From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([208.118.235.92]:36659) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1aJjZu-0003fv-RT for qemu-devel@nongnu.org; Thu, 14 Jan 2016 10:12:47 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1aJjZt-0003xp-Mf for qemu-devel@nongnu.org; Thu, 14 Jan 2016 10:12:46 -0500 Received: from mail-wm0-x235.google.com ([2a00:1450:400c:c09::235]:34122) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1aJjZt-0003xc-C8 for qemu-devel@nongnu.org; Thu, 14 Jan 2016 10:12:45 -0500 Received: by mail-wm0-x235.google.com with SMTP id u188so351885541wmu.1 for ; Thu, 14 Jan 2016 07:12:45 -0800 (PST) MIME-Version: 1.0 In-Reply-To: References: Date: Thu, 14 Jan 2016 17:12:41 +0200 Message-ID: From: farmdve Content-Type: multipart/alternative; boundary=001a114b1c24ca4ef905294cb70b Subject: Re: [Qemu-devel] Question regarding self-modifying code. List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: QEMU Developers --001a114b1c24ca4ef905294cb70b Content-Type: text/plain; charset=UTF-8 I can only provide this shellcode right here. \x89\xe1\xd9\xcd\xd9\x71\xf4\x5d\x55\x59\x49\x49\x49\x49\x49\x49" \ "\x49\x49\x49\x49\x43\x43\x43\x43\x43\x43\x37\x51\x5a\x6a\x41\x58" \ "\x50\x30\x41\x30\x41\x6b\x41\x41\x51\x32\x41\x42\x32\x42\x42\x30" \ "\x42\x42\x41\x42\x58\x50\x38\x41\x42\x75\x4a\x49\x51\x51\x51\x52" \ "\x47\x33\x47\x34\x51\x55\x51\x56\x50\x47\x47\x38\x47\x39\x50\x4a" \ "\x50\x4b\x50\x4c\x50\x4d\x50\x4e\x50\x4f\x50\x50\x50\x31\x47\x42" \ "\x47\x42\x50\x34\x50\x5a\x50\x45\x51\x52\x46\x32\x47\x31\x50\x4d" \ "\x51\x51\x50\x4e\x41\x41 This code runs normally in a debugger when executed on a real CPU. Here is the disassembly of the relevant parts. mov ecx,esp fxch st5 fnstenv dword ptr ds:[ecx-C] pop ebp push ebp pop ecx dec ecx dec ecx dec ecx dec ecx dec ecx dec ecx dec ecx dec ecx dec ecx dec ecx inc ebx inc ebx inc ebx inc ebx inc ebx inc ebx aaa push ecx pop edx push 41 pop eax push eax xor byte ptr ds:[ecx+30],al inc ecx imul eax,dword ptr ds:[ecx+41],51 <-- should multiply with 0x10, not 0x51. The code is position independent. On 14 January 2016 at 16:36, Peter Maydell wrote: > On 14 January 2016 at 14:29, farmdve wrote: > > Again, sorry for the personal message, Peter, Google really is failing > here, > > more so than me. > > There's a "Default reply behaviour" setting in Settings->General > in gmail that you can use to make it default to reply-to-all > rather than just reply if you prefer that. > > > But in my case, an instruction did forward modify some code, but > > this if statement did not execute and QEMU executed the old code. > > Can't really diagnose this without a test case. But the > if condition is pretty trivial and very unlikely to be wrong. > > thanks > -- PMM > --001a114b1c24ca4ef905294cb70b Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
I can only provide this shellcode right here.

\x89\xe1\xd9\xcd\xd9\x71\xf4\x5d\x55\x59\x49\x49\x49\x49\x49\x4= 9" \
"\x49\x49\x49\x49\x43\x43\x43\x43\x43\x43\x37\x51\= x5a\x6a\x41\x58" \
"\x50\x30\x41\x30\x41\x6b\x41\x41\x5= 1\x32\x41\x42\x32\x42\x42\x30" \
"\x42\x42\x41\x42\x58\= x50\x38\x41\x42\x75\x4a\x49\x51\x51\x51\x52" \
"\x47\x3= 3\x47\x34\x51\x55\x51\x56\x50\x47\x47\x38\x47\x39\x50\x4a" \
"\x50\x4b\x50\x4c\x50\x4d\x50\x4e\x50\x4f\x50\x50\x50\x31\x47\x42&quo= t; \
"\x47\x42\x50\x34\x50\x5a\x50\x45\x51\x52\x46\x32\x47\x= 31\x50\x4d" \
"\x51\x51\x50\x4e\x41\x41

This code runs normally in a debugger when executed on a re= al CPU.

Here is the disassembly of the relevant pa= rts.

mov ecx,esp
fxch st5
fnstenv dword ptr ds:[ecx-C]
pop ebp
push ebp
pop ecx
dec ecx
dec ecx
dec ecx
d= ec ecx
dec ecx
dec ecx
dec ecx
dec = ecx
dec ecx
dec ecx
inc ebx
inc ebx=
inc ebx
inc ebx
inc ebx
inc ebx
aaa
push ecx
pop edx
push 41
pop eax
push eax
xor byte ptr ds:[ecx+30],al
inc ecx
imul eax,dword ptr ds:[ecx+41],51 <-- should multipl= y with 0x10, not 0x51.

The code is position = independent.

On 14 January 2016 at 16:36, Peter Maydell <peter.maydell@li= naro.org> wrote:
On 14 January 2016 at 14:29, farmdve <farmdve@gmail.com> wrote:
> Again, sorry for the personal message, Peter, Google really is failing= here,
> more so than me.

There's a "Default reply behaviour" setting in Setting= s->General
in gmail that you can use to make it default to reply-to-all
rather than just reply if you prefer that.

> But in my case, an instruction did forward modify some code, but
> this if statement did not execute and QEMU executed the old code.

Can't really diagnose this without a test case. But the
if condition is pretty trivial and very unlikely to be wrong.

thanks
-- PMM

--001a114b1c24ca4ef905294cb70b--