From 59b09a71bfc6fd8b95357944f6be9aa54f424421 Mon Sep 17 00:00:00 2001 From: mothran Date: Thu, 27 Aug 2015 21:54:23 -0700 Subject: [PATCH 01/26] first shot at getting FPIP working, need to remove all FP control instructions from being updated --- qemu/target-i386/fpu_helper.c | 2 +- qemu/target-i386/translate.c | 6 ++++++ 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/qemu/target-i386/fpu_helper.c b/qemu/target-i386/fpu_helper.c index 1d4eee39..fa20b7a1 100644 --- a/qemu/target-i386/fpu_helper.c +++ b/qemu/target-i386/fpu_helper.c @@ -991,7 +991,7 @@ void helper_fstenv(CPUX86State *env, target_ulong ptr, int data32) cpu_stl_data(env, ptr, env->fpuc); cpu_stl_data(env, ptr + 4, fpus); cpu_stl_data(env, ptr + 8, fptag); - cpu_stl_data(env, ptr + 12, 0); /* fpip */ + cpu_stl_data(env, ptr + 12, env->fpip); /* fpip */ cpu_stl_data(env, ptr + 16, 0); /* fpcs */ cpu_stl_data(env, ptr + 20, 0); /* fpoo */ cpu_stl_data(env, ptr + 24, 0); /* fpos */ diff --git a/qemu/target-i386/translate.c b/qemu/target-i386/translate.c index 7ce37ef8..d48ed3c8 100644 --- a/qemu/target-i386/translate.c +++ b/qemu/target-i386/translate.c @@ -248,6 +248,11 @@ static void gen_update_cc_op(DisasContext *s) } } +static void fpu_update_ip(CPUX86State *env) +{ + env->fpip = env->eip; +} + #ifdef TARGET_X86_64 #define NB_OP_SIZES 4 @@ -6065,6 +6070,7 @@ static target_ulong disas_insn(CPUX86State *env, DisasContext *s, gen_exception(s, EXCP07_PREX, pc_start - s->cs_base); break; } + fpu_update_ip(env); modrm = cpu_ldub_code(env, s->pc++); mod = (modrm >> 6) & 3; rm = modrm & 7; From 933ef379b4b11f10b430536cee2db4d5665fbb6b Mon Sep 17 00:00:00 2001 From: mothran Date: Fri, 28 Aug 2015 03:19:10 -0700 Subject: [PATCH 02/26] restricted fpip updates to only non-control instructions --- qemu/target-i386/translate.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/qemu/target-i386/translate.c b/qemu/target-i386/translate.c index d48ed3c8..5b4ccb25 100644 --- a/qemu/target-i386/translate.c +++ b/qemu/target-i386/translate.c @@ -6070,7 +6070,6 @@ static target_ulong disas_insn(CPUX86State *env, DisasContext *s, gen_exception(s, EXCP07_PREX, pc_start - s->cs_base); break; } - fpu_update_ip(env); modrm = cpu_ldub_code(env, s->pc++); mod = (modrm >> 6) & 3; rm = modrm & 7; @@ -6116,6 +6115,7 @@ static target_ulong disas_insn(CPUX86State *env, DisasContext *s, /* fcomp needs pop */ gen_helper_fpop(tcg_ctx, cpu_env); } + fpu_update_ip(env); } break; case 0x08: /* flds */ @@ -6200,6 +6200,7 @@ static target_ulong disas_insn(CPUX86State *env, DisasContext *s, gen_helper_fpop(tcg_ctx, cpu_env); break; } + fpu_update_ip(env); break; case 0x0c: /* fldenv mem */ gen_update_cc_op(s); @@ -6225,12 +6226,14 @@ static target_ulong disas_insn(CPUX86State *env, DisasContext *s, gen_update_cc_op(s); gen_jmp_im(s, pc_start - s->cs_base); gen_helper_fldt_ST0(tcg_ctx, cpu_env, cpu_A0); + fpu_update_ip(env); break; case 0x1f: /* fstpt mem */ gen_update_cc_op(s); gen_jmp_im(s, pc_start - s->cs_base); gen_helper_fstt_ST0(tcg_ctx, cpu_env, cpu_A0); gen_helper_fpop(tcg_ctx, cpu_env); + fpu_update_ip(env); break; case 0x2c: /* frstor mem */ gen_update_cc_op(s); @@ -6251,21 +6254,25 @@ static target_ulong disas_insn(CPUX86State *env, DisasContext *s, gen_update_cc_op(s); gen_jmp_im(s, pc_start - s->cs_base); gen_helper_fbld_ST0(tcg_ctx, cpu_env, cpu_A0); + fpu_update_ip(env); break; case 0x3e: /* fbstp */ gen_update_cc_op(s); gen_jmp_im(s, pc_start - s->cs_base); gen_helper_fbst_ST0(tcg_ctx, cpu_env, cpu_A0); gen_helper_fpop(tcg_ctx, cpu_env); + fpu_update_ip(env); break; case 0x3d: /* fildll */ tcg_gen_qemu_ld_i64(s->uc, cpu_tmp1_i64, cpu_A0, s->mem_index, MO_LEQ); gen_helper_fildll_ST0(tcg_ctx, cpu_env, cpu_tmp1_i64); + fpu_update_ip(env); break; case 0x3f: /* fistpll */ gen_helper_fistll_ST0(tcg_ctx, cpu_tmp1_i64, cpu_env); tcg_gen_qemu_st_i64(s->uc, cpu_tmp1_i64, cpu_A0, s->mem_index, MO_LEQ); gen_helper_fpop(tcg_ctx, cpu_env); + fpu_update_ip(env); break; default: goto illegal_op; @@ -6580,6 +6587,7 @@ static target_ulong disas_insn(CPUX86State *env, DisasContext *s, default: goto illegal_op; } + fpu_update_ip(env); } break; /************************/ From feb8ced027b7f33bfca6795093b1206df4c2315a Mon Sep 17 00:00:00 2001 From: mothran Date: Fri, 28 Aug 2015 10:39:11 -0700 Subject: [PATCH 03/26] fixed the FPIP updates to correctly only work with non-control instructions and make sure the pc addr is correct --- qemu/target-i386/translate.c | 22 +++++++-------- regress/fpu_ip.py | 52 ++++++++++++++++++++++++++++++++++++ 2 files changed, 63 insertions(+), 11 deletions(-) create mode 100755 regress/fpu_ip.py diff --git a/qemu/target-i386/translate.c b/qemu/target-i386/translate.c index 5b4ccb25..fc8c66ef 100644 --- a/qemu/target-i386/translate.c +++ b/qemu/target-i386/translate.c @@ -248,9 +248,9 @@ static void gen_update_cc_op(DisasContext *s) } } -static void fpu_update_ip(CPUX86State *env) +static void fpu_update_ip(CPUX86State *env, target_ulong pc) { - env->fpip = env->eip; + env->fpip = pc; } #ifdef TARGET_X86_64 @@ -6115,7 +6115,7 @@ static target_ulong disas_insn(CPUX86State *env, DisasContext *s, /* fcomp needs pop */ gen_helper_fpop(tcg_ctx, cpu_env); } - fpu_update_ip(env); + fpu_update_ip(env, pc_start); } break; case 0x08: /* flds */ @@ -6200,7 +6200,7 @@ static target_ulong disas_insn(CPUX86State *env, DisasContext *s, gen_helper_fpop(tcg_ctx, cpu_env); break; } - fpu_update_ip(env); + fpu_update_ip(env, pc_start); break; case 0x0c: /* fldenv mem */ gen_update_cc_op(s); @@ -6226,14 +6226,14 @@ static target_ulong disas_insn(CPUX86State *env, DisasContext *s, gen_update_cc_op(s); gen_jmp_im(s, pc_start - s->cs_base); gen_helper_fldt_ST0(tcg_ctx, cpu_env, cpu_A0); - fpu_update_ip(env); + fpu_update_ip(env, pc_start); break; case 0x1f: /* fstpt mem */ gen_update_cc_op(s); gen_jmp_im(s, pc_start - s->cs_base); gen_helper_fstt_ST0(tcg_ctx, cpu_env, cpu_A0); gen_helper_fpop(tcg_ctx, cpu_env); - fpu_update_ip(env); + fpu_update_ip(env, pc_start); break; case 0x2c: /* frstor mem */ gen_update_cc_op(s); @@ -6254,25 +6254,25 @@ static target_ulong disas_insn(CPUX86State *env, DisasContext *s, gen_update_cc_op(s); gen_jmp_im(s, pc_start - s->cs_base); gen_helper_fbld_ST0(tcg_ctx, cpu_env, cpu_A0); - fpu_update_ip(env); + fpu_update_ip(env, pc_start); break; case 0x3e: /* fbstp */ gen_update_cc_op(s); gen_jmp_im(s, pc_start - s->cs_base); gen_helper_fbst_ST0(tcg_ctx, cpu_env, cpu_A0); gen_helper_fpop(tcg_ctx, cpu_env); - fpu_update_ip(env); + fpu_update_ip(env, pc_start); break; case 0x3d: /* fildll */ tcg_gen_qemu_ld_i64(s->uc, cpu_tmp1_i64, cpu_A0, s->mem_index, MO_LEQ); gen_helper_fildll_ST0(tcg_ctx, cpu_env, cpu_tmp1_i64); - fpu_update_ip(env); + fpu_update_ip(env, pc_start); break; case 0x3f: /* fistpll */ gen_helper_fistll_ST0(tcg_ctx, cpu_tmp1_i64, cpu_env); tcg_gen_qemu_st_i64(s->uc, cpu_tmp1_i64, cpu_A0, s->mem_index, MO_LEQ); gen_helper_fpop(tcg_ctx, cpu_env); - fpu_update_ip(env); + fpu_update_ip(env, pc_start); break; default: goto illegal_op; @@ -6587,7 +6587,7 @@ static target_ulong disas_insn(CPUX86State *env, DisasContext *s, default: goto illegal_op; } - fpu_update_ip(env); + fpu_update_ip(env, pc_start); } break; /************************/ diff --git a/regress/fpu_ip.py b/regress/fpu_ip.py new file mode 100755 index 00000000..ed8fec6b --- /dev/null +++ b/regress/fpu_ip.py @@ -0,0 +1,52 @@ +#!/usr/bin/python +from unicorn import * +from unicorn.x86_const import * +from capstone import * + +ESP = 0x2000 +PAGE_SIZE = 0x8000 + +# mov [esp], DWORD 0x37f +# fldcw [esp] +# fnop +# fnstenv [esp + 8] +# pop ecx +CODE = b'\xc7\x04\x24\x7f\x03\x00\x00\xd9\x2c\x24\xd9\xd0\xd9\x74\x24\x08\x59' + +class SimpleEngine: + def __init__(self): + self.capmd = Cs(CS_ARCH_X86, CS_MODE_32) + + def disas_single(self, data): + for i in self.capmd.disasm(data, 16): + print("\t%s\t%s" % (i.mnemonic, i.op_str)) + break + +disasm = SimpleEngine() + +def hook_code(uc, addr, size, user_data): + mem = uc.mem_read(addr, size) + print(" 0x%X:" % (addr)), + disasm.disas_single(str(mem)) + +def mem_reader(addr, size): + tmp = mu.mem_read(addr, size) + + for i in tmp: + print(" 0x%x" % i), + print("") + + +mu = Uc(UC_ARCH_X86, UC_MODE_32) + +mu.mem_map(0x0, PAGE_SIZE) +mu.mem_map(0x4000, PAGE_SIZE) +mu.mem_write(0x4000, CODE) +mu.reg_write(UC_X86_REG_ESP, ESP) +mu.hook_add(UC_HOOK_CODE, hook_code) + + +mu.emu_start(0x4000, 0, 0, 5) +esp = mu.reg_read(UC_X86_REG_ESP) +print("value at ESP [0x%X - 4]: " % esp) +mem_reader(esp + 14, 4) \ No newline at end of file From 5d6a478d119394e63e11f6e9a1cc3cf33b19198b Mon Sep 17 00:00:00 2001 From: mothran Date: Fri, 28 Aug 2015 23:46:15 -0700 Subject: [PATCH 04/26] added expect output to fpu_ip.py --- regress/fpu_ip.py | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/regress/fpu_ip.py b/regress/fpu_ip.py index ed8fec6b..77efa21b 100755 --- a/regress/fpu_ip.py +++ b/regress/fpu_ip.py @@ -4,7 +4,7 @@ from unicorn.x86_const import * from capstone import * ESP = 0x2000 -PAGE_SIZE = 0x8000 +PAGE_SIZE = 2 * 1024 * 1024 # mov [esp], DWORD 0x37f # fldcw [esp] @@ -40,7 +40,6 @@ def mem_reader(addr, size): mu = Uc(UC_ARCH_X86, UC_MODE_32) mu.mem_map(0x0, PAGE_SIZE) -mu.mem_map(0x4000, PAGE_SIZE) mu.mem_write(0x4000, CODE) mu.reg_write(UC_X86_REG_ESP, ESP) mu.hook_add(UC_HOOK_CODE, hook_code) @@ -49,4 +48,14 @@ mu.hook_add(UC_HOOK_CODE, hook_code) mu.emu_start(0x4000, 0, 0, 5) esp = mu.reg_read(UC_X86_REG_ESP) print("value at ESP [0x%X - 4]: " % esp) -mem_reader(esp + 14, 4) \ No newline at end of file +mem_reader(esp + 14, 4) + +# EXPECTED OUTPUT: +# 0x4000: mov dword ptr [esp], 0x37f +# 0x4007: fldcw word ptr [esp] +# 0x400A: fnop +# 0x400C: fnstenv dword ptr [esp + 8] +# 0x4010: pop ecx +# value at ESP [0x2004 - 4]: +# 0x0 0x0 0xa 0x40 +# ^ this value should match the fnop instuction addr \ No newline at end of file From b7d60313b5ccd49e3a3d87c7190e011214089c60 Mon Sep 17 00:00:00 2001 From: mothran Date: Sat, 29 Aug 2015 01:56:36 -0700 Subject: [PATCH 05/26] added 64 bit mode to the fstenv helper function, also a fpu_ip64.py regress script --- qemu/target-i386/fpu_helper.c | 19 +++++++++-- regress/fpu_ip64.py | 62 +++++++++++++++++++++++++++++++++++ 2 files changed, 79 insertions(+), 2 deletions(-) create mode 100644 regress/fpu_ip64.py diff --git a/qemu/target-i386/fpu_helper.c b/qemu/target-i386/fpu_helper.c index fa20b7a1..a54580c8 100644 --- a/qemu/target-i386/fpu_helper.c +++ b/qemu/target-i386/fpu_helper.c @@ -986,7 +986,18 @@ void helper_fstenv(CPUX86State *env, target_ulong ptr, int data32) } } } - if (data32) { + switch (env->uc->mode) { + case (UC_MODE_64): + /* 64 bit */ + cpu_stl_data(env, ptr, env->fpuc); + cpu_stl_data(env, ptr + 4, fpus); + cpu_stl_data(env, ptr + 8, fptag); + cpu_stl_data(env, ptr + 12, env->fpip); /* fpip */ + cpu_stl_data(env, ptr + 20, 0); /* fpcs */ + cpu_stl_data(env, ptr + 24, 0); /* fpoo */ + cpu_stl_data(env, ptr + 28, 0); /* fpos */ + break; + case (UC_MODE_32): /* 32 bit */ cpu_stl_data(env, ptr, env->fpuc); cpu_stl_data(env, ptr + 4, fpus); @@ -995,7 +1006,8 @@ void helper_fstenv(CPUX86State *env, target_ulong ptr, int data32) cpu_stl_data(env, ptr + 16, 0); /* fpcs */ cpu_stl_data(env, ptr + 20, 0); /* fpoo */ cpu_stl_data(env, ptr + 24, 0); /* fpos */ - } else { + break; + case (UC_MODE_16): /* 16 bit */ cpu_stw_data(env, ptr, env->fpuc); cpu_stw_data(env, ptr + 2, fpus); @@ -1004,6 +1016,9 @@ void helper_fstenv(CPUX86State *env, target_ulong ptr, int data32) cpu_stw_data(env, ptr + 8, 0); cpu_stw_data(env, ptr + 10, 0); cpu_stw_data(env, ptr + 12, 0); + break; + default: + break; } } diff --git a/regress/fpu_ip64.py b/regress/fpu_ip64.py new file mode 100644 index 00000000..dd0b5c1c --- /dev/null +++ b/regress/fpu_ip64.py @@ -0,0 +1,62 @@ +#!/usr/bin/python +from unicorn import * +from unicorn.x86_const import * +from capstone import * + +ESP = 0x2000 +PAGE_SIZE = 2 * 1024 * 1024 + +# mov [esp], DWORD 0x37f +# fldcw [esp] +# fnop +# fnstenv [esp + 8] +# pop ecx +CODE = "C704247F030000D92C24D9D0D974240859".decode('hex') + +class SimpleEngine: + def __init__(self): + self.capmd = Cs(CS_ARCH_X86, CS_MODE_64) + + def disas_single(self, data): + for i in self.capmd.disasm(data, 16): + print("\t%s\t%s" % (i.mnemonic, i.op_str)) + break + +disasm = SimpleEngine() + +def hook_code(uc, addr, size, user_data): + mem = uc.mem_read(addr, size) + print(" 0x%X:" % (addr)), + disasm.disas_single(str(mem)) + +def mem_reader(addr, size): + tmp = mu.mem_read(addr, size) + + for i in tmp: + print(" 0x%x" % i), + print("") + + +mu = Uc(UC_ARCH_X86, UC_MODE_64) + +mu.mem_map(0x0, PAGE_SIZE) +mu.mem_write(0x4000, CODE) +mu.reg_write(UC_X86_REG_RSP, ESP) +mu.hook_add(UC_HOOK_CODE, hook_code) + + +mu.emu_start(0x4000, 0, 0, 5) +rsp = mu.reg_read(UC_X86_REG_RSP) +print("Value of FPIP: [0x%X]" % (rsp + 10)) +mem_reader(rsp + 10, 8) +# EXPECTED OUTPUT: + +# 0x4000: mov dword ptr [rsp], 0x37f +# 0x4007: fldcw word ptr [rsp] +# 0x400A: fnop +# 0x400C: fnstenv dword ptr [rsp + 8] +# 0x4010: pop rcx +# Value of FPIP: [0x2012] +# 0x0 0x0 0xa 0x40 0x0 0x0 0x0 0x0 + +# WHERE: the value of FPIP should be the address of fnop \ No newline at end of file From cf0a3d75a8c821a43f99976218ea977ecbd6d1e6 Mon Sep 17 00:00:00 2001 From: cherepanov74 Date: Sun, 30 Aug 2015 16:34:23 +0200 Subject: [PATCH 06/26] Added MingW instruction & converted some tabs to spaces --- COMPILE.TXT | 115 +++++++++++++++++++++++++++++++--------------------- 1 file changed, 68 insertions(+), 47 deletions(-) diff --git a/COMPILE.TXT b/COMPILE.TXT index 57c2a629..ec8ea564 100644 --- a/COMPILE.TXT +++ b/COMPILE.TXT @@ -66,11 +66,11 @@ Unicorn requires few dependent packages as followings - To compile for current platform, run: - $ ./make.sh + $ ./make.sh - On 64-bit OS, run the command below to cross-compile Unicorn for 32-bit binary: - $ ./make.sh nix32 + $ ./make.sh nix32 @@ -78,11 +78,11 @@ Unicorn requires few dependent packages as followings To install Unicorn, run: - $ sudo ./make.sh install + $ sudo ./make.sh install - For FreeBSD/OpenBSD, where sudo is unavailable, run: + For FreeBSD/OpenBSD, where sudo is unavailable, run: - $ su; ./make.sh install + $ su; ./make.sh install Users are then required to enter root password to copy Unicorn into machine system directories. @@ -93,17 +93,17 @@ Unicorn requires few dependent packages as followings NOTE: The core framework installed by "./make.sh install" consist of following files: - /usr/include/unicorn/unicorn.h - /usr/include/unicorn/x86.h - /usr/include/unicorn/arm.h - /usr/include/unicorn/arm64.h - /usr/include/unicorn/mips.h - /usr/include/unicorn/ppc.h - /usr/include/unicorn/sparc.h - /usr/include/unicorn/m68k.h - /usr/include/unicorn/platform.h - /usr/lib/libunicorn.so (for Linux/*nix), or /usr/lib/libunicorn.dylib (OSX) - /usr/lib/libunicorn.a + /usr/include/unicorn/unicorn.h + /usr/include/unicorn/x86.h + /usr/include/unicorn/arm.h + /usr/include/unicorn/arm64.h + /usr/include/unicorn/mips.h + /usr/include/unicorn/ppc.h + /usr/include/unicorn/sparc.h + /usr/include/unicorn/m68k.h + /usr/include/unicorn/platform.h + /usr/lib/libunicorn.so (for Linux/*nix), or /usr/lib/libunicorn.dylib (OSX) + /usr/lib/libunicorn.a @@ -112,19 +112,18 @@ Unicorn requires few dependent packages as followings To cross-compile for Windows, Linux & gcc-mingw-w64-i686 (and also gcc-mingw-w64-x86-64 for 64-bit binaries) are required. - - To cross-compile Windows 32-bit binary, simply run: + - To cross-compile Windows 32-bit binary, simply run: - $ ./make.sh cross-win32 + $ ./make.sh cross-win32 - - To cross-compile Windows 64-bit binary, run: + - To cross-compile Windows 64-bit binary, run: - $ ./make.sh cross-win64 + $ ./make.sh cross-win64 - Resulted files libunicorn.dll, libunicorn.dll.a & tests/test*.exe can then + Resulted files unicorn.dll, unicorn.lib & samples/sample*.exe can then be used on Windows machine. To run sample_x86.exe on Windows 32-bit, you need the following files: - - unicorn.dll - /usr/i686-w64-mingw32/sys-root/mingw/bin/libglib-2.0-0.dll - /usr/lib/gcc/i686-w64-mingw32/4.8/libgcc_s_sjlj-1.dll @@ -145,17 +144,17 @@ Unicorn requires few dependent packages as followings To cross-compile for iOS (iPhone/iPad/iPod), Mac OSX with XCode installed is required. - - To cross-compile for ArmV7 (iPod 4, iPad 1/2/3, iPhone4, iPhone4S), run: - $ ./make.sh ios_armv7 + - To cross-compile for ArmV7 (iPod 4, iPad 1/2/3, iPhone4, iPhone4S), run: + $ ./make.sh ios_armv7 - - To cross-compile for ArmV7s (iPad 4, iPhone 5C, iPad mini), run: - $ ./make.sh ios_armv7s + - To cross-compile for ArmV7s (iPad 4, iPhone 5C, iPad mini), run: + $ ./make.sh ios_armv7s - - To cross-compile for Arm64 (iPhone 5S, iPad mini Retina, iPad Air), run: - $ ./make.sh ios_arm64 + - To cross-compile for Arm64 (iPhone 5S, iPad mini Retina, iPad Air), run: + $ ./make.sh ios_arm64 - - To cross-compile for all iDevices (armv7 + armv7s + arm64), run: - $ ./make.sh ios + - To cross-compile for all iDevices (armv7 + armv7s + arm64), run: + $ ./make.sh ios Resulted files libunicorn.dylib, libunicorn.a & tests/test* can then be used on iOS devices. @@ -167,47 +166,69 @@ Unicorn requires few dependent packages as followings To cross-compile for Android (smartphone/tablet), Android NDK is required. NOTE: Only ARM and ARM64 are currently supported. - $ NDK=/android/android-ndk-r10e ./make.sh cross-android arm + $ NDK=/android/android-ndk-r10e ./make.sh cross-android arm or - $ NDK=/android/android-ndk-r10e ./make.sh cross-android arm64 + $ NDK=/android/android-ndk-r10e ./make.sh cross-android arm64 Resulted files libunicorn.so, libunicorn.a & tests/test* can then be used on Android devices. -[7] Compile on Windows with Cygwin +[7] Compile on Windows with MinGW (MSYS2) - To compile under Cygwin gcc-mingw-w64-i686 or x86_64-w64-mingw32 run: + To compile with MinGW you need to install MSYS2: https://msys2.github.io/ + Follow the install instructions and don't forget to update the system packages as written in 5 & 6 paragraphs + + - To compile Windows 32-bit binary with MinGW, run: + $ pacman -S make + $ pacman -S pkg-config + $ pacman -S mingw-w64-i686-glib2 + $ pacman -S mingw-w64-i686-toolchain + $ ./make.sh cross-win32 - - To compile Windows 32-bit binary under Cygwin, run: + - To compile Windows 64-bit binary with MinGW, run: + $ pacman -S make + $ pacman -S pkg-config + $ pacman -S mingw-w64-x86_64-glib2 + $ pacman -S mingw-w64-x86_64-toolchain + $ ./make.sh cross-win64 - $ ./make.sh cygwin-mingw32 - - - To compile Windows 64-bit binary under Cygwin, run: - - $ ./make.sh cygwin-mingw64 - - Resulted files libunicorn.dll, libunicorn.dll.a & tests/test*.exe can then + Resulted files unicorn.dll, unicorn.lib & samples/sample*.exe can then be used on Windows machine. + To run sample_x86.exe on Windows 32-bit, you need the following files: + - unicorn.dll + - C:\msys32\mingw32\bin\libiconv-2.dll + - C:\msys32\mingw32\bin\libintl-8.dll + - C:\msys32\mingw32\bin\libglib-2.0-0.dll + - C:\msys32\mingw32\bin\libgcc_s_seh-1.dll + - C:\msys32\mingw32\bin\libwinpthread-1.dll + + To run sample_x86.exe on Windows 64-bit, you need the following files: + - unicorn.dll + - C:\msys64\mingw64\bin\libiconv-2.dll + - C:\msys64\mingw64\bin\libintl-8.dll + - C:\msys64\mingw64\bin\libglib-2.0-0.dll + - C:\msys64\mingw64\bin\libgcc_s_seh-1.dll + - C:\msys64\mingw64\bin\libwinpthread-1.dll [8] By default, "cc" (default C compiler on the system) is used as compiler. - - To use "clang" compiler instead, run the command below: + - To use "clang" compiler instead, run the command below: - $ ./make.sh clang + $ ./make.sh clang - - To use "gcc" compiler instead, run: + - To use "gcc" compiler instead, run: - $ ./make.sh gcc + $ ./make.sh gcc [9] To uninstall Unicorn, run the command below: - $ sudo ./make.sh uninstall + $ sudo ./make.sh uninstall From 1b6469e60fb31341f1c56cb182f76860e98206c3 Mon Sep 17 00:00:00 2001 From: Sean Heelan Date: Sun, 30 Aug 2015 22:42:48 +0700 Subject: [PATCH 07/26] Regression test for issue #82 (emulator hang on jmp REG) --- regress/jmp_ebx_hang.py | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) create mode 100755 regress/jmp_ebx_hang.py diff --git a/regress/jmp_ebx_hang.py b/regress/jmp_ebx_hang.py new file mode 100755 index 00000000..21b057d2 --- /dev/null +++ b/regress/jmp_ebx_hang.py @@ -0,0 +1,28 @@ +#!/usr/bin/env python + +"""See https://github.com/unicorn-engine/unicorn/issues/82""" + +import unicorn +CODE_ADDR = 0x10101000 +CODE = b'\xff\xe3' +mu = unicorn.Uc(unicorn.UC_ARCH_X86, unicorn.UC_MODE_32) +mu.mem_map(CODE_ADDR, 1024 * 4) +mu.mem_write(CODE_ADDR, CODE) +mu.reg_write(unicorn.x86_const.UC_X86_REG_EBX, 0x0) + +print "jmp ebx, with ebx == 0" +try: + mu.emu_start(CODE_ADDR, CODE_ADDR + 2, count=1) +except unicorn.UcError as e: + print "Error: %s" % e + +mu = unicorn.Uc(unicorn.UC_ARCH_X86, unicorn.UC_MODE_32) +mu.mem_map(CODE_ADDR, 1024 * 4) +# If we write this address to EBX then the emulator hangs on emu_start +mu.reg_write(unicorn.x86_const.UC_X86_REG_EBX, 0xaa96a47f) +mu.mem_write(CODE_ADDR, CODE) +print "jmp ebx, with ebx == 0xaa96a47f" +try: + mu.emu_start(CODE_ADDR, CODE_ADDR + 2, count=1) +except unicorn.UcError as e: + print "Error: %s" % e From 4b05e736a191c3a86f73bbd0eccc0c800d4d8389 Mon Sep 17 00:00:00 2001 From: Sean Heelan Date: Sun, 30 Aug 2015 22:50:47 +0700 Subject: [PATCH 08/26] Use asserts instead of print statements on the correct paths to avoid confusing people as to what the success indicator is here. --- regress/jmp_ebx_hang.py | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/regress/jmp_ebx_hang.py b/regress/jmp_ebx_hang.py index 21b057d2..1b78d89c 100755 --- a/regress/jmp_ebx_hang.py +++ b/regress/jmp_ebx_hang.py @@ -8,21 +8,26 @@ CODE = b'\xff\xe3' mu = unicorn.Uc(unicorn.UC_ARCH_X86, unicorn.UC_MODE_32) mu.mem_map(CODE_ADDR, 1024 * 4) mu.mem_write(CODE_ADDR, CODE) +# If EBX is zero then an exception is raised, as expected mu.reg_write(unicorn.x86_const.UC_X86_REG_EBX, 0x0) -print "jmp ebx, with ebx == 0" try: mu.emu_start(CODE_ADDR, CODE_ADDR + 2, count=1) except unicorn.UcError as e: - print "Error: %s" % e + assert(e.errno == unicorn.UC_ERR_CODE_INVALID) +else: + assert(False) mu = unicorn.Uc(unicorn.UC_ARCH_X86, unicorn.UC_MODE_32) mu.mem_map(CODE_ADDR, 1024 * 4) # If we write this address to EBX then the emulator hangs on emu_start mu.reg_write(unicorn.x86_const.UC_X86_REG_EBX, 0xaa96a47f) mu.mem_write(CODE_ADDR, CODE) -print "jmp ebx, with ebx == 0xaa96a47f" try: mu.emu_start(CODE_ADDR, CODE_ADDR + 2, count=1) except unicorn.UcError as e: - print "Error: %s" % e + assert(e.errno == unicorn.UC_ERR_CODE_INVALID) +else: + assert(False) + +print "Success" From c2b0e6827ad53172e7bffff0853ad9cdad73eb0b Mon Sep 17 00:00:00 2001 From: cherepanov74 Date: Sun, 30 Aug 2015 20:55:25 +0200 Subject: [PATCH 09/26] Fixed the list of required DLLs on Win32 --- COMPILE.TXT | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/COMPILE.TXT b/COMPILE.TXT index ec8ea564..bd0910be 100644 --- a/COMPILE.TXT +++ b/COMPILE.TXT @@ -199,19 +199,19 @@ Unicorn requires few dependent packages as followings To run sample_x86.exe on Windows 32-bit, you need the following files: - unicorn.dll - - C:\msys32\mingw32\bin\libiconv-2.dll - - C:\msys32\mingw32\bin\libintl-8.dll - - C:\msys32\mingw32\bin\libglib-2.0-0.dll - - C:\msys32\mingw32\bin\libgcc_s_seh-1.dll - - C:\msys32\mingw32\bin\libwinpthread-1.dll + - %MSYS2%\mingw32\bin\libiconv-2.dll + - %MSYS2%\mingw32\bin\libintl-8.dll + - %MSYS2%\mingw32\bin\libglib-2.0-0.dll + - %MSYS2%\mingw32\bin\libgcc_s_dw2-1.dll + - %MSYS2%\mingw32\bin\libwinpthread-1.dll To run sample_x86.exe on Windows 64-bit, you need the following files: - unicorn.dll - - C:\msys64\mingw64\bin\libiconv-2.dll - - C:\msys64\mingw64\bin\libintl-8.dll - - C:\msys64\mingw64\bin\libglib-2.0-0.dll - - C:\msys64\mingw64\bin\libgcc_s_seh-1.dll - - C:\msys64\mingw64\bin\libwinpthread-1.dll + - %MSYS2%\mingw64\bin\libiconv-2.dll + - %MSYS2%\mingw64\bin\libintl-8.dll + - %MSYS2%\mingw64\bin\libglib-2.0-0.dll + - %MSYS2%\mingw64\bin\libgcc_s_seh-1.dll + - %MSYS2%\mingw64\bin\libwinpthread-1.dll [8] By default, "cc" (default C compiler on the system) is used as compiler. From f83ddf5ad493838a1c69b88a0b0d372dd13fc0c2 Mon Sep 17 00:00:00 2001 From: Ryan Hileman Date: Sun, 30 Aug 2015 15:52:50 -0700 Subject: [PATCH 10/26] clean up Go binding hook types --- bindings/go/unicorn/hook.go | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/bindings/go/unicorn/hook.go b/bindings/go/unicorn/hook.go index b9e3c14b..ea6ce40e 100644 --- a/bindings/go/unicorn/hook.go +++ b/bindings/go/unicorn/hook.go @@ -17,33 +17,33 @@ type HookData struct { } //export hookCode -func hookCode(handle C.uch, addr C.uint64_t, size C.uint32_t, user unsafe.Pointer) { +func hookCode(handle C.uch, addr uint64, size uint32, user unsafe.Pointer) { hook := (*HookData)(user) hook.Callback.(func(*Uc, uint64, uint32))(hook.Uc, uint64(addr), uint32(size)) } //export hookMemInvalid -func hookMemInvalid(handle C.uch, typ C.uc_mem_type, addr C.uint64_t, size int, value C.int64_t, user unsafe.Pointer) C.bool { +func hookMemInvalid(handle C.uch, typ C.uc_mem_type, addr uint64, size int, value int64, user unsafe.Pointer) bool { hook := (*HookData)(user) - return C.bool(hook.Callback.(func(*Uc, int, uint64, int, int64) bool)(hook.Uc, int(typ), uint64(addr), size, int64(value))) + return hook.Callback.(func(*Uc, int, uint64, int, int64) bool)(hook.Uc, int(typ), addr, size, value) } //export hookMemAccess -func hookMemAccess(handle C.uch, typ C.uc_mem_type, addr C.uint64_t, size int, value C.int64_t, user unsafe.Pointer) { +func hookMemAccess(handle C.uch, typ C.uc_mem_type, addr uint64, size int, value int64, user unsafe.Pointer) { hook := (*HookData)(user) - hook.Callback.(func(*Uc, int, uint64, int, int64))(hook.Uc, int(typ), uint64(addr), size, int64(value)) + hook.Callback.(func(*Uc, int, uint64, int, int64))(hook.Uc, int(typ), addr, size, value) } //export hookX86In -func hookX86In(handle C.uch, port, size uint32, user unsafe.Pointer) C.uint32_t { +func hookX86In(handle C.uch, port, size uint32, user unsafe.Pointer) uint32 { hook := (*HookData)(user) - return C.uint32_t(hook.Callback.(func(*Uc, uint32, uint32) uint32)(hook.Uc, port, size)) + return hook.Callback.(func(*Uc, uint32, uint32) uint32)(hook.Uc, port, size) } //export hookX86Out func hookX86Out(handle C.uch, port, size, value uint32, user unsafe.Pointer) { hook := (*HookData)(user) - hook.Callback.(func(*Uc, uint32, uint32, uint32))(hook.Uc, uint32(port), uint32(size), uint32(value)) + hook.Callback.(func(*Uc, uint32, uint32, uint32))(hook.Uc, port, size, value) } //export hookX86Syscall From ac1fc4d631e65051fe6e9ded55c10fff60bd2dd9 Mon Sep 17 00:00:00 2001 From: Ryan Hileman Date: Sun, 30 Aug 2015 15:53:06 -0700 Subject: [PATCH 11/26] add missing interrupt hook for Go bindings --- bindings/go/unicorn/hook.c | 4 ++++ bindings/go/unicorn/hook.go | 8 ++++++++ bindings/go/unicorn/hook.h | 1 + 3 files changed, 13 insertions(+) diff --git a/bindings/go/unicorn/hook.c b/bindings/go/unicorn/hook.c index e715e1a2..a06f9901 100644 --- a/bindings/go/unicorn/hook.c +++ b/bindings/go/unicorn/hook.c @@ -17,6 +17,10 @@ void hookMemAccess_cgo(uch handle, uc_mem_type type, uint64_t addr, int size, in hookMemAccess(handle, type, addr, size, value, user); } +void hookInterrupt_cgo(uch handle, uint32_t intno, void *user) { + hookInterrupt(handle, intno, user); +} + uint32_t hookX86In_cgo(uch handle, uint32_t port, uint32_t size, void *user) { return hookX86In(handle, port, size, user); } diff --git a/bindings/go/unicorn/hook.go b/bindings/go/unicorn/hook.go index ea6ce40e..dcab893a 100644 --- a/bindings/go/unicorn/hook.go +++ b/bindings/go/unicorn/hook.go @@ -34,6 +34,12 @@ func hookMemAccess(handle C.uch, typ C.uc_mem_type, addr uint64, size int, value hook.Callback.(func(*Uc, int, uint64, int, int64))(hook.Uc, int(typ), addr, size, value) } +//export hookInterrupt +func hookInterrupt(handle C.uch, intno uint32, user unsafe.Pointer) { + hook := (*HookData)(user) + hook.Callback.(func(*Uc, uint32))(hook.Uc, intno) +} + //export hookX86In func hookX86In(handle C.uch, port, size uint32, user unsafe.Pointer) uint32 { hook := (*HookData)(user) @@ -64,6 +70,8 @@ func (u *Uc) HookAdd(htype int, cb interface{}, insn ...int) (C.uch, error) { callback = C.hookMemInvalid_cgo case UC_HOOK_MEM_READ, UC_HOOK_MEM_WRITE, UC_HOOK_MEM_READ_WRITE: callback = C.hookMemAccess_cgo + case UC_HOOK_INTR: + callback = C.hookInterrupt_cgo case UC_HOOK_INSN: extra = C.int(insn[0]) switch extra { diff --git a/bindings/go/unicorn/hook.h b/bindings/go/unicorn/hook.h index a89d8ec0..c8c22267 100644 --- a/bindings/go/unicorn/hook.h +++ b/bindings/go/unicorn/hook.h @@ -2,6 +2,7 @@ uc_err uc_hook_add2(uch handle, uch *h2, uc_hook_t type, void *callback, void *u void hookCode_cgo(uch handle, uint64_t addr, uint32_t size, void *user); bool hookMemInvalid_cgo(uch handle, uc_mem_type type, uint64_t addr, int size, int64_t value, void *user); void hookMemAccess_cgo(uch handle, uc_mem_type type, uint64_t addr, int size, int64_t value, void *user); +void hookInterrupt_cgo(uch handle, uint32_t intno, void *user); uint32_t hookX86In_cgo(uch handle, uint32_t port, uint32_t size, void *user); void hookX86Out_cgo(uch handle, uint32_t port, uint32_t size, uint32_t value, void *user); void hookX86Syscall_cgo(uch handle, void *user); From 912faf2c3cb9c47977d115cdcd893d0894703946 Mon Sep 17 00:00:00 2001 From: mothran Date: Sun, 30 Aug 2015 18:04:28 -0700 Subject: [PATCH 12/26] after closer review, in x64 the the op size is 32 so data32 is set, can removed the unicorn dependency and regress/fpu_ip64.py still works --- qemu/target-i386/fpu_helper.c | 21 +++------------------ 1 file changed, 3 insertions(+), 18 deletions(-) diff --git a/qemu/target-i386/fpu_helper.c b/qemu/target-i386/fpu_helper.c index a54580c8..ea0c1fca 100644 --- a/qemu/target-i386/fpu_helper.c +++ b/qemu/target-i386/fpu_helper.c @@ -986,18 +986,7 @@ void helper_fstenv(CPUX86State *env, target_ulong ptr, int data32) } } } - switch (env->uc->mode) { - case (UC_MODE_64): - /* 64 bit */ - cpu_stl_data(env, ptr, env->fpuc); - cpu_stl_data(env, ptr + 4, fpus); - cpu_stl_data(env, ptr + 8, fptag); - cpu_stl_data(env, ptr + 12, env->fpip); /* fpip */ - cpu_stl_data(env, ptr + 20, 0); /* fpcs */ - cpu_stl_data(env, ptr + 24, 0); /* fpoo */ - cpu_stl_data(env, ptr + 28, 0); /* fpos */ - break; - case (UC_MODE_32): + if (data32) { /* 32 bit */ cpu_stl_data(env, ptr, env->fpuc); cpu_stl_data(env, ptr + 4, fpus); @@ -1006,19 +995,15 @@ void helper_fstenv(CPUX86State *env, target_ulong ptr, int data32) cpu_stl_data(env, ptr + 16, 0); /* fpcs */ cpu_stl_data(env, ptr + 20, 0); /* fpoo */ cpu_stl_data(env, ptr + 24, 0); /* fpos */ - break; - case (UC_MODE_16): + } else { /* 16 bit */ cpu_stw_data(env, ptr, env->fpuc); cpu_stw_data(env, ptr + 2, fpus); cpu_stw_data(env, ptr + 4, fptag); - cpu_stw_data(env, ptr + 6, 0); + cpu_stw_data(env, ptr + 6, env->fpip); cpu_stw_data(env, ptr + 8, 0); cpu_stw_data(env, ptr + 10, 0); cpu_stw_data(env, ptr + 12, 0); - break; - default: - break; } } From 342fcef4ffb07eb18d3d2ffdeacdc56524ee48f2 Mon Sep 17 00:00:00 2001 From: Nguyen Anh Quynh Date: Mon, 31 Aug 2015 09:48:19 +0800 Subject: [PATCH 13/26] update CREDITS --- CREDITS.TXT | 2 ++ 1 file changed, 2 insertions(+) diff --git a/CREDITS.TXT b/CREDITS.TXT index a529cc49..1f76adf0 100644 --- a/CREDITS.TXT +++ b/CREDITS.TXT @@ -37,6 +37,8 @@ Luke Burnett Parker Thompson Daniel Godas-Lopez Antonio "s4tan" Parata +Corey Kallenberg +Shift Contributors (in no particular order) ===================================== From 4cd5fa3811315ac5df1f20d42d628a180eafce15 Mon Sep 17 00:00:00 2001 From: mothran Date: Sun, 30 Aug 2015 18:56:55 -0700 Subject: [PATCH 14/26] fpip x64 fxsave working with using hflags to check CPU mode --- qemu/target-i386/fpu_helper.c | 44 ++++++++++++++++++++++++----------- 1 file changed, 30 insertions(+), 14 deletions(-) diff --git a/qemu/target-i386/fpu_helper.c b/qemu/target-i386/fpu_helper.c index ea0c1fca..12d7710c 100644 --- a/qemu/target-i386/fpu_helper.c +++ b/qemu/target-i386/fpu_helper.c @@ -986,25 +986,41 @@ void helper_fstenv(CPUX86State *env, target_ulong ptr, int data32) } } } - if (data32) { - /* 32 bit */ +#ifdef TARGET_X86_64 + // DFLAG enum: tcg.h, case here to int + if (env->hflags & HF_CS64_MASK) { + printf("HELLO\n"); cpu_stl_data(env, ptr, env->fpuc); cpu_stl_data(env, ptr + 4, fpus); cpu_stl_data(env, ptr + 8, fptag); cpu_stl_data(env, ptr + 12, env->fpip); /* fpip */ - cpu_stl_data(env, ptr + 16, 0); /* fpcs */ - cpu_stl_data(env, ptr + 20, 0); /* fpoo */ - cpu_stl_data(env, ptr + 24, 0); /* fpos */ - } else { - /* 16 bit */ - cpu_stw_data(env, ptr, env->fpuc); - cpu_stw_data(env, ptr + 2, fpus); - cpu_stw_data(env, ptr + 4, fptag); - cpu_stw_data(env, ptr + 6, env->fpip); - cpu_stw_data(env, ptr + 8, 0); - cpu_stw_data(env, ptr + 10, 0); - cpu_stw_data(env, ptr + 12, 0); + cpu_stl_data(env, ptr + 20, 0); /* fpcs */ + cpu_stl_data(env, ptr + 24, 0); /* fpoo */ + cpu_stl_data(env, ptr + 28, 0); /* fpos */ } +#endif + if (!(env->hflags & HF_CS64_MASK)) + { + if (data32) { + /* 32 bit */ + cpu_stl_data(env, ptr, env->fpuc); + cpu_stl_data(env, ptr + 4, fpus); + cpu_stl_data(env, ptr + 8, fptag); + cpu_stl_data(env, ptr + 12, env->fpip); /* fpip */ + cpu_stl_data(env, ptr + 16, 0); /* fpcs */ + cpu_stl_data(env, ptr + 20, 0); /* fpoo */ + cpu_stl_data(env, ptr + 24, 0); /* fpos */ + } else { + /* 16 bit */ + cpu_stw_data(env, ptr, env->fpuc); + cpu_stw_data(env, ptr + 2, fpus); + cpu_stw_data(env, ptr + 4, fptag); + cpu_stw_data(env, ptr + 6, env->fpip); + cpu_stw_data(env, ptr + 8, 0); + cpu_stw_data(env, ptr + 10, 0); + cpu_stw_data(env, ptr + 12, 0); + } + } void helper_fldenv(CPUX86State *env, target_ulong ptr, int data32) From 2b6f80675959fa4175d61b8e090e75859ad2bb96 Mon Sep 17 00:00:00 2001 From: mothran Date: Sun, 30 Aug 2015 19:22:41 -0700 Subject: [PATCH 15/26] removed testing printf --- qemu/target-i386/fpu_helper.c | 1 - 1 file changed, 1 deletion(-) diff --git a/qemu/target-i386/fpu_helper.c b/qemu/target-i386/fpu_helper.c index 12d7710c..3dbba049 100644 --- a/qemu/target-i386/fpu_helper.c +++ b/qemu/target-i386/fpu_helper.c @@ -989,7 +989,6 @@ void helper_fstenv(CPUX86State *env, target_ulong ptr, int data32) #ifdef TARGET_X86_64 // DFLAG enum: tcg.h, case here to int if (env->hflags & HF_CS64_MASK) { - printf("HELLO\n"); cpu_stl_data(env, ptr, env->fpuc); cpu_stl_data(env, ptr + 4, fpus); cpu_stl_data(env, ptr + 8, fptag); From e1ab761e8a2f8303775042ba44c69b533f571d41 Mon Sep 17 00:00:00 2001 From: mothran Date: Sun, 30 Aug 2015 19:32:39 -0700 Subject: [PATCH 16/26] fixed typo --- qemu/target-i386/fpu_helper.c | 1 + 1 file changed, 1 insertion(+) diff --git a/qemu/target-i386/fpu_helper.c b/qemu/target-i386/fpu_helper.c index 3dbba049..e9cbd7d0 100644 --- a/qemu/target-i386/fpu_helper.c +++ b/qemu/target-i386/fpu_helper.c @@ -1019,6 +1019,7 @@ void helper_fstenv(CPUX86State *env, target_ulong ptr, int data32) cpu_stw_data(env, ptr + 10, 0); cpu_stw_data(env, ptr + 12, 0); } + } } From 6aa2b73bea09aeff7e65efa9bd18ca51f84859e8 Mon Sep 17 00:00:00 2001 From: mothran Date: Sun, 30 Aug 2015 19:39:46 -0700 Subject: [PATCH 17/26] removed ifdef for x64 in fpu saving --- qemu/target-i386/fpu_helper.c | 43 ++++++++++++++++------------------- 1 file changed, 19 insertions(+), 24 deletions(-) diff --git a/qemu/target-i386/fpu_helper.c b/qemu/target-i386/fpu_helper.c index e9cbd7d0..a74380f0 100644 --- a/qemu/target-i386/fpu_helper.c +++ b/qemu/target-i386/fpu_helper.c @@ -986,7 +986,7 @@ void helper_fstenv(CPUX86State *env, target_ulong ptr, int data32) } } } -#ifdef TARGET_X86_64 + // DFLAG enum: tcg.h, case here to int if (env->hflags & HF_CS64_MASK) { cpu_stl_data(env, ptr, env->fpuc); @@ -996,29 +996,24 @@ void helper_fstenv(CPUX86State *env, target_ulong ptr, int data32) cpu_stl_data(env, ptr + 20, 0); /* fpcs */ cpu_stl_data(env, ptr + 24, 0); /* fpoo */ cpu_stl_data(env, ptr + 28, 0); /* fpos */ - } -#endif - if (!(env->hflags & HF_CS64_MASK)) - { - if (data32) { - /* 32 bit */ - cpu_stl_data(env, ptr, env->fpuc); - cpu_stl_data(env, ptr + 4, fpus); - cpu_stl_data(env, ptr + 8, fptag); - cpu_stl_data(env, ptr + 12, env->fpip); /* fpip */ - cpu_stl_data(env, ptr + 16, 0); /* fpcs */ - cpu_stl_data(env, ptr + 20, 0); /* fpoo */ - cpu_stl_data(env, ptr + 24, 0); /* fpos */ - } else { - /* 16 bit */ - cpu_stw_data(env, ptr, env->fpuc); - cpu_stw_data(env, ptr + 2, fpus); - cpu_stw_data(env, ptr + 4, fptag); - cpu_stw_data(env, ptr + 6, env->fpip); - cpu_stw_data(env, ptr + 8, 0); - cpu_stw_data(env, ptr + 10, 0); - cpu_stw_data(env, ptr + 12, 0); - } + } else if (data32) { + /* 32 bit */ + cpu_stl_data(env, ptr, env->fpuc); + cpu_stl_data(env, ptr + 4, fpus); + cpu_stl_data(env, ptr + 8, fptag); + cpu_stl_data(env, ptr + 12, env->fpip); /* fpip */ + cpu_stl_data(env, ptr + 16, 0); /* fpcs */ + cpu_stl_data(env, ptr + 20, 0); /* fpoo */ + cpu_stl_data(env, ptr + 24, 0); /* fpos */ + } else { + /* 16 bit */ + cpu_stw_data(env, ptr, env->fpuc); + cpu_stw_data(env, ptr + 2, fpus); + cpu_stw_data(env, ptr + 4, fptag); + cpu_stw_data(env, ptr + 6, env->fpip); + cpu_stw_data(env, ptr + 8, 0); + cpu_stw_data(env, ptr + 10, 0); + cpu_stw_data(env, ptr + 12, 0); } } From 046f29442bcf80ace713bc998d01ebf4e4f405d7 Mon Sep 17 00:00:00 2001 From: pancake Date: Mon, 31 Aug 2015 11:08:02 +0200 Subject: [PATCH 18/26] Some polishment on the ascii art logo --- docs/unicorn-logo.txt | 36 ++++++++++++++++++------------------ 1 file changed, 18 insertions(+), 18 deletions(-) diff --git a/docs/unicorn-logo.txt b/docs/unicorn-logo.txt index 943c0ad2..3b6e96af 100644 --- a/docs/unicorn-logo.txt +++ b/docs/unicorn-logo.txt @@ -1,19 +1,19 @@ - /\'. _,, - |.\ \ .'_/ - _.-- |(\\ \ .'_.' - _.-' \_\\ \\_),/ _/ - _).' .:::::::.___ .' - // ' ./::::::\\o\( - // //::/ '"( \ - //_ //::( '. '. - /_'/ /||:::\ '. \ - '// '\\:::':\_ -<_' _'- - / | '\::/|::::.._ _ )( - | | \:| \:( '.(_'._) + /\'. _,. + |:\ \. .'_/ + _.- |(\\ \ .'_.' + _.-' ,__\\ \\_),/ _/ + _:.' .:::::::.___ ,' + // ' ./::::::\ Date: Mon, 31 Aug 2015 23:38:22 +0800 Subject: [PATCH 19/26] chmod +x regress/fpu_ip64.py --- regress/fpu_ip64.py | 0 1 file changed, 0 insertions(+), 0 deletions(-) mode change 100644 => 100755 regress/fpu_ip64.py diff --git a/regress/fpu_ip64.py b/regress/fpu_ip64.py old mode 100644 new mode 100755 From 12019dba40bafa7e8525d6540d8499ad3076db7c Mon Sep 17 00:00:00 2001 From: Nguyen Anh Quynh Date: Mon, 31 Aug 2015 23:38:48 +0800 Subject: [PATCH 20/26] update .gitignore --- .gitignore | 1 + 1 file changed, 1 insertion(+) diff --git a/.gitignore b/.gitignore index d1522566..99d9edc7 100644 --- a/.gitignore +++ b/.gitignore @@ -87,3 +87,4 @@ regress/block_test regress/map_write regress/ro_mem_test regress/nr_mem_test +regress/timeout_segfault From bea73ef2139e04f72f6199cc50ab3a45276f3622 Mon Sep 17 00:00:00 2001 From: Nguyen Anh Quynh Date: Tue, 1 Sep 2015 00:17:55 +0800 Subject: [PATCH 21/26] stop emulation when hitting invalid code address. this fixes issue #82 --- qemu/cpu-exec.c | 2 ++ regress/jmp_ebx_hang.py | 6 +++++- 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/qemu/cpu-exec.c b/qemu/cpu-exec.c index 1e26e1b9..b7460385 100644 --- a/qemu/cpu-exec.c +++ b/qemu/cpu-exec.c @@ -205,6 +205,8 @@ int cpu_exec(struct uc_struct *uc, CPUArchState *env) // qq have_tb_lock = true; tb = tb_find_fast(env); // qq if (!tb) { // invalid TB due to invalid code? + uc->invalid_error = UC_ERR_CODE_INVALID; + ret = EXCP_HLT; break; } /* Note: we do it here to avoid a gcc bug on Mac OS X when diff --git a/regress/jmp_ebx_hang.py b/regress/jmp_ebx_hang.py index 1b78d89c..5683de89 100755 --- a/regress/jmp_ebx_hang.py +++ b/regress/jmp_ebx_hang.py @@ -4,20 +4,23 @@ import unicorn CODE_ADDR = 0x10101000 -CODE = b'\xff\xe3' +CODE = b'\xff\xe3' # jmp ebx mu = unicorn.Uc(unicorn.UC_ARCH_X86, unicorn.UC_MODE_32) mu.mem_map(CODE_ADDR, 1024 * 4) mu.mem_write(CODE_ADDR, CODE) # If EBX is zero then an exception is raised, as expected mu.reg_write(unicorn.x86_const.UC_X86_REG_EBX, 0x0) +print(">>> jmp ebx (ebx = 0)"); try: mu.emu_start(CODE_ADDR, CODE_ADDR + 2, count=1) except unicorn.UcError as e: + print("ERROR: %s" % e) assert(e.errno == unicorn.UC_ERR_CODE_INVALID) else: assert(False) +print(">>> jmp ebx (ebx = 0xaa96a47f)"); mu = unicorn.Uc(unicorn.UC_ARCH_X86, unicorn.UC_MODE_32) mu.mem_map(CODE_ADDR, 1024 * 4) # If we write this address to EBX then the emulator hangs on emu_start @@ -26,6 +29,7 @@ mu.mem_write(CODE_ADDR, CODE) try: mu.emu_start(CODE_ADDR, CODE_ADDR + 2, count=1) except unicorn.UcError as e: + print("ERROR: %s" % e) assert(e.errno == unicorn.UC_ERR_CODE_INVALID) else: assert(False) From d3cf1faf80c5f777b52de24886f8de6e91cd1782 Mon Sep 17 00:00:00 2001 From: Ryan Hileman Date: Mon, 31 Aug 2015 22:55:38 -0700 Subject: [PATCH 22/26] add regression test for #91 --- regress/pshufb.py | 12 ++++++++++++ 1 file changed, 12 insertions(+) create mode 100755 regress/pshufb.py diff --git a/regress/pshufb.py b/regress/pshufb.py new file mode 100755 index 00000000..0d01bf5e --- /dev/null +++ b/regress/pshufb.py @@ -0,0 +1,12 @@ +#!/usr/bin/python +# By Ryan Hileman, issue #91 + +# Invalid instruction = test failed + +from unicorn import * +from unicorn.x86_const import * +uc = Uc(UC_ARCH_X86, UC_MODE_64) +uc.mem_map(0x2000, 0x1000) +# pshufb xmm0, xmm1 +uc.mem_write(0x2000, '660f3800c1'.decode('hex')) +uc.emu_start(0x2000, 0) From 95059407ee50e4c705918814be002b42605ffe4c Mon Sep 17 00:00:00 2001 From: Chris Eagle Date: Mon, 31 Aug 2015 23:52:22 -0700 Subject: [PATCH 23/26] add regression for callbacks generated during movsb --- regress/rep_movsb.c | 183 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 183 insertions(+) create mode 100644 regress/rep_movsb.c diff --git a/regress/rep_movsb.c b/regress/rep_movsb.c new file mode 100644 index 00000000..ab49175b --- /dev/null +++ b/regress/rep_movsb.c @@ -0,0 +1,183 @@ +/* + +rep movsb regression + +Copyright(c) 2015 Chris Eagle + +This program is free software; you can redistribute it and/or +modify it under the terms of the GNU General Public License +version 2 as published by the Free Software Foundation. + +This program is distributed in the hope that it will be useful, +but WITHOUT ANY WARRANTY; without even the implied warranty of +MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +GNU General Public License for more details. + +You should have received a copy of the GNU General Public License +along with this program; if not, write to the Free Software +Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. + +*/ + +#define __STDC_FORMAT_MACROS +#include +#include +#include +#include +#include +#include + +#include + +unsigned char PROGRAM[] = + "\xbe\x00\x00\x20\x00\xbf\x00\x10\x20\x00\xb9\x14\x00\x00\x00\xf3" + "\xa4\xf4"; +// total size: 18 bytes + +/* +bits 32 + +; assumes code section at 0x100000 r-x +; assumes data section at 0x200000-0x202000, rw- + +mov esi, 0x200000 +mov edi, 0x201000 +mov ecx, 20 +rep movsb +hlt +*/ + +static int log_num = 1; + +// callback for tracing instruction +static void hook_code(uch handle, uint64_t addr, uint32_t size, void *user_data) +{ + uint8_t opcode; + if (uc_mem_read(handle, addr, &opcode, 1) != UC_ERR_OK) { + printf("not ok %d - uc_mem_read fail during hook_code callback, addr: 0x%" PRIx64 "\n", log_num++, addr); + _exit(-1); + } + switch (opcode) { + case 0xf4: //hlt + printf("# Handling HLT\n"); + if (uc_emu_stop(handle) != UC_ERR_OK) { + printf("not ok %d - uc_emu_stop fail during hook_code callback, addr: 0x%" PRIx64 "\n", log_num++, addr); + _exit(-1); + } + else { + printf("ok %d - hlt encountered, uc_emu_stop called\n", log_num++); + } + break; + default: //all others + break; + } +} + +// callback for tracing memory access (READ or WRITE) +static void hook_mem_write(uch handle, uc_mem_type type, + uint64_t addr, int size, int64_t value, void *user_data) +{ + printf("# write to memory at 0x%"PRIx64 ", data size = %u, data value = 0x%"PRIx64 "\n", addr, size, value); + if (addr < 0x201000L) { + //this is actually a read, we don't write in this range + printf("not ok %d - write hook called for read of 0x%"PRIx64 ", data size = %u, data value = 0x%"PRIx64 "\n", log_num++, addr, size, value); + } + else { + printf("ok %d - write hook called for write of 0x%"PRIx64 ", data size = %u, data value = 0x%"PRIx64 "\n", log_num++, addr, size, value); + } +} + +int main(int argc, char **argv, char **envp) +{ + uch handle, trace1, trace2; + uc_err err; + uint8_t buf1[100], readbuf[100]; + + printf("# rep movsb test\n"); + + memset(buf1, 'A', 20); + + // Initialize emulator in X86-32bit mode + err = uc_open(UC_ARCH_X86, UC_MODE_32, &handle); + if (err) { + printf("not ok %d - Failed on uc_open() with error returned: %u\n", log_num++, err); + return 1; + } + else { + printf("ok %d - uc_open() success\n", log_num++); + } + + uc_mem_map(handle, 0x100000, 0x1000, UC_PROT_READ); + uc_mem_map(handle, 0x200000, 0x2000, UC_PROT_READ | UC_PROT_WRITE); + + // fill in the data that we want to copy + if (uc_mem_write(handle, 0x200000, (uint8_t*)buf1, 20)) { + printf("not ok %d - Failed to write read buffer to memory, quit!\n", log_num++); + return 2; + } + else { + printf("ok %d - Read buffer written to memory\n", log_num++); + } + + // write machine code to be emulated to memory + if (uc_mem_write(handle, 0x100000, PROGRAM, sizeof(PROGRAM))) { + printf("not ok %d - Failed to write emulation code to memory, quit!\n", log_num++); + return 4; + } + else { + printf("ok %d - Program written to memory\n", log_num++); + } + + if (uc_hook_add(handle, &trace2, UC_HOOK_CODE, hook_code, NULL, 1, 0) != UC_ERR_OK) { + printf("not ok %d - Failed to install UC_HOOK_CODE handler\n", log_num++); + return 5; + } + else { + printf("ok %d - UC_HOOK_CODE installed\n", log_num++); + } + + // intercept memory write events only, NOT read events + if (uc_hook_add(handle, &trace1, UC_HOOK_MEM_WRITE, hook_mem_write, NULL) != UC_ERR_OK) { + printf("not ok %d - Failed to install UC_HOOK_MEM_WRITE handler\n", log_num++); + return 6; + } + else { + printf("ok %d - UC_HOOK_MEM_WRITE installed\n", log_num++); + } + + // emulate machine code until told to stop by hook_code + printf("# BEGIN execution\n"); + err = uc_emu_start(handle, 0x100000, 0x101000, 0, 0); + if (err != UC_ERR_OK) { + printf("not ok %d - Failure on uc_emu_start() with error %u:%s\n", log_num++, err, uc_strerror(err)); + return 8; + } + else { + printf("ok %d - uc_emu_start complete\n", log_num++); + } + printf("# END execution\n"); + + //make sure that data got copied + // fill in sections that shouldn't get touched + if (uc_mem_read(handle, 0x201000, (uint8_t*)readbuf, 20)) { + printf("not ok %d - Failed to read random buffer 1 from memory\n", log_num++); + } + else { + printf("ok %d - Random buffer 1 read from memory\n", log_num++); + if (memcmp(buf1, readbuf, 20)) { + printf("not ok %d - write buffer contents are incorrect\n", log_num++); + } + else { + printf("ok %d - write buffer contents are correct\n", log_num++); + } + } + + if (uc_close(&handle) == UC_ERR_OK) { + printf("ok %d - uc_close complete\n", log_num++); + } + else { + printf("not ok %d - uc_close complete\n", log_num++); + } + + return 0; +} From 0e13ab6c3f62e269d1b54ef36dbd5f4a4fda5f8c Mon Sep 17 00:00:00 2001 From: Nguyen Anh Quynh Date: Tue, 1 Sep 2015 20:05:33 +0800 Subject: [PATCH 24/26] compile regress/rep_movsb.c --- .gitignore | 1 + regress/Makefile | 1 + 2 files changed, 2 insertions(+) diff --git a/.gitignore b/.gitignore index 99d9edc7..fade14b3 100644 --- a/.gitignore +++ b/.gitignore @@ -88,3 +88,4 @@ regress/map_write regress/ro_mem_test regress/nr_mem_test regress/timeout_segfault +regress/rep_movsb diff --git a/regress/Makefile b/regress/Makefile index bbb49c2a..806db172 100644 --- a/regress/Makefile +++ b/regress/Makefile @@ -6,6 +6,7 @@ TESTS += sigill sigill2 TESTS += block_test TESTS += ro_mem_test nr_mem_test TESTS += timeout_segfault +TESTS += rep_movsb all: $(TESTS) From 4f7b91d0b738149260bab7392bfc93fa85d65606 Mon Sep 17 00:00:00 2001 From: Nguyen Anh Quynh Date: Tue, 1 Sep 2015 23:34:06 +0800 Subject: [PATCH 25/26] minor fix for instructions in COMPILE.TXT --- COMPILE.TXT | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/COMPILE.TXT b/COMPILE.TXT index bd0910be..5887f094 100644 --- a/COMPILE.TXT +++ b/COMPILE.TXT @@ -87,7 +87,7 @@ Unicorn requires few dependent packages as followings Users are then required to enter root password to copy Unicorn into machine system directories. - Afterwards, run ./tests/test* to see the tests disassembling sample code. + Afterwards, run ./samples/sample_all.sh to see the sample emulations. NOTE: The core framework installed by "./make.sh install" consist of From 90fc201f8d1e2f676aabb31a0bd8605e1529b243 Mon Sep 17 00:00:00 2001 From: Nguyen Anh Quynh Date: Wed, 2 Sep 2015 00:16:45 +0800 Subject: [PATCH 26/26] x86: enable bunch of instructions via CPUID. this fixes issue #91 --- qemu/target-i386/unicorn.c | 5 +++++ regress/pshufb.py | 2 +- 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/qemu/target-i386/unicorn.c b/qemu/target-i386/unicorn.c index c6350213..b0bd2f57 100644 --- a/qemu/target-i386/unicorn.c +++ b/qemu/target-i386/unicorn.c @@ -54,6 +54,11 @@ void x86_reg_reset(uch handle) CPUArchState *env; env = first_cpu->env_ptr; + env->features[FEAT_1_EDX] = CPUID_CX8 | CPUID_CMOV | CPUID_SSE2 | CPUID_FXSR | CPUID_SSE | CPUID_CLFLUSH; + env->features[FEAT_1_ECX] = CPUID_EXT_SSSE3 | CPUID_EXT_SSE41 | CPUID_EXT_SSE42 | CPUID_EXT_AES; + env->features[FEAT_8000_0001_EDX] = CPUID_EXT2_3DNOW | CPUID_EXT2_RDTSCP; + env->features[FEAT_8000_0001_ECX] = CPUID_EXT3_LAHF_LM | CPUID_EXT3_ABM | CPUID_EXT3_SKINIT | CPUID_EXT3_CR8LEG; + env->features[FEAT_7_0_EBX] = CPUID_7_0_EBX_BMI1 | CPUID_7_0_EBX_BMI2 | CPUID_7_0_EBX_ADX | CPUID_7_0_EBX_SMAP; env->invalid_error = UC_ERR_OK; // no error memset(env->regs, 0, sizeof(env->regs)); diff --git a/regress/pshufb.py b/regress/pshufb.py index 0d01bf5e..432a2300 100755 --- a/regress/pshufb.py +++ b/regress/pshufb.py @@ -9,4 +9,4 @@ uc = Uc(UC_ARCH_X86, UC_MODE_64) uc.mem_map(0x2000, 0x1000) # pshufb xmm0, xmm1 uc.mem_write(0x2000, '660f3800c1'.decode('hex')) -uc.emu_start(0x2000, 0) +uc.emu_start(0x2000, 0x2005)