All pastes #554475 Raw Edit

Mine

public text v1 · immutable
·published 2007-06-10 04:50 UTC
rendered paste body
some code to single step after hitting utmpname
 
    int single_step_count = 1280; //dbgSTEPCOUNT;
 
        if(single_stepping){
            if( single_step_count-- == 0){
                single_stepping = 0;
                printf("COUNT OVER\n");
            }
        }
...
        if(single_step_count>0 && lastfunc){
            if(! strcmp(lastfunc,"utmpname") )
                single_stepping = 1;
            else
                single_stepping = 0;
        }
 
...
 
        if(ret != 0 && next_eip && entered_main && !single_stepping )
        {
                set_hook(pid, next_eip);
                run_hook(pid);
        }
 
Hi! Alright, so single stepping 1279 times allows PTRACE_CONT to work just fine. 
1278 would be the "xor %eax, %eax" you see below, single stepping up to this point 
and then doing a PTRACE_CONT never lets our hook catch.
single stepping 1279, 1280, 1281, ... times works fine. This number (1279)
varies from machine to machine.
 
I need some help. What's going on @ that ret?
 
 
b7e60692: jnz 0xb7e60688.
  eax=08049d00 ebx=b7f2fff4 ecx=08049dfc edx=b7f182b0 
  esi=0000000f edi=00000001 ebp=bfe77708 esp=bfe776e8 
  flags= [c] [P] [a] [Z] [s] [t] [I] [df] [id] 246
  stack:  b7ef6c06 08049dee b7f182a2 b7f77300
 
b7e60694: xor %eax,%eax.
  eax=00000000 ebx=b7f2fff4 ecx=08049dfc edx=b7f182b0 
  esi=0000000f edi=00000001 ebp=bfe77708 esp=bfe776e8 
  flags= [c] [P] [a] [Z] [s] [t] [I] [df] [id] 246
  stack:  b7ef6c06 08049dee b7f182a2 b7f77300
 
b7e60696: ret .                              <------- ??? LOL ???
  eax=00000000 ebx=b7f2fff4 ecx=08049dfc edx=b7f182b0   |
  esi=0000000f edi=00000001 ebp=bfe77708 esp=bfe776ec   |
  flags= [c] [P] [a] [Z] [s] [t] [I] [df] [id] 246      |
  stack:  08049dee b7f182a2 b7f77300 b7f182a2           |
                                                        |
b7ef6c06: xor %edx,%edx.                      <---------/
COUNT OVER
  eax=00000000 ebx=00000000 ecx=08049dfc edx=00000000 
  esi=0000000f edi=00000001 ebp=00000001 esp=bfe77710 
  flags= [c] [P] [a] [Z] [s] [t] [I] [df] [id] 246
  stack:  08049dee 00005413 bfe77730 080488d9
 
804970d: call 0x8048aac         ###     setutent().
  eax=00000000 ebx=00000000 ecx=08049dfc edx=00000000 
  esi=0000000f edi=00000001 ebp=00000001 esp=bfe7770c 
  flags= [c] [P] [a] [Z] [s] [t] [I] [df] [id] 246
  stack:  08049712 08049dee 00005413 bfe77730





updated to show the first 4 instr bytes
b7e9f694> 31 c0 c3 b8
b7e9f694: xor %eax,%eax.
  eax=00000000 ebx=b7f6eff4 ecx=08049dfc edx=b7f572b0 
  esi=0000000f edi=00000001 ebp=bfc3ccc8 esp=bfc3cca8 
  flags= [c] [P] [a] [Z] [s] [t] [I] [df] [id] 246
  stack:  bfc3ccc8 b7f35c06 08049dee b7f572a2

b7e9f696> c3 b8 01 00
b7e9f696: ret .
  eax=00000000 ebx=b7f6eff4 ecx=08049dfc edx=b7f572b0 
  esi=0000000f edi=00000001 ebp=bfc3ccc8 esp=bfc3ccac 
  flags= [c] [P] [a] [Z] [s] [t] [I] [df] [id] 246
  stack:  b7f35c06 08049dee b7f572a2 b7fb6300

b7f35c06> 31 d2 85 c0
b7f35c06: xor %edx,%edx.
COUNT OVER
  eax=00000000 ebx=00000000 ecx=08049dfc edx=00000000 
  esi=0000000f edi=00000001 ebp=00000001 esp=bfc3ccd0 
  flags= [c] [P] [a] [Z] [s] [t] [I] [df] [id] 246
  stack:  0804970d 08049dee 00005413 bfc3ccf0