[vbox-dev] invalid sysenter information in debug core dump

samuele.defrancesco sdefrancesco at tetrane.com
Wed Jun 8 15:21:21 UTC 2016


The sysenter information of debug core dumps appears to be invalid.

The issue seem to come from the fact that the DBGFCORECPU sysenter field 
is an union.

Index: include/VBox/vmm/dbgfcorefmt.h
typedef struct DBGFCORECPU
        uint64_t        cs;
        uint64_t        eip;
        uint64_t        esp;
     } sysenter;

In fact, its initialized by copying the CPUMSYSENTER fields from the cpu 

Index: src/VBox/VMM/VMMR3/DBGFCoreWrite.cpp
static void dbgfR3GetCoreCpu(PVM pVM, PCPUMCTX pCtx, PDBGFCORECPU pDbgfCpu)
     pDbgfCpu->sysenter.cs     = pCtx->SysEnter.cs;
     pDbgfCpu->sysenter.eip    = pCtx->SysEnter.eip;
     pDbgfCpu->sysenter.esp    = pCtx->SysEnter.esp;

leading to an inconsistent core dump where sysenter.cs == sysenter.eip 
== systenter.esp.

Using a struct instead of an union fix the issue.


More information about the vbox-dev mailing list