Metasploit mailing list archives

EBX and EDI overwrite instead of EAX and EIP

From: hdm at metasploit.com (H D Moore)
Date: Mon, 23 Oct 2006 17:54:00 -0500

While the register dumps are great, we need to see the actual opcode being 
executed with these registers. This should look something like:

mov [ebx], edi

-HD

On Monday 23 October 2006 17:47, Greg Linares wrote:

EIP 7C91B3FB ntdll.7C91B3FB

Current thread:

EBX and EDI overwrite instead of EAX and EIP Greg Linares (Oct 23)
- EBX and EDI overwrite instead of EAX and EIP H D Moore (Oct 23)
  - EBX and EDI overwrite instead of EAX and EIP Greg Linares (Oct 23)
    - EBX and EDI overwrite instead of EAX and EIP H D Moore (Oct 23)
    - EBX and EDI overwrite instead of EAX and EIP Greg Linares (Oct 23)