* [Qemu-devel] [Bug 1738434] [NEW] CALL FWORD PTR [ESP] handled incorrectly
@ 2017-12-15 15:47 Oleg Boyarchuk
2020-11-10 18:01 ` [Bug 1738434] " Thomas Huth
2021-01-10 4:17 ` Launchpad Bug Tracker
0 siblings, 2 replies; 3+ messages in thread
From: Oleg Boyarchuk @ 2017-12-15 15:47 UTC (permalink / raw)
To: qemu-devel
Public bug reported:
To keep the story short, this 32-bit code crashes on 64-bit Windows
whereas it works fine on real system and VMware:
push 33h
push offset _far_call
call fword ptr[esp]
jmp _ret
_far_call:
retf
_ret:
32-bit code running under WoW64 on 64-bit Windows has the ability to
switch to the 64-bit mode via so called "Heaven's gate". In order to do
that you have to make a far call/jmp by 0x33 selector how the code
snippet above shows. QEMU throws an access violation exception whereas
the code snippet runs with no problems on real CPU and VMware. By the
way, this code works fine under QEMU, I hope it gives you a hint where
to look:
push 23h
push offset _far_call
call fword ptr[esp]
jmp _ret
_far_call:
retf
_ret:
0x23 is a default 32-bit selector for 32-bit processes running under
WoW64.
Environment:
QEMU: 2.10.93, command line: qemu-system-x86_64.exe -m 2G -snapshot -cdrom full_path_to_iso fullP_path_to_img
Guest OS: Windows 7 x64 SP1 build 7601 or Windows 10 version 1709 build 16299.19
Host OS: Windows 10 x64 version 1703 build 15063.786
** Affects: qemu
Importance: Undecided
Status: New
** Attachment added: "OllyDbg screenshot explains the problem"
https://bugs.launchpad.net/bugs/1738434/+attachment/5023064/+files/call_fword_ptr_bug.png
--
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1738434
Title:
CALL FWORD PTR [ESP] handled incorrectly
Status in QEMU:
New
Bug description:
To keep the story short, this 32-bit code crashes on 64-bit Windows
whereas it works fine on real system and VMware:
push 33h
push offset _far_call
call fword ptr[esp]
jmp _ret
_far_call:
retf
_ret:
32-bit code running under WoW64 on 64-bit Windows has the ability to
switch to the 64-bit mode via so called "Heaven's gate". In order to
do that you have to make a far call/jmp by 0x33 selector how the code
snippet above shows. QEMU throws an access violation exception whereas
the code snippet runs with no problems on real CPU and VMware. By the
way, this code works fine under QEMU, I hope it gives you a hint where
to look:
push 23h
push offset _far_call
call fword ptr[esp]
jmp _ret
_far_call:
retf
_ret:
0x23 is a default 32-bit selector for 32-bit processes running under
WoW64.
Environment:
QEMU: 2.10.93, command line: qemu-system-x86_64.exe -m 2G -snapshot -cdrom full_path_to_iso fullP_path_to_img
Guest OS: Windows 7 x64 SP1 build 7601 or Windows 10 version 1709 build 16299.19
Host OS: Windows 10 x64 version 1703 build 15063.786
To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1738434/+subscriptions
^ permalink raw reply [flat|nested] 3+ messages in thread
* [Bug 1738434] Re: CALL FWORD PTR [ESP] handled incorrectly
2017-12-15 15:47 [Qemu-devel] [Bug 1738434] [NEW] CALL FWORD PTR [ESP] handled incorrectly Oleg Boyarchuk
@ 2020-11-10 18:01 ` Thomas Huth
2021-01-10 4:17 ` Launchpad Bug Tracker
1 sibling, 0 replies; 3+ messages in thread
From: Thomas Huth @ 2020-11-10 18:01 UTC (permalink / raw)
To: qemu-devel
The QEMU project is currently considering to move its bug tracking to another system. For this we need to know which bugs are still valid and which could be closed already. Thus we are setting older bugs to "Incomplete" now.
If you still think this bug report here is valid, then please switch the state back to "New" within the next 60 days, otherwise this report will be marked as "Expired". Or mark it as "Fix Released" if the problem has been solved with a newer version of QEMU already. Thank you and sorry for the inconvenience.
** Changed in: qemu
Status: New => Incomplete
--
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1738434
Title:
CALL FWORD PTR [ESP] handled incorrectly
Status in QEMU:
Incomplete
Bug description:
To keep the story short, this 32-bit code crashes on 64-bit Windows
whereas it works fine on real system and VMware:
push 33h
push offset _far_call
call fword ptr[esp]
jmp _ret
_far_call:
retf
_ret:
32-bit code running under WoW64 on 64-bit Windows has the ability to
switch to the 64-bit mode via so called "Heaven's gate". In order to
do that you have to make a far call/jmp by 0x33 selector how the code
snippet above shows. QEMU throws an access violation exception whereas
the code snippet runs with no problems on real CPU and VMware. By the
way, this code works fine under QEMU, I hope it gives you a hint where
to look:
push 23h
push offset _far_call
call fword ptr[esp]
jmp _ret
_far_call:
retf
_ret:
0x23 is a default 32-bit selector for 32-bit processes running under
WoW64.
Environment:
QEMU: 2.10.93, command line: qemu-system-x86_64.exe -m 2G -snapshot -cdrom full_path_to_iso fullP_path_to_img
Guest OS: Windows 7 x64 SP1 build 7601 or Windows 10 version 1709 build 16299.19
Host OS: Windows 10 x64 version 1703 build 15063.786
To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1738434/+subscriptions
^ permalink raw reply [flat|nested] 3+ messages in thread
* [Bug 1738434] Re: CALL FWORD PTR [ESP] handled incorrectly
2017-12-15 15:47 [Qemu-devel] [Bug 1738434] [NEW] CALL FWORD PTR [ESP] handled incorrectly Oleg Boyarchuk
2020-11-10 18:01 ` [Bug 1738434] " Thomas Huth
@ 2021-01-10 4:17 ` Launchpad Bug Tracker
1 sibling, 0 replies; 3+ messages in thread
From: Launchpad Bug Tracker @ 2021-01-10 4:17 UTC (permalink / raw)
To: qemu-devel
[Expired for QEMU because there has been no activity for 60 days.]
** Changed in: qemu
Status: Incomplete => Expired
--
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1738434
Title:
CALL FWORD PTR [ESP] handled incorrectly
Status in QEMU:
Expired
Bug description:
To keep the story short, this 32-bit code crashes on 64-bit Windows
whereas it works fine on real system and VMware:
push 33h
push offset _far_call
call fword ptr[esp]
jmp _ret
_far_call:
retf
_ret:
32-bit code running under WoW64 on 64-bit Windows has the ability to
switch to the 64-bit mode via so called "Heaven's gate". In order to
do that you have to make a far call/jmp by 0x33 selector how the code
snippet above shows. QEMU throws an access violation exception whereas
the code snippet runs with no problems on real CPU and VMware. By the
way, this code works fine under QEMU, I hope it gives you a hint where
to look:
push 23h
push offset _far_call
call fword ptr[esp]
jmp _ret
_far_call:
retf
_ret:
0x23 is a default 32-bit selector for 32-bit processes running under
WoW64.
Environment:
QEMU: 2.10.93, command line: qemu-system-x86_64.exe -m 2G -snapshot -cdrom full_path_to_iso fullP_path_to_img
Guest OS: Windows 7 x64 SP1 build 7601 or Windows 10 version 1709 build 16299.19
Host OS: Windows 10 x64 version 1703 build 15063.786
To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1738434/+subscriptions
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2021-01-10 4:29 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-12-15 15:47 [Qemu-devel] [Bug 1738434] [NEW] CALL FWORD PTR [ESP] handled incorrectly Oleg Boyarchuk
2020-11-10 18:01 ` [Bug 1738434] " Thomas Huth
2021-01-10 4:17 ` Launchpad Bug Tracker
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.