Date: Fri, 21 Sep 2001 16:03:35 +0200
From: Laszlo Molnar <laszlo DOT molnar AT eth DOT ericsson DOT se>
To: Charles Sandmann <sandmann AT clio DOT rice DOT edu>
Cc: djgpp-workers AT delorie DOT com
Subject: Re: UPX'ed image and debugger note [was Re: gcc-3.01 ...]
Message-ID: <20010921160335.T4845@libra.eth.ericsson.se>
References: <20010921125243 DOT K4845 AT libra DOT eth DOT ericsson DOT se> <10109211323 DOT AA16761 AT clio DOT rice DOT edu>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.2i
In-Reply-To: <10109211323.AA16761@clio.rice.edu>; from sandmann@clio.rice.edu on Fri, Sep 21, 2001 at 08:23:46AM -0500
Reply-To: djgpp-workers AT delorie DOT com
Errors-To: nobody AT delorie DOT com
X-Mailing-List: djgpp-workers AT delorie DOT com
X-Unsubscribes-To: listserv AT delorie DOT com
Precedence: bulk

> The point of the original (too terse) note was to point out that
> the CS:EIP plus SS:ESP signature looked possibly like UPX decompressor
> and we needed to hack the debugger if you wanted to look at it.

Well, I do have a debugger for this purpose :-) A patched fsdb.

[..]

> After all, I did recommend that we start using it for distributions ...

Obviously I can only agree with this. But I'm a bit biased :-)

Laszlo