Re: [Qemu-devel] Darwin/Mac OS X Port

[Karel Gardas]

On Thu, 19 Feb 2004, Pierre d'Herbemont wrote:

> Hi all!
>
> I finally made the dyngen tool mach-o compatible. But it is still not
> working, when I do:
> i386-softmmu/qemu /path/to/linux.img -d
> I get two block of instructions translated, but it ends in a SIGBUS
> with the following backtrace:
>

Sorry, I'm completely begginer in using Qemu, but it looks like you have
not (qemu have not) translated x86 instructions into the ppc instructions.
At least when I do the oposite and use ppc linux binary and translate to
x86 linux calls the debug will looks like the output below, so in this
comparison your output is missing ``OUT:'' section...

If I'm wrong, please correct me, I would also like to know how to debug
Qemu better.

Cheers,

Karel
--
Karel Gardas                  address@hidden
ObjectSecurity Ltd.           http://www.objectsecurity.com


start    end      size     prot
10000000-1006d000 0006d000 r-x
1007c000-1007f000 00003000 rwx
4015b000-401db000 00080000 rw-
401db000-401dc000 00001000 ---
start_brk   0x1007e8c4
end_code    0x1007dcd0
start_code  0x10000000
end_data    0x1007dcd0
start_stack 0x401da5c0
brk         0x1007e8c4
entry       0x100000e0
----------------
nip=0x100000e0 super=0 ir=0
translate opcode 7c290b78 (1f 1c 0d)
----------------
nip=0x100000e4 super=0 ir=0
translate opcode 54210036 (15 1b 00)
----------------
nip=0x100000e8 super=0 ir=0
translate opcode 38000000 (0e 00 00)
----------------
nip=0x100000ec super=0 ir=0
translate opcode 9421fff0 (25 18 1f)
----------------
nip=0x100000f0 super=0 ir=0
translate opcode 7c0803a6 (1f 13 0e)
----------------
nip=0x100000f4 super=0 ir=0
translate opcode 90010000 (24 00 00)
----------------
nip=0x100000f8 super=0 ir=0
translate opcode 3d001006 (0f 03 00)
----------------
nip=0x100000fc super=0 ir=0
translate opcode 85a893e8 (21 14 0f)
----------------
nip=0x10000100 super=0 ir=0
translate opcode 480001b8 (12 1c 06)
---------------- excp: 0108
nip=0x100000e0 LR=0x00000000 CTR=0x00000000 XER=0x00000000 MSR=0x00004000
GPR00: 00000000 401da5c0 00000000 00000001 401da5c4 401da5cc 00000000 00000000
GPR08: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
GPR16: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
GPR24: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
CR: 0x00000000  [ -  -  -  -  -  -  -  -  ] TB: 0x00000000 00000000
FPR00: 0000000000000000 0000000000000000 0000000000000000 0000000000000000
FPR04: 0000000000000000 0000000000000000 0000000000000000 0000000000000000
FPR08: 0000000000000000 0000000000000000 0000000000000000 0000000000000000
FPR12: 0000000000000000 0000000000000000 0000000000000000 0000000000000000
SRR0 0x00000000 SRR1 0x00000000
reservation 0x00000000
IN: _start
0x100000e0:  mr r9,r1
0x100000e4:  rlwinm     r1,r1,0,0,27
0x100000e8:  li r0,0
0x100000ec:  stwu       r1,-16(r1)
0x100000f0:  mtlr       r0
0x100000f4:  stw        r0,0(r1)
0x100000f8:  lis        r8,4102
0x100000fc:  lwzu       r13,-27672(r8)
0x10000100:  b  100002B8

OP:
0x0000: load_gpr_T0_gpr1
0x0001: store_T0_gpr_gpr9
0x0002: load_gpr_T0_gpr1
0x0003: andi_ 0xfffffff0
0x0004: store_T0_gpr_gpr1
0x0005: set_T0 0x0
0x0006: store_T0_gpr_gpr0
0x0007: load_gpr_T0_gpr1
0x0008: addi 0xfffffff0
0x0009: load_gpr_T1_gpr1
0x000a: stw_raw
0x000b: store_T0_gpr_gpr1
0x000c: load_gpr_T0_gpr0
0x000d: andi_ 0xfffffffc
0x000e: store_lr
0x000f: load_gpr_T0_gpr1
0x0010: load_gpr_T1_gpr0
0x0011: stw_raw
0x0012: set_T0 0x10060000
0x0013: store_T0_gpr_gpr8
0x0014: load_gpr_T0_gpr8
0x0015: addi 0xffff93e8
0x0016: lwz_raw
0x0017: store_T1_gpr_gpr13
0x0018: store_T0_gpr_gpr8
0x0019: update_tb 0x9
0x001a: update_decr 0x9
0x001b: process_exceptions 0x10000100
0x001c: b 0x100002b8
0x001d: set_T0 0x0
0x001e: exit_tb
0x001f: end

OUT: [size=312]
0x80952500:  movl   0x4(%ebp),%ebx
0x80952503:  movl   %ebx,0x24(%ebp)
0x80952506:  movl   0x4(%ebp),%ebx
0x80952509:  andl   $0xfffffff0,%ebx
0x8095250f:  movl   %ebx,0x4(%ebp)
0x80952512:  movl   $0x0,%ebx
0x80952517:  movl   %ebx,0x0(%ebp)
0x8095251a:  movl   0x4(%ebp),%ebx
0x8095251d:  addl   $0xfffffff0,%ebx
0x80952523:  movl   0x4(%ebp),%esi
0x80952526:  movl   %esi,%eax
0x80952528:  movl   %esi,%edx
0x8095252a:  sarl   $0x18,%eax
0x8095252d:  movb   %al,(%ebx)
0x8095252f:  movl   %esi,%eax
0x80952531:  sarl   $0x10,%eax
0x80952534:  movb   %al,0x1(%ebx)
0x80952537:  movl   %esi,%eax
0x80952539:  sarl   $0x8,%eax
0x8095253c:  movb   %al,0x2(%ebx)
0x8095253f:  movb   %dl,0x3(%ebx)
0x80952542:  movl   %ebx,0x4(%ebp)
0x80952545:  movl   0x0(%ebp),%ebx
0x80952548:  andl   $0xfffffffc,%ebx
0x8095254e:  movl   %ebx,0x200(%ebp)
0x80952554:  movl   0x4(%ebp),%ebx
0x80952557:  movl   0x0(%ebp),%esi
0x8095255a:  movl   %esi,%eax
0x8095255c:  movl   %esi,%edx
0x8095255e:  sarl   $0x18,%eax
0x80952561:  movb   %al,(%ebx)
0x80952563:  movl   %esi,%eax
0x80952565:  sarl   $0x10,%eax
0x80952568:  movb   %al,0x1(%ebx)
0x8095256b:  movl   %esi,%eax
0x8095256d:  sarl   $0x8,%eax
0x80952570:  movb   %al,0x2(%ebx)
0x80952573:  movb   %dl,0x3(%ebx)
0x80952576:  movl   $0x10060000,%ebx
0x8095257b:  movl   %ebx,0x20(%ebp)
0x8095257e:  movl   0x20(%ebp),%ebx
0x80952581:  addl   $0xffff93e8,%ebx
0x80952587:  movzbl (%ebx),%edx
0x8095258a:  movzbl 0x1(%ebx),%eax
0x8095258e:  shll   $0x18,%edx
0x80952591:  shll   $0x10,%eax
0x80952594:  orl    %eax,%edx
0x80952596:  movzbl 0x2(%ebx),%eax
0x8095259a:  shll   $0x8,%eax
0x8095259d:  orl    %eax,%edx
0x8095259f:  movzbl 0x3(%ebx),%eax
0x809525a3:  movl   %edx,%esi
0x809525a5:  orl    %eax,%esi
0x809525a7:  movl   %esi,0x34(%ebp)
0x809525aa:  movl   %ebx,0x20(%ebp)
0x809525ad:  movl   0x208(%ebp),%ebx
0x809525b3:  movl   %ebx,%esi
0x809525b5:  leal   0x9(%ebx),%eax
0x809525bb:  cmpl   %esi,%eax
0x809525bd:  movl   %eax,%ebx
0x809525bf:  jae    0xffffffff809525d0
0x809525c1:  movl   0x20c(%ebp),%eax
0x809525c7:  incl   %eax
0x809525c8:  movl   %eax,%esi
0x809525ca:  movl   %eax,0x20c(%ebp)
0x809525d0:  movl   %ebx,0x208(%ebp)
0x809525d6:  subl   $0x4,%esp
0x809525d9:  movl   0x210(%ebp),%ebx
0x809525df:  movl   %ebx,%esi
0x809525e1:  movl   %ebx,%eax
0x809525e3:  subl   $0x9,%eax
0x809525e8:  cmpl   $0x9,%esi
0x809525ee:  movl   %eax,0x210(%ebp)
0x809525f4:  movl   %eax,%ebx
0x809525f6:  jae    0xffffffff80952606
0x809525f8:  movl   $0x9,(%esp,1)
0x809525ff:  call   0xffffffff8003eca0
0x80952604:  movl   %esi,%esi
0x80952606:  popl   %eax
0x80952607:  movl   0x1358(%ebp),%eax
0x8095260d:  testl  %eax,%eax
0x8095260f:  je     0xffffffff80952627
0x80952611:  movl   $0x10000100,%ecx
0x80952616:  movl   %ecx,0x1fc(%ebp)
0x8095261c:  call   0xffffffff8003ecc0
0x80952621:  leal   0x0(%esi),%esi
0x80952627:  movl   $0x100002b8,%eax
0x8095262c:  movl   %eax,0x1fc(%ebp)
0x80952632:  movl   $0x0,%ebx
0x80952637:  ret

----------------
nip=0x100002b8 super=0 ir=0
translate opcode 9421ffd0 (25 08 1f)
----------------
nip=0x100002bc super=0 ir=0
translate opcode 7c0802a6 (1f 13 0a)
----------------
nip=0x100002c0 super=0 ir=0
translate opcode 93210014 (24 0a 00)
----------------
nip=0x100002c4 super=0 ir=0
translate opcode 93410018 (24 0c 00)
----------------
nip=0x100002c8 super=0 ir=0
translate opcode 9361001c (24 0e 00)
----------------
nip=0x100002cc super=0 ir=0
translate opcode 93810020 (24 10 00)
----------------
nip=0x100002d0 super=0 ir=0
translate opcode 93a10024 (24 12 00)
----------------
nip=0x100002d4 super=0 ir=0
translate opcode 93c10028 (24 14 00)
----------------
nip=0x100002d8 super=0 ir=0
translate opcode 93e1002c (24 16 00)
----------------
nip=0x100002dc super=0 ir=0
translate opcode 90010034 (24 1a 00)
----------------
nip=0x100002e0 super=0 ir=0
translate opcode 7c791b78 (1f 1c 0d)
----------------
nip=0x100002e4 super=0 ir=0
translate opcode 7c9b2378 (1f 1c 0d)
----------------
nip=0x100002e8 super=0 ir=0
translate opcode 7cbf2b78 (1f 1c 0d)
----------------
nip=0x100002ec super=0 ir=0
translate opcode 7cdc3378 (1f 1c 0d)
----------------
nip=0x100002f0 super=0 ir=0
translate opcode 7cfd3b78 (1f 1c 0d)
----------------
nip=0x100002f4 super=0 ir=0
translate opcode 7d1a4378 (1f 1c 0d)
----------------
nip=0x100002f8 super=0 ir=0
translate opcode 7d3e4b78 (1f 1c 0d)
----------------
nip=0x100002fc super=0 ir=0
translate opcode 3d201008 (0f 04 00)
----------------
nip=0x10000300 super=0 ir=0
translate opcode 3809dc7c (0e 1e 11)
----------------
nip=0x10000304 super=0 ir=0
translate opcode 39600000 (0e 00 00)
----------------
nip=0x10000308 super=0 ir=0
translate opcode 2c000000 (0b 00 00)
----------------
nip=0x1000030c super=0 ir=0
translate opcode 41820014 (10 0a 00)
---------------- excp: 0108
nip=0x100002b8 LR=0x00000000 CTR=0x00000000 XER=0x00000000 MSR=0x00004000
GPR00: 00000000 401da5b0 00000000 00000001 401da5c4 401da5cc 00000000 00000000
GPR08: 100593e8 401da5c0 00000000 00000000 00000000 10085c48 00000000 00000000
GPR16: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
GPR24: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
CR: 0x00000000  [ -  -  -  -  -  -  -  -  ] TB: 0x00000000 00000009
FPR00: 0000000000000000 0000000000000000 0000000000000000 0000000000000000
FPR04: 0000000000000000 0000000000000000 0000000000000000 0000000000000000
FPR08: 0000000000000000 0000000000000000 0000000000000000 0000000000000000
FPR12: 0000000000000000 0000000000000000 0000000000000000 0000000000000000
SRR0 0x00000000 SRR1 0x00000000
reservation 0x00000000
IN: __libc_start_main
0x100002b8:  stwu       r1,-48(r1)
0x100002bc:  mflr       r0
0x100002c0:  stw        r25,20(r1)
0x100002c4:  stw        r26,24(r1)
0x100002c8:  stw        r27,28(r1)
0x100002cc:  stw        r28,32(r1)
0x100002d0:  stw        r29,36(r1)
0x100002d4:  stw        r30,40(r1)
0x100002d8:  stw        r31,44(r1)
0x100002dc:  stw        r0,52(r1)
0x100002e0:  mr r25,r3
0x100002e4:  mr r27,r4
0x100002e8:  mr r31,r5
0x100002ec:  mr r28,r6
0x100002f0:  mr r29,r7
0x100002f4:  mr r26,r8
0x100002f8:  mr r30,r9
0x100002fc:  lis        r9,4104
0x10000300:  addi       r0,r9,-9092
0x10000304:  li r11,0
0x10000308:  cmpwi      r0,0
0x1000030c:  beq        10000320

OP:
0x0000: load_gpr_T0_gpr1
0x0001: addi 0xffffffd0
0x0002: load_gpr_T1_gpr1
0x0003: stw_raw
0x0004: store_T0_gpr_gpr1
0x0005: load_lr
0x0006: store_T0_gpr_gpr0
0x0007: load_gpr_T0_gpr1
0x0008: addi 0x14
0x0009: load_gpr_T1_gpr25
0x000a: stw_raw
0x000b: load_gpr_T0_gpr1
0x000c: addi 0x18
0x000d: load_gpr_T1_gpr26
0x000e: stw_raw
0x000f: load_gpr_T0_gpr1
0x0010: addi 0x1c
0x0011: load_gpr_T1_gpr27
0x0012: stw_raw
0x0013: load_gpr_T0_gpr1
0x0014: addi 0x20
0x0015: load_gpr_T1_gpr28
0x0016: stw_raw
0x0017: load_gpr_T0_gpr1
0x0018: addi 0x24
0x0019: load_gpr_T1_gpr29
0x001a: stw_raw
0x001b: load_gpr_T0_gpr1
0x001c: addi 0x28
0x001d: load_gpr_T1_gpr30
0x001e: stw_raw
0x001f: load_gpr_T0_gpr1
0x0020: addi 0x2c
0x0021: load_gpr_T1_gpr31
0x0022: stw_raw
0x0023: load_gpr_T0_gpr1
0x0024: addi 0x34
0x0025: load_gpr_T1_gpr0
0x0026: stw_raw
0x0027: load_gpr_T0_gpr3
0x0028: store_T0_gpr_gpr25
0x0029: load_gpr_T0_gpr4
0x002a: store_T0_gpr_gpr27
0x002b: load_gpr_T0_gpr5
0x002c: store_T0_gpr_gpr31
0x002d: load_gpr_T0_gpr6
0x002e: store_T0_gpr_gpr28
0x002f: load_gpr_T0_gpr7
0x0030: store_T0_gpr_gpr29
0x0031: load_gpr_T0_gpr8
0x0032: store_T0_gpr_gpr26
0x0033: load_gpr_T0_gpr9
0x0034: store_T0_gpr_gpr30
0x0035: set_T0 0x10080000
0x0036: store_T0_gpr_gpr9
0x0037: load_gpr_T0_gpr9
0x0038: addi 0xffffdc7c
0x0039: store_T0_gpr_gpr0
0x003a: set_T0 0x0
0x003b: store_T0_gpr_gpr11
0x003c: load_gpr_T0_gpr0
0x003d: cmpi 0x0
0x003e: store_T0_crf_crf0
0x003f: update_tb 0x16
0x0040: update_decr 0x16
0x0041: process_exceptions 0x1000030c
0x0042: load_crf_T0_crf0
0x0043: b_true 0x10000310 0x10000320 0x2
0x0044: set_T0 0x0
0x0045: exit_tb
0x0046: end

OUT: [size=644]
0x80952640:  movl   0x4(%ebp),%ebx
0x80952643:  addl   $0xffffffd0,%ebx
0x80952649:  movl   0x4(%ebp),%esi
0x8095264c:  movl   %esi,%eax
0x8095264e:  movl   %esi,%edx
0x80952650:  sarl   $0x18,%eax
0x80952653:  movb   %al,(%ebx)
0x80952655:  movl   %esi,%eax
0x80952657:  sarl   $0x10,%eax
0x8095265a:  movb   %al,0x1(%ebx)
0x8095265d:  movl   %esi,%eax
0x8095265f:  sarl   $0x8,%eax
0x80952662:  movb   %al,0x2(%ebx)
0x80952665:  movb   %dl,0x3(%ebx)
0x80952668:  movl   %ebx,0x4(%ebp)
0x8095266b:  movl   0x200(%ebp),%ebx
0x80952671:  movl   %ebx,0x0(%ebp)
0x80952674:  movl   0x4(%ebp),%ebx
0x80952677:  addl   $0x14,%ebx
0x8095267d:  movl   0x64(%ebp),%esi
0x80952680:  movl   %esi,%eax
0x80952682:  movl   %esi,%edx
0x80952684:  sarl   $0x18,%eax
0x80952687:  movb   %al,(%ebx)
0x80952689:  movl   %esi,%eax
0x8095268b:  sarl   $0x10,%eax
0x8095268e:  movb   %al,0x1(%ebx)
0x80952691:  movl   %esi,%eax
0x80952693:  sarl   $0x8,%eax
0x80952696:  movb   %al,0x2(%ebx)
0x80952699:  movb   %dl,0x3(%ebx)
0x8095269c:  movl   0x4(%ebp),%ebx
0x8095269f:  addl   $0x18,%ebx
0x809526a5:  movl   0x68(%ebp),%esi
0x809526a8:  movl   %esi,%eax
0x809526aa:  movl   %esi,%edx
0x809526ac:  sarl   $0x18,%eax
0x809526af:  movb   %al,(%ebx)
0x809526b1:  movl   %esi,%eax
0x809526b3:  sarl   $0x10,%eax
0x809526b6:  movb   %al,0x1(%ebx)
0x809526b9:  movl   %esi,%eax
0x809526bb:  sarl   $0x8,%eax
0x809526be:  movb   %al,0x2(%ebx)
0x809526c1:  movb   %dl,0x3(%ebx)
0x809526c4:  movl   0x4(%ebp),%ebx
0x809526c7:  addl   $0x1c,%ebx
0x809526cd:  movl   0x6c(%ebp),%esi
0x809526d0:  movl   %esi,%eax
0x809526d2:  movl   %esi,%edx
0x809526d4:  sarl   $0x18,%eax
0x809526d7:  movb   %al,(%ebx)
0x809526d9:  movl   %esi,%eax
0x809526db:  sarl   $0x10,%eax
0x809526de:  movb   %al,0x1(%ebx)
0x809526e1:  movl   %esi,%eax
0x809526e3:  sarl   $0x8,%eax
0x809526e6:  movb   %al,0x2(%ebx)
0x809526e9:  movb   %dl,0x3(%ebx)
0x809526ec:  movl   0x4(%ebp),%ebx
0x809526ef:  addl   $0x20,%ebx
0x809526f5:  movl   0x70(%ebp),%esi
0x809526f8:  movl   %esi,%eax
0x809526fa:  movl   %esi,%edx
0x809526fc:  sarl   $0x18,%eax
0x809526ff:  movb   %al,(%ebx)
0x80952701:  movl   %esi,%eax
0x80952703:  sarl   $0x10,%eax
0x80952706:  movb   %al,0x1(%ebx)
0x80952709:  movl   %esi,%eax
0x8095270b:  sarl   $0x8,%eax
0x8095270e:  movb   %al,0x2(%ebx)
0x80952711:  movb   %dl,0x3(%ebx)
0x80952714:  movl   0x4(%ebp),%ebx
0x80952717:  addl   $0x24,%ebx
0x8095271d:  movl   0x74(%ebp),%esi
0x80952720:  movl   %esi,%eax
0x80952722:  movl   %esi,%edx
0x80952724:  sarl   $0x18,%eax
0x80952727:  movb   %al,(%ebx)
0x80952729:  movl   %esi,%eax
0x8095272b:  sarl   $0x10,%eax
0x8095272e:  movb   %al,0x1(%ebx)
0x80952731:  movl   %esi,%eax
0x80952733:  sarl   $0x8,%eax
0x80952736:  movb   %al,0x2(%ebx)
0x80952739:  movb   %dl,0x3(%ebx)
0x8095273c:  movl   0x4(%ebp),%ebx
0x8095273f:  addl   $0x28,%ebx
0x80952745:  movl   0x78(%ebp),%esi
0x80952748:  movl   %esi,%eax
0x8095274a:  movl   %esi,%edx
0x8095274c:  sarl   $0x18,%eax
0x8095274f:  movb   %al,(%ebx)
0x80952751:  movl   %esi,%eax
0x80952753:  sarl   $0x10,%eax
0x80952756:  movb   %al,0x1(%ebx)
0x80952759:  movl   %esi,%eax
0x8095275b:  sarl   $0x8,%eax
0x8095275e:  movb   %al,0x2(%ebx)
0x80952761:  movb   %dl,0x3(%ebx)
0x80952764:  movl   0x4(%ebp),%ebx
0x80952767:  addl   $0x2c,%ebx
0x8095276d:  movl   0x7c(%ebp),%esi
0x80952770:  movl   %esi,%eax
0x80952772:  movl   %esi,%edx
0x80952774:  sarl   $0x18,%eax
0x80952777:  movb   %al,(%ebx)
0x80952779:  movl   %esi,%eax
0x8095277b:  sarl   $0x10,%eax
0x8095277e:  movb   %al,0x1(%ebx)
0x80952781:  movl   %esi,%eax
0x80952783:  sarl   $0x8,%eax
0x80952786:  movb   %al,0x2(%ebx)
0x80952789:  movb   %dl,0x3(%ebx)
0x8095278c:  movl   0x4(%ebp),%ebx
0x8095278f:  addl   $0x34,%ebx
0x80952795:  movl   0x0(%ebp),%esi
0x80952798:  movl   %esi,%eax
0x8095279a:  movl   %esi,%edx
0x8095279c:  sarl   $0x18,%eax
0x8095279f:  movb   %al,(%ebx)
0x809527a1:  movl   %esi,%eax
0x809527a3:  sarl   $0x10,%eax
0x809527a6:  movb   %al,0x1(%ebx)
0x809527a9:  movl   %esi,%eax
0x809527ab:  sarl   $0x8,%eax
0x809527ae:  movb   %al,0x2(%ebx)
0x809527b1:  movb   %dl,0x3(%ebx)
0x809527b4:  movl   0xc(%ebp),%ebx
0x809527b7:  movl   %ebx,0x64(%ebp)
0x809527ba:  movl   0x10(%ebp),%ebx
0x809527bd:  movl   %ebx,0x6c(%ebp)
0x809527c0:  movl   0x14(%ebp),%ebx
0x809527c3:  movl   %ebx,0x7c(%ebp)
0x809527c6:  movl   0x18(%ebp),%ebx
0x809527c9:  movl   %ebx,0x70(%ebp)
0x809527cc:  movl   0x1c(%ebp),%ebx
0x809527cf:  movl   %ebx,0x74(%ebp)
0x809527d2:  movl   0x20(%ebp),%ebx
0x809527d5:  movl   %ebx,0x68(%ebp)
0x809527d8:  movl   0x24(%ebp),%ebx
0x809527db:  movl   %ebx,0x78(%ebp)
0x809527de:  movl   $0x10080000,%ebx
0x809527e3:  movl   %ebx,0x24(%ebp)
0x809527e6:  movl   0x24(%ebp),%ebx
0x809527e9:  addl   $0xffffdc7c,%ebx
0x809527ef:  movl   %ebx,0x0(%ebp)
0x809527f2:  movl   $0x0,%ebx
0x809527f7:  movl   %ebx,0x2c(%ebp)
0x809527fa:  movl   0x0(%ebp),%ebx
0x809527fd:  cmpl   $0x0,%ebx
0x80952803:  jnl    0xffffffff8095280d
0x80952805:  movl   $0x8,%ebx
0x8095280a:  jmp    0xffffffff8095281c
0x8095280c:  nop
0x8095280d:  xorl   %eax,%eax
0x8095280f:  cmpl   $0x0,%ebx
0x80952815:  setg   %al
0x80952818:  leal   0x2(%eax,%eax,1),%ebx
0x8095281c:  movb   %bl,0x1ec(%ebp)
0x80952822:  movl   0x208(%ebp),%ebx
0x80952828:  movl   %ebx,%esi
0x8095282a:  leal   0x16(%ebx),%eax
0x80952830:  cmpl   %esi,%eax
0x80952832:  movl   %eax,%ebx
0x80952834:  jae    0xffffffff80952845
0x80952836:  movl   0x20c(%ebp),%eax
0x8095283c:  incl   %eax
0x8095283d:  movl   %eax,%esi
0x8095283f:  movl   %eax,0x20c(%ebp)
0x80952845:  movl   %ebx,0x208(%ebp)
0x8095284b:  subl   $0x4,%esp
0x8095284e:  movl   0x210(%ebp),%ebx
0x80952854:  movl   %ebx,%esi
0x80952856:  movl   %ebx,%eax
0x80952858:  subl   $0x16,%eax
0x8095285d:  cmpl   $0x16,%esi
0x80952863:  movl   %eax,0x210(%ebp)
0x80952869:  movl   %eax,%ebx
0x8095286b:  jae    0xffffffff8095287b
0x8095286d:  movl   $0x9,(%esp,1)
0x80952874:  call   0xffffffff8003eca0
0x80952879:  movl   %esi,%esi
0x8095287b:  popl   %eax
0x8095287c:  movl   0x1358(%ebp),%eax
0x80952882:  testl  %eax,%eax
0x80952884:  je     0xffffffff8095289c
0x80952886:  movl   $0x1000030c,%ecx
0x8095288b:  movl   %ecx,0x1fc(%ebp)
0x80952891:  call   0xffffffff8003ecc0
0x80952896:  leal   0x0(%esi),%esi
0x8095289c:  movzbl 0x1ec(%ebp),%ebx
0x809528a3:  testl  $0x2,%ebx
0x809528a9:  je     0xffffffff809528b3
0x809528ab:  movl   $0x10000320,%eax
0x809528b0:  jmp    0xffffffff809528b8
0x809528b2:  nop
0x809528b3:  movl   $0x10000310,%eax
0x809528b8:  movl   %eax,0x1fc(%ebp)
0x809528be:  movl   $0x0,%ebx
0x809528c3:  ret

[...snipped...]