Ticket #11794 (new defect)
Opened 3 years ago
EIP/RIP off by one after int 3
|Reported by:||TimoKreuzer||Owned by:|
After hitting an int 3, execution is transferred to the registered interrupt handler, but the EIP (or RIP in long mode) that is pushed on the stack is off by one.
The bug occurs randomly and seems to be introduced by modification of page tables.
I got this bug the first time in 2011 in x64 long mode. Today it happened for me in x86 mode. Like in long mode the eip value on the stack is pointing at the int 3 instruction. While in long mode the bug continued to happen, it only happened a single time on x86, while all following int 3 were correct. In long mode it happened after writing a valid PTE, in x86 mode it happened after zeroing out the lower half of the page directory.