[Lguest] A Switcher question

Eviatar Khen eviatarkhen at gmail.com
Thu Oct 7 04:04:43 EST 2010


Hi All,

I hacked Lguest as part of a university project, and there is one main
issue I haven't understood, and I would really appreciate if someone
would answer me. 
In the end of the Guest -> Host switch, the %esp register is just above
five registers: eip, cs, eflag, esp, ss. Then the "iret" instruction
pops them out and the Guest starts running.
What I don't understand is, before the switch back to the Host, where
the Guest updates those five stack slots and the stack pointer to be
above them?

I know this may be stupid question, so sorry, I don't have much
experience.

Thank you very much and best regards,

Eviatar



More information about the Lguest mailing list