2026-10-30

How to trigger signals on Linux i386 without calling a syscall

This blog post explains how to reliably trigger various signals on Linux i386 using only CPU instructions, without calling a syscall (such as kill(2)). The signals not mentioned below are harder to trigger. There are many ways to trigger the same signal; minimum-length byte sequences are shown below.

Illegal instruction == SIGILL == 4

Byte sequence: db 0fh, 0bh
32-bit disassembly: ud2

Trace/breakpoint trap == SIGTRAP == 5

Byte sequence: db 0cch
32-bit disassembly: int3

Floating point exception == SIGFPE == 8

Byte sequence: db 0d4h, 0
32-bit disassembly: aam 0

Segmentation fault == SIGSEGV == 11

Byte sequence: db 0f4h
32-bit disassembly: hlt

No comments: