diff options
Diffstat (limited to 'results/classifier/zero-shot-user-mode/output/instruction/1738434')
| -rw-r--r-- | results/classifier/zero-shot-user-mode/output/instruction/1738434 | 34 |
1 files changed, 34 insertions, 0 deletions
diff --git a/results/classifier/zero-shot-user-mode/output/instruction/1738434 b/results/classifier/zero-shot-user-mode/output/instruction/1738434 new file mode 100644 index 000000000..63f53b8e2 --- /dev/null +++ b/results/classifier/zero-shot-user-mode/output/instruction/1738434 @@ -0,0 +1,34 @@ +instruction: 0.485 +syscall: 0.279 +runtime: 0.235 + + + +CALL FWORD PTR [ESP] handled incorrectly + +To keep the story short, this 32-bit code crashes on 64-bit Windows whereas it works fine on real system and VMware: + + push 33h + push offset _far_call + call fword ptr[esp] + jmp _ret +_far_call: + retf +_ret: + +32-bit code running under WoW64 on 64-bit Windows has the ability to switch to the 64-bit mode via so called "Heaven's gate". In order to do that you have to make a far call/jmp by 0x33 selector how the code snippet above shows. QEMU throws an access violation exception whereas the code snippet runs with no problems on real CPU and VMware. By the way, this code works fine under QEMU, I hope it gives you a hint where to look: + + push 23h + push offset _far_call + call fword ptr[esp] + jmp _ret +_far_call: + retf +_ret: + +0x23 is a default 32-bit selector for 32-bit processes running under WoW64. + +Environment: +QEMU: 2.10.93, command line: qemu-system-x86_64.exe -m 2G -snapshot -cdrom full_path_to_iso fullP_path_to_img +Guest OS: Windows 7 x64 SP1 build 7601 or Windows 10 version 1709 build 16299.19 +Host OS: Windows 10 x64 version 1703 build 15063.786 \ No newline at end of file |