linux-kernel - Re: 2.6.23-rc1: no setup signature found...

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20070730185359.GA4290@gollum.tnic>
Date:	Mon, 30 Jul 2007 20:53:59 +0200
From:	Borislav Petkov <bbpetkov@...oo.de>
To:	"H. Peter Anvin" <hpa@...or.com>
Cc:	Xudong Guan <xudong.guan@...il.com>, linux-kernel@...r.kernel.org,
	Chuck Ebbert <cebbert@...hat.com>
Subject: Re: 2.6.23-rc1: no setup signature found...

On Mon, Jul 30, 2007 at 07:05:35AM -0700, H. Peter Anvin wrote:
> Borislav Petkov wrote:
>> Breakpoint 4, 0x00040200 in ?? ()
>> 1: x/i ($cs << 4) + $eip  0x40300:      lea    (%si),%dx
>> (gdb) p/x $ds
>> $1 = 0x18
>
>
> This isn't the setup code, it's doing something else.
>
> Could you try this again, but when you get to this point, if the 
> instruction displayed isn't a "jmp" instruction, and $ds doesn't have the 
> right value, enter "c" and see if you hit the proper break later.

Hi,

i decided to do some cheating :) and skipped the breakpoint where it used to
stop (0x40200). (by the way, hitting 'c' wouldn't continue at all and keep
executing the same instruction over and over again). This time it seems it behaves as expected:

GNU gdb 6.6-debian
Copyright (C) 2006 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i486-linux-gnu".
(gdb) target remote localhost:1234
Remote debugging using localhost:1234
0x0000fff0 in ?? ()
(gdb) set architecture i8086
The target architecture is assumed to be i8086
(gdb)         disp/i ($cs << 4)+$eip
1: x/i ($cs << 4) + $eip  0xffff0:      ljmp   $0xf000,$0xe05b
(gdb)         br *0x10200
Breakpoint 1 at 0x10200
(gdb)         br *0x20200
Breakpoint 2 at 0x20200
(gdb)         br *0x30200
Breakpoint 3 at 0x30200
(gdb) br *0x50200
Breakpoint 4 at 0x50200
(gdb)         br *0x60200
Breakpoint 5 at 0x60200
(gdb)         br *0x70200
Breakpoint 6 at 0x70200
(gdb)         br *0x80200
Breakpoint 7 at 0x80200
(gdb)         br *0x90200
Breakpoint 8 at 0x90200
(gdb) c
Continuing.

Program received signal SIGTRAP, Trace/breakpoint trap.
0x00000000 in ?? ()
1: x/i ($cs << 4) + $eip  0x90200:      jmp    0x9023c
(gdb) p/x $ds
$1 = 0x9000
(gdb) dump memory setup.dump 0x90000 0x98000
(gdb) 

-- 
Regards/Gruß,
    Boris.

Download attachment "setup.dump" of type "application/octet-stream" (32768 bytes)