From 00944b6cdef70eda67f8b3ea5fae0e57c24b2f53 Mon Sep 17 00:00:00 2001 From: Chris Eagle Date: Wed, 26 Aug 2015 13:29:54 -0700 Subject: [PATCH] Add ability to mark memory are read only. Add new API uc_mem_map_ex to allow permissions to be passed. Change MemoryBlock to track created MemoryRegions. Add regress/ro_mem_test.c --- include/uc_priv.h | 7 +++-- include/unicorn/unicorn.h | 22 ++++++++++++- qemu/include/exec/memory.h | 4 ++- qemu/memory.c | 10 ++++-- qemu/unicorn_common.h | 1 + regress/ro_mem_test.c | 64 ++++++++++++++++++++++++++++++++++++++ uc.c | 43 ++++++++++++++++++++++--- 7 files changed, 139 insertions(+), 12 deletions(-) mode change 100644 => 100755 qemu/include/exec/memory.h mode change 100644 => 100755 qemu/memory.c mode change 100644 => 100755 qemu/unicorn_common.h create mode 100644 regress/ro_mem_test.c diff --git a/include/uc_priv.h b/include/uc_priv.h index 3fde4862..e9ebb23f 100755 --- a/include/uc_priv.h +++ b/include/uc_priv.h @@ -16,7 +16,7 @@ QTAILQ_HEAD(CPUTailQ, CPUState); typedef struct MemoryBlock { - uint64_t begin; //inclusive + MemoryRegion *region; //inclusive uint64_t end; //exclusive uint32_t perms; } MemoryBlock; @@ -51,7 +51,9 @@ typedef void (*uc_args_uc_long_t)(struct uc_struct*, unsigned long); typedef void (*uc_args_uc_u64_t)(struct uc_struct *, uint64_t addr); -typedef int (*uc_args_uc_ram_size_t)(struct uc_struct*, ram_addr_t begin, size_t size); +typedef MemoryRegion* (*uc_args_uc_ram_size_t)(struct uc_struct*, ram_addr_t begin, size_t size, uint32_t perms); + +typedef void (*uc_readonly_mem_t)(MemoryRegion *mr, bool readonly); // which interrupt should make emulation stop? typedef bool (*uc_args_int_t)(int intno); @@ -94,6 +96,7 @@ struct uc_struct { uc_args_tcg_enable_t tcg_enabled; uc_args_uc_long_t tcg_exec_init; uc_args_uc_ram_size_t memory_map; + uc_readonly_mem_t readonly_mem; // list of cpu void* cpu; diff --git a/include/unicorn/unicorn.h b/include/unicorn/unicorn.h index ebdb47f3..975581cc 100755 --- a/include/unicorn/unicorn.h +++ b/include/unicorn/unicorn.h @@ -392,7 +392,8 @@ typedef enum uc_prot { /* Map memory in for emulation. - This API adds a memory region that can be used by emulation. + This API adds a memory region that can be used by emulation. The region is mapped + with permissions UC_PROT_READ | UC_PROT_WRITE | UC_PROT_EXEC. @handle: handle returned by uc_open() @address: starting address of the new memory region to be mapped in. @@ -406,6 +407,25 @@ typedef enum uc_prot { UNICORN_EXPORT uc_err uc_mem_map(uch handle, uint64_t address, size_t size); +/* + Map memory in for emulation. + This API adds a memory region that can be used by emulation. + + @handle: handle returned by uc_open() + @address: starting address of the new memory region to be mapped in. + This address must be aligned to 4KB, or this will return with UC_ERR_MAP error. + @size: size of the new memory region to be mapped in. + This size must be multiple of 4KB, or this will return with UC_ERR_MAP error. + @perms: Permissions for the newly mapped region. + This must be some combination of UC_PROT_READ | UC_PROT_WRITE | UC_PROT_EXEC, + or this will return with UC_ERR_MAP error. + + @return UC_ERR_OK on success, or other value on failure (refer to uc_err enum + for detailed error). +*/ +UNICORN_EXPORT +uc_err uc_mem_map_ex(uch handle, uint64_t address, size_t size, uint32_t perms); + #ifdef __cplusplus } #endif diff --git a/qemu/include/exec/memory.h b/qemu/include/exec/memory.h old mode 100644 new mode 100755 index c8b0c333..81081405 --- a/qemu/include/exec/memory.h +++ b/qemu/include/exec/memory.h @@ -315,12 +315,14 @@ void memory_region_init_io(struct uc_struct *uc, MemoryRegion *mr, * @owner: the object that tracks the region's reference count * @name: the name of the region. * @size: size of the region. + * @perms: permissions on the region (UC_PROT_READ, UC_PROT_WRITE, UC_PROT_EXEC). * @errp: pointer to Error*, to store an error if it happens. */ void memory_region_init_ram(struct uc_struct *uc, MemoryRegion *mr, struct Object *owner, const char *name, uint64_t size, + uint32_t perms, Error **errp); /** @@ -934,7 +936,7 @@ void address_space_unmap(AddressSpace *as, void *buffer, hwaddr len, void memory_register_types(struct uc_struct *uc); -int memory_map(struct uc_struct *uc, ram_addr_t begin, size_t size); +MemoryRegion *memory_map(struct uc_struct *uc, ram_addr_t begin, size_t size, uint32_t perms); int memory_free(struct uc_struct *uc); #endif diff --git a/qemu/memory.c b/qemu/memory.c old mode 100644 new mode 100755 index f7bf161b..74ea2cf8 --- a/qemu/memory.c +++ b/qemu/memory.c @@ -31,18 +31,18 @@ // Unicorn engine -int memory_map(struct uc_struct *uc, ram_addr_t begin, size_t size) +MemoryRegion *memory_map(struct uc_struct *uc, ram_addr_t begin, size_t size, uint32_t perms) { uc->ram = g_new(MemoryRegion, 1); - memory_region_init_ram(uc, uc->ram, NULL, "pc.ram", size, &error_abort); + memory_region_init_ram(uc, uc->ram, NULL, "pc.ram", size, perms, &error_abort); memory_region_add_subregion(get_system_memory(uc), begin, uc->ram); if (uc->current_cpu) tlb_flush(uc->current_cpu, 1); - return 0; + return uc->ram; } int memory_free(struct uc_struct *uc) @@ -1151,10 +1151,14 @@ void memory_region_init_ram(struct uc_struct *uc, MemoryRegion *mr, Object *owner, const char *name, uint64_t size, + uint32_t perms, Error **errp) { memory_region_init(uc, mr, owner, name, size); mr->ram = true; + if (!(perms & UC_PROT_WRITE)) { + mr->readonly = true; + } mr->terminates = true; mr->destructor = memory_region_destructor_ram; mr->ram_addr = qemu_ram_alloc(size, mr, errp); diff --git a/qemu/unicorn_common.h b/qemu/unicorn_common.h old mode 100644 new mode 100755 index 93f1c5f4..176900cb --- a/qemu/unicorn_common.h +++ b/qemu/unicorn_common.h @@ -73,6 +73,7 @@ static inline void uc_common_init(struct uc_struct* uc) uc->pause_all_vcpus = pause_all_vcpus; uc->vm_start = vm_start; uc->memory_map = memory_map; + uc->readonly_mem = memory_region_set_readonly; if (!uc->release) uc->release = release_common; diff --git a/regress/ro_mem_test.c b/regress/ro_mem_test.c new file mode 100644 index 00000000..57f4f0ca --- /dev/null +++ b/regress/ro_mem_test.c @@ -0,0 +1,64 @@ +#include +#include +#include + +#include + +#define PROGRAM "\xeb\x08\x58\xc7\x00\x78\x56\x34\x12\x90\xe8\xf3\xff\xff\xff" + +/* +bits 32 + + jmp short bottom +top: + pop eax + mov dword [eax], 0x12345678 + nop +bottom: + call top +*/ + +int main(int argc, char **argv, char **envp) { + uch handle; + uc_err err; + uint8_t bytes[8]; + + printf("Memory mapping test\n"); + + // Initialize emulator in X86-32bit mode + err = uc_open(UC_ARCH_X86, UC_MODE_32, &handle); + if (err) { + printf("Failed on uc_open() with error returned: %u\n", err); + return; + } + + uc_mem_map(handle, 0x100000, 0x1000); + uc_mem_map(handle, 0x200000, 0x2000); + uc_mem_map(handle, 0x300000, 0x3000); + uc_mem_map_ex(handle, 0x400000, 0x4000, UC_PROT_READ | UC_PROT_EXEC); + + // write machine code to be emulated to memory + if (uc_mem_write(handle, 0x400000, PROGRAM, sizeof(PROGRAM))) { + printf("Failed to write emulation code to memory, quit!\n"); + return; + } + else { + printf("Allowed to write to read only memory via uc_mem_write\n"); + } + + // emulate machine code in infinite time + printf("BEGIN execution\n"); + err = uc_emu_start(handle, 0x400000, 0x400000 + sizeof(PROGRAM), 0, 5); + if (err) { + printf("Failed on uc_emu_start() with error returned %u: %s\n", + err, uc_strerror(err)); + } + printf("END execution\n"); + + if (!uc_mem_read(handle, 0x400000 + sizeof(PROGRAM) - 1, bytes, 4)) + printf(">>> Read 4 bytes from [0x%x] = 0x%x\n", 0x400000 + sizeof(PROGRAM) - 1,*(uint32_t*) bytes); + else + printf(">>> Failed to read 4 bytes from [0x%x]\n", 0x400000 + sizeof(PROGRAM) - 1); + + uc_close(&handle); +} diff --git a/uc.c b/uc.c index a7533196..5c5564cc 100755 --- a/uc.c +++ b/uc.c @@ -350,7 +350,18 @@ uc_err uc_mem_read(uch handle, uint64_t address, uint8_t *bytes, size_t size) return UC_ERR_OK; } +static const MemoryBlock *getMemoryBlock(struct uc_struct *uc, uint64_t address); +static const MemoryBlock *getMemoryBlock(struct uc_struct *uc, uint64_t address) { + unsigned int i; + for(i = 0; i < uc->mapped_block_count; i++) { + if (address >= uc->mapped_blocks[i].region->addr && address < uc->mapped_blocks[i].end) + return &uc->mapped_blocks[i]; + } + + // not found + return NULL; +} UNICORN_EXPORT uc_err uc_mem_write(uch handle, uint64_t address, const uint8_t *bytes, size_t size) @@ -361,9 +372,21 @@ uc_err uc_mem_write(uch handle, uint64_t address, const uint8_t *bytes, size_t s // invalid handle return UC_ERR_UCH; + const MemoryBlock *mb = getMemoryBlock(uc, address); + if (mb == NULL) + return UC_ERR_MEM_WRITE; + + if (!(mb->perms & UC_PROT_WRITE)) //write protected + //but this is not the program accessing memory, so temporarily mark writable + uc->readonly_mem(mb->region, false); + if (uc->write_mem(&uc->as, address, bytes, size) == false) return UC_ERR_MEM_WRITE; + if (!(mb->perms & UC_PROT_WRITE)) //write protected + //now write protect it again + uc->readonly_mem(mb->region, true); + return UC_ERR_OK; } @@ -529,7 +552,7 @@ static uc_err _hook_mem_access(uch handle, uc_mem_type type, } UNICORN_EXPORT -uc_err uc_mem_map(uch handle, uint64_t address, size_t size) +uc_err uc_mem_map_ex(uch handle, uint64_t address, size_t size, uint32_t perms) { MemoryBlock *blocks; struct uc_struct* uc = (struct uc_struct *)handle; @@ -550,6 +573,10 @@ uc_err uc_mem_map(uch handle, uint64_t address, size_t size) if ((size & (4*1024 - 1)) != 0) return UC_ERR_MAP; + // check for only valid permissions + if ((perms & ~(UC_PROT_READ | UC_PROT_WRITE | UC_PROT_EXEC)) != 0) + return UC_ERR_MAP; + if ((uc->mapped_block_count & (MEM_BLOCK_INCR - 1)) == 0) { //time to grow blocks = realloc(uc->mapped_blocks, sizeof(MemoryBlock) * (uc->mapped_block_count + MEM_BLOCK_INCR)); if (blocks == NULL) { @@ -557,22 +584,28 @@ uc_err uc_mem_map(uch handle, uint64_t address, size_t size) } uc->mapped_blocks = blocks; } - uc->mapped_blocks[uc->mapped_block_count].begin = address; uc->mapped_blocks[uc->mapped_block_count].end = address + size; //TODO extend uc_mem_map to accept permissions, figure out how to pass this down to qemu - uc->mapped_blocks[uc->mapped_block_count].perms = UC_PROT_READ | UC_PROT_WRITE | UC_PROT_EXEC; - uc->memory_map(uc, address, size); + uc->mapped_blocks[uc->mapped_block_count].perms = perms; + uc->mapped_blocks[uc->mapped_block_count].region = uc->memory_map(uc, address, size, perms); uc->mapped_block_count++; return UC_ERR_OK; } +UNICORN_EXPORT +uc_err uc_mem_map(uch handle, uint64_t address, size_t size) +{ + //old api, maps RWX by default + return uc_mem_map_ex(handle, address, size, UC_PROT_READ | UC_PROT_WRITE | UC_PROT_EXEC); +} + bool memory_mapping(struct uc_struct* uc, uint64_t address) { unsigned int i; for(i = 0; i < uc->mapped_block_count; i++) { - if (address >= uc->mapped_blocks[i].begin && address < uc->mapped_blocks[i].end) + if (address >= uc->mapped_blocks[i].region->addr && address < uc->mapped_blocks[i].end) return true; }