Hello,
I’m trying to inject code in WinXP host operating system, starting from
intermediate code.
My objective is to trigger a page fault handler from the guest operating
system, in such a way I can read memory with cpu_memory_rw_debug without
error.
The idea is :
1. read memory in some location.
2. if cpu_memory_rw_debug return code !=0
1. forge a page fault intermediate code buffer
2. transform the intermediate code in host code with dyngen_code()
3. execute the host code buffer
3. attempt to read memory another time
I haven’t problem while making the intermediate code buffer :
opc_buf[]
opparam_buf[]
and forge a host code buffer with dyngen_code() :
code_buf[]
The problems arise when I want it to be executed by the host operating
system (step 2.c).
If I use neutral instructions, like:
opc_buf[0]=INDEX_nop;
opc_buf[1]=INDEX_op_exit_tb;
opc_buf[2]=INDEX_op_end;
I haven’t problem.
But if I trigger a fault, by using INDEX_op_ldsb_kernel_, etc.
Then Qemu seems to enter an infinite loop.
Do you see a solution to this problem ?
Thanks a lot.
Sebastien.
_______________________________________________
Qemu-devel mailing list
Qemu-devel@nongnu.org
http://lists.nongnu.org/mailman/listinfo/qemu-devel
