Return-Path: <linux-kernel-owner+willy=40w.ods.org@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
	id <S261487AbTCOT2X>; Sat, 15 Mar 2003 14:28:23 -0500
Received: (majordomo@vger.kernel.org) by vger.kernel.org
	id <S261490AbTCOT2X>; Sat, 15 Mar 2003 14:28:23 -0500
Received: from inti.inf.utfsm.cl ([200.1.21.155]:10194 "EHLO inti.inf.utfsm.cl")
	by vger.kernel.org with ESMTP id <S261487AbTCOT2W>;
	Sat, 15 Mar 2003 14:28:22 -0500
Message-Id: <200303151834.h2FIYAXh005499@eeyore.valparaiso.cl>
To: vda@port.imtp.ilyichevsk.odessa.ua
Cc: Linux Kernel Mailing List <linux-kernel@vger.kernel.org>
Subject: Re: 2.5.63 accesses below %esp (was: Re: ntfs OOPS (2.5.63)) 
In-Reply-To: Your message of "Fri, 14 Mar 2003 09:14:59 +0200."
             <200303140718.h2E7IKu06478@Port.imtp.ilyichevsk.odessa.ua> 
Date: Sat, 15 Mar 2003 14:34:10 -0400
From: Horst von Brand <vonbrand@inf.utfsm.cl>
Sender: linux-kernel-owner@vger.kernel.org
X-Mailing-List: linux-kernel@vger.kernel.org
Content-Length: 1699
Lines: 33

Denis Vlasenko <vda@port.imtp.ilyichevsk.odessa.ua> said:
> On 13 March 2003 23:04, Horst von Brand wrote:
> > Szakacsits Szabolcs <szaka@sienet.hu> said:
> > > On Wed, 12 Mar 2003, Horst von Brand wrote:
> > > > It is _hard_ to do with variable length instructions (CISC,
> > > > remember?), the code is designed to be easily decoded forward,
> > > > noone executes code going backwards.
> > >
> > > Of course, it's a bad approach. You start earlier and stop at EIP.
> > > Repeat this for max(instruction length) different offsets and you
> > > will have the winner. Figure it out from the context after EIP.
> >
> > By hand, OK. Automatically, no.
> 
> Why not? Disassemble from, say, EIP-16 and check whether you
> have an instruction starting exactly at EIP. If no, repeat from EIP-15, -14...
> You are guaranteed to succeed at EIP-0  ;)

But your previous success (if any) doesn't mean anything, and might even
screw up the decoding after EIP (if accidentally an address looks like an
instruction, say). This is too much work (to get right) for something of
purely informational value (if that much), generated by a suspect kernel
(an Oops is when something went wrong...).
-- 
Dr. Horst H. von Brand                   User #22616 counter.li.org
Departamento de Informatica                     Fono: +56 32 654431
Universidad Tecnica Federico Santa Maria              +56 32 654239
Casilla 110-V, Valparaiso, Chile                Fax:  +56 32 797513
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/