Re: 2.5.63 accesses below %esp (was: Re: ntfs OOPS (2.5.63))

[Szakacsits Szabolcs]

On Wed, 12 Mar 2003, Linus Torvalds wrote:
>
> The difficulty is finidng the right instruction boundary. It's basically
> impossible.

If I understand you correctly, no. We have the boundary at EIP.
Decoding what's before is max 7-8 tries by a human and one can figure
out the real code from the context (with high probability). 2-3 times
more code before EIP then after could significantly help of course.

> If you want to get the instructions before that point, just use
>
> 	gdb vmlinux

This approach frequently fails because vmlinux is on a users computer
far away and he

  1) doesn't bother answering anymore
  2) recompiled with different .config
  3) reinstalled another distro
  4) etc

> and disassemble it by hand. Because the kernel _cannot_ do it reliably.

The kernel shouldn't do it, it's not disassembler. It should just give
enough data for a human and disassembler. Nothing lost but much can be
gain.

	Szaka