We will need a bochs compiled with the Ero patches to provide the python instrumentation with the CVS version.
$ cvs -d:pserver:anonymous@bochs.cvs.sourceforge.net:/cvsroot/bochs login
$ cvs -z3 -d:pserver:anonymous@bochs.cvs.sourceforge.net:/cvsroot/bochs co -P bochs
...
$ cd bochs
$ patch -p1 < bochs-python-ero.patch
$ ./configure --enable-debugger --enable-instrumentation=python_hooks --enable-all-optimizations \
--enable-show-ips --enable-global-pages --enable-fpu --enable-pci --enable-cpu-level=6 \
--enable-vbe --enable-repeat-speedups --enable-guest2host-tlb --enable-ignore-bad-msr \
--enable-pae --enable-mtrr --enable-trace-cache --enable-icache --enable-fast-function-calls \
--enable-host-specific-asms --enable-mmx --enable-sse=4 --enable-sse-extension --enable-sep \
--enable-x86-debugger
...
$ make
...
$ sudo make install
...
Now we have to open a bochs session and initialize the radapy-bochs interface.
$ bochs
00000000000i[APIC?] local apic in initializing
========================================================================
Bochs x86 Emulator 2.3.7.cvs
Build from CVS snapshot, after release 2.3.7
========================================================================
00000000000i[ ] reading configuration from .bochsrc
------------------------------
Bochs Configuration: Main Menu
------------------------------
This is the Bochs Configuration Interface, where you can describe the
machine that you want to simulate. Bochs has already searched for a
configuration file (typically called bochsrc.txt) and loaded it if it
could be found. When you are satisfied with the configuration, go
ahead and start the simulation.
You can also start bochs with the -q option to skip these menus.
1. Restore factory default configuration
2. Read options from...
3. Edit options
4. Save options to...
5. Restore the Bochs state from...
6. Begin simulation
7. Quit now
Please choose one: [6]
00000000000i[ ] installing x module as the Bochs GUI
00000000000i[ ] using log file bochsout.txt
Next at t=0
(0) [0xfffffff0] f000:fff0 (unk. ctxt): jmp far f000:e05b ; ea5be000f0
bochs-python: environment variable "BOCHS_PYTHON_INIT" not set
>>> import radapy_bochs
Listening at port 9998
Now is time to launch our radare against this port!
$ radare connect://127.0.0.1:9998/dbg://bochs
Connected to 127.0.0.1:9998
We can just enter in visual mode to make the debugging more pleasant, and obviously we need to disassemble in 16 bit. EIP is calculated from CS_base+EIP only for flags.
[0x000F05F7]> e asm.arch=intel16
[0x000F05F7]> V
Stack:
offset 0 1 2 3 4 5 6 7 8 9 A B C D E F 0 1 0123456789ABCDEF01
0x0000FFC6 d0ff 9c08 00f0 9401 0000 f0ff d50c 0400 00f0 ..................
0x0000FFD8, 9401 0000 0000 0000 0000 0000 9401 0000 f8ff ..................
0x0000FFEA 0000 0100 0073 faff e117 0400 f7d7 9401 0000 .....s............
0x0000FFFC, c1e0 0000 0000 0000 0000 0000 ............
Registers:
eax 0x0000f000 esi 0x00000000 eip 0x000005f7
ebx 0x0000fff8 edi 0x00000500 oeax 0x0000f000
ecx 0x00000000 esp 0x0000ffc6 eflags 0x00000082
edx 0x00000f00 ebp 0x0000ffc6 cr0 0x60000010
dr0 0x00000000 dr1 0x00000000 dr2 0x00000000 dr3 0x00000000
Disassembly:
0x000F05F7 eip: 53 push bx
0x000F05F8, 1e push ds
0x000F05F9 8b4604 mov ax, [bp+0x4]
0x000F05FC, 8ed8 mov ds, ax
0x000F05FE 8b5e06 mov bx, [bp+0x6]
0x000F0601 8a07 mov al, [bx]
0x000F0603 1f pop ds
0x000F0604, 5b pop bx
0x000F0605 5d pop bp
0x000F0606 c3 ret
0x000F0606 ; ------------------------------------
0x000F0607 55 push bp
0x000F0608, 89e5 mov bp, sp
0x000F060A 53 push bx
The '!help' will show us the available commands
[0x000F05F7]> !help
Bochs-python remote debugger
!? : alias for !help
!reg [reg] ([value]) : get/set CPU registers
!regs[*] : show CPU registers
!cregs : show control registers
!fpregs : show FPU registers
!st : print stack
!bp [[-]addr] : breakpoints
!cont : continue execution
!step [n] : perforn N steps
!stepo [n] : step over
!mem [physical|linear] : select memory addressing
!exec [python-expr] : execute python expression remotely
Have fun!