Hello Christian,

Yes. I'm doing to tests with Carlo and we are on the same boat. The problem looks related to big-endian.
I think we are closer now with a solution. Carlo is doing a remote debug for us :)

Thanks


On Sun, Oct 28, 2012 at 5:50 AM, Christian Bockermann <chris@jwall.org> wrote:
Hi Carlo,

I don't think it is related to the sizes of types, rather than a possible
byte-ordering issue. The System-Z is big-endian, whereas the Intel platforms
are little-endian.

With the byte-level conversion of the bytes2hex function, the function uses
bitwise AND and shifting for creating the hex string.
My guess is that the "shift" operation with your byte-order simply "shifts in"
0's from the left, which then explains the 0's in your event IDs.

If we have a look at the for-loop in bytes2hex (msc_util.c, lines 964-968):

    j = 0;
    for(i = 0; i < len; i++) {
        hex[j++] = b2hex[data[i] >> 4];   // divide data[i] by 2^4 = 16
        hex[j++] = b2hex[data[i] & 0x0f]; // gives the "remainder"
    }

if the byte-order on your machine is reversed, then this *should* rather be

    for(i = 0; i < len; i++) {
        hex[j++] = b2hex[data[i] << 4];   // divide data[i] by 2^4 = 16
        hex[j++] = b2hex[data[i] & 0xf0]; // gives the "remainder"
    }


But I am no C programmer nor do I have a big-endian system available for
testing. So this is just a "guess".

Chris


Am 27.10.2012 um 19:49 schrieb carlo beccaria <becks@stepdev.org>:

> On Fri, Oct 26, 2012 at 3:11 PM, Breno Silva Pinto <BPinto@trustwave.com> wrote:
>> Right,
>>
>> I think it should be related to some low-level byte conversion issue on
>> s390x.
>>
>> Could you print the size of char, int, unsigned char, unsigned long ?
>
> Hi,
>
> printf("int %d\n",sizeof(int));
> printf("char %d\n",sizeof(char));
> printf("uchar %d\n",sizeof(unsigned char));
> printf("ulong %d\n",sizeof(unsigned long));
>
> s390x
> int 4
> char 1
> uchar 1
> ulong 8
>
> x86_64
> int 4
> char 1
> uchar 1
> ulong 8
>
> thanks!
>
> --
> cb
>
> ------------------------------------------------------------------------------
> WINDOWS 8 is here.
> Millions of people.  Your app in 30 days.
> Visit The Windows 8 Center at Sourceforge for all your go to resources.
> http://windows8center.sourceforge.net/
> join-generation-app-and-make-money-coding-fast/
> _______________________________________________
> mod-security-users mailing list
> mod-security-users@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/


------------------------------------------------------------------------------
WINDOWS 8 is here.
Millions of people.  Your app in 30 days.
Visit The Windows 8 Center at Sourceforge for all your go to resources.
http://windows8center.sourceforge.net/
join-generation-app-and-make-money-coding-fast/
_______________________________________________
mod-security-users mailing list
mod-security-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/
http://www.modsecurity.org/projects/commercial/support/