// pgfault.c
int main() {
__asm__(
"xor rax, rax\n\t"
"mov rbx, [rax]\n\t"
"xor rcx, rbx\n\t"
"add rax, rcx\n\t"
);
}
// compile
x86_64-w64-mingw32-gcc pgfault.c -masm=intel -o pgfault.exe
// and run in PANDA/QEMU
实际上,我得到了跟踪:
// first translation block
0x401510 xor rax, rax ; first instruction of main
; second instruction generates a page fault
// second translation block (KiPageFault in ntoskrnl.exe)
0xfffff80026e4600 push rbx
0xfffff80026e4601 sub rbp, 0x158
第二条指令产生了页面错误,然后转换块仅包含第一条指令。 QEMU / PANDA如何提前知道(即在翻译步骤中)?