INT3

INT3 raises the breakpoint exception, #BP (vector 3), as a trap: the handler sees RIP pointing past the instruction, so returning from it resumes the program. Its encoding, the single byte CC, is the point: it can overwrite the first byte of any instruction, even a one-byte one, without touching the next, and that is how debuggers set software breakpoints.

How a debugger uses it#

To stop at an address, a debugger saves the byte there and writes CC in its place. When the program reaches it, the trap reports a RIP one byte too far, so the debugger moves RIP back, puts the original byte back, executes that one instruction under single-step, and writes CC again. The debug registers give only four breakpoints without modifying code (Intel’s Volume 3); INT3 has no such limit. Zen 5 recorded #BP for each case of the Operation section.

INT3 is not INT 3#

INT with an operand of 3 encodes as CD 03, two bytes, and reaches the same vector, but it is a different instruction. The GNU assembler and Clang’s both turn int 3 into CC, as Intel’s manual says of Intel’s and Microsoft’s, so CD 03 comes only from hand-coded bytes. In virtual-8086 mode INT3 skips the IOPL check and the redirection of the mode’s extensions that INT n undergoes, and FRED delivers it as a software exception rather than a software interrupt. Elsewhere, both check the gate’s privilege, which operating systems set so that user code may raise #BP. INT1 (F1) is the one-byte form for #DB, which Intel’s manual leaves to hardware debugging tools.

In compiled code#

• Clang 23’s __builtin_debugtrap() emits INT3 and carries on after it; __builtin_trap() emits UD2, which does not continue. GCC 14 has no __builtin_debugtrap.
• With -mharden-sls=all, GCC 14 and Clang 23 place an INT3 after every RET and indirect JMP, so that speculation running straight past the branch meets a trap instead of the code that happens to follow.

The instruction table of AMD’s Zen 5 guide lists INT, with INT3 among its forms, as microcoded.

Forms

Latency and throughput

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

g = gate(3)                      # as INT 3 (CD 03) reads it
if g >> 40 & 0xF not in (0xE, 0xF):
    fault(GP, 26)                # 8 * 3 + 2
if g >> 45 & 3 < CPL:
    fault(GP, 26)                # the gate's DPL, as for INT n
if g >> 47 & 1 == 0:
    fault(NP, 26)
interrupt(3)                     # #BP, a trap: the handler returns to
                                 # the next instruction
# one byte, CC, which can take the place of the first byte of any
# instruction. In virtual-8086 mode, unlike CD 03, it ignores IOPL
# and the redirection bitmap of the mode's extensions

Operands

Flags

Attributes

What else XED records about the forms. How to read.

All forms

may abort a TSX transaction

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.

More General-purpose instructions

• CMP
• CMPS
• CMPXCHG
• CMPXCHG8B
• CPUID
• CQO
• CWD
• CWDE
• DAA
• DAS
• DEC
• DIV
• ENTER
• IDIV
• IMUL
• IN
• INC
• INS
• INT
• INT1
• INTO
• IRET
• Jcc
• JCXZ
• JECXZ
• JMP
• JRCXZ
• LDS
• LEA
• LEAVE
• LES
• LFS
• LGS
• LODS
• LOOP
• LOOPE
• LOOPNE
• LSS
• MOV
• MOVS

All 109 General-purpose instructions