From b7d60313b5ccd49e3a3d87c7190e011214089c60 Mon Sep 17 00:00:00 2001
From: mothran <w.parker.thompson@gmail.com>
Date: Sat, 29 Aug 2015 01:56:36 -0700
Subject: [PATCH] added 64 bit mode to the fstenv helper function, also a
 fpu_ip64.py regress script

---
 qemu/target-i386/fpu_helper.c | 19 +++++++++--
 regress/fpu_ip64.py           | 62 +++++++++++++++++++++++++++++++++++
 2 files changed, 79 insertions(+), 2 deletions(-)
 create mode 100644 regress/fpu_ip64.py

diff --git a/qemu/target-i386/fpu_helper.c b/qemu/target-i386/fpu_helper.c
index fa20b7a1..a54580c8 100644
--- a/qemu/target-i386/fpu_helper.c
+++ b/qemu/target-i386/fpu_helper.c
@@ -986,7 +986,18 @@ void helper_fstenv(CPUX86State *env, target_ulong ptr, int data32)
             }
         }
     }
-    if (data32) {
+    switch (env->uc->mode) {
+    case (UC_MODE_64):
+        /* 64 bit */
+        cpu_stl_data(env, ptr, env->fpuc);
+        cpu_stl_data(env, ptr + 4, fpus);
+        cpu_stl_data(env, ptr + 8, fptag);
+        cpu_stl_data(env, ptr + 12, env->fpip); /* fpip */
+        cpu_stl_data(env, ptr + 20, 0); /* fpcs */
+        cpu_stl_data(env, ptr + 24, 0); /* fpoo */
+        cpu_stl_data(env, ptr + 28, 0); /* fpos */
+        break;
+    case (UC_MODE_32):
         /* 32 bit */
         cpu_stl_data(env, ptr, env->fpuc);
         cpu_stl_data(env, ptr + 4, fpus);
@@ -995,7 +1006,8 @@ void helper_fstenv(CPUX86State *env, target_ulong ptr, int data32)
         cpu_stl_data(env, ptr + 16, 0); /* fpcs */
         cpu_stl_data(env, ptr + 20, 0); /* fpoo */
         cpu_stl_data(env, ptr + 24, 0); /* fpos */
-    } else {
+        break;
+    case (UC_MODE_16):
         /* 16 bit */
         cpu_stw_data(env, ptr, env->fpuc);
         cpu_stw_data(env, ptr + 2, fpus);
@@ -1004,6 +1016,9 @@ void helper_fstenv(CPUX86State *env, target_ulong ptr, int data32)
         cpu_stw_data(env, ptr + 8, 0);
         cpu_stw_data(env, ptr + 10, 0);
         cpu_stw_data(env, ptr + 12, 0);
+        break;
+    default:
+        break;
     }
 }
 
diff --git a/regress/fpu_ip64.py b/regress/fpu_ip64.py
new file mode 100644
index 00000000..dd0b5c1c
--- /dev/null
+++ b/regress/fpu_ip64.py
@@ -0,0 +1,62 @@
+#!/usr/bin/python
+from unicorn import *
+from unicorn.x86_const import *
+from capstone import *
+
+ESP = 0x2000
+PAGE_SIZE = 2 * 1024 * 1024
+
+#	mov [esp], DWORD 0x37f
+#	fldcw [esp]
+#	fnop
+#	fnstenv [esp + 8]
+#	pop ecx
+CODE = "C704247F030000D92C24D9D0D974240859".decode('hex')
+
+class SimpleEngine:
+	def __init__(self):
+		self.capmd = Cs(CS_ARCH_X86, CS_MODE_64)
+
+	def disas_single(self, data):
+		for i in self.capmd.disasm(data, 16):
+			print("\t%s\t%s" % (i.mnemonic, i.op_str))
+			break
+
+disasm = SimpleEngine()
+
+def hook_code(uc, addr, size, user_data):
+	mem = uc.mem_read(addr, size)
+	print("  0x%X:" % (addr)),
+	disasm.disas_single(str(mem))
+
+def mem_reader(addr, size):
+	tmp = mu.mem_read(addr, size)
+
+	for i in tmp:
+		print(" 0x%x" % i),
+	print("")
+
+
+mu = Uc(UC_ARCH_X86, UC_MODE_64)
+
+mu.mem_map(0x0, PAGE_SIZE)
+mu.mem_write(0x4000, CODE)
+mu.reg_write(UC_X86_REG_RSP, ESP)
+mu.hook_add(UC_HOOK_CODE, hook_code)
+
+
+mu.emu_start(0x4000, 0, 0, 5)
+rsp = mu.reg_read(UC_X86_REG_RSP)
+print("Value of FPIP: [0x%X]" % (rsp + 10))
+mem_reader(rsp + 10, 8)
+# EXPECTED OUTPUT:
+
+#   0x4000: 	mov	dword ptr [rsp], 0x37f
+#   0x4007: 	fldcw	word ptr [rsp]
+#   0x400A: 	fnop	
+#   0x400C: 	fnstenv	dword ptr [rsp + 8]
+#   0x4010: 	pop	rcx
+# Value of FPIP: [0x2012]
+#  0x0  0x0  0xa  0x40  0x0  0x0  0x0  0x0 
+
+# WHERE: the value of FPIP should be the address of fnop
\ No newline at end of file