On Tue, 11 May 2010 08:53:56 -0700 George Fogg <gf...@nwlink.com> wrote:

:>> Rob Scott wrote

:>> I think the OP and Chris were referring to a situation where the target
:>> address space is being "snooped" - rather than sharing its memory by a
:>> controlled and approved x-memory linkage. There are example code snippets 
out
:>> there in the public domain that attempt to access private storage in a 
foreign
:>> non-swap ASID in AR-mode after adding an ALET using CHKEAX=NO on the 
ALESERV.
:>> This technique is not to be encouraged and will eventually end in tears for
:>> someone.

:>Here's some of the code that the OP might be refering too from the Zephon
:>article.
:>** CROSS MEMORY CALL
:>*
:>@XMEM    XR    2,2 ZERO REG 2
:>         ESAR  2 OBTAIN OUR ADDR SP NUMBER
:>         ST    2,OURASN SAVE IT
:>*
:>         MODESET KEY=ZERO,MODE=PROB KEY ZERO, PROB STATE
:>         BAL   14,@INXMEM
:>*
:>         XR    1,1 REG 1 = 0
:>         L     8,XMADDR ADDRESS TO READ FROM
:>         L     2,XMLENG LENGTH TO READ
:>         L     2,XMLENG LENGTH TO READ
:>         MVCP  XMSTOR(2),0(8),1
:>*
:>         BAL   14,@OUTXMEM
:>         MODESET KEY=NZERO,MODE=PROB KEY USER, PROB STATE
:>*
:>the code following uses IKJCT441 to create variables to pass back to the REXX
:>caller. One var contains the storage obtained from another ASID.
:>  . . . . .
:>** SUBROUTINE - INTO CROSS MEMORY MODE **************************
:>*
:>@INXMEM  LA    2,1 REG 2 = 1
:>         AXSET AX=(2) AUTH INDEX = 1
:>         L     2,REQASN INTO XMEM MODE
:>         SSAR  2
:>@INXEND  BR    14
:>*
:>** SUBROUTINE - OUT OF CROSS MEMORY MODE ************************
:>*
:>@OUTXMEM L     2,OURASN OUT OF XMEM MODE
:>         SSAR  2
:>         XR    2,2 REG 2 = 0
:>         AXSET AX=(2) AUTH INDEX = 0
:>@OUTXEND BR    14

:>This rexx assembler is defined in IKJTSO00 in AUTHPGM.
:>BTW, I couldn't get it to work either.

You can access fixed storage from a swapped in job (since that is guaranteed
to be paged in) in this way. This code should work if REQASN and XMADDR are
properly set.

--
Binyamin Dissen <bdis...@dissensoftware.com>
http://www.dissensoftware.com

Director, Dissen Software, Bar & Grill - Israel


Should you use the mailblocks package and expect a response from me,
you should preauthorize the dissensoftware.com domain.

I very rarely bother responding to challenge/response systems,
especially those from irresponsible companies.

----------------------------------------------------------------------
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html

Reply via email to