diff --git a/src/experiments/ecos_kernel_test/experiment.cc b/src/experiments/ecos_kernel_test/experiment.cc
index 6b25abca..d14dd4d5 100644
--- a/src/experiments/ecos_kernel_test/experiment.cc
+++ b/src/experiments/ecos_kernel_test/experiment.cc
@@ -45,14 +45,18 @@ bool EcosKernelTestExperiment::retrieveGuestAddresses() {
 	// workaround for 00002808875p[BIOS ] >>PANIC<< Keyboard error:21
 	// *** If the first listener is a TimerListener, FailBochs panics. ***
 	// *** Therefore, just wait one instruction before using a timer. ***
-	// BPSingleListener bp;
-	// bp.setWatchInstructionPointer(ANY_ADDR);
-	// simulator.addListenerAndResume(&bp);
-
-	// run until 'ECOS_FUNC_FINISH' is reached
 	BPSingleListener bp;
-	bp.setWatchInstructionPointer(ECOS_FUNC_FINISH);
-	simulator.addListener(&bp);
+	bp.setWatchInstructionPointer(ANY_ADDR);
+	simulator.addListenerAndResume(&bp);
+
+	// run until 'ECOS_FUNC_FINISH' is reached //FIXME: [CPU0 ] prefetch: EIP [00010000] > CS.limit [0000ffff]
+	//BPSingleListener bp;
+	//bp.setWatchInstructionPointer(ECOS_FUNC_FINISH);
+	//simulator.addListener(&bp);
+
+	// 10000us = 500000 instructions
+	TimerListener record_timeout(50000000); //TODO: how long to wait?
+	simulator.addListener(&record_timeout);
 
 	// memory map serialization
 	ofstream mm(mm_filename, ios::out | ios::app);
@@ -91,7 +95,8 @@ bool EcosKernelTestExperiment::retrieveGuestAddresses() {
 		}
 	}
 	assert(number_of_guest_events > 0);
-	log << "Breakpoint at 'ECOS_FUNC_FINISH' reached: created memory map (" << number_of_guest_events << " entries)" << endl;
+	//log << "Breakpoint at 'ECOS_FUNC_FINISH' reached: created memory map (" << number_of_guest_events << " entries)" << endl;
+	log << "Record timeout reached: created memory map (" << number_of_guest_events << " entries)" << endl;
 	delete str;
 
 	// close serialized mm
@@ -100,8 +105,8 @@ bool EcosKernelTestExperiment::retrieveGuestAddresses() {
 
 	// workaround for 00291674339e[CPU0 ] prefetch: EIP [00010000] > CS.limit [0000ffff]
 	// *** just wait some time here *** //FIXME
-	TimerListener record_timeout(1);
-	simulator.addListenerAndResume(&record_timeout);
+	//TimerListener record_timeout(10000);
+	//simulator.addListenerAndResume(&record_timeout);
 
 	// clean up simulator
 	simulator.clearListeners();
diff --git a/src/experiments/ecos_kernel_test/experimentInfo.hpp b/src/experiments/ecos_kernel_test/experimentInfo.hpp
index e708ec83..c6be2a75 100644
--- a/src/experiments/ecos_kernel_test/experimentInfo.hpp
+++ b/src/experiments/ecos_kernel_test/experimentInfo.hpp
@@ -4,11 +4,11 @@
 
 // user-specified start-function address:
 // nm -C thread1.elf|fgrep cyg_start
-#define ECOS_FUNC_ENTRY 			0x0000406c
+#define ECOS_FUNC_ENTRY 			0x0000409c
 // cyg_test_exit address
-#define ECOS_FUNC_FINISH 			0x00005eb0
+#define ECOS_FUNC_FINISH 			0x00005f0c
 // cyg_test_output address
-#define ECOS_FUNC_TEST_OUTPUT		0x00005eb8
+#define ECOS_FUNC_TEST_OUTPUT		0x00005f14
 // the variable that's increased if ECC corrects an error:
 #define ECOS_ERROR_CORRECTED		0x99999999
 
@@ -17,12 +17,7 @@
 #define ECOS_TEXT_START				0x00003000
 // text end:
 // nm -C thread1.elf|fgrep _etext
-#define ECOS_TEXT_END				0x00013c9e
-
-// number of instructions the target executes under non-error conditions from ENTRY to FINISH:
-#define ECOS_NUMINSTR	71618
-// number of instructions that are executed additionally for error corrections
-// (this is a rough guess ... TODO)
-#define ECOS_RECOVERYINSTR	0x2000
+#define ECOS_TEXT_END				0x0001627a
+