diff --git a/bdshemu/bdshemu_x86.c b/bdshemu/bdshemu_x86.c index ee18b94..2bd5dd6 100644 --- a/bdshemu/bdshemu_x86.c +++ b/bdshemu/bdshemu_x86.c @@ -1793,13 +1793,6 @@ ShemuX86Emulate( nd_memzero(&dst, sizeof(dst)); nd_memzero(&src, sizeof(src)); - // The stop flag has been set, this means we've reached a valid instruction, but that instruction cannot be - // emulated (for example, SYSCALL, INT, system instructions, etc). - if (stop) - { - return SHEMU_ABORT_CANT_EMULATE; - } - // If we already have a detection and we wish to stop on detections, do so now. if ((0 != Context->Flags) && (0 != (Context->Options & SHEMU_OPT_STOP_ON_EXPLOIT))) { @@ -3557,6 +3550,13 @@ ShemuX86Emulate( break; } + + // The stop flag has been set, this means we've reached a valid instruction, but that instruction cannot be + // emulated (for example, SYSCALL, INT, system instructions, etc). + if (stop) + { + return SHEMU_ABORT_CANT_EMULATE; + } } // Minimum percent of the instructions were NOPs => consider we have a NOP sled. Note that we get here only if