Date:	Fri, 21 Sep 2001 16:03:35 +0200
From:	Laszlo Molnar <laszlo DOT molnar AT eth DOT ericsson DOT se>
To:	Charles Sandmann <sandmann AT clio DOT rice DOT edu>
Cc:	djgpp-workers AT delorie DOT com
Subject:	Re: UPX'ed image and debugger note [was Re: gcc-3.01 ...]
Message-ID:	<20010921160335.T4845@libra.eth.ericsson.se>
References:	<20010921125243 DOT K4845 AT libra DOT eth DOT ericsson DOT se> <10109211323 DOT AA16761 AT clio DOT rice DOT edu>
Mime-Version:	1.0
User-Agent:	Mutt/1.2i
In-Reply-To:	<10109211323.AA16761@clio.rice.edu>; from sandmann@clio.rice.edu on Fri, Sep 21, 2001 at 08:23:46AM -0500
Reply-To:	djgpp-workers AT delorie DOT com
Errors-To:	nobody AT delorie DOT com
X-Mailing-List:	djgpp-workers AT delorie DOT com
X-Unsubscribes-To:	listserv AT delorie DOT com

> The point of the original (too terse) note was to point out that
> the CS:EIP plus SS:ESP signature looked possibly like UPX decompressor
> and we needed to hack the debugger if you wanted to look at it.

Well, I do have a debugger for this purpose :-) A patched fsdb.

[..]

> After all, I did recommend that we start using it for distributions ...

Obviously I can only agree with this. But I'm a bit biased :-)

Laszlo

- Raw text -