Merge branch 'master' into java_dev

.gitignore

@@ -87,3 +87,4 @@ regress/block_test
 regress/map_write
 regress/ro_mem_test
 regress/nr_mem_test
+regress/timeout_segfault

docs/unicorn-logo.txt

@@ -1,19 +1,19 @@
-                 /\'.         _,,
+                 /\'.         _,.
-                 |.\ \      .'_/
+                 |:\ \.     .'_/
-            _.-- |(\\ \   .'_.'
+            _.-  |(\\ \   .'_.'
-        _.-'   \_\\ \\_),/ _/
+        _.-'  ,__\\ \\_),/ _/
-      _).'  .:::::::.___  .'
+      _:.'  .:::::::.___  ,'
-      //   ' ./::::::\\o\(
+      //   ' ./::::::\<o\(
-     //     //::/   '"(   \
+     //     /|::/   `"(   \
-    //_    //::(       '.  '.
+    ;/_    / ::(       `.  `.
-   /_'/   /||:::\        '.  \
+   /_'/   | ::::\        `.  \
-   '//    '\\:::':\_    -<_' _'-
+   '//    '\ :::':\_    _, ` _'-
-   / |     '\::/|::::.._   _  )(
+   / |     '\.:/|::::.._ `-__ )/
-   | |       \:| \:(    '.(_'._)
+   | |       \;| \:(    '.(_ \_)
    | |        \(  \::.    '-)
-   \ \  .          '""""---.
+   \ \  ,          '""""---.
-    \ \ \    .        _.-...)
+    \ \ \    ,        _.-...)
-     \ \/\.  \:.___.-'..:::/
+     \ \/\.  \:,___.-'..:::/
-      \ |\\:..\:::::'.::::/
+      \ |\\:,.\:::::'.::::/
-       '  '.:::::'..:::"'
+       `  `:;::::'.::;::'
-             '":::""'
+             '":;:""'

qemu/cpu-exec.c

@@ -205,6 +205,8 @@ int cpu_exec(struct uc_struct *uc, CPUArchState *env)   // qq
                 have_tb_lock = true;
                 tb = tb_find_fast(env);	// qq
                 if (!tb) {   // invalid TB due to invalid code?
+                    uc->invalid_error = UC_ERR_CODE_INVALID;
+                    ret = EXCP_HLT;
                     break;
                 }
                 /* Note: we do it here to avoid a gcc bug on Mac OS X when

qemu/target-i386/fpu_helper.c

@@ -986,12 +986,22 @@ void helper_fstenv(CPUX86State *env, target_ulong ptr, int data32)
             }
         }
     }
-    if (data32) {
+
+    // DFLAG enum: tcg.h, case here to int
+    if (env->hflags & HF_CS64_MASK) {
+        cpu_stl_data(env, ptr, env->fpuc);
+        cpu_stl_data(env, ptr + 4, fpus);
+        cpu_stl_data(env, ptr + 8, fptag);
+        cpu_stl_data(env, ptr + 12, env->fpip); /* fpip */
+        cpu_stl_data(env, ptr + 20, 0); /* fpcs */
+        cpu_stl_data(env, ptr + 24, 0); /* fpoo */
+        cpu_stl_data(env, ptr + 28, 0); /* fpos */
+    } else if (data32) {
         /* 32 bit */
         cpu_stl_data(env, ptr, env->fpuc);
         cpu_stl_data(env, ptr + 4, fpus);
         cpu_stl_data(env, ptr + 8, fptag);
-        cpu_stl_data(env, ptr + 12, 0); /* fpip */
+        cpu_stl_data(env, ptr + 12, env->fpip); /* fpip */
         cpu_stl_data(env, ptr + 16, 0); /* fpcs */
         cpu_stl_data(env, ptr + 20, 0); /* fpoo */
         cpu_stl_data(env, ptr + 24, 0); /* fpos */
@@ -1000,11 +1010,12 @@ void helper_fstenv(CPUX86State *env, target_ulong ptr, int data32)
         cpu_stw_data(env, ptr, env->fpuc);
         cpu_stw_data(env, ptr + 2, fpus);
         cpu_stw_data(env, ptr + 4, fptag);
-        cpu_stw_data(env, ptr + 6, 0);
+        cpu_stw_data(env, ptr + 6, env->fpip);
         cpu_stw_data(env, ptr + 8, 0);
         cpu_stw_data(env, ptr + 10, 0);
         cpu_stw_data(env, ptr + 12, 0);
     }
+
 }
 
 void helper_fldenv(CPUX86State *env, target_ulong ptr, int data32)

qemu/target-i386/translate.c

@@ -248,6 +248,11 @@ static void gen_update_cc_op(DisasContext *s)
     }
 }
 
+static void fpu_update_ip(CPUX86State *env, target_ulong pc)
+{
+	env->fpip = pc;
+}
+
 #ifdef TARGET_X86_64
 
 #define NB_OP_SIZES 4
@@ -6110,6 +6115,7 @@ static target_ulong disas_insn(CPUX86State *env, DisasContext *s,
                         /* fcomp needs pop */
                         gen_helper_fpop(tcg_ctx, cpu_env);
                     }
+                    fpu_update_ip(env, pc_start);
                 }
                 break;
             case 0x08: /* flds */
@@ -6194,6 +6200,7 @@ static target_ulong disas_insn(CPUX86State *env, DisasContext *s,
                         gen_helper_fpop(tcg_ctx, cpu_env);
                     break;
                 }
+                fpu_update_ip(env, pc_start);
                 break;
             case 0x0c: /* fldenv mem */
                 gen_update_cc_op(s);
@@ -6219,12 +6226,14 @@ static target_ulong disas_insn(CPUX86State *env, DisasContext *s,
                 gen_update_cc_op(s);
                 gen_jmp_im(s, pc_start - s->cs_base);
                 gen_helper_fldt_ST0(tcg_ctx, cpu_env, cpu_A0);
+                fpu_update_ip(env, pc_start);
                 break;
             case 0x1f: /* fstpt mem */
                 gen_update_cc_op(s);
                 gen_jmp_im(s, pc_start - s->cs_base);
                 gen_helper_fstt_ST0(tcg_ctx, cpu_env, cpu_A0);
                 gen_helper_fpop(tcg_ctx, cpu_env);
+                fpu_update_ip(env, pc_start);
                 break;
             case 0x2c: /* frstor mem */
                 gen_update_cc_op(s);
@@ -6245,21 +6254,25 @@ static target_ulong disas_insn(CPUX86State *env, DisasContext *s,
                 gen_update_cc_op(s);
                 gen_jmp_im(s, pc_start - s->cs_base);
                 gen_helper_fbld_ST0(tcg_ctx, cpu_env, cpu_A0);
+                fpu_update_ip(env, pc_start);
                 break;
             case 0x3e: /* fbstp */
                 gen_update_cc_op(s);
                 gen_jmp_im(s, pc_start - s->cs_base);
                 gen_helper_fbst_ST0(tcg_ctx, cpu_env, cpu_A0);
                 gen_helper_fpop(tcg_ctx, cpu_env);
+                fpu_update_ip(env, pc_start);
                 break;
             case 0x3d: /* fildll */
                 tcg_gen_qemu_ld_i64(s->uc, cpu_tmp1_i64, cpu_A0, s->mem_index, MO_LEQ);
                 gen_helper_fildll_ST0(tcg_ctx, cpu_env, cpu_tmp1_i64);
+                fpu_update_ip(env, pc_start);
                 break;
             case 0x3f: /* fistpll */
                 gen_helper_fistll_ST0(tcg_ctx, cpu_tmp1_i64, cpu_env);
                 tcg_gen_qemu_st_i64(s->uc, cpu_tmp1_i64, cpu_A0, s->mem_index, MO_LEQ);
                 gen_helper_fpop(tcg_ctx, cpu_env);
+                fpu_update_ip(env, pc_start);
                 break;
             default:
                 goto illegal_op;
@@ -6574,6 +6587,7 @@ static target_ulong disas_insn(CPUX86State *env, DisasContext *s,
             default:
                 goto illegal_op;
             }
+            fpu_update_ip(env, pc_start);
         }
         break;
         /************************/

regress/fpu_ip.py

@@ -0,0 +1,61 @@
+#!/usr/bin/python
+from unicorn import *
+from unicorn.x86_const import *
+from capstone import *
+
+ESP = 0x2000
+PAGE_SIZE = 2 * 1024 * 1024
+
+#	mov [esp], DWORD 0x37f
+#	fldcw [esp]
+#	fnop
+#	fnstenv [esp + 8]
+#	pop ecx
+CODE = b'\xc7\x04\x24\x7f\x03\x00\x00\xd9\x2c\x24\xd9\xd0\xd9\x74\x24\x08\x59'
+
+class SimpleEngine:
+	def __init__(self):
+		self.capmd = Cs(CS_ARCH_X86, CS_MODE_32)
+
+	def disas_single(self, data):
+		for i in self.capmd.disasm(data, 16):
+			print("\t%s\t%s" % (i.mnemonic, i.op_str))
+			break
+
+disasm = SimpleEngine()
+
+def hook_code(uc, addr, size, user_data):
+	mem = uc.mem_read(addr, size)
+	print("  0x%X:" % (addr)),
+	disasm.disas_single(str(mem))
+
+def mem_reader(addr, size):
+	tmp = mu.mem_read(addr, size)
+
+	for i in tmp:
+		print(" 0x%x" % i),
+	print("")
+
+
+mu = Uc(UC_ARCH_X86, UC_MODE_32)
+
+mu.mem_map(0x0, PAGE_SIZE)
+mu.mem_write(0x4000, CODE)
+mu.reg_write(UC_X86_REG_ESP, ESP)
+mu.hook_add(UC_HOOK_CODE, hook_code)
+
+
+mu.emu_start(0x4000, 0, 0, 5)
+esp = mu.reg_read(UC_X86_REG_ESP)
+print("value at ESP [0x%X - 4]: " % esp)
+mem_reader(esp +  14, 4)
+
+# EXPECTED OUTPUT:
+#   0x4000: 	mov	dword ptr [esp], 0x37f
+#   0x4007: 	fldcw	word ptr [esp]
+#   0x400A: 	fnop	
+#   0x400C: 	fnstenv	dword ptr [esp + 8]
+#   0x4010: 	pop	ecx
+# value at ESP [0x2004 - 4]: 
+#  0x0  0x0  0xa  0x40 
+#  ^ this value should match the fnop instuction addr

regress/fpu_ip64.py

@@ -0,0 +1,62 @@
+#!/usr/bin/python
+from unicorn import *
+from unicorn.x86_const import *
+from capstone import *
+
+ESP = 0x2000
+PAGE_SIZE = 2 * 1024 * 1024
+
+#	mov [esp], DWORD 0x37f
+#	fldcw [esp]
+#	fnop
+#	fnstenv [esp + 8]
+#	pop ecx
+CODE = "C704247F030000D92C24D9D0D974240859".decode('hex')
+
+class SimpleEngine:
+	def __init__(self):
+		self.capmd = Cs(CS_ARCH_X86, CS_MODE_64)
+
+	def disas_single(self, data):
+		for i in self.capmd.disasm(data, 16):
+			print("\t%s\t%s" % (i.mnemonic, i.op_str))
+			break
+
+disasm = SimpleEngine()
+
+def hook_code(uc, addr, size, user_data):
+	mem = uc.mem_read(addr, size)
+	print("  0x%X:" % (addr)),
+	disasm.disas_single(str(mem))
+
+def mem_reader(addr, size):
+	tmp = mu.mem_read(addr, size)
+
+	for i in tmp:
+		print(" 0x%x" % i),
+	print("")
+
+
+mu = Uc(UC_ARCH_X86, UC_MODE_64)
+
+mu.mem_map(0x0, PAGE_SIZE)
+mu.mem_write(0x4000, CODE)
+mu.reg_write(UC_X86_REG_RSP, ESP)
+mu.hook_add(UC_HOOK_CODE, hook_code)
+
+
+mu.emu_start(0x4000, 0, 0, 5)
+rsp = mu.reg_read(UC_X86_REG_RSP)
+print("Value of FPIP: [0x%X]" % (rsp + 10))
+mem_reader(rsp + 10, 8)
+# EXPECTED OUTPUT:
+
+#   0x4000: 	mov	dword ptr [rsp], 0x37f
+#   0x4007: 	fldcw	word ptr [rsp]
+#   0x400A: 	fnop	
+#   0x400C: 	fnstenv	dword ptr [rsp + 8]
+#   0x4010: 	pop	rcx
+# Value of FPIP: [0x2012]
+#  0x0  0x0  0xa  0x40  0x0  0x0  0x0  0x0 
+
+# WHERE: the value of FPIP should be the address of fnop

regress/jmp_ebx_hang.py

@@ -4,20 +4,23 @@
 
 import unicorn
 CODE_ADDR = 0x10101000
-CODE = b'\xff\xe3'
+CODE = b'\xff\xe3'  # jmp ebx
 mu = unicorn.Uc(unicorn.UC_ARCH_X86, unicorn.UC_MODE_32)
 mu.mem_map(CODE_ADDR, 1024 * 4)
 mu.mem_write(CODE_ADDR, CODE)
 # If EBX is zero then an exception is raised, as expected
 mu.reg_write(unicorn.x86_const.UC_X86_REG_EBX, 0x0)
 
+print(">>> jmp ebx (ebx = 0)");
 try:
     mu.emu_start(CODE_ADDR, CODE_ADDR + 2, count=1)
 except unicorn.UcError as e:
+    print("ERROR: %s" % e)
     assert(e.errno == unicorn.UC_ERR_CODE_INVALID)
 else:
     assert(False)
 
+print(">>> jmp ebx (ebx = 0xaa96a47f)");
 mu = unicorn.Uc(unicorn.UC_ARCH_X86, unicorn.UC_MODE_32)
 mu.mem_map(CODE_ADDR, 1024 * 4)
 # If we write this address to EBX then the emulator hangs on emu_start
@@ -26,6 +29,7 @@ mu.mem_write(CODE_ADDR, CODE)
 try:
     mu.emu_start(CODE_ADDR, CODE_ADDR + 2, count=1)
 except unicorn.UcError as e:
+    print("ERROR: %s" % e)
     assert(e.errno == unicorn.UC_ERR_CODE_INVALID)
 else:
     assert(False)

regress/pshufb.py

@@ -0,0 +1,12 @@
+#!/usr/bin/python
+# By Ryan Hileman, issue #91
+
+# Invalid instruction = test failed
+
+from unicorn import *
+from unicorn.x86_const import *
+uc = Uc(UC_ARCH_X86, UC_MODE_64)
+uc.mem_map(0x2000, 0x1000)
+# pshufb xmm0, xmm1
+uc.mem_write(0x2000, '660f3800c1'.decode('hex'))
+uc.emu_start(0x2000, 0)