Inclusion of an `INT 2D` instruction appears to be a fairly common anti-debugging tactic used by Windows malware authors. From what I understand, it causes a process to act differently when a debugger is attached from when it is not attached.

I have read that this is due in part to an asynchronous (not part of normal program flow) increment to the instruction pointer. This increment can be made to lead to instruction scission.

Could someone explain this anti-debugging tactic, specifically *why* this increment to the instruction pointer occurs, and what happens when a debugger *is* and *is not* attached.