From dee4dcba78baf712cab403d47d9db319ab7f95d6 Mon Sep 17 00:00:00 2001 From: Christian Krinitsin Date: Thu, 3 Jul 2025 19:39:53 +0200 Subject: restructure results --- results/classifier/108/debug/661696 | 215 ------------------------------------ 1 file changed, 215 deletions(-) delete mode 100644 results/classifier/108/debug/661696 (limited to 'results/classifier/108/debug/661696') diff --git a/results/classifier/108/debug/661696 b/results/classifier/108/debug/661696 deleted file mode 100644 index 8f423a17..00000000 --- a/results/classifier/108/debug/661696 +++ /dev/null @@ -1,215 +0,0 @@ -debug: 0.959 -device: 0.956 -semantic: 0.956 -other: 0.955 -PID: 0.955 -performance: 0.953 -graphic: 0.950 -network: 0.949 -files: 0.949 -socket: 0.934 -permissions: 0.922 -vnc: 0.916 -boot: 0.872 -KVM: 0.823 - -incomplete emulation of fstenv under TCG - -Steps to reproduce: - -1) Install Windows (tried XP and 7) in qemu (tried qemu without kvm and qemu-kvm). - -2) Get OllyDbg ( http://ollydbg.de/odbg200.zip ). - -3) Use some Metasploit-encoded file, example included. - -It is not a virus! - -File was generated with Metasploit, command (if i remember it right): `msfpayload windows/exec cmd=notepad R | msfencode -e x86/shikata_ga_nai -t exe -o cmd_exec_notepad.shikata_ga_nai.exe`. - -4) Launch the file under Windows in qemu, make sure it opens a notepad. - -5) Open file under OllyDbg, run (F9) it there. It opens a notpad. Close OllyDbg. - -6) Open file under OllyDbg, trace over (Ctrl+F12) it there. It fails with `Access violation when writing to [some address]`. -Command: 316A 13, XOR DWORD PTR DS:[EDX+13],EBP - -Under native Windows, the trace over command works fine. - -Under VMware the trace works fine. -Under VirtualBox it also fails (checked in the spring). - -$ qemu-kvm --version -QEMU PC emulator version 0.12.5 (qemu-kvm-0.12.5), Copyright (c) 2003-2008 Fabrice Bellard - - - - - -http://imagebin.ca/view/zue0YNZ.html - This is VMware screenshot just before executing that command. - -Looks like something is wrong with EDX register in OllyDbg under QEMU. That register was popped as a result of FSTENV command. - -linux-user testcase: - -extern void *x; - -int main() -{ - int a; - asm volatile ("x: fldz\n\ - push %%edx\n\ - .byte 0xd9,0x74,0x24,0xf4\n\ - pop %%edx\n" : "=d" (a) : : "memory"); - printf ("%x %x\n", a, &x); -} - -yakj:~ pbonzini$ ./a.out -80483d9 80483d9 -yakj:~ pbonzini$ qemu-i386 ./a.out -0 80483d9 - - -On Sat, Oct 16, 2010 at 3:24 PM, Paolo Bonzini