I can only provide this shellcode right here. \x89\xe1\xd9\xcd\xd9\x71\xf4\x5d\x55\x59\x49\x49\x49\x49\x49\x49" \ "\x49\x49\x49\x49\x43\x43\x43\x43\x43\x43\x37\x51\x5a\x6a\x41\x58" \ "\x50\x30\x41\x30\x41\x6b\x41\x41\x51\x32\x41\x42\x32\x42\x42\x30" \ "\x42\x42\x41\x42\x58\x50\x38\x41\x42\x75\x4a\x49\x51\x51\x51\x52" \ "\x47\x33\x47\x34\x51\x55\x51\x56\x50\x47\x47\x38\x47\x39\x50\x4a" \ "\x50\x4b\x50\x4c\x50\x4d\x50\x4e\x50\x4f\x50\x50\x50\x31\x47\x42" \ "\x47\x42\x50\x34\x50\x5a\x50\x45\x51\x52\x46\x32\x47\x31\x50\x4d" \ "\x51\x51\x50\x4e\x41\x41
This code runs normally in a debugger when executed on a real CPU. Here is the disassembly of the relevant parts. mov ecx,esp fxch st5 fnstenv dword ptr ds:[ecx-C] pop ebp push ebp pop ecx dec ecx dec ecx dec ecx dec ecx dec ecx dec ecx dec ecx dec ecx dec ecx dec ecx inc ebx inc ebx inc ebx inc ebx inc ebx inc ebx aaa push ecx pop edx push 41 pop eax push eax xor byte ptr ds:[ecx+30],al inc ecx imul eax,dword ptr ds:[ecx+41],51 <-- should multiply with 0x10, not 0x51. The code is position independent. On 14 January 2016 at 16:36, Peter Maydell <peter.mayd...@linaro.org> wrote: > On 14 January 2016 at 14:29, farmdve <farm...@gmail.com> wrote: > > Again, sorry for the personal message, Peter, Google really is failing > here, > > more so than me. > > There's a "Default reply behaviour" setting in Settings->General > in gmail that you can use to make it default to reply-to-all > rather than just reply if you prefer that. > > > But in my case, an instruction did forward modify some code, but > > this if statement did not execute and QEMU executed the old code. > > Can't really diagnose this without a test case. But the > if condition is pretty trivial and very unlikely to be wrong. > > thanks > -- PMM >
