21.3.1 Demo

We will need a bochs compiled with the Ero patches to provide the python instrumentation with the CVS version.

$ cvs -d:pserver:anonymous@bochs.cvs.sourceforge.net:/cvsroot/bochs login
$ cvs -z3 -d:pserver:anonymous@bochs.cvs.sourceforge.net:/cvsroot/bochs co -P bochs
 ...
$ cd bochs
$ patch -p1 < bochs-python-ero.patch
$ ./configure --enable-debugger --enable-instrumentation=python_hooks --enable-all-optimizations \
 --enable-show-ips --enable-global-pages --enable-fpu --enable-pci --enable-cpu-level=6 \
 --enable-vbe --enable-repeat-speedups --enable-guest2host-tlb --enable-ignore-bad-msr \
 --enable-pae --enable-mtrr --enable-trace-cache --enable-icache --enable-fast-function-calls \
 --enable-host-specific-asms --enable-mmx --enable-sse=4 --enable-sse-extension --enable-sep \
 --enable-x86-debugger
...
$ make
...
$ sudo make install
...

Now we have to open a bochs session and initialize the radapy-bochs interface.

$ bochs
00000000000i[APIC?] local apic in  initializing
========================================================================
                     Bochs x86 Emulator 2.3.7.cvs
             Build from CVS snapshot, after release 2.3.7
========================================================================
00000000000i[     ] reading configuration from .bochsrc
------------------------------
Bochs Configuration: Main Menu
------------------------------

This is the Bochs Configuration Interface, where you can describe the
machine that you want to simulate.  Bochs has already searched for a
configuration file (typically called bochsrc.txt) and loaded it if it
could be found.  When you are satisfied with the configuration, go
ahead and start the simulation.

You can also start bochs with the -q option to skip these menus.

1. Restore factory default configuration
2. Read options from...
3. Edit options
4. Save options to...
5. Restore the Bochs state from...
6. Begin simulation
7. Quit now

Please choose one: [6] 
00000000000i[     ] installing x module as the Bochs GUI
00000000000i[     ] using log file bochsout.txt
Next at t=0
(0) [0xfffffff0] f000:fff0 (unk. ctxt): jmp far f000:e05b         ; ea5be000f0
bochs-python: environment variable "BOCHS_PYTHON_INIT" not set

>>> import radapy_bochs
Listening at port 9998

Now is time to launch our radare against this port!

$ radare connect://127.0.0.1:9998/dbg://bochs
Connected to 127.0.0.1:9998

We can just enter in visual mode to make the debugging more pleasant, and obviously we need to disassemble in 16 bit. EIP is calculated from CS_base+EIP only for flags.

[0x000F05F7]> e asm.arch=intel16
[0x000F05F7]> V
Stack:
   offset   0 1  2 3  4 5  6 7  8 9  A B  C D  E F  0 1  0123456789ABCDEF01
0x0000FFC6  d0ff 9c08 00f0 9401 0000 f0ff d50c 0400 00f0 ..................
0x0000FFD8, 9401 0000 0000 0000 0000 0000 9401 0000 f8ff ..................
0x0000FFEA  0000 0100 0073 faff e117 0400 f7d7 9401 0000 .....s............
0x0000FFFC, c1e0 0000 0000 0000 0000 0000                ............      
Registers:
  eax  0x0000f000    esi  0x00000000    eip     0x000005f7
  ebx  0x0000fff8    edi  0x00000500    oeax    0x0000f000
  ecx  0x00000000    esp  0x0000ffc6    eflags  0x00000082
  edx  0x00000f00    ebp  0x0000ffc6    cr0     0x60000010
  dr0 0x00000000   dr1 0x00000000   dr2 0x00000000   dr3 0x00000000
Disassembly:
          0x000F05F7        eip: 53              push bx             
          0x000F05F8,            1e              push ds             
          0x000F05F9             8b4604          mov ax, [bp+0x4]    
          0x000F05FC,            8ed8            mov ds, ax          
          0x000F05FE             8b5e06          mov bx, [bp+0x6]    
          0x000F0601             8a07            mov al, [bx]        
          0x000F0603             1f              pop ds              
          0x000F0604,            5b              pop bx              
          0x000F0605             5d              pop bp              
          0x000F0606             c3              ret                 
          0x000F0606          ; ------------------------------------ 
          0x000F0607             55              push bp             
          0x000F0608,            89e5            mov bp, sp          
          0x000F060A             53              push bx             

The '!help' will show us the available commands

[0x000F05F7]> !help
Bochs-python remote debugger
 !?                     : alias for !help
 !reg [reg] ([value])   : get/set CPU registers
 !regs[*]               : show CPU registers
 !cregs                 : show control registers
 !fpregs                : show FPU registers
 !st                    : print stack
 !bp [[-]addr]          : breakpoints
 !cont                  : continue execution
 !step [n]              : perforn N steps
 !stepo [n]             : step over
 !mem [physical|linear] : select memory addressing
 !exec [python-expr]    : execute python expression remotely

Have fun!