While reading a book it mentioned that the following code is usually used to as an antidebugger mov     eax,   large fs:18hmov     eax,   [eax+30h]movzx   eax,   byte ptr [eax+2]retnI don't understand what are the keywords large , byte, ptr and retn. I am new learner of assembly and its usage in malware.
How does this test for debugger
assembly;malware;anti debugging
The syntax is incorrect, but the code is basically what IsDebuggerPresent does.Get a pointer to the TEB (located at fs:18h)Get a pointer to the PEB (located at teb+30h)Check the BeingDebugged flag (located at peb+2)The syntax should be something like:mov     eax, large fs:18hmov     eax, [eax+30h]movzx   eax, byte ptr [eax+2]If you don't understand assembler syntax, though, you're generally going to have a bad time when analyzing malware.