mirror of
https://github.com/yuzu-emu/unicorn.git
synced 2024-12-23 13:45:40 +00:00
79 lines
2.4 KiB
Python
Executable file
79 lines
2.4 KiB
Python
Executable file
#!/usr/bin/python
|
|
# By Mariano Graziano
|
|
|
|
from unicorn import *
|
|
from unicorn.x86_const import *
|
|
|
|
import regress, struct
|
|
|
|
|
|
class Emulator:
|
|
def __init__(self, code, stack):
|
|
self.mask = 0xFFFFFFFFFFFFF000
|
|
self.unicorn_code = code
|
|
self.unicorn_stack = stack
|
|
self.mu = Uc(UC_ARCH_X86, UC_MODE_64)
|
|
size = 1 * 4096
|
|
self.mu.mem_map(code & self.mask, size)
|
|
size = 1 * 4096
|
|
self.mu.mem_map(stack & self.mask, size)
|
|
self.set_hooks()
|
|
|
|
def set_hooks(self):
|
|
self.mu.hook_add(UC_HOOK_MEM_WRITE, self.hook_mem_access)
|
|
self.mu.hook_add(UC_HOOK_MEM_READ_UNMAPPED | UC_HOOK_MEM_WRITE_UNMAPPED, self.hook_mem_invalid)
|
|
self.mu.hook_add(UC_HOOK_MEM_FETCH_UNMAPPED, self.hook_mem_fetch_unmapped)
|
|
|
|
def hook_mem_fetch_unmapped(self, uc, access, address, size, value, user_data):
|
|
next_ip = self.unicorn_code + size
|
|
self.mu.reg_write(UC_X86_REG_RIP, next_ip)
|
|
self.mu.mem_write(next_ip, "\x90")
|
|
self.mu.reg_write(UC_X86_REG_RIP, address)
|
|
return True
|
|
|
|
def hook_mem_invalid(self, uc, access, address, size, value, user_data):
|
|
return True
|
|
|
|
def hook_mem_access(self, uc, access, address, size, value, user_data):
|
|
return True
|
|
|
|
def emu(self, size):
|
|
ip = self.mu.reg_read(UC_X86_REG_RIP)
|
|
try:
|
|
self.mu.emu_start(ip, ip + size, timeout=10000, count=1)
|
|
except UcError as e:
|
|
print("Error %s" % e)
|
|
|
|
def write_data(self, address, content):
|
|
self.mu.mem_write(address, content)
|
|
|
|
|
|
class Init(regress.RegressTest):
|
|
def init_unicorn(self, ip, sp, counter):
|
|
print "[+] Emulating IP: %x SP: %x - Counter: %x" % (ip, sp, counter)
|
|
E = Emulator(ip, sp)
|
|
E.write_data(ip, "\x90")
|
|
E.write_data(sp, self.generate_value(counter))
|
|
E.mu.reg_write(UC_X86_REG_RSP, sp)
|
|
E.mu.reg_write(UC_X86_REG_RIP, ip)
|
|
E.emu(1)
|
|
|
|
def generate_value(self, counter):
|
|
start = 0xffff880026f02000
|
|
offset = counter * 8
|
|
address = start + offset
|
|
return struct.pack("<Q", address)
|
|
|
|
def runTest(self):
|
|
global mu
|
|
ips = list(range(0xffffffff816a9000, 0xffffffff816af000, 0x1))
|
|
sps = list(range(0xffff88001b800000, 0xffff88001b801000, 0x1))
|
|
j = 0
|
|
for i in ips:
|
|
j += 1
|
|
index = ips.index(i)
|
|
self.init_unicorn(i, sps[index], j)
|
|
|
|
if __name__ == '__main__':
|
|
regress.main()
|