rendered paste bodysome code to single step after hitting utmpname
int single_step_count = 1280; //dbgSTEPCOUNT;
if(single_stepping){
if( single_step_count-- == 0){
single_stepping = 0;
printf("COUNT OVER\n");
}
}
...
if(single_step_count>0 && lastfunc){
if(! strcmp(lastfunc,"utmpname") )
single_stepping = 1;
else
single_stepping = 0;
}
...
if(ret != 0 && next_eip && entered_main && !single_stepping )
{
set_hook(pid, next_eip);
run_hook(pid);
}
Hi! Alright, so single stepping 1279 times allows PTRACE_CONT to work just fine.
1278 would be the "xor %eax, %eax" you see below, single stepping up to this point
and then doing a PTRACE_CONT never lets our hook catch.
single stepping 1279, 1280, 1281, ... times works fine. This number (1279)
varies from machine to machine.
I need some help. What's going on @ that ret?
b7e60692: jnz 0xb7e60688.
eax=08049d00 ebx=b7f2fff4 ecx=08049dfc edx=b7f182b0
esi=0000000f edi=00000001 ebp=bfe77708 esp=bfe776e8
flags= [c] [P] [a] [Z] [s] [t] [I] [df] [id] 246
stack: b7ef6c06 08049dee b7f182a2 b7f77300
b7e60694: xor %eax,%eax.
eax=00000000 ebx=b7f2fff4 ecx=08049dfc edx=b7f182b0
esi=0000000f edi=00000001 ebp=bfe77708 esp=bfe776e8
flags= [c] [P] [a] [Z] [s] [t] [I] [df] [id] 246
stack: b7ef6c06 08049dee b7f182a2 b7f77300
b7e60696: ret . <------- ??? LOL ???
eax=00000000 ebx=b7f2fff4 ecx=08049dfc edx=b7f182b0 |
esi=0000000f edi=00000001 ebp=bfe77708 esp=bfe776ec |
flags= [c] [P] [a] [Z] [s] [t] [I] [df] [id] 246 |
stack: 08049dee b7f182a2 b7f77300 b7f182a2 |
|
b7ef6c06: xor %edx,%edx. <---------/
COUNT OVER
eax=00000000 ebx=00000000 ecx=08049dfc edx=00000000
esi=0000000f edi=00000001 ebp=00000001 esp=bfe77710
flags= [c] [P] [a] [Z] [s] [t] [I] [df] [id] 246
stack: 08049dee 00005413 bfe77730 080488d9
804970d: call 0x8048aac ### setutent().
eax=00000000 ebx=00000000 ecx=08049dfc edx=00000000
esi=0000000f edi=00000001 ebp=00000001 esp=bfe7770c
flags= [c] [P] [a] [Z] [s] [t] [I] [df] [id] 246
stack: 08049712 08049dee 00005413 bfe77730
updated to show the first 4 instr bytes
b7e9f694> 31 c0 c3 b8
b7e9f694: xor %eax,%eax.
eax=00000000 ebx=b7f6eff4 ecx=08049dfc edx=b7f572b0
esi=0000000f edi=00000001 ebp=bfc3ccc8 esp=bfc3cca8
flags= [c] [P] [a] [Z] [s] [t] [I] [df] [id] 246
stack: bfc3ccc8 b7f35c06 08049dee b7f572a2
b7e9f696> c3 b8 01 00
b7e9f696: ret .
eax=00000000 ebx=b7f6eff4 ecx=08049dfc edx=b7f572b0
esi=0000000f edi=00000001 ebp=bfc3ccc8 esp=bfc3ccac
flags= [c] [P] [a] [Z] [s] [t] [I] [df] [id] 246
stack: b7f35c06 08049dee b7f572a2 b7fb6300
b7f35c06> 31 d2 85 c0
b7f35c06: xor %edx,%edx.
COUNT OVER
eax=00000000 ebx=00000000 ecx=08049dfc edx=00000000
esi=0000000f edi=00000001 ebp=00000001 esp=bfc3ccd0
flags= [c] [P] [a] [Z] [s] [t] [I] [df] [id] 246
stack: 0804970d 08049dee 00005413 bfc3ccf0