diff --git a/scripts/l4sys/l4sys-prepare.sh b/scripts/l4sys/l4sys-prepare.sh
index 40a5a23d..426c7b19 100755
--- a/scripts/l4sys/l4sys-prepare.sh
+++ b/scripts/l4sys/l4sys-prepare.sh
@@ -40,7 +40,10 @@ echo -e "\033[35;1m[$(date)] ================== Step 2: Get Instruction Count ==
 cat $BAK | sed -e 's/PREPARATION_STEP.*/PREPARATION_STEP 2/' >$CFG
 buildfail
 echo -e "\033[32mRunning...\033[0m"
-num_inst=`$FAIL_CMD 2>/dev/null | grep instructions\; | sed -e 's/.*after \(.*\) instructions.*/\1/'`
+values=`$FAIL_CMD 2>/dev/null | grep instructions\; | sed -e 's/.*after \(.*\) instructions;\(.*\) accepted/\1 \2/'`
+echo $values
+filtered_instr=`echo $values | cut -d\  -f 2`
+total_instr=`echo $values | cut -d\  -f 1`
 
 echo -e "\033[35;1m[$(date)] ================== Step 3: Golden Run ==========================\033[0m"
 cat $BAK | sed -e 's/PREPARATION_STEP.*/PREPARATION_STEP 3/' >$CFG
@@ -48,9 +51,10 @@ BuildNRun
 
 # now get ready to rumble...
 echo -e "\033[35;1m[$(date)] ================== Step 4: Build Injection Client ==============\033[0m"
-cat $BAK | sed -e "s/L4SYS_NUMINSTR.*/L4SYS_NUMINSTR $((num_inst*10))/" >$BAK.2
-cat $BAK.2 | sed -e "s/PREPARATION_STEP.*/PREPARATION_STEP 0/">$CFG
-rm $BAK $BAK.2
+cat $BAK | sed -e "s/L4SYS_NUMINSTR.*/L4SYS_NUMINSTR $filtered_instr/" >$BAK.2
+cat $BAK.2 | sed -e "s/L4SYS_TOTINSTR.*/L4SYS_TOTINSTR $total_instr/" >$BAK.3
+cat $BAK.3 | sed -e "s/PREPARATION_STEP.*/PREPARATION_STEP 0/">$CFG
+rm $BAK $BAK.2 $BAK.3
 buildfail
 
 echo -e "\033[32;1m=========================================================================================="
diff --git a/src/experiments/l4-sys/experiment.cc b/src/experiments/l4-sys/experiment.cc
index c704c4da..394c1ece 100644
--- a/src/experiments/l4-sys/experiment.cc
+++ b/src/experiments/l4-sys/experiment.cc
@@ -118,8 +118,8 @@ void L4SysExperiment::logInjection() {
 	address_t injection_ip = param->msg.injection_ip();
 
 	log << "job " << id << " exp_type " << exp_type << endl;
-	log << "inject @ ip " << injection_ip << " (offset " << dec << instr_offset
-			<< ")" << " bit " << bit_offset << endl;
+	log << "inject @ ip " << hex << injection_ip << " (offset " << dec << instr_offset
+	    << ")" << " bit " << bit_offset << endl;
 }
 
 BaseListener *L4SysExperiment::singleStep(bool preserveAddressSpace) {
@@ -257,6 +257,8 @@ bool L4SysExperiment::run() {
                 reinterpret_cast<char const*>(calculateInstructionAddress()))) {
 			accepted++;
 			TraceInstr new_instr;
+			log << "writing IP " << hex << curr_addr << " counter "
+				<< dec << times_called << endl;
 			new_instr.trigger_addr = curr_addr;
 			new_instr.bp_counter = times_called;
 
@@ -267,7 +269,7 @@ bool L4SysExperiment::run() {
 	log << "saving instructions triggered during normal execution" << endl;
 	instr_list_file.close();
 	log << "test function calculation position reached after "
-			<< dec << count << " instructions; " << accepted << " accepted" << endl;
+	    << dec << count << " instructions; " << accepted << " accepted" << endl;
 #else
 	int count = 0;
 	int ul = 0, kernel = 0;
@@ -353,6 +355,9 @@ bool L4SysExperiment::run() {
 	int bit_offset = param->msg.bit_offset();
 	int exp_type = param->msg.exp_type();
 
+	log << "   got job parameters: offs " << hex << instr_offset
+	    << " bit " << bit_offset << " exp " << exp_type << endl;
+
 #ifdef L4SYS_FILTER_INSTRUCTIONS
 	ifstream instr_list_file(L4SYS_INSTRUCTION_LIST, ios::binary);
 
@@ -363,10 +368,18 @@ bool L4SysExperiment::run() {
 
 	TraceInstr curr_instr;
 	instr_list_file.seekg(instr_offset * sizeof(TraceInstr));
+	log << instr_list_file.eof() << " " << instr_list_file.bad() << " "
+	    << instr_list_file.fail() << endl;
+	if (instr_list_file.eof()) {
+		log << "Job parameters indicate position outside the traced instruction list." << endl;
+		terminate(1);
+	}
 	instr_list_file.read(reinterpret_cast<char*>(&curr_instr), sizeof(TraceInstr));
 	instr_list_file.close();
 
+	log << "setting watchpoint at " << hex << curr_instr.trigger_addr << endl;
 	bp.setWatchInstructionPointer(curr_instr.trigger_addr);
+	log << "setting bp counter " << hex << curr_instr.bp_counter << endl;
 	bp.setCounter(curr_instr.bp_counter);
 #else
 	bp.setWatchInstructionPointer(ANY_ADDR);
@@ -409,8 +422,9 @@ bool L4SysExperiment::run() {
 
 		// do the logging in case everything worked out
 		logInjection();
-		log << "register data: 0x" << hex << ((int) data) << " -> 0x"
-				<< ((int) newdata) << endl;
+		log << "IP " << hex << simulator.getCPU(0).getInstructionPointer()
+			<< " register data: 0x" << hex << ((int) data) << " -> 0x"
+  		    << ((int) newdata) << endl;
 	} else if (exp_type == param->msg.IDCFLIP) {
 		// this is a twisted one
 
@@ -626,11 +640,13 @@ bool L4SysExperiment::run() {
 	// aftermath
 	BPSingleListener ev_done(L4SYS_FUNC_EXIT, L4SYS_ADDRESS_SPACE);
 	simulator.addListener(&ev_done);
-	unsigned instr_left = L4SYS_NUMINSTR - instr_offset;
+	
+	unsigned instr_left = L4SYS_TOTINSTR - instr_offset; // XXX offset is in NUMINSTR, TOTINSTR is higher
 	BPSingleListener ev_incomplete(ANY_ADDR, L4SYS_ADDRESS_SPACE);
 	ev_incomplete.setCounter(
 	    static_cast<unsigned>(instr_left * 1.1));
 	simulator.addListener(&ev_incomplete);
+
 	TimerListener ev_timeout(calculateTimeout(instr_left));
 	simulator.addListener(&ev_timeout);
 
diff --git a/src/experiments/l4-sys/experimentInfo.hpp b/src/experiments/l4-sys/experimentInfo.hpp
index 83849aaf..eb378acc 100644
--- a/src/experiments/l4-sys/experimentInfo.hpp
+++ b/src/experiments/l4-sys/experimentInfo.hpp
@@ -5,11 +5,20 @@
 #define MAX_INSTR_BYTES 15
 
 // the bounds of the program (space, instructions and time)
-#define L4SYS_ADDRESS_SPACE		0x1fe0000
-#define L4SYS_FUNC_ENTRY		0x10025ca
-#define L4SYS_FUNC_EXIT			0x1002810
+#define L4SYS_ADDRESS_SPACE		0x1fd6e000
+#define L4SYS_FUNC_ENTRY		0x01000200
+#define L4SYS_FUNC_EXIT			0x01000245
+
+// Instruction filtering: Allows to specify a range within
+// which to perform injection experiments. If in doubt, set
+// to the whole user-addressable area (0, 0xC0000000)
+#define L4SYS_FILTER_INSTRUCTIONS 1
+#define L4SYS_ADDRESS_LBOUND 0
+#define L4SYS_ADDRESS_UBOUND 0xC0000000
+
 // kernel: 2377547, userland: 79405472
-#define L4SYS_NUMINSTR			81783019
+#define L4SYS_NUMINSTR 3281
+#define L4SYS_TOTINSTR 228218
 #define L4SYS_BOCHS_IPS			5000000
 
 // several file names used
@@ -21,6 +30,6 @@
 // flags
 //  0 - preparation complete
 // >0 - next step to execute
-#define PREPARATION_STEP		0
+#define PREPARATION_STEP 0
 
 #endif // __L4SYS_EXPERIMENT_INFO_HPP__