debugging longman dictionary
laurent.pinchart at skynet.be
Mon Mar 25 13:55:53 CST 2002
> > what I'd do is:
> > - simulate (as for DR?) the IDTR read/write (memory/instr)
> > - provide our own interrupt table
> > - then hook the signal catches to this table (dlls/ntdll/
> > - in your case, especially the divide by 0 signal to entry 1 of this
> > table
> > however, I don't think this is the best way to go. It will add lots of
> > code to Wine (mainly i386 virtualization), and let programs modify
> > things
> > they shouldn't normally need to touch.
> Even if you did this, it probably wouldn't help much, as the
> interrupt routine is supposed to be executed in ring 0 (which
> presumably is the very *reason* the program does this nonsense).
Does that mean that a win95/98 app can execute arbitrary ring 0 code by using
this method ?
> So you'll fail immediately afterwards due to privilege
> violations as the app does whatever it wants to do in ring 0 ...
> Of course, you could add virtualization for all the ring 0 stuff,
> but this is quite open-ended :-(
I agree with you
More information about the wine-devel