// emulate code that jump to invalid memory static void test_i386_jump_invalid(void) { uc_engine *uc; uc_err err; uc_hook trace1, trace2; int r_ecx = 0x1234; // ECX register int r_edx = 0x7890; // EDX register printf("===================================\n"); printf("Emulate i386 code that jumps to invalid memory\n"); // Initialize emulator in X86-32bit mode err = uc_open(UC_ARCH_X86, UC_MODE_32, &uc); if (err) { printf("Failed on uc_open() with error returned: %u\n", err); return; } // map 2MB memory for this emulation uc_mem_map(uc, ADDRESS, 2 * 1024 * 1024, UC_PROT_ALL); // write machine code to be emulated to memory if (uc_mem_write(uc, ADDRESS, X86_CODE32_JMP_INVALID, sizeof(X86_CODE32_JMP_INVALID) - 1)) { printf("Failed to write emulation code to memory, quit!\n"); return; } // initialize machine registers uc_reg_write(uc, UC_X86_REG_ECX, &r_ecx); uc_reg_write(uc, UC_X86_REG_EDX, &r_edx); // tracing all basic blocks with customized callback uc_hook_add(uc, &trace1, UC_HOOK_BLOCK, hook_block, NULL, 1, 0); // tracing all instructions by having @begin > @end uc_hook_add(uc, &trace2, UC_HOOK_CODE, hook_code, NULL, 1, 0); // emulate machine code in infinite time err = uc_emu_start(uc, ADDRESS, ADDRESS + sizeof(X86_CODE32_JMP_INVALID) - 1, 0, 0); if (err) { printf("Failed on uc_emu_start() with error returned %u: %s\n", err, uc_strerror(err)); } // now print out some registers printf(">>> Emulation done. Below is the CPU context\n"); uc_reg_read(uc, UC_X86_REG_ECX, &r_ecx); uc_reg_read(uc, UC_X86_REG_EDX, &r_edx); printf(">>> ECX = 0x%x\n", r_ecx); printf(">>> EDX = 0x%x\n", r_edx); uc_close(uc); }
static void test_arm(void) { uc_engine *uc; uc_err err; uc_hook trace1, trace2; int r0 = 0x1234; // R0 register int r2 = 0x6789; // R1 register int r3 = 0x3333; // R2 register int r1; // R1 register printf("Emulate ARM code\n"); // Initialize emulator in ARM mode err = uc_open(UC_ARCH_ARM, UC_MODE_ARM, &uc); if (err) { printf("Failed on uc_open() with error returned: %u (%s)\n", err, uc_strerror(err)); return; } // map 2MB memory for this emulation uc_mem_map(uc, ADDRESS, 2 * 1024 * 1024, UC_PROT_ALL); // write machine code to be emulated to memory uc_mem_write(uc, ADDRESS, ARM_CODE, sizeof(ARM_CODE) - 1); // initialize machine registers uc_reg_write(uc, UC_ARM_REG_R0, &r0); uc_reg_write(uc, UC_ARM_REG_R2, &r2); uc_reg_write(uc, UC_ARM_REG_R3, &r3); // tracing all basic blocks with customized callback uc_hook_add(uc, &trace1, UC_HOOK_BLOCK, hook_block, NULL, 1, 0); // tracing one instruction at ADDRESS with customized callback uc_hook_add(uc, &trace2, UC_HOOK_CODE, hook_code, NULL, ADDRESS, ADDRESS); // emulate machine code in infinite time (last param = 0), or when // finishing all the code. err = uc_emu_start(uc, ADDRESS, ADDRESS + sizeof(ARM_CODE) -1, UC_SECOND_SCALE * TIMEOUT, 0); if (err) { printf("Failed on uc_emu_start() with error returned: %u\n", err); } // now print out some registers printf(">>> Emulation done. Below is the CPU context\n"); uc_reg_read(uc, UC_ARM_REG_R0, &r0); uc_reg_read(uc, UC_ARM_REG_R1, &r1); printf(">>> R0 = 0x%x\n", r0); printf(">>> R1 = 0x%x\n", r1); uc_close(uc); }
static void test_sparc(void) { uc_engine *uc; uc_err err; uc_hook trace1, trace2; int g1 = 0x1230; // G1 register int g2 = 0x6789; // G2 register int g3 = 0x5555; // G3 register printf("Emulate SPARC code\n"); // Initialize emulator in Sparc mode err = uc_open(UC_ARCH_SPARC, UC_MODE_32, &uc); if (err) { printf("Failed on uc_open() with error returned: %u (%s)\n", err, uc_strerror(err)); return; } // map 2MB memory for this emulation uc_mem_map(uc, ADDRESS, 2 * 1024 * 1024, UC_PROT_ALL); // write machine code to be emulated to memory uc_mem_write(uc, ADDRESS, SPARC_CODE, sizeof(SPARC_CODE) - 1); // initialize machine registers uc_reg_write(uc, UC_SPARC_REG_G1, &g1); uc_reg_write(uc, UC_SPARC_REG_G2, &g2); uc_reg_write(uc, UC_SPARC_REG_G3, &g3); // tracing all basic blocks with customized callback uc_hook_add(uc, &trace1, UC_HOOK_BLOCK, hook_block, NULL, (uint64_t)1, (uint64_t)0); // tracing all instructions with customized callback uc_hook_add(uc, &trace2, UC_HOOK_CODE, hook_code, NULL, (uint64_t)1, (uint64_t)0); // emulate machine code in infinite time (last param = 0), or when // finishing all the code. err = uc_emu_start(uc, ADDRESS, ADDRESS + sizeof(SPARC_CODE) - 1, 0, 0); if (err) { printf("Failed on uc_emu_start() with error returned: %u (%s)\n", err, uc_strerror(err)); } // now print out some registers printf(">>> Emulation done. Below is the CPU context\n"); uc_reg_read(uc, UC_SPARC_REG_G3, &g3); printf(">>> G3 = 0x%x\n", g3); uc_close(uc); }
static void test_arm64(void) { uc_engine *uc; uc_err err; uc_hook trace1, trace2; int64_t x11 = 0x1234; // X11 register int64_t x13 = 0x6789; // X13 register int64_t x15 = 0x3333; // X15 register printf("Emulate ARM64 code\n"); // Initialize emulator in ARM mode err = uc_open(UC_ARCH_ARM64, UC_MODE_ARM, &uc); if (err) { printf("Failed on uc_open() with error returned: %u (%s)\n", err, uc_strerror(err)); return; } // map 2MB memory for this emulation uc_mem_map(uc, ADDRESS, 2 * 1024 * 1024, UC_PROT_ALL); // write machine code to be emulated to memory uc_mem_write(uc, ADDRESS, ARM_CODE, sizeof(ARM_CODE) - 1); // initialize machine registers uc_reg_write(uc, UC_ARM64_REG_X11, &x11); uc_reg_write(uc, UC_ARM64_REG_X13, &x13); uc_reg_write(uc, UC_ARM64_REG_X15, &x15); // tracing all basic blocks with customized callback uc_hook_add(uc, &trace1, UC_HOOK_BLOCK, hook_block, NULL, (uint64_t)1, (uint64_t)0); // tracing one instruction at ADDRESS with customized callback uc_hook_add(uc, &trace2, UC_HOOK_CODE, hook_code, NULL, (uint64_t)ADDRESS, (uint64_t)ADDRESS); // emulate machine code in infinite time (last param = 0), or when // finishing all the code. err = uc_emu_start(uc, ADDRESS, ADDRESS + sizeof(ARM_CODE) -1, 0, 0); if (err) { printf("Failed on uc_emu_start() with error returned: %u\n", err); } // now print out some registers printf(">>> Emulation done. Below is the CPU context\n"); uc_reg_read(uc, UC_ARM64_REG_X11, &x11); printf(">>> X11 = 0x%" PRIx64 "\n", x11); uc_close(uc); }
static void test_basic_blocks(void **state) { uc_engine *uc = *state; uc_hook trace1, trace2; #define BASEADDR 0x1000000 uint64_t address = BASEADDR; const uint8_t code[] = { 0x33, 0xC0, // xor eax, eax 0x90, // nop 0x90, // nop 0xEB, 0x00, // jmp $+2 0x90, // nop 0x90, // nop 0x90, // nop }; static const struct bb blocks[] = { {BASEADDR, 6}, {BASEADDR+ 6, 3}, }; struct bbtest bbtest = { .blocks = blocks, .blocknum = 0, }; #undef BASEADDR // map 2MB memory for this emulation OK(uc_mem_map(uc, address, 2 * 1024 * 1024, UC_PROT_ALL)); // write machine code to be emulated to memory OK(uc_mem_write(uc, address, code, sizeof(code))); // trace all basic blocks OK(uc_hook_add(uc, &trace1, UC_HOOK_BLOCK, test_basic_blocks_hook, &bbtest, (uint64_t)1, (uint64_t)0)); OK(uc_hook_add(uc, &trace2, UC_HOOK_BLOCK, test_basic_blocks_hook2, &bbtest, (uint64_t)1, (uint64_t)0)); OK(uc_emu_start(uc, address, address+sizeof(code), 0, 0)); } int main(void) { const struct CMUnitTest tests[] = { cmocka_unit_test_setup_teardown(test_basic_blocks, setup32, teardown), }; return cmocka_run_group_tests(tests, NULL, NULL); }
static void test_thumb(void) { uc_engine *uc; uc_err err; uc_hook trace1, trace2; int sp = 0x1234; // R0 register printf("Emulate THUMB code\n"); // Initialize emulator in ARM mode err = uc_open(UC_ARCH_ARM, UC_MODE_THUMB, &uc); if (err) { printf("Failed on uc_open() with error returned: %u (%s)\n", err, uc_strerror(err)); return; } // map 2MB memory for this emulation uc_mem_map(uc, ADDRESS, 2 * 1024 * 1024, UC_PROT_ALL); // write machine code to be emulated to memory uc_mem_write(uc, ADDRESS, THUMB_CODE, sizeof(THUMB_CODE) - 1); // initialize machine registers uc_reg_write(uc, UC_ARM_REG_SP, &sp); // tracing all basic blocks with customized callback uc_hook_add(uc, &trace1, UC_HOOK_BLOCK, hook_block, NULL, 1, 0); // tracing one instruction at ADDRESS with customized callback uc_hook_add(uc, &trace2, UC_HOOK_CODE, hook_code, NULL, ADDRESS, ADDRESS); // emulate machine code in infinite time (last param = 0), or when // finishing all the code. // Note we start at ADDRESS | 1 to indicate THUMB mode. err = uc_emu_start(uc, ADDRESS | 1, ADDRESS + sizeof(THUMB_CODE) -1, 0, 0); if (err) { printf("Failed on uc_emu_start() with error returned: %u\n", err); } // now print out some registers printf(">>> Emulation done. Below is the CPU context\n"); uc_reg_read(uc, UC_ARM_REG_SP, &sp); printf(">>> SP = 0x%x\n", sp); uc_close(uc); }
static void test_mips_el(void) { uc_engine *uc; uc_err err; uc_hook trace1, trace2; int r1 = 0x6789; // R1 register printf("===========================\n"); printf("Emulate MIPS code (little-endian)\n"); // Initialize emulator in MIPS mode err = uc_open(UC_ARCH_MIPS, UC_MODE_MIPS32, &uc); if (err) { printf("Failed on uc_open() with error returned: %u (%s)\n", err, uc_strerror(err)); return; } // map 2MB memory for this emulation uc_mem_map(uc, ADDRESS, 2 * 1024 * 1024, UC_PROT_ALL); // write machine code to be emulated to memory uc_mem_write(uc, ADDRESS, MIPS_CODE_EL, sizeof(MIPS_CODE_EL) - 1); // initialize machine registers uc_reg_write(uc, UC_MIPS_REG_1, &r1); // tracing all basic blocks with customized callback uc_hook_add(uc, &trace1, UC_HOOK_BLOCK, hook_block, NULL, (uint64_t)1, (uint64_t)0); // tracing one instruction at ADDRESS with customized callback uc_hook_add(uc, &trace2, UC_HOOK_CODE, hook_code, NULL, (uint64_t)ADDRESS, (uint64_t)ADDRESS); // emulate machine code in infinite time (last param = 0), or when // finishing all the code. err = uc_emu_start(uc, ADDRESS, ADDRESS + sizeof(MIPS_CODE_EL) - 1, 0, 0); if (err) { printf("Failed on uc_emu_start() with error returned: %u (%s)\n", err, uc_strerror(err)); } // now print out some registers printf(">>> Emulation done. Below is the CPU context\n"); uc_reg_read(uc, UC_MIPS_REG_1, &r1); printf(">>> R1 = 0x%x\n", r1); uc_close(uc); }
int main() { int size; uint8_t *buf; uc_engine *uc; uc_hook uh_trap; uc_err err = uc_open (UC_ARCH_X86, UC_MODE_64, &uc); if (err) { fprintf (stderr, "Cannot initialize unicorn\n"); return 1; } size = UC_BUG_WRITE_SIZE; buf = malloc (size); if (!buf) { fprintf (stderr, "Cannot allocate\n"); return 1; } memset (buf, 0, size); if (!uc_mem_map(uc, UC_BUG_WRITE_ADDR, size, UC_PROT_ALL)) { uc_mem_write(uc, UC_BUG_WRITE_ADDR, (const uint8_t*)"\xff\xff\xff\xff\xff\xff\xff\xff", 8); } uc_hook_add(uc, &uh_trap, UC_HOOK_INTR, _interrupt, NULL, 1, 0); uc_emu_start(uc, UC_BUG_WRITE_ADDR, UC_BUG_WRITE_ADDR+8, 0, 1); uc_close(uc); printf ("Correct: %s\n", got_sigill? "YES": "NO"); return got_sigill? 0: 1; }
int main(int argc, char **argv, char **envp) { uc_engine *uc; uc_hook trace1, trace2; uc_err err; uint32_t eax, ebx; printf("Memory protections test\n"); // Initialize emulator in X86-32bit mode err = uc_open(UC_ARCH_X86, UC_MODE_32, &uc); if (err) { printf("Failed on uc_open() with error returned: %u\n", err); return 1; } uc_mem_map(uc, 0x100000, 0x1000, UC_PROT_READ); uc_mem_map(uc, 0x300000, 0x1000, UC_PROT_READ | UC_PROT_WRITE); uc_mem_map(uc, 0x400000, 0x1000, UC_PROT_WRITE); // write machine code to be emulated to memory if (uc_mem_write(uc, 0x100000, PROGRAM, sizeof(PROGRAM))) { printf("Failed to write emulation code to memory, quit!\n"); return 2; } else { printf("Allowed to write to read only memory via uc_mem_write\n"); } uc_mem_write(uc, 0x300000, (const uint8_t*)"\x41\x41\x41\x41", 4); uc_mem_write(uc, 0x400000, (const uint8_t*)"\x42\x42\x42\x42", 4); //uc_hook_add(uc, &trace2, UC_HOOK_CODE, hook_code, NULL, (uint64_t)0x400000, (uint64_t)0x400fff); // intercept invalid memory events uc_hook_add(uc, &trace1, UC_MEM_READ_PROT, hook_mem_invalid, NULL); // emulate machine code in infinite time printf("BEGIN execution\n"); err = uc_emu_start(uc, 0x100000, 0x100000 + sizeof(PROGRAM), 0, 2); if (err) { printf("Expected failure on uc_emu_start() with error returned %u: %s\n", err, uc_strerror(err)); } else { printf("UNEXPECTED uc_emu_start returned UC_ERR_OK\n"); } printf("END execution\n"); uc_reg_read(uc, UC_X86_REG_EAX, &eax); printf("Final eax = 0x%x\n", eax); uc_reg_read(uc, UC_X86_REG_EBX, &ebx); printf("Final ebx = 0x%x\n", ebx); uc_close(uc); return 0; }
static void test_i386_jump(void) { uc_engine *uc; uc_err err; uc_hook trace1, trace2; printf("===================================\n"); printf("Emulate i386 code with jump\n"); // Initialize emulator in X86-32bit mode err = uc_open(UC_ARCH_X86, UC_MODE_32, &uc); if (err) { printf("Failed on uc_open() with error returned: %u\n", err); return; } // map 2MB memory for this emulation uc_mem_map(uc, ADDRESS, 2 * 1024 * 1024, UC_PROT_ALL); // write machine code to be emulated to memory if (uc_mem_write(uc, ADDRESS, X86_CODE32_JUMP, sizeof(X86_CODE32_JUMP) - 1)) { printf("Failed to write emulation code to memory, quit!\n"); return; } // tracing 1 basic block with customized callback uc_hook_add(uc, &trace1, UC_HOOK_BLOCK, hook_block, NULL, ADDRESS, ADDRESS); // tracing 1 instruction at ADDRESS uc_hook_add(uc, &trace2, UC_HOOK_CODE, hook_code, NULL, ADDRESS, ADDRESS); // emulate machine code in infinite time err = uc_emu_start(uc, ADDRESS, ADDRESS + sizeof(X86_CODE32_JUMP) - 1, 0, 0); if (err) { printf("Failed on uc_emu_start() with error returned %u: %s\n", err, uc_strerror(err)); } printf(">>> Emulation done. Below is the CPU context\n"); uc_close(uc); }
int main(int argc, char **argv) { uc_engine *uc; uc_hook trace; uc_err err; uint8_t memory[MEM_SIZE]; if (argc == 1) { usage(argv[0]); return -1; } const char *fname = argv[1]; err = uc_open (UC_ARCH_X86, UC_MODE_16, &uc); if (err) { fprintf(stderr, "Cannot initialize unicorn\n"); return 1; } // map 64KB in if (uc_mem_map (uc, 0, MEM_SIZE, UC_PROT_ALL)) { fprintf(stderr, "Failed to write emulation code to memory, quit!\n"); uc_close(uc); return 0; } // initialize internal settings int21_init(); //load executable size_t fsize = load_com(uc, memory, fname); // setup PSP setup_psp(0, memory, argc, argv); // write machine code to be emulated in, including the prefix PSP uc_mem_write(uc, 0, memory, DOS_ADDR + fsize); // handle interrupt ourself uc_hook_add(uc, &trace, UC_HOOK_INTR, hook_intr, NULL); err = uc_emu_start(uc, DOS_ADDR, DOS_ADDR + 0x10000, 0, 0); if (err) { fprintf(stderr, "Failed on uc_emu_start() with error returned %u: %s\n", err, uc_strerror(err)); } uc_close(uc); return 0; }
static void test_x86_64_syscall(void) { uc_engine *uc; uc_hook trace1; uc_err err; int64_t rax = 0x100; printf("===================================\n"); printf("Emulate x86_64 code with 'syscall' instruction\n"); // Initialize emulator in X86-64bit mode err = uc_open(UC_ARCH_X86, UC_MODE_64, &uc); if (err) { printf("Failed on uc_open() with error returned: %u\n", err); return; } // map 2MB memory for this emulation uc_mem_map(uc, ADDRESS, 2 * 1024 * 1024, UC_PROT_ALL); // write machine code to be emulated to memory if (uc_mem_write(uc, ADDRESS, X86_CODE64_SYSCALL, sizeof(X86_CODE64_SYSCALL) - 1)) { printf("Failed to write emulation code to memory, quit!\n"); return; } // hook interrupts for syscall uc_hook_add(uc, &trace1, UC_HOOK_INSN, hook_syscall, NULL, 1, 0, UC_X86_INS_SYSCALL); // initialize machine registers uc_reg_write(uc, UC_X86_REG_RAX, &rax); // emulate machine code in infinite time (last param = 0), or when // finishing all the code. err = uc_emu_start(uc, ADDRESS, ADDRESS + sizeof(X86_CODE64_SYSCALL) - 1, 0, 0); if (err) { printf("Failed on uc_emu_start() with error returned %u: %s\n", err, uc_strerror(err)); } // now print out some registers printf(">>> Emulation done. Below is the CPU context\n"); uc_reg_read(uc, UC_X86_REG_RAX, &rax); printf(">>> RAX = 0x%" PRIx64 "\n", rax); uc_close(uc); }
static void test_i386_jump(void **state) { uc_engine *uc; uc_err err; uc_hook trace1, trace2; const uint8_t code[] = "\xeb\x02\x90\x90\x90\x90\x90\x90"; // jmp 4; nop; nop; nop; nop; nop; nop const uint64_t address = 0x1000000; // Initialize emulator in X86-32bit mode err = uc_open(UC_ARCH_X86, UC_MODE_32, &uc); uc_assert_success(err); // map 2MB memory for this emulation err = uc_mem_map(uc, address, 2 * 1024 * 1024, UC_PROT_ALL); uc_assert_success(err); // write machine code to be emulated to memory err = uc_mem_write(uc, address, code, sizeof(code)-1); uc_assert_success(err); // tracing 1 basic block with customized callback err = uc_hook_add(uc, &trace1, UC_HOOK_BLOCK, hook_block, NULL, address, address); uc_assert_success(err); // tracing 1 instruction at address err = uc_hook_add(uc, &trace2, UC_HOOK_CODE, hook_code, NULL, address, address); uc_assert_success(err); // emulate machine code in infinite time err = uc_emu_start(uc, address, address+sizeof(code)-1, 0, 0); uc_assert_success(err); err = uc_close(uc); uc_assert_success(err); }
int main(int argc, char **argv, char **envp) { uc_engine *uc; if (uc_open(HARDWARE_ARCHITECTURE, HARDWARE_MODE, &uc)) { printf("uc_open(…) failed\n"); return 1; } uc_mem_map(uc, MEMORY_STARTING_ADDRESS, MEMORY_SIZE, MEMORY_PERMISSIONS); if (uc_mem_write(uc, MEMORY_STARTING_ADDRESS, BINARY_CODE, sizeof(BINARY_CODE) - 1)) { printf("uc_mem_write(…) failed\n"); return 1; } uc_hook trace; uc_hook_add(uc, &trace, UC_HOOK_CODE, hook_code, NULL, (uint64_t)MEMORY_STARTING_ADDRESS, (uint64_t)(MEMORY_STARTING_ADDRESS + 1)); printf("uc_emu_start(…)\n"); uc_emu_start(uc, MEMORY_STARTING_ADDRESS, MEMORY_STARTING_ADDRESS + sizeof(BINARY_CODE) - 1, 0, 0); printf("done\n"); return 0; }
static void test_x86_64_syscall(void **state) { uc_engine *uc; uc_hook trace1; uc_err err; static const uint64_t address = 0x1000000; static const uint8_t code[] = { 0x0F, 0x05, // SYSCALL }; int64_t rax = 0x100; // Initialize emulator in X86-64bit mode err = uc_open(UC_ARCH_X86, UC_MODE_64, &uc); uc_assert_success(err); // map 2MB memory for this emulation err = uc_mem_map(uc, address, 2 * 1024 * 1024, UC_PROT_ALL); uc_assert_success(err); // write machine code to be emulated to memory err = uc_mem_write(uc, address, code, sizeof(code)); uc_assert_success(err); // hook interrupts for syscall err = uc_hook_add(uc, &trace1, UC_HOOK_INSN, hook_syscall, NULL, 1, 0, UC_X86_INS_SYSCALL); uc_assert_success(err); // initialize machine registers err = uc_reg_write(uc, UC_X86_REG_RAX, &rax); uc_assert_success(err); // emulate machine code in infinite time (last param = 0), or when // finishing all the code. err = uc_emu_start(uc, address, address + sizeof(code), 0, 0); uc_assert_success(err); // verify register values uc_assert_success(uc_reg_read(uc, UC_X86_REG_RAX, &rax)); assert_int_equal(0x200, rax); uc_assert_success(uc_close(uc)); }
//if a read is performed from a big address whith a non-zero last digit, multiple read events are triggered static void test_high_address_reads(void **state) { uc_engine *uc = *state; uc_hook trace2; uint64_t addr = 0x0010000000000001; //addr = 0x0010000000000000; // uncomment to fix wrong? behaviour //addr = 90000000; // uncomment to fix wrong? behaviour // uc_mem_map(uc, addr-(addr%4096), 4096*2, UC_PROT_ALL); uc_assert_success(uc_reg_write(uc, UC_X86_REG_RAX, &addr)); const uint64_t base_addr = 0x40000; uint8_t code[] = {0x48,0x8b,0x00,0x90,0x90,0x90,0x90}; // mov rax, [rax], nops uc_assert_success(uc_mem_map(uc, base_addr, 4096, UC_PROT_ALL)); uc_assert_success(uc_mem_write(uc, base_addr, code, 7)); uc_assert_success(uc_hook_add(uc, &trace2, UC_HOOK_MEM_READ, hook_mem64, NULL, (uint64_t)1, (uint64_t)0)); uc_assert_success(uc_emu_start(uc, base_addr, base_addr + 3, 0, 0)); if(number_of_memory_reads != 1) { fail_msg("wrong number of memory reads for instruction %i", number_of_memory_reads); } }
static void test_tb_x86_64_32_imul_Gv_Ev_Ib(void **state) { uc_engine *uc = *state; uc_hook trace1, trace2; void *mem; #ifdef RIP_NEXT_TO_THE_SELFMODIFY_OPCODE // These values assumes just before PC = 0x60000021 int64_t eax = 0x00000041; int64_t ecx = 0x5ffffff8; int64_t edx = 0x5ffffff8; int64_t ebx = 0x034a129b; int64_t esp = 0x6010229a; int64_t ebp = 0x60000002; int64_t esi = 0x1f350211; int64_t edi = 0x488ac239; #else // These values assumes PC == 0x6000000 int64_t eax = 0x73952c43; int64_t ecx = 0x6010229a; int64_t edx = 0x2a500e50; int64_t ebx = 0x034a1295; int64_t esp = 0x6010229a; int64_t ebp = 0x60000000; int64_t esi = 0x1f350211; int64_t edi = 0x488ac239; #endif mem = calloc(1, CODE_SPACE); assert_int_not_equal(0, mem); uc_assert_success(uc_open(UC_ARCH_X86, UC_MODE_32, &uc)); uc_assert_success(uc_mem_map(uc, PHY_STACK_REGION, CODE_SPACE, UC_PROT_ALL)); uc_assert_success(uc_mem_write(uc, PHY_STACK_REGION, X86_CODE32_ALPHA_MIXED, sizeof(X86_CODE32_ALPHA_MIXED) - 1)); uc_assert_success(uc_reg_write(uc, UC_X86_REG_EAX, &eax)); uc_assert_success(uc_reg_write(uc, UC_X86_REG_ECX, &ecx)); uc_assert_success(uc_reg_write(uc, UC_X86_REG_EDX, &edx)); uc_assert_success(uc_reg_write(uc, UC_X86_REG_EBX, &ebx)); uc_assert_success(uc_reg_write(uc, UC_X86_REG_ESP, &esp)); uc_assert_success(uc_reg_write(uc, UC_X86_REG_EBP, &ebp)); uc_assert_success(uc_reg_write(uc, UC_X86_REG_ESI, &esi)); uc_assert_success(uc_reg_write(uc, UC_X86_REG_EDI, &edi)); uc_assert_success(uc_hook_add(uc, &trace1, UC_HOOK_CODE, hook_code32, NULL, (uint64_t)1, (uint64_t)0)); uc_assert_success(uc_hook_add(uc, &trace2, UC_HOOK_MEM_VALID, hook_mem32, NULL, (uint64_t)1, (uint64_t)0)); uc_assert_success(uc_emu_start(uc, #ifdef RIP_NEXT_TO_THE_SELFMODIFY_OPCODE // Register set (before self-modifying IMUL opcode) // Start at "0x00000021: xorb %al, 0x30(%ecx) // Start at "0x00000021: xor byte ptr [ecx + 0x30], al PHY_STACK_REGION+0x0021, // 0x0024 didn't work #else PHY_STACK_REGION+0x0000, #endif PHY_STACK_REGION+sizeof(X86_CODE32_ALPHA_MIXED) - 1, 0, 0)); uc_assert_success(uc_close(uc)); }
static void VM_exec() { uc_engine *uc; uc_err err; uint32_t tmp; uc_hook trace1, trace2; unsigned int r_eax, r_ebx, r_ecx, r_edx, r_ebp, r_esp, r_esi, r_edi, r_eip, eflags; unsigned int tr_eax, tr_ebx, tr_ecx, tr_edx, tr_ebp, tr_esp, tr_esi, tr_edi, tr_eip, t_eflags; r_eax = tr_eax = 0x1DB10106; r_ebx = tr_ebx = 0x7EFDE000; r_ecx = tr_ecx = 0x7EFDE000; r_edx = tr_edx = 0x00001DB1; r_ebp = tr_ebp = 0x0018FF88; r_esp = tr_esp = 0x0018FF14; r_esi = tr_esi = 0x0; r_edi = tr_edi = 0x0; r_eip = tr_eip = 0x004939F3; t_eflags = eflags = 0x00000206; // Initialize emulator in X86-32bit mode err = uc_open(UC_ARCH_X86, UC_MODE_32, &uc); if(err) { printf("Failed on uc_open() with error returned: %s", uc_strerror(err)); return; } err = uc_mem_map(uc, ADDRESS, (4 * 1024 * 1024), UC_PROT_ALL); if(err != UC_ERR_OK) { printf("Failed to map memory %s", uc_strerror(err)); return; } // write machine code to be emulated to memory err = uc_mem_write(uc, ADDRESS, X86_CODE32, sizeof(X86_CODE32) - 1); if(err != UC_ERR_OK) { printf("Failed to write emulation code to memory, quit!: %s(len %lu)", uc_strerror(err), sizeof(X86_CODE32) - 1); return; } // initialize machine registers uc_reg_write(uc, UC_X86_REG_EAX, &r_eax); uc_reg_write(uc, UC_X86_REG_EBX, &r_ebx); uc_reg_write(uc, UC_X86_REG_ECX, &r_ecx); uc_reg_write(uc, UC_X86_REG_EDX, &r_edx); uc_reg_write(uc, UC_X86_REG_EBP, &r_ebp); uc_reg_write(uc, UC_X86_REG_ESP, &r_esp); uc_reg_write(uc, UC_X86_REG_ESI, &r_esi); uc_reg_write(uc, UC_X86_REG_EDI, &r_edi); uc_reg_write(uc, UC_X86_REG_EFLAGS, &eflags); uc_hook_add(uc, &trace1, UC_HOOK_MEM_READ_UNMAPPED | UC_HOOK_MEM_WRITE_UNMAPPED, (void *)hook_invalid_mem, NULL, 1, 0); // tracing all instruction by having @begin > @end uc_hook_add(uc, &trace2, UC_HOOK_CODE, (void *)hook_ins, NULL, 1, 0); // emulate machine code in infinite time err = uc_emu_start(uc, ADDRESS, ADDRESS + (sizeof(X86_CODE32) - 1), 0, 0); if(err) { printf("Failed on uc_emu_start() with error returned %u: %s", err, uc_strerror(err)); instructions = 0; uc_close(uc); return; } uc_reg_read(uc, UC_X86_REG_EAX, &r_eax); uc_reg_read(uc, UC_X86_REG_EBX, &r_ebx); uc_reg_read(uc, UC_X86_REG_ECX, &r_ecx); uc_reg_read(uc, UC_X86_REG_EDX, &r_edx); uc_reg_read(uc, UC_X86_REG_EBP, &r_ebp); uc_reg_read(uc, UC_X86_REG_ESP, &r_esp); uc_reg_read(uc, UC_X86_REG_ESI, &r_esi); uc_reg_read(uc, UC_X86_REG_EDI, &r_edi); uc_reg_read(uc, UC_X86_REG_EIP, &r_eip); uc_reg_read(uc, UC_X86_REG_EFLAGS, &eflags); uc_close(uc); printf(">>> Emulation done. Below is the CPU context\n"); printf(">>> EAX = 0x%08X %s\n", r_eax, (r_eax == tr_eax ? "" : "(m)")); printf(">>> EBX = 0x%08X %s\n", r_ebx, (r_ebx == tr_ebx ? "" : "(m)")); printf(">>> ECX = 0x%08X %s\n", r_ecx, (r_ecx == tr_ecx ? "" : "(m)")); printf(">>> EDX = 0x%08X %s\n", r_edx, (r_edx == tr_edx ? "" : "(m)")); printf(">>> EBP = 0x%08X %s\n", r_ebp, (r_ebp == tr_ebp ? "" : "(m)")); printf(">>> ESP = 0x%08X %s\n", r_esp, (r_esp == tr_esp ? "" : "(m)")); printf(">>> ESI = 0x%08X %s\n", r_esi, (r_esi == tr_esi ? "" : "(m)")); printf(">>> EDI = 0x%08X %s\n", r_edi, (r_edi == tr_edi ? "" : "(m)")); printf(">>> EIP = 0x%08X %s\n", (r_eip - ADDRESS) + tr_eip, (r_eip == tr_eip ? "" : "(m)\n")); printf(">>> EFLAGS = 0x%08X %s\n", eflags, (eflags == t_eflags ? "" : "(m)")); printf(">>> Instructions executed %" PRIu64 "\n", instructions); assert(r_eax == 0x1DB10106); assert(r_ebx == 0x7EFDE000); assert(r_ecx == 0x00000006); assert(r_edx == 0x00000001); assert(r_ebp == 0x0018FF88); assert(r_esp == 0x0018FF14); assert(r_esi == 0x00000000); assert(r_edi == 0x00000000); assert(eflags == 0x00000206); //we shouldn't fail this assert, eflags should be 0x00000206 because the last AND instruction produces a non-zero result. instructions = 0; }
static void VM_exec() { uc_engine *uc; uc_err err; uc_hook trace; unsigned int r_eax, eflags, r_esp, r_edi, r_ecx; r_eax = 0xbaadbabe; r_esp = ADDRESS+0x20; r_edi = ADDRESS+0x300; //some safe distance from main code. eflags = 0x00000206; r_ecx = ECX_OPS; // Initialize emulator in X86-32bit mode err = uc_open(UC_ARCH_X86, UC_MODE_32, &uc); if(err) { printf("Failed on uc_open() with error returned: %s\n", uc_strerror(err)); return; } err = uc_mem_map(uc, ADDRESS, (2 * 1024 * 1024), UC_PROT_ALL); if(err != UC_ERR_OK) { printf("Failed to map memory %s\n", uc_strerror(err)); return; } // write machine code to be emulated to memory err = uc_mem_write(uc, ADDRESS, X86_CODE32, sizeof(X86_CODE32) - 1); if(err != UC_ERR_OK) { printf("Failed to write emulation code to memory, quit!: %s(len %lu)\n", uc_strerror(err), (unsigned long)sizeof(X86_CODE32) - 1); return; } // initialize machine registers uc_reg_write(uc, UC_X86_REG_EAX, &r_eax); uc_reg_write(uc, UC_X86_REG_EDI, &r_edi); uc_reg_write(uc, UC_X86_REG_ECX, &r_ecx); uc_reg_write(uc, UC_X86_REG_ESP, &r_esp); //make stack pointer point to already mapped memory so we don't need to hook. uc_reg_write(uc, UC_X86_REG_EFLAGS, &eflags); uc_hook_add(uc, &trace, UC_HOOK_CODE, (void *)hook_ins, NULL, 1, 0); // emulate machine code in infinite time err = uc_emu_start(uc, ADDRESS, ADDRESS + (sizeof(X86_CODE32) - 1), 0, 0); if(err) { printf("Failed on uc_emu_start() with error returned %u: %s\n", err, uc_strerror(err)); uc_close(uc); return; } uc_reg_read(uc, UC_X86_REG_EAX, &r_eax); uc_reg_read(uc, UC_X86_REG_ECX, &r_ecx); uc_reg_read(uc, UC_X86_REG_EDI, &r_edi); uc_reg_read(uc, UC_X86_REG_EFLAGS, &eflags); uc_close(uc); printf("\n>>> Emulation done. Below is the CPU context\n"); printf(">>> EAX = 0x%08X\n", r_eax); printf(">>> ECX = 0x%08X\n", r_ecx); printf(">>> EDI = 0x%08X\n", r_edi); printf(">>> EFLAGS = 0x%08X\n", eflags); printf("\nHook called %lu times. Test %s\n", hook_called, (hook_called == ECX_OPS ? "PASSED!!" : "FAILED!!!")); }
/** * This is the part that launches the code in the Unicorn emulator. **/ int em_code(u8 *code, u32 bytelength, u32 startat, u8 *seed_res, uc_arch arch){ // bit of lazy coding here: update a global arch var, so that // we can easily read the arch from the single step hook. // neither elegant nor dangerous. if (global_arch != arch) global_arch = arch; /* The start address must be aligned to 4KB, or uc_mem_map will * throw a UC_ERR_ARG error. */ u32 round_start = startat & (u32) (~0xFFF); u32 offset = startat - round_start; int errcode = 0; int roundlength = roundup(bytelength); uc_engine *uc; uc_err err; uc_hook hook1; int sys_abi_len; uc_mode mode; int ret_inst; int *sys_abi_vec; /* if (DEBUG){ */ /* printf("IN EMULATOR\n"); */ /* fdump(stdout, code, bytelength); */ /* } */ switch (arch) { case UC_ARCH_X86 : sys_abi_vec = x86_64_syscall_abi; // careful sys_abi_len = x86_64_syscall_abi_len; mode = UC_MODE_64; ret_inst = UC_X86_INS_RET; break; case UC_ARCH_ARM : if (DEBUG) printf("Emulating ARM architecture...\n"); sys_abi_vec = arm_32_syscall_abi; sys_abi_len = arm_32_syscall_abi_len; mode = UC_MODE_ARM; break; default : fprintf(stderr,"Unknown architecture requested of em_code.\nExiting.\n"); exit(EXIT_FAILURE); } union seedvals { u32 words[sys_abi_len]; // wrinkle here: the word size should be dynamic u8 bytes[sys_abi_len * sizeof(word)]; } seedvals; /* fprintf(stderr, "bytelength = %d\nroundlength = %d\nsizeof(seedvals.bytes) = %d\nsizeof(seed_res) = %d\nsizeof(word) * sys_abi_len = %d\n",bytelength, roundlength, sizeof(seedvals.bytes), sizeof(seed_res), (sys_abi_len * sizeof(word))); */ if (!memcpy(seedvals.bytes, seed_res, (sys_abi_len * sizeof(word)))){ fprintf(stderr, "Error in memcpy, in em_code.\n"); } /** * from the unicorn src: "This part of the API is less... clean... * because Unicorn supports arbitrary register types. So the least * intrusive solution is passing individual pointers. On the plus * side, you only need to make this pointer array once." */ void *ptrs[sys_abi_len]; int i; for (i = 0; i < sys_abi_len; i++) { ptrs[i] = &(seedvals.words[i]); } if ((err = uc_open(arch, mode, &uc))) { uc_perror("uc_open", err); return -1; } // seed the registers if ((err = uc_reg_write_batch(uc, sys_abi_vec, ptrs, sys_abi_len))){ uc_perror("uc_reg_write_batch", err); return -1; } /* Add a single-stepping hook if debugging */ if (DEBUG){ if ((err = uc_hook_add(uc, &hook1, UC_HOOK_CODE, hook_step, NULL, 1, 0, 0))) { uc_perror("uc_hook_add", err); return 1; } } // don't leave 0x1000 a magic number if ((err = uc_mem_map(uc, round_start, 0x1000, UC_PROT_ALL))) { // does PROT_ALL mean 777? might want to set to XN for ROP... uc_perror("uc_mem_map", err); return -1; } if ((err = uc_mem_write(uc, startat, (void *) code, bytelength-1))) { uc_perror("uc_mem_write", err); return -1; } // why does the unicorn example suggest sizeof(CODE) -1 // where I have bytelength (sizeof(CODE))? probably because // it's implemented as a string, so it ends with a null byte if ((err = uc_emu_start(uc, startat, startat + bytelength -1, 0, TTL))){ if (DEBUG){ uc_perror("uc_emu_start", err); if (err == UC_ERR_FETCH_UNMAPPED) ret_msg(uc, err, arch); } errcode = -2; } uc_reg_read_batch(uc, sys_abi_vec, ptrs, sys_abi_len); /** for testing **/ if (DEBUG) { printf("syscall vec: {"); for (i = 0; i < sys_abi_len; i++) { if (i != 0) printf(", "); printf(WORDFMT, seedvals.words[i]); } printf("}\n"); } /******************/ memcpy(seed_res, seedvals.bytes, (sys_abi_len * sizeof(word))); uc_close(uc); return errcode; }
int main(int argc, char *argv[]) { uc_engine *uc; uc_hook trace; uc_err err; unsigned int EAX, ESP, val = 0x0c0c0c0c, stkval = STACK; EAX = 0; ESP = STACK+0x4; // Initialize emulator in X86-64bit mode err = uc_open(UC_ARCH_X86, UC_MODE_32, &uc); if(err) { printf("Failed on uc_open() with error returned: %s\n", uc_strerror(err)); return 1; } err = uc_mem_map(uc, ADDRESS, SIZE, UC_PROT_ALL); if(err != UC_ERR_OK) { printf("Failed to map memory %s\n", uc_strerror(err)); return 1; } err = uc_mem_write(uc, ADDRESS, CODE32, sizeof(CODE32) - 1); if(err != UC_ERR_OK) { printf("Failed to write to memory %s\n", uc_strerror(err)); return 1; } loop: err = uc_mem_map(uc, stkval, STACK_SIZE, UC_PROT_ALL); if(err != UC_ERR_OK) { printf("Failed to map memory %s\n", uc_strerror(err)); return 1; } err = uc_mem_write(uc, ESP, &val, sizeof(val)); if(err != UC_ERR_OK) { printf("Failed to write to memory %s\n", uc_strerror(err)); return 1; } uc_hook_add(uc, &trace, UC_HOOK_MEM_WRITE | UC_HOOK_MEM_READ, (void *)hook_mem_rw, NULL); uc_reg_write(uc, UC_X86_REG_EAX, &EAX); uc_reg_write(uc, UC_X86_REG_ESP, &ESP); err = uc_emu_start(uc, ADDRESS, ADDRESS + (sizeof(CODE32) - 1), 0, 0); if(err) { printf("Failed on uc_emu_start() with error returned %u: %s\n", err, uc_strerror(err)); uc_close(uc); return 1; } uc_reg_read(uc, UC_X86_REG_EAX, &EAX); printf(">>> EAX = %08X\n", EAX); if(stkval != STACK2) { printf("=== Beginning test two ===\n"); ESP = STACK2+0x4; EAX = 0; stkval = STACK2; goto loop; } uc_close(uc); return 0; }
static void test_basic_blocks(void **state) { uc_engine *uc = *state; uc_hook trace1; #define BASEADDR 0x1000000 uint64_t address = BASEADDR; const uint8_t code[] = { 0x33, 0xC0, // xor eax, eax 0x90, // nop 0x90, // nop 0xEB, 0x00, // jmp $+2 0x90, // nop 0x90, // nop 0x90, // nop }; static const struct bb blocks[] = { {BASEADDR, 6}, {BASEADDR+ 6, 3}, }; struct bbtest bbtest = { .blocks = blocks, .blocknum = 0, }; #undef BASEADDR // map 2MB memory for this emulation OK(uc_mem_map(uc, address, 2 * 1024 * 1024, UC_PROT_ALL)); // write machine code to be emulated to memory OK(uc_mem_write(uc, address, code, sizeof(code))); // trace all basic blocks OK(uc_hook_add(uc, &trace1, UC_HOOK_BLOCK, test_basic_blocks_hook, &bbtest, 1, 0)); OK(uc_emu_start(uc, address, address+sizeof(code), 0, 0)); } /******************************************************************************/ // callback for tracing basic blocks static void hook_block(uc_engine *uc, uint64_t address, uint32_t size, void *user_data) { //printf(">>> Tracing basic block at 0x%"PRIx64 ", block size = 0x%x\n", address, size); } // callback for tracing instruction static void hook_code(uc_engine *uc, uint64_t address, uint32_t size, void *user_data) { //int eflags; //printf(">>> Tracing instruction at 0x%"PRIx64 ", instruction size = 0x%x\n", address, size); //uc_reg_read(uc, UC_X86_REG_EFLAGS, &eflags); //printf(">>> --- EFLAGS is 0x%x\n", eflags); // Uncomment below code to stop the emulation using uc_emu_stop() // if (address == 0x1000009) // uc_emu_stop(uc); } static void test_i386(void **state) { uc_engine *uc; uc_err err; uint32_t tmp; uc_hook trace1, trace2; const uint8_t code[] = "\x41\x4a"; // INC ecx; DEC edx const uint64_t address = 0x1000000; int r_ecx = 0x1234; // ECX register int r_edx = 0x7890; // EDX register // Initialize emulator in X86-32bit mode err = uc_open(UC_ARCH_X86, UC_MODE_32, &uc); uc_assert_success(err); // map 2MB memory for this emulation err = uc_mem_map(uc, address, 2 * 1024 * 1024, UC_PROT_ALL); uc_assert_success(err); // write machine code to be emulated to memory err = uc_mem_write(uc, address, code, sizeof(code)-1); uc_assert_success(err); // initialize machine registers err = uc_reg_write(uc, UC_X86_REG_ECX, &r_ecx); uc_assert_success(err); err = uc_reg_write(uc, UC_X86_REG_EDX, &r_edx); uc_assert_success(err); // tracing all basic blocks with customized callback err = uc_hook_add(uc, &trace1, UC_HOOK_BLOCK, hook_block, NULL, 1, 0); uc_assert_success(err); // tracing all instruction by having @begin > @end err = uc_hook_add(uc, &trace2, UC_HOOK_CODE, hook_code, NULL, 1, 0); uc_assert_success(err); // emulate machine code in infinite time err = uc_emu_start(uc, address, address+sizeof(code)-1, 0, 0); uc_assert_success(err); // now print out some registers //printf(">>> Emulation done. Below is the CPU context\n"); uc_reg_read(uc, UC_X86_REG_ECX, &r_ecx); uc_reg_read(uc, UC_X86_REG_EDX, &r_edx); assert_int_equal(r_ecx, 0x1235); assert_int_equal(r_edx, 0x788F); // read from memory err = uc_mem_read(uc, address, (uint8_t *)&tmp, 4); uc_assert_success(err); //printf(">>> Read 4 bytes from [0x%"PRIX64"] = 0x%x\n", address, tmp); uc_close(uc); }
static void test_i386_inout(void **state) { uc_engine *uc; uc_err err; uc_hook trace1, trace2, trace3, trace4; int r_eax = 0x1234; // EAX register int r_ecx = 0x6789; // ECX register static const uint64_t address = 0x1000000; static const uint8_t code[] = { 0x41, // inc ecx 0xE4, 0x3F, // in al, 0x3F 0x4A, // dec edx 0xE6, 0x46, // out 0x46, al 0x43, // inc ebx }; // Initialize emulator in X86-32bit mode err = uc_open(UC_ARCH_X86, UC_MODE_32, &uc); uc_assert_success(err); // map 2MB memory for this emulation err = uc_mem_map(uc, address, 2 * 1024 * 1024, UC_PROT_ALL); uc_assert_success(err); // write machine code to be emulated to memory err = uc_mem_write(uc, address, code, sizeof(code)); uc_assert_success(err); // initialize machine registers err = uc_reg_write(uc, UC_X86_REG_EAX, &r_eax); uc_assert_success(err); err = uc_reg_write(uc, UC_X86_REG_ECX, &r_ecx); uc_assert_success(err); // tracing all basic blocks with customized callback err = uc_hook_add(uc, &trace1, UC_HOOK_BLOCK, hook_block, NULL, 1, 0); uc_assert_success(err); // tracing all instructions err = uc_hook_add(uc, &trace2, UC_HOOK_CODE, hook_code, NULL, 1, 0); uc_assert_success(err); // uc IN instruction err = uc_hook_add(uc, &trace3, UC_HOOK_INSN, hook_in, NULL, 1, 0, UC_X86_INS_IN); uc_assert_success(err); // uc OUT instruction err = uc_hook_add(uc, &trace4, UC_HOOK_INSN, hook_out, NULL, 1, 0, UC_X86_INS_OUT); uc_assert_success(err); // emulate machine code in infinite time err = uc_emu_start(uc, address, address+sizeof(code), 0, 0); uc_assert_success(err); uc_reg_read(uc, UC_X86_REG_EAX, &r_eax); uc_reg_read(uc, UC_X86_REG_ECX, &r_ecx); //printf(">>> EAX = 0x%x\n", r_eax); //printf(">>> ECX = 0x%x\n", r_ecx); // TODO: Assert on the register values here uc_assert_success(uc_close(uc)); }
int main(int argc, char **argv, char **envp) { uc_engine *uc; uc_err err; uc_hook hhc; uint32_t val; // dynamically load shared library #ifdef DYNLOAD uc_dyn_load(NULL, 0); #endif // Initialize emulator in MIPS 32bit little endian mode printf("uc_open()\n"); err = uc_open(UC_ARCH_MIPS, UC_MODE_MIPS32, &uc); if (err) { printf("Failed on uc_open() with error returned: %u\n", err); return err; } // map in a page of mem printf("uc_mem_map()\n"); err = uc_mem_map(uc, addr, 0x1000, UC_PROT_ALL); if (err) { printf("Failed on uc_mem_map() with error returned: %u\n", err); return err; } // hook all instructions by having @begin > @end printf("uc_hook_add()\n"); uc_hook_add(uc, &hhc, UC_HOOK_CODE, mips_codehook, NULL, (uint64_t)1, (uint64_t)0); if( err ) { printf("Failed on uc_hook_add(code) with error returned: %u\n", err); return err; } // write test1 code to be emulated to memory test_num = 1; printf("\nuc_mem_write(1)\n"); err = uc_mem_write(uc, addr, test_code_1, sizeof(test_code_1)); if( err ) { printf("Failed on uc_mem_write() with error returned: %u\n", err); return err; } // start executing test code 1 printf("uc_emu_start(1)\n"); uc_emu_start(uc, addr, addr+sizeof(test_code_1), 0, 0); // read the value from a0 when finished executing uc_reg_read(uc, UC_MIPS_REG_A0, &val); printf("a0 is %X\n", val); if( val != 0 ) test1_delayslot_executed = true; // write test2 code to be emulated to memory test_num = 2; printf("\nuc_mem_write(2)\n"); err = uc_mem_write(uc, addr, test_code_2, sizeof(test_code_2)); if( err ) { printf("Failed on uc_mem_write() with error returned: %u\n", err); return err; } // start executing test code 2 printf("uc_emu_start(2)\n"); uc_emu_start(uc, addr, addr+sizeof(test_code_2), 0, 0); // read the value from a0 when finished executing uc_reg_read(uc, UC_MIPS_REG_A0, &val); printf("a0 is %X\n", val); if( val != 0 ) test2_delayslot_executed = true; // free resources printf("\nuc_close()\n"); uc_close(uc); // print test results printf("\n\nTest 1 SHOULD execute the delay slot instruction:\n"); printf(" Emulator %s execute the delay slot: %s\n", test1_delayslot_executed ? "did" : "did not", test1_delayslot_executed ? "CORRECT" : "WRONG"); printf(" Emulator %s hook the delay slot: %s\n", test1_delayslot_hooked ? "did" : "did not", test1_delayslot_hooked ? "CORRECT" : "WRONG"); printf("\n\nTest 2 SHOULD NOT execute the delay slot instruction:\n"); printf(" Emulator %s execute the delay slot: %s\n", test2_delayslot_executed ? "did" : "did not", !test2_delayslot_executed ? "CORRECT" : "WRONG"); printf(" Emulator %s hook the delay slot: %s\n", test2_delayslot_hooked ? "did" : "did not", !test2_delayslot_hooked ? "CORRECT" : "WRONG"); // test 1 SHOULD execute the instruction in the delay slot if( test1_delayslot_hooked == true && test1_delayslot_executed == true ) printf("\n\nTEST 1 PASSED!\n"); else printf("\n\nTEST 1 FAILED!\n"); // test 2 SHOULD NOT execute the instruction in the delay slot if( test2_delayslot_hooked == false && test2_delayslot_executed == false ) printf("TEST 2 PASSED!\n\n"); else printf("TEST 2 FAILED!\n\n"); // dynamically free shared library #ifdef DYNLOAD uc_dyn_free(); #endif return 0; }
int main(int argc, char **argv, char **envp) { uc_engine *uc; uc_hook trace1; uc_err err; uint8_t bytes[8]; uint32_t esp; int map_stack = 0; if (argc == 2 && strcmp(argv[1], "--map-stack") == 0) { map_stack = 1; } printf("Memory mapping test\n"); // Initialize emulator in X86-32bit mode err = uc_open(UC_ARCH_X86, UC_MODE_32, &uc); if (err) { printf("Failed on uc_open() with error returned: %u\n", err); return 1; } uc_mem_map(uc, 0x100000, 0x1000, UC_PROT_ALL); uc_mem_map(uc, 0x200000, 0x2000, UC_PROT_ALL); uc_mem_map(uc, 0x300000, 0x3000, UC_PROT_ALL); uc_mem_map(uc, 0x400000, 0x4000, UC_PROT_READ); if (map_stack) { printf("Pre-mapping stack\n"); uc_mem_map(uc, STACK, STACK_SIZE, UC_PROT_READ | UC_PROT_WRITE); } else { printf("Mapping stack on first invalid memory access\n"); } esp = STACK + STACK_SIZE; uc_reg_write(uc, UC_X86_REG_ESP, &esp); // write machine code to be emulated to memory if (uc_mem_write(uc, 0x400000, PROGRAM, sizeof(PROGRAM))) { printf("Failed to write emulation code to memory, quit!\n"); return 2; } else { printf("Allowed to write to read only memory via uc_mem_write\n"); } //uc_hook_add(uc, &trace2, UC_HOOK_CODE, hook_code, NULL, 0x400000, 0x400fff); // intercept invalid memory events uc_hook_add(uc, &trace1, UC_HOOK_MEM_WRITE_UNMAPPED | UC_HOOK_MEM_WRITE_PROT, hook_mem_invalid, NULL, 1, 0); // emulate machine code in infinite time printf("BEGIN execution - 1\n"); err = uc_emu_start(uc, 0x400000, 0x400000 + sizeof(PROGRAM), 0, 10); if (err) { printf("Expected failue on uc_emu_start() with error returned %u: %s\n", err, uc_strerror(err)); } else { printf("UNEXPECTED uc_emu_start returned UC_ERR_OK\n"); } printf("END execution - 1\n"); // emulate machine code in infinite time printf("BEGIN execution - 2\n"); //update eax to point to aligned memory (same as add eax,7 above) uint32_t eax = 0x40002C; uc_reg_write(uc, UC_X86_REG_EAX, &eax); //resume execution at the mov dword [eax], 0x87654321 //to test an aligned write as well err = uc_emu_start(uc, 0x400015, 0x400000 + sizeof(PROGRAM), 0, 2); if (err) { printf("Expected failure on uc_emu_start() with error returned %u: %s\n", err, uc_strerror(err)); } else { printf("UNEXPECTED uc_emu_start returned UC_ERR_OK\n"); } printf("END execution - 2\n"); printf("Verifying content at 0x400025 is unchanged\n"); if (!uc_mem_read(uc, 0x400025, bytes, 4)) { printf(">>> Read 4 bytes from [0x%x] = 0x%x\n", (uint32_t)0x400025, *(uint32_t*) bytes); if (0x41414141 != *(uint32_t*) bytes) { printf("ERROR content in read only memory changed\n"); } else { printf("SUCCESS content in read only memory unchanged\n"); } } else { printf(">>> Failed to read 4 bytes from [0x%x]\n", (uint32_t)(esp - 4)); return 4; } printf("Verifying content at 0x40002C is unchanged\n"); if (!uc_mem_read(uc, 0x40002C, bytes, 4)) { printf(">>> Read 4 bytes from [0x%x] = 0x%x\n", (uint32_t)0x40002C, *(uint32_t*) bytes); if (0x42424242 != *(uint32_t*) bytes) { printf("ERROR content in read only memory changed\n"); } else { printf("SUCCESS content in read only memory unchanged\n"); } } else { printf(">>> Failed to read 4 bytes from [0x%x]\n", (uint32_t)(esp - 4)); return 4; } printf("Verifying content at bottom of stack is readable and correct\n"); if (!uc_mem_read(uc, esp - 4, bytes, 4)) { printf(">>> Read 4 bytes from [0x%x] = 0x%x\n", (uint32_t)(esp - 4), *(uint32_t*) bytes); } else { printf(">>> Failed to read 4 bytes from [0x%x]\n", (uint32_t)(esp - 4)); return 4; } uc_close(uc); return 0; }
static void test_x86_64(void **state) { uc_engine *uc; uc_err err; uc_hook trace1, trace2, trace3, trace4; static const uint64_t address = 0x1000000; static const uint8_t code[] = "\x41\xBC\x3B\xB0\x28\x2A\x49\x0F\xC9\x90\x4D\x0F\xAD\xCF\x49\x87\xFD\x90\x48\x81\xD2\x8A\xCE\x77\x35\x48\xF7\xD9\x4D\x29\xF4\x49\x81\xC9\xF6\x8A\xC6\x53\x4D\x87\xED\x48\x0F\xAD\xD2\x49\xF7\xD4\x48\xF7\xE1\x4D\x19\xC5\x4D\x89\xC5\x48\xF7\xD6\x41\xB8\x4F\x8D\x6B\x59\x4D\x87\xD0\x68\x6A\x1E\x09\x3C\x59"; int64_t rax = 0x71f3029efd49d41d; int64_t rbx = 0xd87b45277f133ddb; int64_t rcx = 0xab40d1ffd8afc461; int64_t rdx = 0x919317b4a733f01; int64_t rsi = 0x4c24e753a17ea358; int64_t rdi = 0xe509a57d2571ce96; int64_t r8 = 0xea5b108cc2b9ab1f; int64_t r9 = 0x19ec097c8eb618c1; int64_t r10 = 0xec45774f00c5f682; int64_t r11 = 0xe17e9dbec8c074aa; int64_t r12 = 0x80f86a8dc0f6d457; int64_t r13 = 0x48288ca5671c5492; int64_t r14 = 0x595f72f6e4017f6e; int64_t r15 = 0x1efd97aea331cccc; int64_t rsp = address + 0x200000; // Initialize emulator in X86-64bit mode err = uc_open(UC_ARCH_X86, UC_MODE_64, &uc); uc_assert_success(err); // map 2MB memory for this emulation err = uc_mem_map(uc, address, 2 * 1024 * 1024, UC_PROT_ALL); uc_assert_success(err); // write machine code to be emulated to memory err = uc_mem_write(uc, address, code, sizeof(code) - 1); uc_assert_success(err); // initialize machine registers uc_assert_success(uc_reg_write(uc, UC_X86_REG_RSP, &rsp)); uc_assert_success(uc_reg_write(uc, UC_X86_REG_RAX, &rax)); uc_assert_success(uc_reg_write(uc, UC_X86_REG_RBX, &rbx)); uc_assert_success(uc_reg_write(uc, UC_X86_REG_RCX, &rcx)); uc_assert_success(uc_reg_write(uc, UC_X86_REG_RDX, &rdx)); uc_assert_success(uc_reg_write(uc, UC_X86_REG_RSI, &rsi)); uc_assert_success(uc_reg_write(uc, UC_X86_REG_RDI, &rdi)); uc_assert_success(uc_reg_write(uc, UC_X86_REG_R8, &r8)); uc_assert_success(uc_reg_write(uc, UC_X86_REG_R9, &r9)); uc_assert_success(uc_reg_write(uc, UC_X86_REG_R10, &r10)); uc_assert_success(uc_reg_write(uc, UC_X86_REG_R11, &r11)); uc_assert_success(uc_reg_write(uc, UC_X86_REG_R12, &r12)); uc_assert_success(uc_reg_write(uc, UC_X86_REG_R13, &r13)); uc_assert_success(uc_reg_write(uc, UC_X86_REG_R14, &r14)); uc_assert_success(uc_reg_write(uc, UC_X86_REG_R15, &r15)); // tracing all basic blocks with customized callback err = uc_hook_add(uc, &trace1, UC_HOOK_BLOCK, hook_block, NULL, 1, 0); uc_assert_success(err); // tracing all instructions in the range [address, address+20] err = uc_hook_add(uc, &trace2, UC_HOOK_CODE, hook_code64, NULL, address, address+20); uc_assert_success(err); // tracing all memory WRITE access (with @begin > @end) err = uc_hook_add(uc, &trace3, UC_HOOK_MEM_WRITE, hook_mem64, NULL, 1, 0); uc_assert_success(err); // tracing all memory READ access (with @begin > @end) err = uc_hook_add(uc, &trace4, UC_HOOK_MEM_READ, hook_mem64, NULL, 1, 0); uc_assert_success(err); // emulate machine code in infinite time (last param = 0), or when // finishing all the code. err = uc_emu_start(uc, address, address+sizeof(code) - 1, 0, 0); uc_assert_success(err); // Read registers uc_reg_read(uc, UC_X86_REG_RAX, &rax); uc_reg_read(uc, UC_X86_REG_RBX, &rbx); uc_reg_read(uc, UC_X86_REG_RCX, &rcx); uc_reg_read(uc, UC_X86_REG_RDX, &rdx); uc_reg_read(uc, UC_X86_REG_RSI, &rsi); uc_reg_read(uc, UC_X86_REG_RDI, &rdi); uc_reg_read(uc, UC_X86_REG_R8, &r8); uc_reg_read(uc, UC_X86_REG_R9, &r9); uc_reg_read(uc, UC_X86_REG_R10, &r10); uc_reg_read(uc, UC_X86_REG_R11, &r11); uc_reg_read(uc, UC_X86_REG_R12, &r12); uc_reg_read(uc, UC_X86_REG_R13, &r13); uc_reg_read(uc, UC_X86_REG_R14, &r14); uc_reg_read(uc, UC_X86_REG_R15, &r15); #if 0 printf(">>> RAX = 0x%" PRIx64 "\n", rax); printf(">>> RBX = 0x%" PRIx64 "\n", rbx); printf(">>> RCX = 0x%" PRIx64 "\n", rcx); printf(">>> RDX = 0x%" PRIx64 "\n", rdx); printf(">>> RSI = 0x%" PRIx64 "\n", rsi); printf(">>> RDI = 0x%" PRIx64 "\n", rdi); printf(">>> R8 = 0x%" PRIx64 "\n", r8); printf(">>> R9 = 0x%" PRIx64 "\n", r9); printf(">>> R10 = 0x%" PRIx64 "\n", r10); printf(">>> R11 = 0x%" PRIx64 "\n", r11); printf(">>> R12 = 0x%" PRIx64 "\n", r12); printf(">>> R13 = 0x%" PRIx64 "\n", r13); printf(">>> R14 = 0x%" PRIx64 "\n", r14); printf(">>> R15 = 0x%" PRIx64 "\n", r15); #endif uc_assert_success(uc_close(uc)); }
int main(int argc, char **argv, char **envp) { uc_engine *uc; uc_hook trace1, trace2; uc_err err; uint32_t addr, testval; int32_t buf1[1024], buf2[1024], readbuf[1024]; int i; //don't really care about quality of randomness srand(time(NULL)); for (i = 0; i < 1024; i++) { buf1[i] = rand(); buf2[i] = rand(); } printf("# Memory unmapping test\n"); // Initialize emulator in X86-32bit mode err = uc_open(UC_ARCH_X86, UC_MODE_32, &uc); if (err) { printf("not ok %d - Failed on uc_open() with error returned: %u\n", log_num++, err); return 1; } else { printf("ok %d - uc_open() success\n", log_num++); } uc_mem_map(uc, CODE_SECTION, CODE_SIZE, UC_PROT_READ | UC_PROT_EXEC); uc_mem_map(uc, 0x200000, 0x1000, UC_PROT_READ | UC_PROT_WRITE); uc_mem_map(uc, 0x300000, 0x1000, UC_PROT_READ | UC_PROT_WRITE); uc_mem_map(uc, 0x3ff000, 0x3000, UC_PROT_READ | UC_PROT_WRITE); // fill in sections that shouldn't get touched if (uc_mem_write(uc, 0x3ff000, buf1, sizeof(buf1))) { printf("not ok %d - Failed to write random buffer 1 to memory, quit!\n", log_num++); return 2; } else { printf("ok %d - Random buffer 1 written to memory\n", log_num++); } if (uc_mem_write(uc, 0x401000, buf2, sizeof(buf1))) { printf("not ok %d - Failed to write random buffer 2 to memory, quit!\n", log_num++); return 3; } else { printf("ok %d - Random buffer 2 written to memory\n", log_num++); } // write machine code to be emulated to memory if (uc_mem_write(uc, CODE_SECTION, PROGRAM, sizeof(PROGRAM))) { printf("not ok %d - Failed to write emulation code to memory, quit!\n", log_num++); return 4; } else { printf("ok %d - Program written to memory\n", log_num++); } if (uc_hook_add(uc, &trace2, UC_HOOK_CODE, hook_code, NULL, (uint64_t)1, (uint64_t)0) != UC_ERR_OK) { printf("not ok %d - Failed to install UC_HOOK_CODE ucr\n", log_num++); return 5; } else { printf("ok %d - UC_HOOK_CODE installed\n", log_num++); } // intercept memory write events if (uc_hook_add(uc, &trace1, UC_HOOK_MEM_WRITE, hook_mem_write, NULL, (uint64_t)1, (uint64_t)0) != UC_ERR_OK) { printf("not ok %d - Failed to install UC_HOOK_MEM_WRITE ucr\n", log_num++); return 6; } else { printf("ok %d - UC_HOOK_MEM_WRITE installed\n", log_num++); } // intercept invalid memory events if (uc_hook_add(uc, &trace1, UC_HOOK_MEM_WRITE_UNMAPPED, hook_mem_invalid, NULL) != UC_ERR_OK) { printf("not ok %d - Failed to install memory invalid handler\n", log_num++); return 7; } else { printf("ok %d - memory invalid handler installed\n", log_num++); } // emulate machine code until told to stop by hook_code printf("# BEGIN execution\n"); err = uc_emu_start(uc, CODE_SECTION, CODE_SECTION + CODE_SIZE, 0, 0); if (err != UC_ERR_OK) { printf("not ok %d - Failure on uc_emu_start() with error %u:%s\n", log_num++, err, uc_strerror(err)); return 8; } else { printf("ok %d - uc_emu_start complete\n", log_num++); } printf("# END execution\n"); //read from the remapped memory testval = 0x42424242; for (addr = 0x200000; addr <= 0x400000; addr += 0x100000) { uint32_t val; if (uc_mem_read(uc, addr, &val, sizeof(val)) != UC_ERR_OK) { printf("not ok %d - Failed uc_mem_read for address 0x%x\n", log_num++, addr); } else { printf("ok %d - Good uc_mem_read from 0x%x\n", log_num++, addr); } if (val != testval) { printf("not ok %d - Read 0x%x, expected 0x%x\n", log_num++, val, testval); } else { printf("ok %d - Correct value retrieved\n", log_num++); } testval += 0x02020202; } //make sure that random blocks didn't get nuked // fill in sections that shouldn't get touched if (uc_mem_read(uc, 0x3ff000, readbuf, sizeof(readbuf))) { printf("not ok %d - Failed to read random buffer 1 from memory\n", log_num++); } else { printf("ok %d - Random buffer 1 read from memory\n", log_num++); if (memcmp(buf1, readbuf, 4096)) { printf("not ok %d - Random buffer 1 contents are incorrect\n", log_num++); } else { printf("ok %d - Random buffer 1 contents are correct\n", log_num++); } } if (uc_mem_read(uc, 0x401000, readbuf, sizeof(readbuf))) { printf("not ok %d - Failed to read random buffer 2 from memory\n", log_num++); } else { printf("ok %d - Random buffer 2 read from memory\n", log_num++); if (memcmp(buf2, readbuf, 4096)) { printf("not ok %d - Random buffer 2 contents are incorrect\n", log_num++); } else { printf("ok %d - Random buffer 2 contents are correct\n", log_num++); } } if (uc_close(uc) == UC_ERR_OK) { printf("ok %d - uc_close complete\n", log_num++); } else { printf("not ok %d - uc_close complete\n", log_num++); } return 0; }
int main(int argc, char **argv, char **envp) { uc_engine *uc; uc_err err; uc_hook hhc; uint32_t val; // dynamically load shared library #ifdef DYNLOAD uc_dyn_load(NULL, 0); #endif // Initialize emulator in MIPS 32bit little endian mode err = uc_open(UC_ARCH_MIPS, UC_MODE_MIPS32, &uc); if (err) { printf("Failed on uc_open() with error returned: %u\n", err); return err; } // map in a page of mem err = uc_mem_map(uc, addr, 0x1000, UC_PROT_ALL); if (err) { printf("Failed on uc_mem_map() with error returned: %u\n", err); return err; } // write machine code to be emulated to memory err = uc_mem_write(uc, addr, loop_test_code, sizeof(loop_test_code)); if( err ) { printf("Failed on uc_mem_write() with error returned: %u\n", err); return err; } // hook all instructions by having @begin > @end uc_hook_add(uc, &hhc, UC_HOOK_CODE, mips_codehook, NULL, (uint64_t)1, (uint64_t)0); if( err ) { printf("Failed on uc_hook_add(code) with error returned: %u\n", err); return err; } // execute code printf("---- Executing Code ----\n"); err = uc_emu_start(uc, addr, addr + sizeof(loop_test_code), 0, 0); if (err) { printf("Failed on uc_emu_start() with error returned %u: %s\n", err, uc_strerror(err)); return err; } // done executing, print some reg values as a test printf("---- Execution Complete ----\n\n"); uc_reg_read(uc, UC_MIPS_REG_PC, &val); printf("pc is %X\n", val); uc_reg_read(uc, UC_MIPS_REG_A0, &val); printf("a0 is %X\n", val); // free resources uc_close(uc); if( test_passed_ok ) printf("\n\nTEST PASSED!\n\n"); else printf("\n\nTEST FAILED!\n\n"); // dynamically free shared library #ifdef DYNLOAD uc_dyn_free(); #endif return 0; }
static void test_m68k(void) { uc_engine *uc; uc_hook trace1, trace2; uc_err err; int d0 = 0x0000; // d0 data register int d1 = 0x0000; // d1 data register int d2 = 0x0000; // d2 data register int d3 = 0x0000; // d3 data register int d4 = 0x0000; // d4 data register int d5 = 0x0000; // d5 data register int d6 = 0x0000; // d6 data register int d7 = 0x0000; // d7 data register int a0 = 0x0000; // a0 address register int a1 = 0x0000; // a1 address register int a2 = 0x0000; // a2 address register int a3 = 0x0000; // a3 address register int a4 = 0x0000; // a4 address register int a5 = 0x0000; // a5 address register int a6 = 0x0000; // a6 address register int a7 = 0x0000; // a6 address register int pc = 0x0000; // program counter int sr = 0x0000; // status register printf("Emulate M68K code\n"); // Initialize emulator in M68K mode err = uc_open(UC_ARCH_M68K, UC_MODE_BIG_ENDIAN, &uc); if (err) { printf("Failed on uc_open() with error returned: %u (%s)\n", err, uc_strerror(err)); return; } // map 2MB memory for this emulation uc_mem_map(uc, ADDRESS, 2 * 1024 * 1024, UC_PROT_ALL); // write machine code to be emulated to memory uc_mem_write(uc, ADDRESS, M68K_CODE, sizeof(M68K_CODE) - 1); // initialize machine registers uc_reg_write(uc, UC_M68K_REG_D0, &d0); uc_reg_write(uc, UC_M68K_REG_D1, &d1); uc_reg_write(uc, UC_M68K_REG_D2, &d2); uc_reg_write(uc, UC_M68K_REG_D3, &d3); uc_reg_write(uc, UC_M68K_REG_D4, &d4); uc_reg_write(uc, UC_M68K_REG_D5, &d5); uc_reg_write(uc, UC_M68K_REG_D6, &d6); uc_reg_write(uc, UC_M68K_REG_D7, &d7); uc_reg_write(uc, UC_M68K_REG_A0, &a0); uc_reg_write(uc, UC_M68K_REG_A1, &a1); uc_reg_write(uc, UC_M68K_REG_A2, &a2); uc_reg_write(uc, UC_M68K_REG_A3, &a3); uc_reg_write(uc, UC_M68K_REG_A4, &a4); uc_reg_write(uc, UC_M68K_REG_A5, &a5); uc_reg_write(uc, UC_M68K_REG_A6, &a6); uc_reg_write(uc, UC_M68K_REG_A7, &a7); uc_reg_write(uc, UC_M68K_REG_PC, &pc); uc_reg_write(uc, UC_M68K_REG_SR, &sr); // tracing all basic blocks with customized callback uc_hook_add(uc, &trace1, UC_HOOK_BLOCK, hook_block, NULL, 1, 0); // tracing all instruction uc_hook_add(uc, &trace2, UC_HOOK_CODE, hook_code, NULL, 1, 0); // emulate machine code in infinite time (last param = 0), or when // finishing all the code. err = uc_emu_start(uc, ADDRESS, ADDRESS + sizeof(M68K_CODE)-1, 0, 0); if (err) { printf("Failed on uc_emu_start() with error returned: %u\n", err); } // now print out some registers printf(">>> Emulation done. Below is the CPU context\n"); uc_reg_read(uc, UC_M68K_REG_D0, &d0); uc_reg_read(uc, UC_M68K_REG_D1, &d1); uc_reg_read(uc, UC_M68K_REG_D2, &d2); uc_reg_read(uc, UC_M68K_REG_D3, &d3); uc_reg_read(uc, UC_M68K_REG_D4, &d4); uc_reg_read(uc, UC_M68K_REG_D5, &d5); uc_reg_read(uc, UC_M68K_REG_D6, &d6); uc_reg_read(uc, UC_M68K_REG_D7, &d7); uc_reg_read(uc, UC_M68K_REG_A0, &a0); uc_reg_read(uc, UC_M68K_REG_A1, &a1); uc_reg_read(uc, UC_M68K_REG_A2, &a2); uc_reg_read(uc, UC_M68K_REG_A3, &a3); uc_reg_read(uc, UC_M68K_REG_A4, &a4); uc_reg_read(uc, UC_M68K_REG_A5, &a5); uc_reg_read(uc, UC_M68K_REG_A6, &a6); uc_reg_read(uc, UC_M68K_REG_A7, &a7); uc_reg_read(uc, UC_M68K_REG_PC, &pc); uc_reg_read(uc, UC_M68K_REG_SR, &sr); printf(">>> A0 = 0x%x\t\t>>> D0 = 0x%x\n", a0, d0); printf(">>> A1 = 0x%x\t\t>>> D1 = 0x%x\n", a1, d1); printf(">>> A2 = 0x%x\t\t>>> D2 = 0x%x\n", a2, d2); printf(">>> A3 = 0x%x\t\t>>> D3 = 0x%x\n", a3, d3); printf(">>> A4 = 0x%x\t\t>>> D4 = 0x%x\n", a4, d4); printf(">>> A5 = 0x%x\t\t>>> D5 = 0x%x\n", a5, d5); printf(">>> A6 = 0x%x\t\t>>> D6 = 0x%x\n", a6, d6); printf(">>> A7 = 0x%x\t\t>>> D7 = 0x%x\n", a7, d7); printf(">>> PC = 0x%x\n", pc); printf(">>> SR = 0x%x\n", sr); uc_close(uc); }
UNICORN_EXPORT uc_err uc_emu_start(uc_engine* uc, uint64_t begin, uint64_t until, uint64_t timeout, size_t count) { // reset the counter uc->emu_counter = 0; uc->invalid_error = UC_ERR_OK; uc->block_full = false; uc->emulation_done = false; switch(uc->arch) { default: break; case UC_ARCH_M68K: uc_reg_write(uc, UC_M68K_REG_PC, &begin); break; case UC_ARCH_X86: switch(uc->mode) { default: break; case UC_MODE_16: uc_reg_write(uc, UC_X86_REG_IP, &begin); break; case UC_MODE_32: uc_reg_write(uc, UC_X86_REG_EIP, &begin); break; case UC_MODE_64: uc_reg_write(uc, UC_X86_REG_RIP, &begin); break; } break; case UC_ARCH_ARM: uc_reg_write(uc, UC_ARM_REG_R15, &begin); break; case UC_ARCH_ARM64: uc_reg_write(uc, UC_ARM64_REG_PC, &begin); break; case UC_ARCH_MIPS: // TODO: MIPS32/MIPS64/BIGENDIAN etc uc_reg_write(uc, UC_MIPS_REG_PC, &begin); break; case UC_ARCH_SPARC: // TODO: Sparc/Sparc64 uc_reg_write(uc, UC_SPARC_REG_PC, &begin); break; } uc->stop_request = false; uc->emu_count = count; // remove count hook if counting isn't necessary if (count <= 0 && uc->count_hook != 0) { uc_hook_del(uc, uc->count_hook); uc->count_hook = 0; } // set up count hook to count instructions. if (count > 0 && uc->count_hook == 0) { uc_err err = uc_hook_add(uc, &uc->count_hook, UC_HOOK_CODE, hook_count_cb, NULL, 1, 0); if (err != UC_ERR_OK) { return err; } } uc->addr_end = until; if (timeout) enable_emu_timer(uc, timeout * 1000); // microseconds -> nanoseconds if (uc->vm_start(uc)) { return UC_ERR_RESOURCE; } // emulation is done uc->emulation_done = true; if (timeout) { // wait for the timer to finish qemu_thread_join(&uc->timer); } return uc->invalid_error; }