[Qemu-devel] [Bug 661696] Re: incomplete emulation of fstenv under TCG

[Morten Shearman Kirkegaard]

I've had quite some problems with this bug as well. It would be really
nice if it could be fixed.

I have ported Chalkerx's patch to QEMU-1.5.0. The patch is attached.

// MOKI

** Patch added: "patch-qemu-1.5.0-fpip.diff"
   
https://bugs.launchpad.net/qemu/+bug/661696/+attachment/3683865/+files/patch-qemu-1.5.0-fpip.diff

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/661696

Title:
  incomplete emulation of fstenv under TCG

Status in QEMU:
  New

Bug description:
  Steps to reproduce:

  1) Install Windows (tried XP and 7) in qemu (tried qemu without kvm
  and qemu-kvm).

  2) Get OllyDbg ( http://ollydbg.de/odbg200.zip ).

  3) Use some Metasploit-encoded file, example included.

  It is not a virus!

  File was generated with Metasploit, command (if i remember it right):
  `msfpayload windows/exec cmd=notepad R | msfencode -e
  x86/shikata_ga_nai -t exe -o cmd_exec_notepad.shikata_ga_nai.exe`.

  4) Launch the file under Windows in qemu, make sure it opens a
  notepad.

  5) Open file under OllyDbg, run (F9) it there. It opens a notpad.
  Close OllyDbg.

  6) Open file under OllyDbg, trace over (Ctrl+F12) it there. It fails with 
`Access violation when writing to [some address]`.
  Command: 316A 13, XOR DWORD PTR DS:[EDX+13],EBP 

  Under native Windows, the trace over command works fine.

  Under VMware the trace works fine.
  Under VirtualBox it also fails (checked in the spring).

  $ qemu-kvm --version
  QEMU PC emulator version 0.12.5 (qemu-kvm-0.12.5), Copyright (c) 2003-2008 
Fabrice Bellard

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/661696/+subscriptions