Re: [Qemu-devel] Question regarding self-modifying code.

[farmdve <farmdve@gmail.com>]

[-- Attachment #1: Type: text/plain, Size: 1780 bytes --]

I can only provide this shellcode right here.

\x89\xe1\xd9\xcd\xd9\x71\xf4\x5d\x55\x59\x49\x49\x49\x49\x49\x49" \
"\x49\x49\x49\x49\x43\x43\x43\x43\x43\x43\x37\x51\x5a\x6a\x41\x58" \
"\x50\x30\x41\x30\x41\x6b\x41\x41\x51\x32\x41\x42\x32\x42\x42\x30" \
"\x42\x42\x41\x42\x58\x50\x38\x41\x42\x75\x4a\x49\x51\x51\x51\x52" \
"\x47\x33\x47\x34\x51\x55\x51\x56\x50\x47\x47\x38\x47\x39\x50\x4a" \
"\x50\x4b\x50\x4c\x50\x4d\x50\x4e\x50\x4f\x50\x50\x50\x31\x47\x42" \
"\x47\x42\x50\x34\x50\x5a\x50\x45\x51\x52\x46\x32\x47\x31\x50\x4d" \
"\x51\x51\x50\x4e\x41\x41

This code runs normally in a debugger when executed on a real CPU.

Here is the disassembly of the relevant parts.

mov ecx,esp
fxch st5
fnstenv dword ptr ds:[ecx-C]
pop ebp
push ebp
pop ecx
dec ecx
dec ecx
dec ecx
dec ecx
dec ecx
dec ecx
dec ecx
dec ecx
dec ecx
dec ecx
inc ebx
inc ebx
inc ebx
inc ebx
inc ebx
inc ebx
aaa
push ecx
pop edx
push 41
pop eax
push eax
xor byte ptr ds:[ecx+30],al
inc ecx
imul eax,dword ptr ds:[ecx+41],51 <-- should multiply with 0x10, not 0x51.

The code is position independent.

On 14 January 2016 at 16:36, Peter Maydell <peter.maydell@linaro.org> wrote:

> On 14 January 2016 at 14:29, farmdve <farmdve@gmail.com> wrote:
> > Again, sorry for the personal message, Peter, Google really is failing
> here,
> > more so than me.
>
> There's a "Default reply behaviour" setting in Settings->General
> in gmail that you can use to make it default to reply-to-all
> rather than just reply if you prefer that.
>
> > But in my case, an instruction did forward modify some code, but
> > this if statement did not execute and QEMU executed the old code.
>
> Can't really diagnose this without a test case. But the
> if condition is pretty trivial and very unlikely to be wrong.
>
> thanks
> -- PMM
>

[-- Attachment #2: Type: text/html, Size: 2834 bytes --]