Back to home page

DOS ain't dead

Forum index page

Log in | Register

Back to the forum
Board view  Mix view

discovered 3 more buggs (DOSX)

posted by DOS386(R), 14.07.2010, 14:38


        call    ?001                   ; $0040'1000  E8, 00000009
?001:   pop     edi                    ; $0040'100E  5F
        push    36                     ; $0040'100F  6A, 24
        push    edi                    ; $0040'1011  57
        call    ?002                   ; $0040'1012  E8, 0000000B
?002:   push    0                      ; $0040'1022  6A, 00
        call    near [?011]            ; $0040'1024  FF. 15, 00401106(d)
        shr     eax, 1                 ; $0040'102A  D1. E8
        jc      ?003                   ; $0040'102C  72, 01
        int 3   ; breakpoint or filler ; $0040'102E  CC      ; INT3
?003:   push    36                     ; $0040'102F  6A, 24
        push    edi                    ; $0040'1031  57
        call    ?004                   ; $0040'1032  E8, 0000000A
?004:   pop     eax                    ; $0040'1041  58
        push    eax                    ; $0040'1042  50
        adc     byte [eax], 0          ; $0040'1043  80. 10, 00
        push    0                      ; $0040'1046  6A, 00
        call    near [?011]            ; $0040'1048  FF. 15, 00401106(d)
        shr     eax, 1                 ; $0040'104E  D1. E8
        jc      ?005                   ; $0040'1050  72, 02
        ud2                            ; $0040'1052  0F 0B   ; UD2
?005:   push    36                     ; $0040'1054  6A, 24
        push    edi                    ; $0040'1056  57
        call    ?006                   ; $0040'1057  E8, 00000009
?006:   pop     eax                    ; $0040'1065  58
        push    eax                    ; $0040'1066  50
        adc     byte [eax], 0          ; $0040'1067  80. 10, 00
        push    0                      ; $0040'106A  6A, 00
        call    near [?011]            ; $0040'106C  FF. 15, 00401106(d)
        shr     eax, 1                 ; $0040'1072  D1. E8
        jc      ?007                   ; $0040'1074  72, 01
; Note: Undocumented opcode
        icebp                          ; $0040'1076  F1      ; INT1
?007:   push    36                     ; $0040'1077  6A, 24
        push    edi                    ; $0040'1079  57
        call    ?008                   ; $0040'107A  E8, 00000008
?008:   pop     eax                    ; $0040'1087  58
        push    eax                    ; $0040'1088  50
        adc     byte [eax], 0          ; $0040'1089  80. 10, 00
        push    0                      ; $0040'108C  6A, 00
        call    near [?011]            ; $0040'108E  FF. 15, 00401106(d)
        push    0                      ; $0040'1094  6A, 00
        call    near [?010]            ; $0040'1096  FF. 15, 004010E5(d)


Discovered 3 new bugs:

97. "[eip]" is wrong for INT3 crash. ME has the very same BUG - maybe cloned it from there ??? :clap:

98. INT1 instruction (OBJCONV disassembles it as ICEBP - InterCityExpressBritishPetrol) doesn't work. Either it is completely ignored or it crashes far away from it's location with a wrong exception number far away from the expected 1 (ONE) - maybe related to the "SBEMU" hack in DKRNL32 ???

99. "MessageBoxA" fails to display the buttons if text size is <= 8 char's.

Testcase for those 3 BUG's : http://www.file-pasta.com/file/0/HXBUGS.ZIP

### DKRNL32 ###

INT3 (crashes, but [eip] is wrong ...) :

dkrnl32: exception 80000003, flags=0 occured at B7:40102F
ax=3 bx=401000 cx=146BE8 dx=0
si=400000 di=401005 bp=58B8 sp=126FF4
ip = Module 'hxbugs.exe'+102F
[eip] = 6A 24 57 E8 0A 00 00 00 4D 42 43 44
[esp] = 00112B0D 00000000 00000000 00905A4D 00000003 00000004
dkrnl32: fatal exit!

UD2 (good) :

dkrnl32: exception C000001D, flags=0 occured at B7:401052
ax=3 bx=401000 cx=146BE8 dx=0
si=400000 di=401005 bp=58B8 sp=126FF4
ip = Module 'hxbugs.exe'+1052
[eip] = 0F 0B 6A 24 57 E8 09 00 00 00 4D 42
[esp] = 00112B0D 00000000 00000000 00905A4D 00000003 00000004
dkrnl32: fatal exit!

INT1 (ignored, or "bad" crash - both wrong exception
number and wrong [eip] also)

### HDPMI32 ### (SET DKRNL32=32)

INT3 (ignored)

UD2 (OK)

INT1 (ignored - always ???)

### ME ###

INT3 (crashes, but [eip] is wrong ... cloned the BUG from here ???)

UD2 (OK)

INT1 (crashes, but [eip] is wrong ... also here ???)

---
This is a LOGITECH mouse driver, but some software expect here
the following string:*** This is Copyright 1983 Microsoft ***

 

Complete thread:

Back to the forum
Board view  Mix view
15196 Postings in 1365 Threads, 250 registered users, 17 users online (0 registered, 17 guests)
DOS ain't dead | Admin contact
RSS Feed
powered by my little forum