3 instruction by replacing it with the original code to allow continuation of the debugged process.
[EDIT]
Quote:
But I have not make a breakpoint when the os is running .
From the book Windows Internals Part 2 by Mark E Russinovich and others:
Quote:
In the case of a STATUS_BREAKPOINT exception, unassembling the address will confirm the presence of a breakpoint instruction. The processor instruction INT 3 is called the trap to debugger instruction. An INT 3 instruction, when executed, causes the system to call the kernel’s debugger exception handler. If a debugger is attached to the computer, the system will break in.
0: kd>
u 92c70a78
myfault+0xa78: 92c70a78 cc int 3
...
Breakpoints shouldn’t usually appear in retail versions of device drivers. Using the lm command, it’s sometimes possible to determine which environment a device driver was targeted for. When compiling a driver for release (and unless overridden by the developer), a flag is set indicating the release type. When viewing the File flags property, the presence of the word Debug indicates that the driver was built using a checked (or debug) environment.
[/EDIT]
Submit an article or tip