[Qemu-devel] trigger a fault in host OS

[sebastien Josse]

Hello,

I’m trying to inject code in WinXP host operating system, starting from 
intermediate code.

My objective is to trigger a page fault handler from the guest operating 
system, in such a way I can read memory with cpu_memory_rw_debug without 
error.

The idea is :

  1. read memory in some location.
  2. if cpu_memory_rw_debug return code !=0
        1. forge a page fault intermediate code buffer
        2. transform the intermediate code in host code with dyngen_code()
        3. execute the host code buffer
  3. attempt to read memory another time

I haven’t problem while making the intermediate code buffer :

opc_buf[]

opparam_buf[]

and forge a host code buffer with dyngen_code() :

code_buf[]

The problems arise when I want it to be executed by the host operating 
system (step 2.c).

If I use neutral instructions, like:

opc_buf[0]=INDEX_nop;

opc_buf[1]=INDEX_op_exit_tb;

opc_buf[2]=INDEX_op_end;

I haven’t problem.

But if I trigger a fault, by using INDEX_op_ldsb_kernel_, etc.

Then Qemu seems to enter an infinite loop.

Do you see a solution to this problem ?

Thanks a lot.

Sebastien.