From 12909e6a4ca03a5f50a10a44ac39be821b284faf Mon Sep 17 00:00:00 2001 From: Jonathon Reinhart Date: Thu, 3 Sep 2015 21:52:41 -0400 Subject: [PATCH 01/10] add basic cmocka unit test --- test/unit/.gitignore | 1 + test/unit/Makefile | 13 ++++++ test/unit/test_x86.c | 99 ++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 113 insertions(+) create mode 100644 test/unit/.gitignore create mode 100644 test/unit/Makefile create mode 100644 test/unit/test_x86.c diff --git a/test/unit/.gitignore b/test/unit/.gitignore new file mode 100644 index 00000000..b045baae --- /dev/null +++ b/test/unit/.gitignore @@ -0,0 +1 @@ +test_x86 diff --git a/test/unit/Makefile b/test/unit/Makefile new file mode 100644 index 00000000..9b5aed65 --- /dev/null +++ b/test/unit/Makefile @@ -0,0 +1,13 @@ +CFLAGS += -lcmocka -lunicorn + + +ALL_TESTS = test_x86 + +all: ${ALL_TESTS} + +clean: + rm ${ALL_TESTS} + + +test_x86: test_x86.c + gcc ${CFLAGS} -o $@ $^ diff --git a/test/unit/test_x86.c b/test/unit/test_x86.c new file mode 100644 index 00000000..a6b509bd --- /dev/null +++ b/test/unit/test_x86.c @@ -0,0 +1,99 @@ +#include +#include +#include +#include +#include +#include + +// callback for tracing basic blocks +static void hook_block(uc_engine *uc, uint64_t address, uint32_t size, void *user_data) +{ + //printf(">>> Tracing basic block at 0x%"PRIx64 ", block size = 0x%x\n", address, size); +} + +// callback for tracing instruction +static void hook_code(uc_engine *uc, uint64_t address, uint32_t size, void *user_data) +{ + int eflags; + //printf(">>> Tracing instruction at 0x%"PRIx64 ", instruction size = 0x%x\n", address, size); + + //uc_reg_read(uc, UC_X86_REG_EFLAGS, &eflags); + //printf(">>> --- EFLAGS is 0x%x\n", eflags); + + // Uncomment below code to stop the emulation using uc_emu_stop() + // if (address == 0x1000009) + // uc_emu_stop(uc); +} + +static void uc_assert_success(uc_err err) +{ + assert_int_equal(err, 0); + // uc_strerror(err) +} + +static void test_i386(void **state) +{ + uc_engine *uc; + uc_err err; + uint32_t tmp; + uc_hook trace1, trace2; + + const uint8_t code[] = "\x41\x4a"; // INC ecx; DEC edx + const uint64_t address = 0x1000000; + + int r_ecx = 0x1234; // ECX register + int r_edx = 0x7890; // EDX register + + // Initialize emulator in X86-32bit mode + err = uc_open(UC_ARCH_X86, UC_MODE_32, &uc); + uc_assert_success(err); + + // map 2MB memory for this emulation + err = uc_mem_map(uc, address, 2 * 1024 * 1024, UC_PROT_ALL); + uc_assert_success(err); + + // write machine code to be emulated to memory + err = uc_mem_write(uc, address, code, sizeof(code)-1); + uc_assert_success(err); + + // initialize machine registers + err = uc_reg_write(uc, UC_X86_REG_ECX, &r_ecx); + uc_assert_success(err); + err = uc_reg_write(uc, UC_X86_REG_EDX, &r_edx); + uc_assert_success(err); + + // tracing all basic blocks with customized callback + err = uc_hook_add(uc, &trace1, UC_HOOK_BLOCK, hook_block, NULL, (uint64_t)1, (uint64_t)0); + uc_assert_success(err); + + // tracing all instruction by having @begin > @end + err = uc_hook_add(uc, &trace2, UC_HOOK_CODE, hook_code, NULL, (uint64_t)1, (uint64_t)0); + uc_assert_success(err); + + // emulate machine code in infinite time + err = uc_emu_start(uc, address, address+sizeof(code)-1, 0, 0); + uc_assert_success(err); + + // now print out some registers + //printf(">>> Emulation done. Below is the CPU context\n"); + + uc_reg_read(uc, UC_X86_REG_ECX, &r_ecx); + uc_reg_read(uc, UC_X86_REG_EDX, &r_edx); + + assert_int_equal(r_ecx, 0x1235); + assert_int_equal(r_edx, 0x788F); + + // read from memory + err = uc_mem_read(uc, address, (uint8_t *)&tmp, 4); + uc_assert_success(err); + //printf(">>> Read 4 bytes from [0x%"PRIX64"] = 0x%x\n", address, tmp); + + uc_close(uc); +} + +int main(void) { + const struct CMUnitTest tests[] = { + cmocka_unit_test(test_i386), + }; + return cmocka_run_group_tests(tests, NULL, NULL); +} From d4de54601d5dad35d3836604d6b73e4d3e42df2f Mon Sep 17 00:00:00 2001 From: Jonathon Reinhart Date: Mon, 7 Sep 2015 15:05:55 -0400 Subject: [PATCH 02/10] add start of test_mem_map.c --- test/unit/Makefile | 24 ++++++++++++++++++++++-- test/unit/test_mem_map.c | 35 +++++++++++++++++++++++++++++++++++ test/unit/unicorn_test.h | 16 ++++++++++++++++ 3 files changed, 73 insertions(+), 2 deletions(-) create mode 100644 test/unit/test_mem_map.c create mode 100644 test/unit/unicorn_test.h diff --git a/test/unit/Makefile b/test/unit/Makefile index 9b5aed65..0eac4063 100644 --- a/test/unit/Makefile +++ b/test/unit/Makefile @@ -1,13 +1,33 @@ + +CFLAGS += -L ../../ CFLAGS += -lcmocka -lunicorn +CFLAGS += -I ../../include +ALL_TESTS = test_x86 test_mem_map -ALL_TESTS = test_x86 - +.PHONY: all all: ${ALL_TESTS} +.PHONY: clean clean: rm ${ALL_TESTS} +.PHONY: test +test: export LD_LIBRARY_PATH=../../ +test: ${ALL_TESTS} + @#echo ${ALL_TESTS} | xargs -n1 | xargs -I CMD sh -c ./CMD + @for test in ${ALL_TESTS}; do \ + echo -e "\n--------------------------------------------------------------------------------"; \ + echo "TEST: $$test"; \ + ./$$test || break; \ + done + test_x86: test_x86.c +test_mem_map: test_mem_map.c + +${ALL_TESTS}: gcc ${CFLAGS} -o $@ $^ + + + diff --git a/test/unit/test_mem_map.c b/test/unit/test_mem_map.c new file mode 100644 index 00000000..58e2a779 --- /dev/null +++ b/test/unit/test_mem_map.c @@ -0,0 +1,35 @@ +#include "unicorn_test.h" +#include + +static int setup(void **state) +{ + fprintf(stderr, "~~~ setup() ~~~\n"); + + uc_engine *uc; + + uc_assert_success(uc_open(UC_ARCH_X86, UC_MODE_32, &uc)); + + *state = uc; + return 0; +} + +static int teardown(void **state) +{ + uc_engine *uc = *state; + fprintf(stderr, "~~~ teardown() ~~~\n"); + + uc_assert_success(uc_close(uc)); + return 0; +} + + +static void test_basic(void **state) +{ +} + +int main(void) { + const struct CMUnitTest tests[] = { + cmocka_unit_test(test_basic), + }; + return cmocka_run_group_tests(tests, setup, teardown); +} diff --git a/test/unit/unicorn_test.h b/test/unit/unicorn_test.h new file mode 100644 index 00000000..03f9e556 --- /dev/null +++ b/test/unit/unicorn_test.h @@ -0,0 +1,16 @@ +#ifndef UNICORN_TEST_H +#define UNICORN_TEST_H + +#include +#include +#include +#include +#include + +static void uc_assert_success(uc_err err) +{ + assert_int_equal(err, 0); + // uc_strerror(err) +} + +#endif /* UNICORN_TEST_H */ From df3966a90ca971c661e139af2aa9673a51656294 Mon Sep 17 00:00:00 2001 From: Jonathon Reinhart Date: Mon, 7 Sep 2015 16:07:48 -0400 Subject: [PATCH 03/10] continued work on test framework --- test/unit/.gitignore | 1 + test/unit/Makefile | 9 ++--- test/unit/test_mem_map.c | 77 +++++++++++++++++++++++++++++++++++++--- test/unit/test_x86.c | 2 +- test/unit/unicorn_test.h | 15 +++++--- 5 files changed, 87 insertions(+), 17 deletions(-) diff --git a/test/unit/.gitignore b/test/unit/.gitignore index b045baae..1a39afbc 100644 --- a/test/unit/.gitignore +++ b/test/unit/.gitignore @@ -1 +1,2 @@ test_x86 +test_mem_map diff --git a/test/unit/Makefile b/test/unit/Makefile index 0eac4063..707e9cd2 100644 --- a/test/unit/Makefile +++ b/test/unit/Makefile @@ -1,4 +1,5 @@ +CFLAGS += -Wall -Werror -Wno-unused-function -g CFLAGS += -L ../../ CFLAGS += -lcmocka -lunicorn CFLAGS += -I ../../include @@ -15,12 +16,8 @@ clean: .PHONY: test test: export LD_LIBRARY_PATH=../../ test: ${ALL_TESTS} - @#echo ${ALL_TESTS} | xargs -n1 | xargs -I CMD sh -c ./CMD - @for test in ${ALL_TESTS}; do \ - echo -e "\n--------------------------------------------------------------------------------"; \ - echo "TEST: $$test"; \ - ./$$test || break; \ - done + ./test_x86 + ./test_mem_map test_x86: test_x86.c diff --git a/test/unit/test_mem_map.c b/test/unit/test_mem_map.c index 58e2a779..08b46aef 100644 --- a/test/unit/test_mem_map.c +++ b/test/unit/test_mem_map.c @@ -1,10 +1,10 @@ #include "unicorn_test.h" #include +#include +/* Called before every test to set up a new instance */ static int setup(void **state) { - fprintf(stderr, "~~~ setup() ~~~\n"); - uc_engine *uc; uc_assert_success(uc_open(UC_ARCH_X86, UC_MODE_32, &uc)); @@ -13,23 +13,90 @@ static int setup(void **state) return 0; } +/* Called after every test to clean up */ static int teardown(void **state) { uc_engine *uc = *state; - fprintf(stderr, "~~~ teardown() ~~~\n"); uc_assert_success(uc_close(uc)); + + *state = NULL; return 0; } +/******************************************************************************/ + +/** + * A basic test showing mapping of memory, and reading/writing it + */ static void test_basic(void **state) { + uc_engine *uc = *state; + const uint64_t mem_start = 0x1000; + const uint64_t mem_len = 0x1000; + const uint64_t test_addr = mem_start + 0x100; + + /* Map a region */ + uc_assert_success(uc_mem_map(uc, mem_start, mem_len, UC_PROT_NONE)); + + /* Write some data to it */ + uc_assert_success(uc_mem_write(uc, test_addr, "test", 4)); + + uint8_t buf[4]; + memset(buf, 0xCC, sizeof(buf)); + + /* Read it back */ + uc_assert_success(uc_mem_read(uc, test_addr, buf, sizeof(buf))); + + /* And make sure it matches what we expect */ + assert_memory_equal(buf, "test", 4); + + /* Unmap the region */ + uc_assert_success(uc_mem_unmap(uc, mem_start, mem_len)); } +/** + * Verify that we can read/write across memory map region boundaries + */ +static void test_rw_across_boundaries(void **state) +{ + uc_engine *uc = *state; + + /* Map in two adjacent regions */ + uc_assert_success(uc_mem_map(uc, 0, 0x1000, 0)); /* 0x0000 - 0x1000 */ + uc_assert_success(uc_mem_map(uc, 0x1000, 0x1000, 0)); /* 0x1000 - 0x2000 */ + + const uint64_t addr = 0x1000 - 2; /* 2 bytes before end of block */ + + /* Write some data across the boundary */ + uc_assert_success(uc_mem_write(uc, addr, "test", 4)); + + uint8_t buf[4]; + memset(buf, 0xCC, sizeof(buf)); + + /* Read the data across the boundary */ + uc_assert_success(uc_mem_read(uc, addr, buf, sizeof(buf))); + + assert_memory_equal(buf, "test", 4); +} + +static void test_bad_unmap(void **state) +{ + uc_engine *uc = *state; + uc_err err; + + /* Try to unmap memory that has not been mapped */ + err = uc_mem_unmap(uc, 0x0, 0x1000); + assert_int_not_equal(err, UC_ERR_OK); +} + + int main(void) { const struct CMUnitTest tests[] = { - cmocka_unit_test(test_basic), + cmocka_unit_test_setup_teardown(test_basic, setup, teardown), + cmocka_unit_test_setup_teardown(test_bad_unmap, setup, teardown), + cmocka_unit_test_setup_teardown(test_rw_across_boundaries, setup, teardown), }; - return cmocka_run_group_tests(tests, setup, teardown); + return cmocka_run_group_tests(tests, NULL, NULL); } diff --git a/test/unit/test_x86.c b/test/unit/test_x86.c index a6b509bd..a56e332e 100644 --- a/test/unit/test_x86.c +++ b/test/unit/test_x86.c @@ -14,7 +14,7 @@ static void hook_block(uc_engine *uc, uint64_t address, uint32_t size, void *use // callback for tracing instruction static void hook_code(uc_engine *uc, uint64_t address, uint32_t size, void *user_data) { - int eflags; + //int eflags; //printf(">>> Tracing instruction at 0x%"PRIx64 ", instruction size = 0x%x\n", address, size); //uc_reg_read(uc, UC_X86_REG_EFLAGS, &eflags); diff --git a/test/unit/unicorn_test.h b/test/unit/unicorn_test.h index 03f9e556..a9dff775 100644 --- a/test/unit/unicorn_test.h +++ b/test/unit/unicorn_test.h @@ -7,10 +7,15 @@ #include #include -static void uc_assert_success(uc_err err) -{ - assert_int_equal(err, 0); - // uc_strerror(err) -} +#define uc_assert_success(err) \ +do { \ + uc_err __err = err; \ + if (__err != UC_ERR_OK) { \ + fail_msg("%s", uc_strerror(__err)); \ + } \ +} while (0) + + + #endif /* UNICORN_TEST_H */ From 4dae31b25ed8f049ef4e971c22d267e93ca625ee Mon Sep 17 00:00:00 2001 From: Jonathon Reinhart Date: Sun, 13 Sep 2015 21:32:31 -0400 Subject: [PATCH 04/10] add uc_assert_(err|fail) macros --- test/unit/unicorn_test.h | 34 ++++++++++++++++++++++++++-------- 1 file changed, 26 insertions(+), 8 deletions(-) diff --git a/test/unit/unicorn_test.h b/test/unit/unicorn_test.h index a9dff775..ccb53d75 100644 --- a/test/unit/unicorn_test.h +++ b/test/unit/unicorn_test.h @@ -7,15 +7,33 @@ #include #include -#define uc_assert_success(err) \ -do { \ - uc_err __err = err; \ - if (__err != UC_ERR_OK) { \ - fail_msg("%s", uc_strerror(__err)); \ - } \ -} while (0) - +#define UC_ASSERT_ERR_ANY 0xDEADBEEF +/** + * Assert that err matches expect + */ +#define uc_assert_err(expect, err) \ +do { \ + uc_err __err = err; \ + if ((__err != expect) \ + || (expect == UC_ASSERT_ERR_ANY && __err == UC_ERR_OK)) { \ + fail_msg("%s", uc_strerror(__err)); \ + } \ +} while (0) + +/** + * Assert that err is UC_ERR_OK + */ +#define uc_assert_success(err) uc_assert_err(UC_ERR_OK, err) + +/** + * Assert that err is anything but UC_ERR_OK + * + * Note: Better to use uc_assert_err(, err), + * as this serves to document which errors a function will return + * in various scenarios. + */ +#define uc_assert_fail(err) uc_assert_err(UC_ASSERT_ERR_ANY, err) #endif /* UNICORN_TEST_H */ From c026c23efbac342972fef5065f9b3ccf23fa3725 Mon Sep 17 00:00:00 2001 From: Jonathon Reinhart Date: Sun, 13 Sep 2015 21:49:43 -0400 Subject: [PATCH 05/10] add more mem map API tests --- test/unit/test_mem_map.c | 57 ++++++++++++++++++++++++++++++++++------ 1 file changed, 49 insertions(+), 8 deletions(-) diff --git a/test/unit/test_mem_map.c b/test/unit/test_mem_map.c index 08b46aef..13b96d9d 100644 --- a/test/unit/test_mem_map.c +++ b/test/unit/test_mem_map.c @@ -1,3 +1,9 @@ +/** + * Unicorn memory API tests + * + * This tests memory read/write and map/unmap functionality. + * One is necessary for doing the other. + */ #include "unicorn_test.h" #include #include @@ -53,9 +59,41 @@ static void test_basic(void **state) assert_memory_equal(buf, "test", 4); /* Unmap the region */ - uc_assert_success(uc_mem_unmap(uc, mem_start, mem_len)); + //uc_assert_success(uc_mem_unmap(uc, mem_start, mem_len)); } +static void test_bad_read(void **state) +{ + uc_engine *uc = *state; + + uint8_t readbuf[0x10]; + memset(readbuf, 0xCC, sizeof(readbuf)); + + uint8_t checkbuf[0x10]; + memset(checkbuf, 0xCC, sizeof(checkbuf)); + + /* Reads to unmapped addresses should fail */ + /* TODO: Which error? */ + uc_assert_fail(uc_mem_read(uc, 0x1000, readbuf, sizeof(readbuf))); + + /* And our buffer should be unchanged */ + assert_memory_equal(readbuf, checkbuf, sizeof(checkbuf)); +} + +static void test_bad_write(void **state) +{ + uc_engine *uc = *state; + + uint8_t writebuf[0x10]; + memset(writebuf, 0xCC, sizeof(writebuf)); + + /* Writes to unmapped addresses should fail */ + /* TODO: Which error? */ + uc_assert_fail(uc_mem_write(uc, 0x1000, writebuf, sizeof(writebuf))); +} + + + /** * Verify that we can read/write across memory map region boundaries */ @@ -81,22 +119,25 @@ static void test_rw_across_boundaries(void **state) assert_memory_equal(buf, "test", 4); } +/* Try to unmap memory that has not been mapped */ static void test_bad_unmap(void **state) { uc_engine *uc = *state; - uc_err err; - /* Try to unmap memory that has not been mapped */ - err = uc_mem_unmap(uc, 0x0, 0x1000); - assert_int_not_equal(err, UC_ERR_OK); + /* TODO: Which error should this return? */ + uc_assert_fail(uc_mem_unmap(uc, 0x0, 0x1000)); } int main(void) { +#define test(x) cmocka_unit_test_setup_teardown(x, setup, teardown) const struct CMUnitTest tests[] = { - cmocka_unit_test_setup_teardown(test_basic, setup, teardown), - cmocka_unit_test_setup_teardown(test_bad_unmap, setup, teardown), - cmocka_unit_test_setup_teardown(test_rw_across_boundaries, setup, teardown), + test(test_basic), + //test(test_bad_read), + //test(test_bad_write), + test(test_bad_unmap), + test(test_rw_across_boundaries), }; +#undef test return cmocka_run_group_tests(tests, NULL, NULL); } From 7a98fc4e784d3a385118f012e3a0f21dd9d579ba Mon Sep 17 00:00:00 2001 From: Jonathon Reinhart Date: Sun, 13 Sep 2015 22:26:00 -0400 Subject: [PATCH 06/10] add tests to test_x86.c from samples/ --- test/unit/test_x86.c | 580 ++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 569 insertions(+), 11 deletions(-) diff --git a/test/unit/test_x86.c b/test/unit/test_x86.c index a56e332e..d40e2902 100644 --- a/test/unit/test_x86.c +++ b/test/unit/test_x86.c @@ -1,9 +1,5 @@ -#include -#include -#include +#include "unicorn_test.h" #include -#include -#include // callback for tracing basic blocks static void hook_block(uc_engine *uc, uint64_t address, uint32_t size, void *user_data) @@ -25,12 +21,6 @@ static void hook_code(uc_engine *uc, uint64_t address, uint32_t size, void *user // uc_emu_stop(uc); } -static void uc_assert_success(uc_err err) -{ - assert_int_equal(err, 0); - // uc_strerror(err) -} - static void test_i386(void **state) { uc_engine *uc; @@ -91,9 +81,577 @@ static void test_i386(void **state) uc_close(uc); } +static void test_i386_jump(void **state) +{ + uc_engine *uc; + uc_err err; + uc_hook trace1, trace2; + + const uint8_t code[] = "\xeb\x02\x90\x90\x90\x90\x90\x90"; // jmp 4; nop; nop; nop; nop; nop; nop + const uint64_t address = 0x1000000; + + // Initialize emulator in X86-32bit mode + err = uc_open(UC_ARCH_X86, UC_MODE_32, &uc); + uc_assert_success(err); + + // map 2MB memory for this emulation + err = uc_mem_map(uc, address, 2 * 1024 * 1024, UC_PROT_ALL); + uc_assert_success(err); + + // write machine code to be emulated to memory + err = uc_mem_write(uc, address, code, sizeof(code)-1); + uc_assert_success(err); + + // tracing 1 basic block with customized callback + err = uc_hook_add(uc, &trace1, UC_HOOK_BLOCK, hook_block, NULL, (uint64_t)address, (uint64_t)address); + uc_assert_success(err); + + // tracing 1 instruction at address + err = uc_hook_add(uc, &trace2, UC_HOOK_CODE, hook_code, NULL, (uint64_t)address, (uint64_t)address); + uc_assert_success(err); + + // emulate machine code in infinite time + err = uc_emu_start(uc, address, address+sizeof(code)-1, 0, 0); + uc_assert_success(err); + + err = uc_close(uc); + uc_assert_success(err); +} + +/******************************************************************************/ + +// callback for IN instruction (X86). +// this returns the data read from the port +static uint32_t hook_in(uc_engine *uc, uint32_t port, int size, void *user_data) +{ + uint32_t eip; + + uc_reg_read(uc, UC_X86_REG_EIP, &eip); + + printf("--- reading from port 0x%x, size: %u, address: 0x%x\n", port, size, eip); + + switch(size) { + default: + return 0; // should never reach this + case 1: + // read 1 byte to AL + return 0xf1; + case 2: + // read 2 byte to AX + return 0xf2; + case 4: + // read 4 byte to EAX + return 0xf4; + } +} + +// callback for OUT instruction (X86). +static void hook_out(uc_engine *uc, uint32_t port, int size, uint32_t value, void *user_data) +{ + uint32_t tmp; + uint32_t eip; + + uc_reg_read(uc, UC_X86_REG_EIP, &eip); + + printf("--- writing to port 0x%x, size: %u, value: 0x%x, address: 0x%x\n", port, size, value, eip); + + // TODO: confirm that value is indeed the value of AL/AX/EAX + switch(size) { + default: + return; // should never reach this + case 1: + uc_reg_read(uc, UC_X86_REG_AL, &tmp); + break; + case 2: + uc_reg_read(uc, UC_X86_REG_AX, &tmp); + break; + case 4: + uc_reg_read(uc, UC_X86_REG_EAX, &tmp); + break; + } + + printf("--- register value = 0x%x\n", tmp); +} + +static void test_i386_inout(void **state) +{ + uc_engine *uc; + uc_err err; + uc_hook trace1, trace2, trace3, trace4; + + int r_eax = 0x1234; // EAX register + int r_ecx = 0x6789; // ECX register + + static const uint64_t address = 0x1000000; + static const uint8_t code[] = { + 0x41, // inc ecx + 0xE4, 0x3F, // in al, 0x3F + 0x4A, // dec edx + 0xE6, 0x46, // out 0x46, al + 0x43, // inc ebx + }; + + + // Initialize emulator in X86-32bit mode + err = uc_open(UC_ARCH_X86, UC_MODE_32, &uc); + uc_assert_success(err); + + // map 2MB memory for this emulation + err = uc_mem_map(uc, address, 2 * 1024 * 1024, UC_PROT_ALL); + uc_assert_success(err); + + // write machine code to be emulated to memory + err = uc_mem_write(uc, address, code, sizeof(code)); + uc_assert_success(err); + + // initialize machine registers + err = uc_reg_write(uc, UC_X86_REG_EAX, &r_eax); + uc_assert_success(err); + err = uc_reg_write(uc, UC_X86_REG_ECX, &r_ecx); + uc_assert_success(err); + + // tracing all basic blocks with customized callback + err = uc_hook_add(uc, &trace1, UC_HOOK_BLOCK, hook_block, NULL, (uint64_t)1, (uint64_t)0); + uc_assert_success(err); + + // tracing all instructions + err = uc_hook_add(uc, &trace2, UC_HOOK_CODE, hook_code, NULL, (uint64_t)1, (uint64_t)0); + uc_assert_success(err); + + // uc IN instruction + err = uc_hook_add(uc, &trace3, UC_HOOK_INSN, hook_in, NULL, UC_X86_INS_IN); + uc_assert_success(err); + + // uc OUT instruction + err = uc_hook_add(uc, &trace4, UC_HOOK_INSN, hook_out, NULL, UC_X86_INS_OUT); + uc_assert_success(err); + + // emulate machine code in infinite time + err = uc_emu_start(uc, address, address+sizeof(code), 0, 0); + uc_assert_success(err); + + uc_reg_read(uc, UC_X86_REG_EAX, &r_eax); + uc_reg_read(uc, UC_X86_REG_ECX, &r_ecx); + printf(">>> EAX = 0x%x\n", r_eax); + printf(">>> ECX = 0x%x\n", r_ecx); + // TODO: Assert on the register values here + + uc_assert_success(uc_close(uc)); +} + +/******************************************************************************/ + +// emulate code that loop forever +static void test_i386_loop(void **state) +{ + uc_engine *uc; + uc_err err; + + int r_ecx = 0x1234; // ECX register + int r_edx = 0x7890; // EDX register + + static const uint64_t address = 0x1000000; + static const uint8_t code[] = { + 0x41, // inc ecx + 0x4a, // dec edx + 0xEB, 0xFE, // jmp $ + }; + + // Initialize emulator in X86-32bit mode + err = uc_open(UC_ARCH_X86, UC_MODE_32, &uc); + uc_assert_success(err); + + // map 2MB memory for this emulation + err = uc_mem_map(uc, address, 2 * 1024 * 1024, UC_PROT_ALL); + uc_assert_success(err); + + // write machine code to be emulated to memory + err = uc_mem_write(uc, address, code, sizeof(code)); + uc_assert_success(err); + + // initialize machine registers + err = uc_reg_write(uc, UC_X86_REG_ECX, &r_ecx); + uc_assert_success(err); + err = uc_reg_write(uc, UC_X86_REG_EDX, &r_edx); + uc_assert_success(err); + + // emulate machine code in 2 seconds, so we can quit even + // if the code loops + err = uc_emu_start(uc, address, address+sizeof(code), 2*UC_SECOND_SCALE, 0); + uc_assert_success(err); + + // verify register values + uc_assert_success(uc_reg_read(uc, UC_X86_REG_ECX, &r_ecx)); + uc_assert_success(uc_reg_read(uc, UC_X86_REG_EDX, &r_edx)); + + assert_int_equal(r_ecx, 0x1235); + assert_int_equal(r_edx, 0x788F); + + uc_assert_success(uc_close(uc)); +} + +/******************************************************************************/ + +// emulate code that reads invalid memory +static void test_i386_invalid_mem_read(void **state) +{ + uc_engine *uc; + uc_err err; + + static const uint64_t address = 0x1000000; + static const uint8_t code[] = { + 0x88, 0x0D, 0xAA, 0xAA, 0xAA, 0xAA, // mov ecx, [0xAAAAAAAA] + }; + + // Initialize emulator in X86-32bit mode + err = uc_open(UC_ARCH_X86, UC_MODE_32, &uc); + uc_assert_success(err); + + // map 2MB memory for this emulation + err = uc_mem_map(uc, address, 2 * 1024 * 1024, UC_PROT_ALL); + uc_assert_success(err); + + // write machine code to be emulated to memory + err = uc_mem_write(uc, address, code, sizeof(code)); + uc_assert_success(err); + + // emulate machine code in infinite time + err = uc_emu_start(uc, address, address+sizeof(code), 0, 0); + uc_assert_err(UC_ERR_MEM_READ, err); // TODO: Currently returns MEM_WRITE + + + uc_assert_success(uc_close(uc)); +} + +// emulate code that writes invalid memory +static void test_i386_invalid_mem_write(void **state) +{ + uc_engine *uc; + uc_err err; + + static const uint64_t address = 0x1000000; + static const uint8_t code[] = { + 0x89, 0x0D, 0xAA, 0xAA, 0xAA, 0xAA, // mov [0xAAAAAAAA], ecx + }; + + // Initialize emulator in X86-32bit mode + err = uc_open(UC_ARCH_X86, UC_MODE_32, &uc); + uc_assert_success(err); + + // map 2MB memory for this emulation + err = uc_mem_map(uc, address, 2 * 1024 * 1024, UC_PROT_ALL); + uc_assert_success(err); + + // write machine code to be emulated to memory + err = uc_mem_write(uc, address, code, sizeof(code)); + uc_assert_success(err); + + // emulate machine code in infinite time + err = uc_emu_start(uc, address, address+sizeof(code), 0, 0); + uc_assert_err(UC_ERR_MEM_WRITE, err); + + + uc_assert_success(uc_close(uc)); +} + +// emulate code that jumps to invalid memory +static void test_i386_jump_invalid(void **state) +{ + uc_engine *uc; + uc_err err; + + static const uint64_t address = 0x1000000; + static const uint8_t code[] = { + 0xE9, 0xE9, 0xEE, 0xEE, 0xEE, // jmp 0xEEEEEEEE + }; + + // Initialize emulator in X86-32bit mode + err = uc_open(UC_ARCH_X86, UC_MODE_32, &uc); + uc_assert_success(err); + + // map 2MB memory for this emulation + err = uc_mem_map(uc, address, 2 * 1024 * 1024, UC_PROT_ALL); + uc_assert_success(err); + + // write machine code to be emulated to memory + err = uc_mem_write(uc, address, code, sizeof(code)); + uc_assert_success(err); + + // emulate machine code in infinite time + err = uc_emu_start(uc, address, address+sizeof(code), 0, 0); + uc_assert_err(UC_ERR_CODE_INVALID, err); + + + uc_assert_success(uc_close(uc)); +} + + +/******************************************************************************/ + +static void hook_mem64(uc_engine *uc, uc_mem_type type, + uint64_t address, int size, int64_t value, void *user_data) +{ + switch(type) { + default: break; + case UC_MEM_READ: + printf(">>> Memory is being READ at 0x%"PRIx64 ", data size = %u\n", + address, size); + break; + case UC_MEM_WRITE: + printf(">>> Memory is being WRITE at 0x%"PRIx64 ", data size = %u, data value = 0x%"PRIx64 "\n", + address, size, value); + break; + } +} + +// callback for tracing instruction +static void hook_code64(uc_engine *uc, uint64_t address, uint32_t size, void *user_data) +{ + uint64_t rip; + + uc_reg_read(uc, UC_X86_REG_RIP, &rip); + printf(">>> Tracing instruction at 0x%"PRIx64 ", instruction size = 0x%x\n", address, size); + printf(">>> RIP is 0x%"PRIx64 "\n", rip); + + // Uncomment below code to stop the emulation using uc_emu_stop() + // if (address == 0x1000009) + // uc_emu_stop(uc); +} + +static void test_x86_64(void **state) +{ + uc_engine *uc; + uc_err err; + uc_hook trace1, trace2, trace3, trace4; + + static const uint64_t address = 0x1000000; + static const uint8_t code[] = "\x41\xBC\x3B\xB0\x28\x2A\x49\x0F\xC9\x90\x4D\x0F\xAD\xCF\x49\x87\xFD\x90\x48\x81\xD2\x8A\xCE\x77\x35\x48\xF7\xD9\x4D\x29\xF4\x49\x81\xC9\xF6\x8A\xC6\x53\x4D\x87\xED\x48\x0F\xAD\xD2\x49\xF7\xD4\x48\xF7\xE1\x4D\x19\xC5\x4D\x89\xC5\x48\xF7\xD6\x41\xB8\x4F\x8D\x6B\x59\x4D\x87\xD0\x68\x6A\x1E\x09\x3C\x59"; + + int64_t rax = 0x71f3029efd49d41d; + int64_t rbx = 0xd87b45277f133ddb; + int64_t rcx = 0xab40d1ffd8afc461; + int64_t rdx = 0x919317b4a733f01; + int64_t rsi = 0x4c24e753a17ea358; + int64_t rdi = 0xe509a57d2571ce96; + int64_t r8 = 0xea5b108cc2b9ab1f; + int64_t r9 = 0x19ec097c8eb618c1; + int64_t r10 = 0xec45774f00c5f682; + int64_t r11 = 0xe17e9dbec8c074aa; + int64_t r12 = 0x80f86a8dc0f6d457; + int64_t r13 = 0x48288ca5671c5492; + int64_t r14 = 0x595f72f6e4017f6e; + int64_t r15 = 0x1efd97aea331cccc; + + int64_t rsp = address + 0x200000; + + + // Initialize emulator in X86-64bit mode + err = uc_open(UC_ARCH_X86, UC_MODE_64, &uc); + uc_assert_success(err); + + // map 2MB memory for this emulation + err = uc_mem_map(uc, address, 2 * 1024 * 1024, UC_PROT_ALL); + uc_assert_success(err); + + // write machine code to be emulated to memory + err = uc_mem_write(uc, address, code, sizeof(code)); + uc_assert_success(err); + + // initialize machine registers + uc_assert_success(uc_reg_write(uc, UC_X86_REG_RSP, &rsp)); + + uc_assert_success(uc_reg_write(uc, UC_X86_REG_RAX, &rax)); + uc_assert_success(uc_reg_write(uc, UC_X86_REG_RBX, &rbx)); + uc_assert_success(uc_reg_write(uc, UC_X86_REG_RCX, &rcx)); + uc_assert_success(uc_reg_write(uc, UC_X86_REG_RDX, &rdx)); + uc_assert_success(uc_reg_write(uc, UC_X86_REG_RSI, &rsi)); + uc_assert_success(uc_reg_write(uc, UC_X86_REG_RDI, &rdi)); + uc_assert_success(uc_reg_write(uc, UC_X86_REG_R8, &r8)); + uc_assert_success(uc_reg_write(uc, UC_X86_REG_R9, &r9)); + uc_assert_success(uc_reg_write(uc, UC_X86_REG_R10, &r10)); + uc_assert_success(uc_reg_write(uc, UC_X86_REG_R11, &r11)); + uc_assert_success(uc_reg_write(uc, UC_X86_REG_R12, &r12)); + uc_assert_success(uc_reg_write(uc, UC_X86_REG_R13, &r13)); + uc_assert_success(uc_reg_write(uc, UC_X86_REG_R14, &r14)); + uc_assert_success(uc_reg_write(uc, UC_X86_REG_R15, &r15)); + + // tracing all basic blocks with customized callback + err = uc_hook_add(uc, &trace1, UC_HOOK_BLOCK, hook_block, NULL, (uint64_t)1, (uint64_t)0); + uc_assert_success(err); + + // tracing all instructions in the range [address, address+20] + err = uc_hook_add(uc, &trace2, UC_HOOK_CODE, hook_code64, NULL, (uint64_t)address, (uint64_t)(address+20)); + uc_assert_success(err); + + // tracing all memory WRITE access (with @begin > @end) + err = uc_hook_add(uc, &trace3, UC_HOOK_MEM_WRITE, hook_mem64, NULL, (uint64_t)1, (uint64_t)0); + uc_assert_success(err); + + // tracing all memory READ access (with @begin > @end) + err = uc_hook_add(uc, &trace4, UC_HOOK_MEM_READ, hook_mem64, NULL, (uint64_t)1, (uint64_t)0); + uc_assert_success(err); + + // emulate machine code in infinite time (last param = 0), or when + // finishing all the code. + err = uc_emu_start(uc, address, address+sizeof(code), 0, 0); + uc_assert_success(err); + + // Read registers + uc_reg_read(uc, UC_X86_REG_RAX, &rax); + uc_reg_read(uc, UC_X86_REG_RBX, &rbx); + uc_reg_read(uc, UC_X86_REG_RCX, &rcx); + uc_reg_read(uc, UC_X86_REG_RDX, &rdx); + uc_reg_read(uc, UC_X86_REG_RSI, &rsi); + uc_reg_read(uc, UC_X86_REG_RDI, &rdi); + uc_reg_read(uc, UC_X86_REG_R8, &r8); + uc_reg_read(uc, UC_X86_REG_R9, &r9); + uc_reg_read(uc, UC_X86_REG_R10, &r10); + uc_reg_read(uc, UC_X86_REG_R11, &r11); + uc_reg_read(uc, UC_X86_REG_R12, &r12); + uc_reg_read(uc, UC_X86_REG_R13, &r13); + uc_reg_read(uc, UC_X86_REG_R14, &r14); + uc_reg_read(uc, UC_X86_REG_R15, &r15); + + printf(">>> RAX = 0x%" PRIx64 "\n", rax); + printf(">>> RBX = 0x%" PRIx64 "\n", rbx); + printf(">>> RCX = 0x%" PRIx64 "\n", rcx); + printf(">>> RDX = 0x%" PRIx64 "\n", rdx); + printf(">>> RSI = 0x%" PRIx64 "\n", rsi); + printf(">>> RDI = 0x%" PRIx64 "\n", rdi); + printf(">>> R8 = 0x%" PRIx64 "\n", r8); + printf(">>> R9 = 0x%" PRIx64 "\n", r9); + printf(">>> R10 = 0x%" PRIx64 "\n", r10); + printf(">>> R11 = 0x%" PRIx64 "\n", r11); + printf(">>> R12 = 0x%" PRIx64 "\n", r12); + printf(">>> R13 = 0x%" PRIx64 "\n", r13); + printf(">>> R14 = 0x%" PRIx64 "\n", r14); + printf(">>> R15 = 0x%" PRIx64 "\n", r15); + + uc_assert_success(uc_close(uc)); +} + +/******************************************************************************/ + +// callback for SYSCALL instruction (X86). +static void hook_syscall(uc_engine *uc, void *user_data) +{ + uint64_t rax; + + uc_assert_success(uc_reg_read(uc, UC_X86_REG_RAX, &rax)); + assert_int_equal(0x100, rax); + + rax = 0x200; + uc_assert_success(uc_reg_write(uc, UC_X86_REG_RAX, &rax)); +} + +static void test_x86_64_syscall(void **state) +{ + uc_engine *uc; + uc_hook trace1; + uc_err err; + + static const uint64_t address = 0x1000000; + static const uint8_t code[] = { + 0x0F, 0x05, // SYSCALL + }; + + int64_t rax = 0x100; + + // Initialize emulator in X86-64bit mode + err = uc_open(UC_ARCH_X86, UC_MODE_64, &uc); + uc_assert_success(err); + + // map 2MB memory for this emulation + err = uc_mem_map(uc, address, 2 * 1024 * 1024, UC_PROT_ALL); + uc_assert_success(err); + + // write machine code to be emulated to memory + err = uc_mem_write(uc, address, code, sizeof(code)); + uc_assert_success(err); + + // hook interrupts for syscall + err = uc_hook_add(uc, &trace1, UC_HOOK_INSN, hook_syscall, NULL, UC_X86_INS_SYSCALL); + uc_assert_success(err); + + // initialize machine registers + err = uc_reg_write(uc, UC_X86_REG_RAX, &rax); + uc_assert_success(err); + + // emulate machine code in infinite time (last param = 0), or when + // finishing all the code. + err = uc_emu_start(uc, address, address + sizeof(code), 0, 0); + uc_assert_success(err); + + // verify register values + uc_assert_success(uc_reg_read(uc, UC_X86_REG_RAX, &rax)); + assert_int_equal(0x200, rax); + + uc_assert_success(uc_close(uc)); +} + +/******************************************************************************/ + +static void test_x86_16(void **state) +{ + uc_engine *uc; + uc_err err; + uint8_t tmp; + + static const uint64_t address = 0; + static const uint8_t code[] = { + 0x00, 0x00, // add byte ptr [bx + si], al + }; + + int32_t eax = 7; + int32_t ebx = 5; + int32_t esi = 6; + + // Initialize emulator in X86-16bit mode + err = uc_open(UC_ARCH_X86, UC_MODE_16, &uc); + uc_assert_success(err); + + // map 8KB memory for this emulation + err = uc_mem_map(uc, address, 8 * 1024, UC_PROT_ALL); + uc_assert_success(err); + + // write machine code to be emulated to memory + err = uc_mem_write(uc, address, code, sizeof(code)); + uc_assert_success(err); + + // initialize machine registers + uc_assert_success(uc_reg_write(uc, UC_X86_REG_EAX, &eax)); + uc_assert_success(uc_reg_write(uc, UC_X86_REG_EBX, &ebx)); + uc_assert_success(uc_reg_write(uc, UC_X86_REG_ESI, &esi)); + + // emulate machine code in infinite time (last param = 0), or when + // finishing all the code. + err = uc_emu_start(uc, address, address+sizeof(code), 0, 0); + uc_assert_success(err); + + // read from memory + uc_assert_success(uc_mem_read(uc, 11, &tmp, 1)); + assert_int_equal(7, tmp); + + uc_assert_success(uc_close(uc)); +} + +/******************************************************************************/ + int main(void) { const struct CMUnitTest tests[] = { cmocka_unit_test(test_i386), + cmocka_unit_test(test_i386_jump), + cmocka_unit_test(test_i386_inout), + cmocka_unit_test(test_i386_loop), + cmocka_unit_test(test_i386_invalid_mem_read), + cmocka_unit_test(test_i386_invalid_mem_write), + cmocka_unit_test(test_i386_jump_invalid), + + // TODO: Infinite loop, then segfault + //cmocka_unit_test(test_x86_64), + cmocka_unit_test(test_x86_64_syscall), + + cmocka_unit_test(test_x86_16), }; return cmocka_run_group_tests(tests, NULL, NULL); } From 46ee860084bcfc15621674642f2db12f84fced44 Mon Sep 17 00:00:00 2001 From: Jonathon Reinhart Date: Sun, 20 Sep 2015 21:33:11 -0400 Subject: [PATCH 07/10] update to new error constants and silence printfs --- test/unit/test_x86.c | 28 +++++++++++++++------------- 1 file changed, 15 insertions(+), 13 deletions(-) diff --git a/test/unit/test_x86.c b/test/unit/test_x86.c index d40e2902..1a31e432 100644 --- a/test/unit/test_x86.c +++ b/test/unit/test_x86.c @@ -128,7 +128,7 @@ static uint32_t hook_in(uc_engine *uc, uint32_t port, int size, void *user_data) uc_reg_read(uc, UC_X86_REG_EIP, &eip); - printf("--- reading from port 0x%x, size: %u, address: 0x%x\n", port, size, eip); + //printf("--- reading from port 0x%x, size: %u, address: 0x%x\n", port, size, eip); switch(size) { default: @@ -153,7 +153,7 @@ static void hook_out(uc_engine *uc, uint32_t port, int size, uint32_t value, voi uc_reg_read(uc, UC_X86_REG_EIP, &eip); - printf("--- writing to port 0x%x, size: %u, value: 0x%x, address: 0x%x\n", port, size, value, eip); + //printf("--- writing to port 0x%x, size: %u, value: 0x%x, address: 0x%x\n", port, size, value, eip); // TODO: confirm that value is indeed the value of AL/AX/EAX switch(size) { @@ -170,7 +170,7 @@ static void hook_out(uc_engine *uc, uint32_t port, int size, uint32_t value, voi break; } - printf("--- register value = 0x%x\n", tmp); + //printf("--- register value = 0x%x\n", tmp); } static void test_i386_inout(void **state) @@ -232,8 +232,8 @@ static void test_i386_inout(void **state) uc_reg_read(uc, UC_X86_REG_EAX, &r_eax); uc_reg_read(uc, UC_X86_REG_ECX, &r_ecx); - printf(">>> EAX = 0x%x\n", r_eax); - printf(">>> ECX = 0x%x\n", r_ecx); + //printf(">>> EAX = 0x%x\n", r_eax); + //printf(">>> ECX = 0x%x\n", r_ecx); // TODO: Assert on the register values here uc_assert_success(uc_close(uc)); @@ -317,7 +317,7 @@ static void test_i386_invalid_mem_read(void **state) // emulate machine code in infinite time err = uc_emu_start(uc, address, address+sizeof(code), 0, 0); - uc_assert_err(UC_ERR_MEM_READ, err); // TODO: Currently returns MEM_WRITE + uc_assert_err(UC_ERR_READ_INVALID, err); // TODO: Currently returns WRITE_INVALID uc_assert_success(uc_close(uc)); @@ -348,7 +348,7 @@ static void test_i386_invalid_mem_write(void **state) // emulate machine code in infinite time err = uc_emu_start(uc, address, address+sizeof(code), 0, 0); - uc_assert_err(UC_ERR_MEM_WRITE, err); + uc_assert_err(UC_ERR_WRITE_INVALID, err); uc_assert_success(uc_close(uc)); @@ -394,12 +394,12 @@ static void hook_mem64(uc_engine *uc, uc_mem_type type, switch(type) { default: break; case UC_MEM_READ: - printf(">>> Memory is being READ at 0x%"PRIx64 ", data size = %u\n", - address, size); + //printf(">>> Memory is being READ at 0x%"PRIx64 ", data size = %u\n", + // address, size); break; case UC_MEM_WRITE: - printf(">>> Memory is being WRITE at 0x%"PRIx64 ", data size = %u, data value = 0x%"PRIx64 "\n", - address, size, value); + //printf(">>> Memory is being WRITE at 0x%"PRIx64 ", data size = %u, data value = 0x%"PRIx64 "\n", + // address, size, value); break; } } @@ -410,8 +410,8 @@ static void hook_code64(uc_engine *uc, uint64_t address, uint32_t size, void *us uint64_t rip; uc_reg_read(uc, UC_X86_REG_RIP, &rip); - printf(">>> Tracing instruction at 0x%"PRIx64 ", instruction size = 0x%x\n", address, size); - printf(">>> RIP is 0x%"PRIx64 "\n", rip); + //printf(">>> Tracing instruction at 0x%"PRIx64 ", instruction size = 0x%x\n", address, size); + //printf(">>> RIP is 0x%"PRIx64 "\n", rip); // Uncomment below code to stop the emulation using uc_emu_stop() // if (address == 0x1000009) @@ -512,6 +512,7 @@ static void test_x86_64(void **state) uc_reg_read(uc, UC_X86_REG_R14, &r14); uc_reg_read(uc, UC_X86_REG_R15, &r15); +#if 0 printf(">>> RAX = 0x%" PRIx64 "\n", rax); printf(">>> RBX = 0x%" PRIx64 "\n", rbx); printf(">>> RCX = 0x%" PRIx64 "\n", rcx); @@ -526,6 +527,7 @@ static void test_x86_64(void **state) printf(">>> R13 = 0x%" PRIx64 "\n", r13); printf(">>> R14 = 0x%" PRIx64 "\n", r14); printf(">>> R15 = 0x%" PRIx64 "\n", r15); +#endif uc_assert_success(uc_close(uc)); } From 1be8ef69c88c976a13cdbfa07e8a243b625fc947 Mon Sep 17 00:00:00 2001 From: Jonathon Reinhart Date: Sun, 20 Sep 2015 21:39:35 -0400 Subject: [PATCH 08/10] add 'test' to main Makefile --- Makefile | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/Makefile b/Makefile index 148baa73..198ed266 100644 --- a/Makefile +++ b/Makefile @@ -249,6 +249,11 @@ else endif +.PHONY: test +test: all + $(MAKE) -C test/unit test + + install: all $(PKGCFGF) mkdir -p $(LIBDIR) ifeq ($(UNICORN_SHARED),yes) @@ -302,6 +307,7 @@ ifeq (,$(findstring yes,$(UNICORN_BUILD_CORE_ONLY))) cd samples && $(MAKE) clean rm -f $(BLDIR)/samples/lib$(LIBNAME).$(EXT) endif + $(MAKE) -C test/unit clean ifdef BUILDDIR rm -rf $(BUILDDIR) From cc1cfb9141f57d4faa04dd89650f730fe3f0cbaa Mon Sep 17 00:00:00 2001 From: Jonathon Reinhart Date: Sun, 20 Sep 2015 22:16:04 -0400 Subject: [PATCH 09/10] add information about unit tests to COMPILE.txt --- COMPILE.TXT | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/COMPILE.TXT b/COMPILE.TXT index 53d6885f..bbcb96ca 100644 --- a/COMPILE.TXT +++ b/COMPILE.TXT @@ -246,3 +246,12 @@ Unicorn requires few dependent packages as followings So far, only Python is supported by bindings in the main code. Look for the bindings under directory bindings/, and refer to README file of corresponding languages. + + +[11] Unit tests + + Automated unit tests use the cmocka unit testing framework (https://cmocka.org/). + It can be installed in most Linux distros using the package manager, e.g. + `sudo yum install libcmocka libcmocka-devel`, or you can easily build and install it from source. + + You can run the tests by running `make test` in the project directory. From 07122809b5f7b2d14136a8ebf7af39ba3d59ab82 Mon Sep 17 00:00:00 2001 From: Jonathon Reinhart Date: Sun, 20 Sep 2015 22:45:45 -0400 Subject: [PATCH 10/10] test/unit: add test_basic_blocks This verifies that the basic block callback is working as expected. --- test/unit/test_x86.c | 93 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 93 insertions(+) diff --git a/test/unit/test_x86.c b/test/unit/test_x86.c index 1a31e432..634201dc 100644 --- a/test/unit/test_x86.c +++ b/test/unit/test_x86.c @@ -1,6 +1,97 @@ #include "unicorn_test.h" #include +#define OK(x) uc_assert_success(x) + +/* Called before every test to set up a new instance */ +static int setup32(void **state) +{ + uc_engine *uc; + + OK(uc_open(UC_ARCH_X86, UC_MODE_32, &uc)); + + *state = uc; + return 0; +} + +/* Called after every test to clean up */ +static int teardown(void **state) +{ + uc_engine *uc = *state; + + OK(uc_close(uc)); + + *state = NULL; + return 0; +} + +/******************************************************************************/ + +struct bb { + uint64_t addr; + size_t size; +}; + +struct bbtest { + const struct bb *blocks; + unsigned int blocknum; +}; + + +static void test_basic_blocks_hook(uc_engine *uc, uint64_t address, uint32_t size, void *user_data) +{ + struct bbtest *bbtest = user_data; + const struct bb *bb = &bbtest->blocks[bbtest->blocknum++]; + + assert_int_equal(address, bb->addr); + assert_int_equal((size_t)size, bb->size); +} + +static void test_basic_blocks(void **state) +{ + uc_engine *uc = *state; + uc_hook trace1; + +#define BASEADDR 0x1000000 + + uint64_t address = BASEADDR; + const uint8_t code[] = { + 0x33, 0xC0, // xor eax, eax + 0x90, // nop + 0x90, // nop + 0xEB, 0x00, // jmp $+2 + 0x90, // nop + 0x90, // nop + 0x90, // nop + }; + + static const struct bb blocks[] = { + {BASEADDR, 6}, + {BASEADDR+ 6, 3}, + }; + + struct bbtest bbtest = { + .blocks = blocks, + .blocknum = 0, + }; + + +#undef BASEADDR + + // map 2MB memory for this emulation + OK(uc_mem_map(uc, address, 2 * 1024 * 1024, UC_PROT_ALL)); + + // write machine code to be emulated to memory + OK(uc_mem_write(uc, address, code, sizeof(code))); + + // trace all basic blocks + OK(uc_hook_add(uc, &trace1, UC_HOOK_BLOCK, test_basic_blocks_hook, &bbtest, (uint64_t)1, (uint64_t)0)); + + OK(uc_emu_start(uc, address, address+sizeof(code), 0, 0)); +} + +/******************************************************************************/ + // callback for tracing basic blocks static void hook_block(uc_engine *uc, uint64_t address, uint32_t size, void *user_data) { @@ -654,6 +745,8 @@ int main(void) { cmocka_unit_test(test_x86_64_syscall), cmocka_unit_test(test_x86_16), + + cmocka_unit_test_setup_teardown(test_basic_blocks, setup32, teardown), }; return cmocka_run_group_tests(tests, NULL, NULL); }