2018-05-19 3:25 GMT+01:00 Dmitry Safonov <0x7f454c46@xxxxxxxxx>:
>> Here is the function:
>> 0000000000400842 <call32_from_64>:
>> 400842: 53 push %rbx
>> 400843: 55 push %rbp
>> 400844: 41 54 push %r12
>> 400846: 41 55 push %r13
>> 400848: 41 56 push %r14
>> 40084a: 41 57 push %r15
>> 40084c: 9c pushfq
>> 40084d: 48 89 27 mov %rsp,(%rdi)
>> 400850: 48 89 fc mov %rdi,%rsp
>> 400853: 6a 23 pushq $0x23
>> 400855: 68 5c 08 40 00 pushq $0x40085c
>> 40085a: 48 cb lretq
>> 40085c: ff d6 callq *%rsi
>> 40085e: ea (bad)
>> 40085f: 65 08 40 00 or %al,%gs:0x0(%rax)
>> 400863: 33 00 xor (%rax),%eax
>> 400865: 48 8b 24 24 mov (%rsp),%rsp
>> 400869: 9d popfq
>> 40086a: 41 5f pop %r15
>> 40086c: 41 5e pop %r14
>> 40086e: 41 5d pop %r13
>> 400870: 41 5c pop %r12
>> 400872: 5d pop %rbp
>> 400873: 5b pop %rbx
>> 400874: c3 retq
>> 400875: 66 2e 0f 1f 84 00 00 nopw %cs:0x0(%rax,%rax,1)
>> 40087c: 00 00 00
>> 40087f: 90 nop
>>
>> Looks like mov between registers caused it? The hell.
>
> Oh, it's not 400850, I missloked, but 40085a so lretq might case it.
But it's
002b:00000000417bafe8
USER_DS and sensible address, still no idea.
--
Dmitry
