diff --git a/include/unicorn/unicorn.h b/include/unicorn/unicorn.h index 925eeb42..784fd999 100644 --- a/include/unicorn/unicorn.h +++ b/include/unicorn/unicorn.h @@ -273,6 +273,14 @@ typedef void (*uc_cb_hookmem_t)(uc_engine *uc, uc_mem_type type, @user_data: user data passed to tracing APIs @return: return true to continue, or false to stop program (due to invalid memory). + NOTE: returning true to continue execution will only work if if the accessed + memory is made accessible with the correct permissions during the hook. + In the event of a UC_MEM_READ_UNMAPPED or UC_MEM_WRITE_UNMAPPED callback, + the memory should be uc_mem_map()-ed with the correct permissions, and the + instruction will then read or write to the address as it was supposed to. + In the event of a UC_MEM_FETCH_UNMAPPED callback, the memory can be mapped + in as executable, in which case execution will resume from the fetched address, + or the instruction pointer can be written to in order to resume execution elsewhere. */ typedef bool (*uc_cb_eventmem_t)(uc_engine *uc, uc_mem_type type, uint64_t address, int size, int64_t value, void *user_data);