summary refs log tree commit diff stats
path: root/results/classifier/108/debug/661696
diff options
context:
space:
mode:
authorChristian Krinitsin <mail@krinitsin.com>2025-07-03 19:39:53 +0200
committerChristian Krinitsin <mail@krinitsin.com>2025-07-03 19:39:53 +0200
commitdee4dcba78baf712cab403d47d9db319ab7f95d6 (patch)
tree418478faf06786701a56268672f73d6b0b4eb239 /results/classifier/108/debug/661696
parent4d9e26c0333abd39bdbd039dcdb30ed429c475ba (diff)
downloademulator-bug-study-dee4dcba78baf712cab403d47d9db319ab7f95d6.tar.gz
emulator-bug-study-dee4dcba78baf712cab403d47d9db319ab7f95d6.zip
restructure results
Diffstat (limited to 'results/classifier/108/debug/661696')
-rw-r--r--results/classifier/108/debug/661696215
1 files changed, 0 insertions, 215 deletions
diff --git a/results/classifier/108/debug/661696 b/results/classifier/108/debug/661696
deleted file mode 100644
index 8f423a17..00000000
--- a/results/classifier/108/debug/661696
+++ /dev/null
@@ -1,215 +0,0 @@
-debug: 0.959
-device: 0.956
-semantic: 0.956
-other: 0.955
-PID: 0.955
-performance: 0.953
-graphic: 0.950
-network: 0.949
-files: 0.949
-socket: 0.934
-permissions: 0.922
-vnc: 0.916
-boot: 0.872
-KVM: 0.823
-
-incomplete emulation of fstenv under TCG
-
-Steps to reproduce:
-
-1) Install Windows (tried XP and 7) in qemu (tried qemu without kvm and qemu-kvm).
-
-2) Get OllyDbg ( http://ollydbg.de/odbg200.zip ).
-
-3) Use some Metasploit-encoded file, example included.
-
-It is not a virus!
-
-File was generated with Metasploit, command (if i remember it right): `msfpayload windows/exec cmd=notepad R | msfencode -e x86/shikata_ga_nai -t exe -o cmd_exec_notepad.shikata_ga_nai.exe`.
-
-4) Launch the file under Windows in qemu, make sure it opens a notepad.
-
-5) Open file under OllyDbg, run (F9) it there. It opens a notpad. Close OllyDbg.
-
-6) Open file under OllyDbg, trace over (Ctrl+F12) it there. It fails with `Access violation when writing to [some address]`.
-Command: 316A 13, XOR DWORD PTR DS:[EDX+13],EBP 
-
-Under native Windows, the trace over command works fine.
-
-Under VMware the trace works fine.
-Under VirtualBox it also fails (checked in the spring).
-
-$ qemu-kvm --version
-QEMU PC emulator version 0.12.5 (qemu-kvm-0.12.5), Copyright (c) 2003-2008 Fabrice Bellard
-
-
-
-
-
-http://imagebin.ca/view/zue0YNZ.html - This is VMware screenshot just before executing that command.
-
-Looks like something is wrong with EDX register in OllyDbg under QEMU. That register was popped as a result of FSTENV command.
-
-linux-user testcase:
-
-extern void *x;
-
-int main()
-{
-	int a;
-	asm volatile ("x: fldz\n\
-	     push %%edx\n\
-	     .byte 0xd9,0x74,0x24,0xf4\n\
-	     pop %%edx\n" : "=d" (a) : : "memory");
-	printf ("%x %x\n", a, &x);
-}
-
-yakj:~ pbonzini$ ./a.out 
-80483d9 80483d9
-yakj:~ pbonzini$ qemu-i386 ./a.out 
-0 80483d9
-
-
-On Sat, Oct 16, 2010 at 3:24 PM, Paolo Bonzini <email address hidden> wrote:
-> linux-user testcase:
->
-> extern void *x;
->
-> int main()
-> {
->        int a;
->        asm volatile ("x: fldz\n\
->             push %%edx\n\
->             .byte 0xd9,0x74,0x24,0xf4\n\
->             pop %%edx\n" : "=d" (a) : : "memory");
->        printf ("%x %x\n", a, &x);
-> }
->
-> yakj:~ pbonzini$ ./a.out
-> 80483d9 80483d9
-> yakj:~ pbonzini$ qemu-i386 ./a.out
-> 0 80483d9
->
->
-> ** Summary changed:
->
-> - Ollydbg under Windows in qemu does not work as it does under native Windows.
-> + incomplete emulation of fstenv under TCG
-
-Each FP instruction should store the needed data into new env fields,
-including IP, CS and opcode. These are known at translation time. Data
-pointers need to be saved at execution time.
-
-The new env fields would be then used by FSTENV, FSAVE, FXSAVE (which
-also suffer from the problem) etc.
-
-Any news on this bug?
-
-The full testcase:
-
-#include <stdio.h>
-extern void *x;
-int main() {
-   int a;
-   asm volatile ("x: fldz\n\
-   push %%edx\n\
-   fnstenv -0xc(%%esp)\n\
-   pop %%edx\n" : "=d" (a) : : "memory");
-   printf ("%x %x\n", a, &x);
-   return 0;
-}
-
-$ gcc -m32 test.c -o test
-$ ./test
-80483ae 80483ae
-$ ./qemu/i386-linux-user/qemu-i386 ./test
-0 80483ae
-
-Cleaned up .byte row.
-
-Example patch.
-Works only for FLDZ and only in -singlestep mode.
-Based on version 0.12.5.
-
-This was just an example of how it could be done.
-
-$ ./qemu-0.12.5/i386-linux-user/qemu-i386 -singlestep ./test
-80483b4 80483b4
-
-
-Ok. Here is a full patch to QEMU 0.13.
-
-Works with and without -singlestep.
-Works with all fpu instructions.
-
-Should also work with fsave.
-
-I've had quite some problems with this bug as well. It would be really nice if it could be fixed.
-
-I have ported Chalkerx's patch to QEMU-1.5.0. The patch is attached.
-
-// MOKI
-
-The bug is still present in the newly released QEMU-1.5.1. I've ported Chalkerx's patch to this release as well. See attached patch.
-
-Is there a problem with this patch, since it has not been committed?
-
-// MOKI
-
-Thanks for porting the patch.
-
-This is the mailing thread I started back in 2010 with that patch:
-http://lists.gnu.org/archive/html/qemu-devel/2010-11/msg02497.html
-That thread has some problems noted.
-
-Sadly, I did not have enough free time to investigate all the other
-places that should be fixed for proper fpip/etc. support.
-
-That patch seems to be related:
-https://patchwork.kernel.org/patch/871232/, but is kvm only. You could
-try contacting the person that did the patch for kvm.
-
-Nikita Skovoroda.
-
-2013/6/29 Morten Shearman Kirkegaard <email address hidden>:
-> The bug is still present in the newly released QEMU-1.5.1. I've ported
-> Chalkerx's patch to this release as well. See attached patch.
->
-> Is there a problem with this patch, since it has not been committed?
->
-> // MOKI
->
-> ** Patch added: "patch-qemu-1.5.1-fpip.diff"
->    https://bugs.launchpad.net/qemu/+bug/661696/+attachment/3718352/+files/patch-qemu-1.5.1-fpip.diff
-
-
-Thanks for the links Nikita.
-
-I'll see if I can add the missing features (fpop, fpdp) to the patch. Since I don't depend on those features, it will be relatively low priority for me, and I will probably not get to it before late August.
-
-// MOKI
-
-The QEMU project is currently considering to move its bug tracking to
-another system. For this we need to know which bugs are still valid
-and which could be closed already. Thus we are setting older bugs to
-"Incomplete" now.
-
-If you still think this bug report here is valid, then please switch
-the state back to "New" within the next 60 days, otherwise this report
-will be marked as "Expired". Or please mark it as "Fix Released" if
-the problem has been solved with a newer version of QEMU already.
-
-Thank you and sorry for the inconvenience.
-
-
-Test case in comment #7 still fails -- still a bug.
-
-
-
-This is an automated cleanup. This bug report has been moved
-to QEMU's new bug tracker on gitlab.com and thus gets marked
-as 'expired' now. Please continue with the discussion here:
-
- https://gitlab.com/qemu-project/qemu/-/issues/67
-
-