# 21.3.1 Demo

We will need a bochs compiled with the Ero patches to provide the python instrumentation with the CVS version.

    $ cvs -d:pserver:anonymous@bochs.cvs.sourceforge.net:/cvsroot/bochs login
    $ cvs -z3 -d:pserver:anonymous@bochs.cvs.sourceforge.net:/cvsroot/bochs co -P bochs
     ...
    $ cd bochs
    $ patch -p1 < bochs-python-ero.patch
    $ ./configure --enable-debugger --enable-instrumentation=python_hooks --enable-all-optimizations \
     --enable-show-ips --enable-global-pages --enable-fpu --enable-pci --enable-cpu-level=6 \
     --enable-vbe --enable-repeat-speedups --enable-guest2host-tlb --enable-ignore-bad-msr \
     --enable-pae --enable-mtrr --enable-trace-cache --enable-icache --enable-fast-function-calls \
     --enable-host-specific-asms --enable-mmx --enable-sse=4 --enable-sse-extension --enable-sep \
     --enable-x86-debugger
    ...
    $ make
    ...
    $ sudo make install
    ...

Now we have to open a bochs session and initialize the radapy-bochs interface.

    $ bochs
    00000000000i[APIC?] local apic in  initializing
    ========================================================================
                         Bochs x86 Emulator 2.3.7.cvs
                 Build from CVS snapshot, after release 2.3.7
    ========================================================================
    00000000000i[     ] reading configuration from .bochsrc
    ------------------------------
    Bochs Configuration: Main Menu
    ------------------------------

    This is the Bochs Configuration Interface, where you can describe the
    machine that you want to simulate.  Bochs has already searched for a
    configuration file (typically called bochsrc.txt) and loaded it if it
    could be found.  When you are satisfied with the configuration, go
    ahead and start the simulation.

    You can also start bochs with the -q option to skip these menus.

    1. Restore factory default configuration
    2. Read options from...
    3. Edit options
    4. Save options to...
    5. Restore the Bochs state from...
    6. Begin simulation
    7. Quit now

    Please choose one: [6]
    00000000000i[     ] installing x module as the Bochs GUI
    00000000000i[     ] using log file bochsout.txt
    Next at t=0
    (0) [0xfffffff0] f000:fff0 (unk. ctxt): jmp far f000:e05b         ; ea5be000f0
    bochs-python: environment variable "BOCHS_PYTHON_INIT" not set

    >>> import radapy_bochs
    Listening at port 9998

Now is time to launch our radare against this port!

    $ radare connect://127.0.0.1:9998/dbg://bochs
    Connected to 127.0.0.1:9998

We can just enter in visual mode to make the debugging more pleasant, and obviously we need to disassemble in 16 bit. EIP is calculated from CS_base+EIP only for flags.

    [0x000F05F7]> e asm.arch=intel16
    [0x000F05F7]> V

    Stack:
       offset   0 1  2 3  4 5  6 7  8 9  A B  C D  E F  0 1  0123456789ABCDEF01
    0x0000FFC6  d0ff 9c08 00f0 9401 0000 f0ff d50c 0400 00f0 ..................
    0x0000FFD8, 9401 0000 0000 0000 0000 0000 9401 0000 f8ff ..................
    0x0000FFEA  0000 0100 0073 faff e117 0400 f7d7 9401 0000 .....s............
    0x0000FFFC, c1e0 0000 0000 0000 0000 0000                ............
    Registers:
      eax  0x0000f000    esi  0x00000000    eip     0x000005f7
      ebx  0x0000fff8    edi  0x00000500    oeax    0x0000f000
      ecx  0x00000000    esp  0x0000ffc6    eflags  0x00000082
      edx  0x00000f00    ebp  0x0000ffc6    cr0     0x60000010
      dr0 0x00000000   dr1 0x00000000   dr2 0x00000000   dr3 0x00000000
    Disassembly:
              0x000F05F7        eip: 53              push bx
              0x000F05F8,            1e              push ds
              0x000F05F9             8b4604          mov ax, [bp+0x4]
              0x000F05FC,            8ed8            mov ds, ax
              0x000F05FE             8b5e06          mov bx, [bp+0x6]
              0x000F0601             8a07            mov al, [bx]
              0x000F0603             1f              pop ds
              0x000F0604,            5b              pop bx
              0x000F0605             5d              pop bp
              0x000F0606             c3              ret
              0x000F0606          ; ------------------------------------
              0x000F0607             55              push bp
              0x000F0608,            89e5            mov bp, sp
              0x000F060A             53              push bx

The '!help' will show us the available commands

    [0x000F05F7]> !help
    Bochs-python remote debugger
     !?                     : alias for !help
     !reg [reg] ([value])   : get/set CPU registers
     !regs[*]               : show CPU registers
     !cregs                 : show control registers
     !fpregs                : show FPU registers
     !st                    : print stack
     !bp [[-]addr]          : breakpoints
     !cont                  : continue execution
     !step [n]              : perforn N steps
     !stepo [n]             : step over
     !mem [physical|linear] : select memory addressing
     !exec [python-expr]    : execute python expression remotely

Have fun!