Beispiel #1
0
// emulate code that jump to invalid memory
static void test_i386_jump_invalid(void)
{
    uc_engine *uc;
    uc_err err;
    uc_hook trace1, trace2;

    int r_ecx = 0x1234;     // ECX register
    int r_edx = 0x7890;     // EDX register

    printf("===================================\n");
    printf("Emulate i386 code that jumps to invalid memory\n");

    // Initialize emulator in X86-32bit mode
    err = uc_open(UC_ARCH_X86, UC_MODE_32, &uc);
    if (err) {
        printf("Failed on uc_open() with error returned: %u\n", err);
        return;
    }

    // map 2MB memory for this emulation
    uc_mem_map(uc, ADDRESS, 2 * 1024 * 1024, UC_PROT_ALL);

    // write machine code to be emulated to memory
    if (uc_mem_write(uc, ADDRESS, X86_CODE32_JMP_INVALID, sizeof(X86_CODE32_JMP_INVALID) - 1)) {
        printf("Failed to write emulation code to memory, quit!\n");
        return;
    }

    // initialize machine registers
    uc_reg_write(uc, UC_X86_REG_ECX, &r_ecx);
    uc_reg_write(uc, UC_X86_REG_EDX, &r_edx);

    // tracing all basic blocks with customized callback
    uc_hook_add(uc, &trace1, UC_HOOK_BLOCK, hook_block, NULL, 1, 0);

    // tracing all instructions by having @begin > @end
    uc_hook_add(uc, &trace2, UC_HOOK_CODE, hook_code, NULL, 1, 0);

    // emulate machine code in infinite time
    err = uc_emu_start(uc, ADDRESS, ADDRESS + sizeof(X86_CODE32_JMP_INVALID) - 1, 0, 0);
    if (err) {
        printf("Failed on uc_emu_start() with error returned %u: %s\n",
                err, uc_strerror(err));
    }

    // now print out some registers
    printf(">>> Emulation done. Below is the CPU context\n");

    uc_reg_read(uc, UC_X86_REG_ECX, &r_ecx);
    uc_reg_read(uc, UC_X86_REG_EDX, &r_edx);
    printf(">>> ECX = 0x%x\n", r_ecx);
    printf(">>> EDX = 0x%x\n", r_edx);

    uc_close(uc);
}
Beispiel #2
0
static void test_arm(void)
{
    uc_engine *uc;
    uc_err err;
    uc_hook trace1, trace2;

    int r0 = 0x1234;     // R0 register
    int r2 = 0x6789;     // R1 register
    int r3 = 0x3333;     // R2 register
    int r1;     // R1 register

    printf("Emulate ARM code\n");

    // Initialize emulator in ARM mode
    err = uc_open(UC_ARCH_ARM, UC_MODE_ARM, &uc);
    if (err) {
        printf("Failed on uc_open() with error returned: %u (%s)\n",
                err, uc_strerror(err));
        return;
    }

    // map 2MB memory for this emulation
    uc_mem_map(uc, ADDRESS, 2 * 1024 * 1024, UC_PROT_ALL);

    // write machine code to be emulated to memory
    uc_mem_write(uc, ADDRESS, ARM_CODE, sizeof(ARM_CODE) - 1);

    // initialize machine registers
    uc_reg_write(uc, UC_ARM_REG_R0, &r0);
    uc_reg_write(uc, UC_ARM_REG_R2, &r2);
    uc_reg_write(uc, UC_ARM_REG_R3, &r3);

    // tracing all basic blocks with customized callback
    uc_hook_add(uc, &trace1, UC_HOOK_BLOCK, hook_block, NULL, 1, 0);

    // tracing one instruction at ADDRESS with customized callback
    uc_hook_add(uc, &trace2, UC_HOOK_CODE, hook_code, NULL, ADDRESS, ADDRESS);

    // emulate machine code in infinite time (last param = 0), or when
    // finishing all the code.
    err = uc_emu_start(uc, ADDRESS, ADDRESS + sizeof(ARM_CODE) -1, UC_SECOND_SCALE * TIMEOUT, 0);
    if (err) {
        printf("Failed on uc_emu_start() with error returned: %u\n", err);
    }

    // now print out some registers
    printf(">>> Emulation done. Below is the CPU context\n");

    uc_reg_read(uc, UC_ARM_REG_R0, &r0);
    uc_reg_read(uc, UC_ARM_REG_R1, &r1);
    printf(">>> R0 = 0x%x\n", r0);
    printf(">>> R1 = 0x%x\n", r1);

    uc_close(uc);
}
Beispiel #3
0
static void test_sparc(void)
{
    uc_engine *uc;
    uc_err err;
    uc_hook trace1, trace2;

    int g1 = 0x1230;     // G1 register
    int g2 = 0x6789;     // G2 register
    int g3 = 0x5555;     // G3 register

    printf("Emulate SPARC code\n");

    // Initialize emulator in Sparc mode
    err = uc_open(UC_ARCH_SPARC, UC_MODE_32, &uc);
    if (err) {
        printf("Failed on uc_open() with error returned: %u (%s)\n",
                err, uc_strerror(err));
        return;
    }

    // map 2MB memory for this emulation
    uc_mem_map(uc, ADDRESS, 2 * 1024 * 1024, UC_PROT_ALL);

    // write machine code to be emulated to memory
    uc_mem_write(uc, ADDRESS, SPARC_CODE, sizeof(SPARC_CODE) - 1);

    // initialize machine registers
    uc_reg_write(uc, UC_SPARC_REG_G1, &g1);
    uc_reg_write(uc, UC_SPARC_REG_G2, &g2);
    uc_reg_write(uc, UC_SPARC_REG_G3, &g3);

    // tracing all basic blocks with customized callback
    uc_hook_add(uc, &trace1, UC_HOOK_BLOCK, hook_block, NULL, (uint64_t)1, (uint64_t)0);

    // tracing all instructions with customized callback
    uc_hook_add(uc, &trace2, UC_HOOK_CODE, hook_code, NULL, (uint64_t)1, (uint64_t)0);

    // emulate machine code in infinite time (last param = 0), or when
    // finishing all the code.
    err = uc_emu_start(uc, ADDRESS, ADDRESS + sizeof(SPARC_CODE) - 1, 0, 0);
    if (err) {
        printf("Failed on uc_emu_start() with error returned: %u (%s)\n",
                err, uc_strerror(err));
    }

    // now print out some registers
    printf(">>> Emulation done. Below is the CPU context\n");

    uc_reg_read(uc, UC_SPARC_REG_G3, &g3);
    printf(">>> G3 = 0x%x\n", g3);

    uc_close(uc);
}
Beispiel #4
0
static void test_arm64(void)
{
    uc_engine *uc;
    uc_err err;
    uc_hook trace1, trace2;

    int64_t x11 = 0x1234;     // X11 register
    int64_t x13 = 0x6789;     // X13 register
    int64_t x15 = 0x3333;     // X15 register

    printf("Emulate ARM64 code\n");

    // Initialize emulator in ARM mode
    err = uc_open(UC_ARCH_ARM64, UC_MODE_ARM, &uc);
    if (err) {
        printf("Failed on uc_open() with error returned: %u (%s)\n",
                err, uc_strerror(err));
        return;
    }

    // map 2MB memory for this emulation
    uc_mem_map(uc, ADDRESS, 2 * 1024 * 1024, UC_PROT_ALL);

    // write machine code to be emulated to memory
    uc_mem_write(uc, ADDRESS, ARM_CODE, sizeof(ARM_CODE) - 1);

    // initialize machine registers
    uc_reg_write(uc, UC_ARM64_REG_X11, &x11);
    uc_reg_write(uc, UC_ARM64_REG_X13, &x13);
    uc_reg_write(uc, UC_ARM64_REG_X15, &x15);

    // tracing all basic blocks with customized callback
    uc_hook_add(uc, &trace1, UC_HOOK_BLOCK, hook_block, NULL, (uint64_t)1, (uint64_t)0);

    // tracing one instruction at ADDRESS with customized callback
    uc_hook_add(uc, &trace2, UC_HOOK_CODE, hook_code, NULL, (uint64_t)ADDRESS, (uint64_t)ADDRESS);

    // emulate machine code in infinite time (last param = 0), or when
    // finishing all the code.
    err = uc_emu_start(uc, ADDRESS, ADDRESS + sizeof(ARM_CODE) -1, 0, 0);
    if (err) {
        printf("Failed on uc_emu_start() with error returned: %u\n", err);
    }

    // now print out some registers
    printf(">>> Emulation done. Below is the CPU context\n");

    uc_reg_read(uc, UC_ARM64_REG_X11, &x11);
    printf(">>> X11 = 0x%" PRIx64 "\n", x11);

    uc_close(uc);
}
Beispiel #5
0
static void test_basic_blocks(void **state)
{
    uc_engine *uc = *state;
    uc_hook trace1, trace2;

#define BASEADDR    0x1000000

    uint64_t address = BASEADDR;
    const uint8_t code[] = {
        0x33, 0xC0,     // xor  eax, eax
        0x90,           // nop
        0x90,           // nop
        0xEB, 0x00,     // jmp  $+2
        0x90,           // nop
        0x90,           // nop
        0x90,           // nop
    };

    static const struct bb blocks[] = {
        {BASEADDR,      6},
        {BASEADDR+ 6,   3},
    };

    struct bbtest bbtest = {
        .blocks = blocks,
        .blocknum = 0,
    };


#undef BASEADDR

    // map 2MB memory for this emulation
    OK(uc_mem_map(uc, address, 2 * 1024 * 1024, UC_PROT_ALL));

    // write machine code to be emulated to memory
    OK(uc_mem_write(uc, address, code, sizeof(code)));

    // trace all basic blocks
    OK(uc_hook_add(uc, &trace1, UC_HOOK_BLOCK, test_basic_blocks_hook, &bbtest, (uint64_t)1, (uint64_t)0));
    OK(uc_hook_add(uc, &trace2, UC_HOOK_BLOCK, test_basic_blocks_hook2, &bbtest, (uint64_t)1, (uint64_t)0));

    OK(uc_emu_start(uc, address, address+sizeof(code), 0, 0));
}

int main(void)
{
    const struct CMUnitTest tests[] = {
        cmocka_unit_test_setup_teardown(test_basic_blocks, setup32, teardown),
    };
    return cmocka_run_group_tests(tests, NULL, NULL);
}
Beispiel #6
0
static void test_thumb(void)
{
    uc_engine *uc;
    uc_err err;
    uc_hook trace1, trace2;

    int sp = 0x1234;     // R0 register

    printf("Emulate THUMB code\n");

    // Initialize emulator in ARM mode
    err = uc_open(UC_ARCH_ARM, UC_MODE_THUMB, &uc);
    if (err) {
        printf("Failed on uc_open() with error returned: %u (%s)\n",
                err, uc_strerror(err));
        return;
    }

    // map 2MB memory for this emulation
    uc_mem_map(uc, ADDRESS, 2 * 1024 * 1024, UC_PROT_ALL);

    // write machine code to be emulated to memory
    uc_mem_write(uc, ADDRESS, THUMB_CODE, sizeof(THUMB_CODE) - 1);

    // initialize machine registers
    uc_reg_write(uc, UC_ARM_REG_SP, &sp);

    // tracing all basic blocks with customized callback
    uc_hook_add(uc, &trace1, UC_HOOK_BLOCK, hook_block, NULL, 1, 0);

    // tracing one instruction at ADDRESS with customized callback
    uc_hook_add(uc, &trace2, UC_HOOK_CODE, hook_code, NULL, ADDRESS, ADDRESS);

    // emulate machine code in infinite time (last param = 0), or when
    // finishing all the code.
    // Note we start at ADDRESS | 1 to indicate THUMB mode.
    err = uc_emu_start(uc, ADDRESS | 1, ADDRESS + sizeof(THUMB_CODE) -1, 0, 0);
    if (err) {
        printf("Failed on uc_emu_start() with error returned: %u\n", err);
    }

    // now print out some registers
    printf(">>> Emulation done. Below is the CPU context\n");

    uc_reg_read(uc, UC_ARM_REG_SP, &sp);
    printf(">>> SP = 0x%x\n", sp);

    uc_close(uc);
}
Beispiel #7
0
static void test_mips_el(void)
{
    uc_engine *uc;
    uc_err err;
    uc_hook trace1, trace2;

    int r1 = 0x6789;     // R1 register

    printf("===========================\n");
    printf("Emulate MIPS code (little-endian)\n");

    // Initialize emulator in MIPS mode
    err = uc_open(UC_ARCH_MIPS, UC_MODE_MIPS32, &uc);
    if (err) {
        printf("Failed on uc_open() with error returned: %u (%s)\n",
                err, uc_strerror(err));
        return;
    }

    // map 2MB memory for this emulation
    uc_mem_map(uc, ADDRESS, 2 * 1024 * 1024, UC_PROT_ALL);

    // write machine code to be emulated to memory
    uc_mem_write(uc, ADDRESS, MIPS_CODE_EL, sizeof(MIPS_CODE_EL) - 1);

    // initialize machine registers
    uc_reg_write(uc, UC_MIPS_REG_1, &r1);

    // tracing all basic blocks with customized callback
    uc_hook_add(uc, &trace1, UC_HOOK_BLOCK, hook_block, NULL, (uint64_t)1, (uint64_t)0);

    // tracing one instruction at ADDRESS with customized callback
    uc_hook_add(uc, &trace2, UC_HOOK_CODE, hook_code, NULL, (uint64_t)ADDRESS, (uint64_t)ADDRESS);

    // emulate machine code in infinite time (last param = 0), or when
    // finishing all the code.
    err = uc_emu_start(uc, ADDRESS, ADDRESS + sizeof(MIPS_CODE_EL) - 1, 0, 0);
    if (err) {
        printf("Failed on uc_emu_start() with error returned: %u (%s)\n", err, uc_strerror(err));
    }

    // now print out some registers
    printf(">>> Emulation done. Below is the CPU context\n");

    uc_reg_read(uc, UC_MIPS_REG_1, &r1);
    printf(">>> R1 = 0x%x\n", r1);

    uc_close(uc);
}
Beispiel #8
0
int main()
{
    int size;
    uint8_t *buf;
    uc_engine *uc;
    uc_hook uh_trap;
    uc_err err = uc_open (UC_ARCH_X86, UC_MODE_64, &uc);
    if (err) {
        fprintf (stderr, "Cannot initialize unicorn\n");
        return 1;
    }
    size = UC_BUG_WRITE_SIZE;
    buf = malloc (size);
    if (!buf) {
        fprintf (stderr, "Cannot allocate\n");
        return 1;
    }
    memset (buf, 0, size);
    if (!uc_mem_map(uc, UC_BUG_WRITE_ADDR, size, UC_PROT_ALL)) {
        uc_mem_write(uc, UC_BUG_WRITE_ADDR,
                (const uint8_t*)"\xff\xff\xff\xff\xff\xff\xff\xff", 8);
    }
    uc_hook_add(uc, &uh_trap, UC_HOOK_INTR, _interrupt, NULL, 1, 0);
    uc_emu_start(uc, UC_BUG_WRITE_ADDR, UC_BUG_WRITE_ADDR+8, 0, 1);
    uc_close(uc);
    printf ("Correct: %s\n", got_sigill? "YES": "NO");
    return got_sigill? 0: 1;
}
Beispiel #9
0
int main(int argc, char **argv, char **envp)
{
    uc_engine *uc;
    uc_hook trace1, trace2;
    uc_err err;
    uint32_t eax, ebx;
    
    printf("Memory protections test\n");

    // Initialize emulator in X86-32bit mode
    err = uc_open(UC_ARCH_X86, UC_MODE_32, &uc);
    if (err) {
        printf("Failed on uc_open() with error returned: %u\n", err);
        return 1;
    }

    uc_mem_map(uc, 0x100000, 0x1000, UC_PROT_READ);
    uc_mem_map(uc, 0x300000, 0x1000, UC_PROT_READ | UC_PROT_WRITE);
    uc_mem_map(uc, 0x400000, 0x1000, UC_PROT_WRITE);
    
    // write machine code to be emulated to memory
    if (uc_mem_write(uc, 0x100000, PROGRAM, sizeof(PROGRAM))) {
        printf("Failed to write emulation code to memory, quit!\n");
        return 2;
    } else {
        printf("Allowed to write to read only memory via uc_mem_write\n");
    }

    uc_mem_write(uc, 0x300000, (const uint8_t*)"\x41\x41\x41\x41", 4);
    uc_mem_write(uc, 0x400000, (const uint8_t*)"\x42\x42\x42\x42", 4);

    //uc_hook_add(uc, &trace2, UC_HOOK_CODE, hook_code, NULL, (uint64_t)0x400000, (uint64_t)0x400fff);

    // intercept invalid memory events
    uc_hook_add(uc, &trace1, UC_MEM_READ_PROT, hook_mem_invalid, NULL);

    // emulate machine code in infinite time
    printf("BEGIN execution\n");
    err = uc_emu_start(uc, 0x100000, 0x100000 + sizeof(PROGRAM), 0, 2);
    if (err) {
        printf("Expected failure on uc_emu_start() with error returned %u: %s\n",
                err, uc_strerror(err));
    } else {
        printf("UNEXPECTED uc_emu_start returned UC_ERR_OK\n");
    }
    printf("END execution\n");

    uc_reg_read(uc, UC_X86_REG_EAX, &eax);
    printf("Final eax = 0x%x\n", eax);
    uc_reg_read(uc, UC_X86_REG_EBX, &ebx);
    printf("Final ebx = 0x%x\n", ebx);

    uc_close(uc);
    
    return 0;
}
Beispiel #10
0
static void test_i386_jump(void)
{
    uc_engine *uc;
    uc_err err;
    uc_hook trace1, trace2;

    printf("===================================\n");
    printf("Emulate i386 code with jump\n");

    // Initialize emulator in X86-32bit mode
    err = uc_open(UC_ARCH_X86, UC_MODE_32, &uc);
    if (err) {
        printf("Failed on uc_open() with error returned: %u\n", err);
        return;
    }

    // map 2MB memory for this emulation
    uc_mem_map(uc, ADDRESS, 2 * 1024 * 1024, UC_PROT_ALL);

    // write machine code to be emulated to memory
    if (uc_mem_write(uc, ADDRESS, X86_CODE32_JUMP,
          sizeof(X86_CODE32_JUMP) - 1)) {
        printf("Failed to write emulation code to memory, quit!\n");
        return;
    }

    // tracing 1 basic block with customized callback
    uc_hook_add(uc, &trace1, UC_HOOK_BLOCK, hook_block, NULL, ADDRESS, ADDRESS);

    // tracing 1 instruction at ADDRESS
    uc_hook_add(uc, &trace2, UC_HOOK_CODE, hook_code, NULL, ADDRESS, ADDRESS);

    // emulate machine code in infinite time
    err = uc_emu_start(uc, ADDRESS, ADDRESS + sizeof(X86_CODE32_JUMP) - 1, 0, 0);
    if (err) {
        printf("Failed on uc_emu_start() with error returned %u: %s\n",
                err, uc_strerror(err));
    }

    printf(">>> Emulation done. Below is the CPU context\n");

    uc_close(uc);
}
Beispiel #11
0
int main(int argc, char **argv)
{
    uc_engine *uc;
    uc_hook trace;
    uc_err err;

    uint8_t memory[MEM_SIZE];

    if (argc == 1) {
        usage(argv[0]);
        return -1;
    }

    const char *fname = argv[1];

    err = uc_open (UC_ARCH_X86, UC_MODE_16, &uc);
    if (err) {
        fprintf(stderr, "Cannot initialize unicorn\n");
        return 1;
    }

    // map 64KB in
    if (uc_mem_map (uc, 0, MEM_SIZE, UC_PROT_ALL)) {
        fprintf(stderr, "Failed to write emulation code to memory, quit!\n");
        uc_close(uc);
        return 0;
    }

    // initialize internal settings
    int21_init();

    //load executable
    size_t fsize = load_com(uc, memory, fname);

    // setup PSP
    setup_psp(0, memory, argc, argv);

    // write machine code to be emulated in, including the prefix PSP
    uc_mem_write(uc, 0, memory, DOS_ADDR + fsize);

    // handle interrupt ourself
    uc_hook_add(uc, &trace, UC_HOOK_INTR, hook_intr, NULL);

    err = uc_emu_start(uc, DOS_ADDR, DOS_ADDR + 0x10000, 0, 0);
    if (err) {
        fprintf(stderr, "Failed on uc_emu_start() with error returned %u: %s\n",
                err, uc_strerror(err));
    }

    uc_close(uc);

    return 0;
}
Beispiel #12
0
static void test_x86_64_syscall(void)
{
    uc_engine *uc;
    uc_hook trace1;
    uc_err err;

    int64_t rax = 0x100;

    printf("===================================\n");
    printf("Emulate x86_64 code with 'syscall' instruction\n");

    // Initialize emulator in X86-64bit mode
    err = uc_open(UC_ARCH_X86, UC_MODE_64, &uc);
    if (err) {
        printf("Failed on uc_open() with error returned: %u\n", err);
        return;
    }

    // map 2MB memory for this emulation
    uc_mem_map(uc, ADDRESS, 2 * 1024 * 1024, UC_PROT_ALL);

    // write machine code to be emulated to memory
    if (uc_mem_write(uc, ADDRESS, X86_CODE64_SYSCALL, sizeof(X86_CODE64_SYSCALL) - 1)) {
        printf("Failed to write emulation code to memory, quit!\n");
        return;
    }

    // hook interrupts for syscall
    uc_hook_add(uc, &trace1, UC_HOOK_INSN, hook_syscall, NULL, 1, 0, UC_X86_INS_SYSCALL);

    // initialize machine registers
    uc_reg_write(uc, UC_X86_REG_RAX, &rax);

    // emulate machine code in infinite time (last param = 0), or when
    // finishing all the code.
    err = uc_emu_start(uc, ADDRESS, ADDRESS + sizeof(X86_CODE64_SYSCALL) - 1, 0, 0);
    if (err) {
        printf("Failed on uc_emu_start() with error returned %u: %s\n",
                err, uc_strerror(err));
    }

    // now print out some registers
    printf(">>> Emulation done. Below is the CPU context\n");

    uc_reg_read(uc, UC_X86_REG_RAX, &rax);

    printf(">>> RAX = 0x%" PRIx64 "\n", rax);

    uc_close(uc);
}
Beispiel #13
0
static void test_i386_jump(void **state)
{
    uc_engine *uc;
    uc_err err;
    uc_hook trace1, trace2;

    const uint8_t code[] = "\xeb\x02\x90\x90\x90\x90\x90\x90"; // jmp 4; nop; nop; nop; nop; nop; nop
    const uint64_t address = 0x1000000;

    // Initialize emulator in X86-32bit mode
    err = uc_open(UC_ARCH_X86, UC_MODE_32, &uc);
    uc_assert_success(err);

    // map 2MB memory for this emulation
    err = uc_mem_map(uc, address, 2 * 1024 * 1024, UC_PROT_ALL);
    uc_assert_success(err);

    // write machine code to be emulated to memory
    err = uc_mem_write(uc, address, code, sizeof(code)-1);
    uc_assert_success(err);

    // tracing 1 basic block with customized callback
    err = uc_hook_add(uc, &trace1, UC_HOOK_BLOCK, hook_block, NULL, address, address);
    uc_assert_success(err);

    // tracing 1 instruction at address
    err = uc_hook_add(uc, &trace2, UC_HOOK_CODE, hook_code, NULL, address, address);
    uc_assert_success(err);

    // emulate machine code in infinite time
    err = uc_emu_start(uc, address, address+sizeof(code)-1, 0, 0);
    uc_assert_success(err);

    err = uc_close(uc);
    uc_assert_success(err);
}
int main(int argc, char **argv, char **envp) {
  uc_engine *uc;
  if (uc_open(HARDWARE_ARCHITECTURE, HARDWARE_MODE, &uc)) {
    printf("uc_open(…) failed\n");
    return 1;
  }
  uc_mem_map(uc, MEMORY_STARTING_ADDRESS, MEMORY_SIZE, MEMORY_PERMISSIONS);
  if (uc_mem_write(uc, MEMORY_STARTING_ADDRESS, BINARY_CODE, sizeof(BINARY_CODE) - 1)) {
    printf("uc_mem_write(…) failed\n");
    return 1;
  }
  uc_hook trace;
  uc_hook_add(uc, &trace, UC_HOOK_CODE, hook_code, NULL, (uint64_t)MEMORY_STARTING_ADDRESS, (uint64_t)(MEMORY_STARTING_ADDRESS + 1));
  printf("uc_emu_start(…)\n");
  uc_emu_start(uc, MEMORY_STARTING_ADDRESS, MEMORY_STARTING_ADDRESS + sizeof(BINARY_CODE) - 1, 0, 0);
  printf("done\n");
  return 0;
}
Beispiel #15
0
static void test_x86_64_syscall(void **state)
{
    uc_engine *uc;
    uc_hook trace1;
    uc_err err;

    static const uint64_t address = 0x1000000;
    static const uint8_t code[] = {
        0x0F, 0x05,     // SYSCALL
    };

    int64_t rax = 0x100;

    // Initialize emulator in X86-64bit mode
    err = uc_open(UC_ARCH_X86, UC_MODE_64, &uc);
    uc_assert_success(err);

    // map 2MB memory for this emulation
    err = uc_mem_map(uc, address, 2 * 1024 * 1024, UC_PROT_ALL);
    uc_assert_success(err);

    // write machine code to be emulated to memory
    err = uc_mem_write(uc, address, code, sizeof(code));
    uc_assert_success(err);

    // hook interrupts for syscall
    err = uc_hook_add(uc, &trace1, UC_HOOK_INSN, hook_syscall, NULL, 1, 0, UC_X86_INS_SYSCALL);
    uc_assert_success(err);

    // initialize machine registers
    err = uc_reg_write(uc, UC_X86_REG_RAX, &rax);
    uc_assert_success(err);

    // emulate machine code in infinite time (last param = 0), or when
    // finishing all the code.
    err = uc_emu_start(uc, address, address + sizeof(code), 0, 0);
    uc_assert_success(err);

    // verify register values
    uc_assert_success(uc_reg_read(uc, UC_X86_REG_RAX, &rax));
    assert_int_equal(0x200, rax);

    uc_assert_success(uc_close(uc));
}
Beispiel #16
0
//if a read is performed from a big address whith a non-zero last digit, multiple read events are triggered
static void test_high_address_reads(void **state)
{
    uc_engine *uc = *state;
    uc_hook trace2;

    uint64_t addr = 0x0010000000000001; 
    //addr = 0x0010000000000000; // uncomment to fix wrong? behaviour
    //addr = 90000000; // uncomment to fix wrong? behaviour
    //
    uc_mem_map(uc, addr-(addr%4096), 4096*2, UC_PROT_ALL);
    uc_assert_success(uc_reg_write(uc, UC_X86_REG_RAX, &addr));
    const uint64_t base_addr = 0x40000;
    uint8_t code[] = {0x48,0x8b,0x00,0x90,0x90,0x90,0x90}; // mov rax, [rax], nops
    uc_assert_success(uc_mem_map(uc, base_addr, 4096, UC_PROT_ALL));
    uc_assert_success(uc_mem_write(uc, base_addr, code, 7));
    uc_assert_success(uc_hook_add(uc, &trace2, UC_HOOK_MEM_READ, hook_mem64, NULL, (uint64_t)1, (uint64_t)0));
    uc_assert_success(uc_emu_start(uc, base_addr, base_addr + 3, 0, 0));
    if(number_of_memory_reads != 1) {
        fail_msg("wrong number of memory reads for instruction %i", number_of_memory_reads);
    }
}
Beispiel #17
0
static void test_tb_x86_64_32_imul_Gv_Ev_Ib(void **state)
{
    uc_engine *uc = *state;
    uc_hook trace1, trace2;
    void *mem;
#ifdef RIP_NEXT_TO_THE_SELFMODIFY_OPCODE
    // These values assumes just before PC = 0x60000021
    int64_t eax = 0x00000041;
    int64_t ecx = 0x5ffffff8;
    int64_t edx = 0x5ffffff8;
    int64_t ebx = 0x034a129b;
    int64_t esp = 0x6010229a;
    int64_t ebp = 0x60000002;
    int64_t esi = 0x1f350211;
    int64_t edi = 0x488ac239;
#else
    //  These values assumes PC == 0x6000000
    int64_t eax = 0x73952c43;
    int64_t ecx = 0x6010229a;
    int64_t edx = 0x2a500e50;
    int64_t ebx = 0x034a1295;
    int64_t esp = 0x6010229a;
    int64_t ebp = 0x60000000;
    int64_t esi = 0x1f350211;
    int64_t edi = 0x488ac239;
#endif

    mem = calloc(1, CODE_SPACE);
    assert_int_not_equal(0, mem);

    uc_assert_success(uc_open(UC_ARCH_X86, 
                              UC_MODE_32, 
                              &uc));
    uc_assert_success(uc_mem_map(uc, 
                                 PHY_STACK_REGION, 
                                 CODE_SPACE, 
                                 UC_PROT_ALL));
    uc_assert_success(uc_mem_write(uc,
                                   PHY_STACK_REGION,
                                   X86_CODE32_ALPHA_MIXED,
                                   sizeof(X86_CODE32_ALPHA_MIXED) - 1));
    uc_assert_success(uc_reg_write(uc, UC_X86_REG_EAX, &eax));
    uc_assert_success(uc_reg_write(uc, UC_X86_REG_ECX, &ecx));
    uc_assert_success(uc_reg_write(uc, UC_X86_REG_EDX, &edx));
    uc_assert_success(uc_reg_write(uc, UC_X86_REG_EBX, &ebx));
    uc_assert_success(uc_reg_write(uc, UC_X86_REG_ESP, &esp));
    uc_assert_success(uc_reg_write(uc, UC_X86_REG_EBP, &ebp));
    uc_assert_success(uc_reg_write(uc, UC_X86_REG_ESI, &esi));
    uc_assert_success(uc_reg_write(uc, UC_X86_REG_EDI, &edi));

    uc_assert_success(uc_hook_add(uc,
                &trace1,
                UC_HOOK_CODE,
                hook_code32,
                NULL,
                (uint64_t)1,
                (uint64_t)0));

    uc_assert_success(uc_hook_add(uc,
                &trace2,
                UC_HOOK_MEM_VALID,
                hook_mem32,
                NULL,
                (uint64_t)1,
                (uint64_t)0));

    uc_assert_success(uc_emu_start(uc,
#ifdef RIP_NEXT_TO_THE_SELFMODIFY_OPCODE
    //  Register set (before self-modifying IMUL opcode)
    //  Start at "0x00000021: xorb   %al, 0x30(%ecx)
    //  Start at "0x00000021: xor    byte ptr [ecx + 0x30], al
                       PHY_STACK_REGION+0x0021,   //  0x0024 didn't work
#else
                       PHY_STACK_REGION+0x0000,
#endif
                       PHY_STACK_REGION+sizeof(X86_CODE32_ALPHA_MIXED) - 1,
                       0, 0));

    uc_assert_success(uc_close(uc));
}
Beispiel #18
0
static void VM_exec()
{
    uc_engine *uc;
    uc_err err;
    uint32_t tmp;
    uc_hook trace1, trace2;
    unsigned int r_eax, r_ebx, r_ecx, r_edx, r_ebp, r_esp, r_esi, r_edi, r_eip, eflags;
    unsigned int tr_eax, tr_ebx, tr_ecx, tr_edx, tr_ebp, tr_esp, tr_esi, tr_edi, tr_eip, t_eflags;


    r_eax = tr_eax = 0x1DB10106;
    r_ebx = tr_ebx = 0x7EFDE000;
    r_ecx = tr_ecx = 0x7EFDE000;
    r_edx = tr_edx = 0x00001DB1;
    r_ebp = tr_ebp = 0x0018FF88;
    r_esp = tr_esp = 0x0018FF14;
    r_esi = tr_esi = 0x0;
    r_edi = tr_edi = 0x0;
    r_eip = tr_eip = 0x004939F3;
    t_eflags = eflags = 0x00000206;

    // Initialize emulator in X86-32bit mode
    err = uc_open(UC_ARCH_X86, UC_MODE_32, &uc);
    if(err)
    {
        printf("Failed on uc_open() with error returned: %s", uc_strerror(err));
        return;
    }

    err = uc_mem_map(uc, ADDRESS, (4 * 1024 * 1024), UC_PROT_ALL);
    if(err != UC_ERR_OK)
    {
        printf("Failed to map memory %s", uc_strerror(err));
        return;
    }

    // write machine code to be emulated to memory
    err = uc_mem_write(uc, ADDRESS, X86_CODE32, sizeof(X86_CODE32) - 1);
    if(err != UC_ERR_OK)
    {
        printf("Failed to write emulation code to memory, quit!: %s(len %lu)", uc_strerror(err), sizeof(X86_CODE32) - 1);
        return;
    }

    // initialize machine registers
    uc_reg_write(uc, UC_X86_REG_EAX, &r_eax);
    uc_reg_write(uc, UC_X86_REG_EBX, &r_ebx);
    uc_reg_write(uc, UC_X86_REG_ECX, &r_ecx);
    uc_reg_write(uc, UC_X86_REG_EDX, &r_edx);
    uc_reg_write(uc, UC_X86_REG_EBP, &r_ebp);
    uc_reg_write(uc, UC_X86_REG_ESP, &r_esp);
    uc_reg_write(uc, UC_X86_REG_ESI, &r_esi);
    uc_reg_write(uc, UC_X86_REG_EDI, &r_edi);
    uc_reg_write(uc, UC_X86_REG_EFLAGS, &eflags);

    uc_hook_add(uc, &trace1, UC_HOOK_MEM_READ_UNMAPPED | UC_HOOK_MEM_WRITE_UNMAPPED, (void *)hook_invalid_mem, NULL, 1, 0);

    // tracing all instruction by having @begin > @end
    uc_hook_add(uc, &trace2, UC_HOOK_CODE, (void *)hook_ins, NULL, 1, 0);

    // emulate machine code in infinite time
    err = uc_emu_start(uc, ADDRESS, ADDRESS + (sizeof(X86_CODE32) - 1), 0, 0);
    if(err)
    {
        printf("Failed on uc_emu_start() with error returned %u: %s", err, uc_strerror(err));
        instructions = 0;

        uc_close(uc);
        return;
    }

    uc_reg_read(uc, UC_X86_REG_EAX, &r_eax);
    uc_reg_read(uc, UC_X86_REG_EBX, &r_ebx);
    uc_reg_read(uc, UC_X86_REG_ECX, &r_ecx);
    uc_reg_read(uc, UC_X86_REG_EDX, &r_edx);
    uc_reg_read(uc, UC_X86_REG_EBP, &r_ebp);
    uc_reg_read(uc, UC_X86_REG_ESP, &r_esp);
    uc_reg_read(uc, UC_X86_REG_ESI, &r_esi);
    uc_reg_read(uc, UC_X86_REG_EDI, &r_edi);
    uc_reg_read(uc, UC_X86_REG_EIP, &r_eip);
    uc_reg_read(uc, UC_X86_REG_EFLAGS, &eflags);

    uc_close(uc);

    printf(">>> Emulation done. Below is the CPU context\n");
    printf(">>> EAX = 0x%08X %s\n", r_eax, (r_eax == tr_eax ? "" : "(m)"));
    printf(">>> EBX = 0x%08X %s\n", r_ebx, (r_ebx == tr_ebx ? "" : "(m)"));
    printf(">>> ECX = 0x%08X %s\n", r_ecx, (r_ecx == tr_ecx ? "" : "(m)"));
    printf(">>> EDX = 0x%08X %s\n", r_edx, (r_edx == tr_edx ? "" : "(m)"));
    printf(">>> EBP = 0x%08X %s\n", r_ebp, (r_ebp == tr_ebp ? "" : "(m)"));
    printf(">>> ESP = 0x%08X %s\n", r_esp, (r_esp == tr_esp ? "" : "(m)"));
    printf(">>> ESI = 0x%08X %s\n", r_esi, (r_esi == tr_esi ? "" : "(m)"));
    printf(">>> EDI = 0x%08X %s\n", r_edi, (r_edi == tr_edi ? "" : "(m)"));
    printf(">>> EIP = 0x%08X %s\n", (r_eip - ADDRESS) + tr_eip, (r_eip == tr_eip ? "" : "(m)\n"));
    printf(">>> EFLAGS = 0x%08X %s\n", eflags, (eflags == t_eflags ? "" : "(m)"));

    printf(">>> Instructions executed %" PRIu64 "\n", instructions);

    assert(r_eax == 0x1DB10106);
    assert(r_ebx == 0x7EFDE000);
    assert(r_ecx == 0x00000006);
    assert(r_edx == 0x00000001);
    assert(r_ebp == 0x0018FF88);
    assert(r_esp == 0x0018FF14);
    assert(r_esi == 0x00000000);
    assert(r_edi == 0x00000000);
    assert(eflags == 0x00000206); //we shouldn't fail this assert, eflags should be 0x00000206 because the last AND instruction produces a non-zero result.

    instructions = 0;
}
Beispiel #19
0
static void VM_exec()
{
    uc_engine *uc;
    uc_err err;
    uc_hook trace;
    unsigned int r_eax, eflags, r_esp, r_edi, r_ecx;

    r_eax = 0xbaadbabe;
    r_esp = ADDRESS+0x20;
    r_edi = ADDRESS+0x300; //some safe distance from main code.
    eflags = 0x00000206;
    r_ecx = ECX_OPS;

    // Initialize emulator in X86-32bit mode
    err = uc_open(UC_ARCH_X86, UC_MODE_32, &uc);
    if(err)
    {
        printf("Failed on uc_open() with error returned: %s\n", uc_strerror(err));
        return;
    }

    err = uc_mem_map(uc, ADDRESS, (2 * 1024 * 1024), UC_PROT_ALL);
    if(err != UC_ERR_OK)
    {
        printf("Failed to map memory %s\n", uc_strerror(err));
        return;
    }

    // write machine code to be emulated to memory
    err = uc_mem_write(uc, ADDRESS, X86_CODE32, sizeof(X86_CODE32) - 1);
    if(err != UC_ERR_OK)
    {
        printf("Failed to write emulation code to memory, quit!: %s(len %lu)\n", uc_strerror(err), (unsigned long)sizeof(X86_CODE32) - 1);
        return;
    }

    // initialize machine registers
    uc_reg_write(uc, UC_X86_REG_EAX, &r_eax);
    uc_reg_write(uc, UC_X86_REG_EDI, &r_edi);
    uc_reg_write(uc, UC_X86_REG_ECX, &r_ecx);
    uc_reg_write(uc, UC_X86_REG_ESP, &r_esp); //make stack pointer point to already mapped memory so we don't need to hook.
    uc_reg_write(uc, UC_X86_REG_EFLAGS, &eflags);

    uc_hook_add(uc, &trace, UC_HOOK_CODE, (void *)hook_ins, NULL, 1, 0);

    // emulate machine code in infinite time
    err = uc_emu_start(uc, ADDRESS, ADDRESS + (sizeof(X86_CODE32) - 1), 0, 0);
    if(err)
    {
        printf("Failed on uc_emu_start() with error returned %u: %s\n", err, uc_strerror(err));

        uc_close(uc);
        return;
    }

    uc_reg_read(uc, UC_X86_REG_EAX, &r_eax);
    uc_reg_read(uc, UC_X86_REG_ECX, &r_ecx);
    uc_reg_read(uc, UC_X86_REG_EDI, &r_edi);
    uc_reg_read(uc, UC_X86_REG_EFLAGS, &eflags);

    uc_close(uc);

    printf("\n>>> Emulation done. Below is the CPU context\n");
    printf(">>> EAX = 0x%08X\n", r_eax);
    printf(">>> ECX = 0x%08X\n", r_ecx);
    printf(">>> EDI = 0x%08X\n", r_edi);
    printf(">>> EFLAGS = 0x%08X\n", eflags);

    printf("\nHook called %lu times. Test %s\n", hook_called, (hook_called == ECX_OPS ? "PASSED!!" : "FAILED!!!"));

}
Beispiel #20
0
/**
 * This is the part that launches the code in the Unicorn emulator.
 **/
int em_code(u8 *code, u32 bytelength, u32 startat,
            u8 *seed_res, uc_arch arch){

  // bit of lazy coding here: update a global arch var, so that
  // we can easily read the arch from the single step hook.
  // neither elegant nor dangerous. 
  if (global_arch != arch)
    global_arch = arch;

  /* The start address must be aligned to 4KB, or uc_mem_map will
   * throw a UC_ERR_ARG error. 
   */
  u32 round_start = startat & (u32) (~0xFFF);
  u32 offset = startat - round_start;
  int errcode = 0;
  int roundlength = roundup(bytelength);
  uc_engine *uc;
  uc_err err;
  uc_hook hook1;
  int sys_abi_len;
  uc_mode mode;
  
  int ret_inst;
  int *sys_abi_vec;

  /* if (DEBUG){ */
  /*   printf("IN EMULATOR\n"); */
  /*   fdump(stdout, code, bytelength); */
  /* } */
  
  switch (arch) {
  case UC_ARCH_X86 :
    sys_abi_vec = x86_64_syscall_abi; // careful
    sys_abi_len = x86_64_syscall_abi_len;
    mode = UC_MODE_64;
    ret_inst = UC_X86_INS_RET; 
    break;
  case UC_ARCH_ARM :
    if (DEBUG) printf("Emulating ARM architecture...\n");
    sys_abi_vec = arm_32_syscall_abi;
    sys_abi_len = arm_32_syscall_abi_len;
    mode = UC_MODE_ARM;
    break;
  default :
    fprintf(stderr,"Unknown architecture requested of em_code.\nExiting.\n");
    exit(EXIT_FAILURE);
  }
    
  union seedvals {
    u32 words[sys_abi_len]; // wrinkle here: the word size should be dynamic
    u8 bytes[sys_abi_len * sizeof(word)];
  } seedvals;

  /* fprintf(stderr, "bytelength = %d\nroundlength = %d\nsizeof(seedvals.bytes) = %d\nsizeof(seed_res) = %d\nsizeof(word) * sys_abi_len = %d\n",bytelength, roundlength, sizeof(seedvals.bytes), sizeof(seed_res), (sys_abi_len * sizeof(word))); */
  
  if (!memcpy(seedvals.bytes, seed_res,
              (sys_abi_len * sizeof(word)))){
    fprintf(stderr, "Error in memcpy, in em_code.\n");
  }
  
  /**
   * from the unicorn src: "This part of the API is less... clean...
   * because Unicorn supports arbitrary register types. So the least
   * intrusive solution is passing individual pointers. On the plus
   * side, you only need to make this pointer array once."
   */
  void *ptrs[sys_abi_len];
  int i;
  for (i = 0; i < sys_abi_len; i++) {
    ptrs[i] = &(seedvals.words[i]);
  }
  
  if ((err = uc_open(arch, mode, &uc))) {
    uc_perror("uc_open", err);
    return -1;
  }

  // seed the registers
  if ((err = uc_reg_write_batch(uc, sys_abi_vec, ptrs, sys_abi_len))){
    uc_perror("uc_reg_write_batch", err);
    return -1;
  }

  /* Add a single-stepping hook if debugging */
  if (DEBUG){
    if ((err = uc_hook_add(uc, &hook1, UC_HOOK_CODE, hook_step, NULL, 1, 0, 0))) {
      uc_perror("uc_hook_add", err);
      return 1;
    }
  }

  // don't leave 0x1000 a magic number
  if ((err = uc_mem_map(uc, round_start, 0x1000, UC_PROT_ALL))) {
    // does PROT_ALL mean 777? might want to set to XN for ROP...
    uc_perror("uc_mem_map", err);
    return -1;
  }

  if ((err = uc_mem_write(uc, startat, (void *) code,
                          bytelength-1))) {
    uc_perror("uc_mem_write", err);
    return -1;
  }
  // why does the unicorn example suggest sizeof(CODE) -1
  // where I have bytelength (sizeof(CODE))? probably because
  // it's implemented as a string, so it ends with a null byte
  if ((err = uc_emu_start(uc, startat,
                          startat + bytelength -1, 0, TTL))){
    if (DEBUG){
      uc_perror("uc_emu_start", err);
      if (err == UC_ERR_FETCH_UNMAPPED)
        ret_msg(uc, err, arch);
    }
    errcode = -2;
  }
  
  uc_reg_read_batch(uc, sys_abi_vec, ptrs, sys_abi_len);

  /** for testing  **/
  if (DEBUG) {
    printf("syscall vec: {");
    for (i = 0; i < sys_abi_len; i++) {
      if (i != 0) printf(", ");
      printf(WORDFMT, seedvals.words[i]);
    }
    printf("}\n");
  }
  /******************/
  memcpy(seed_res, seedvals.bytes,
         (sys_abi_len * sizeof(word)));  
  uc_close(uc);
  return errcode;
}
Beispiel #21
0
int main(int argc, char *argv[])
{
    uc_engine *uc;
    uc_hook trace;
    uc_err err;
    unsigned int EAX, ESP, val = 0x0c0c0c0c, stkval = STACK;

    EAX = 0;
    ESP = STACK+0x4;

    // Initialize emulator in X86-64bit mode
    err = uc_open(UC_ARCH_X86, UC_MODE_32, &uc);
    if(err) {
        printf("Failed on uc_open() with error returned: %s\n", uc_strerror(err));
        return 1;
    }

    err = uc_mem_map(uc, ADDRESS, SIZE, UC_PROT_ALL);
    if(err != UC_ERR_OK) {
        printf("Failed to map memory %s\n", uc_strerror(err));
        return 1;
    }

    err = uc_mem_write(uc, ADDRESS, CODE32, sizeof(CODE32) - 1);
    if(err != UC_ERR_OK) {
        printf("Failed to write to memory %s\n", uc_strerror(err));
        return 1;
    }

loop:
    err = uc_mem_map(uc, stkval, STACK_SIZE, UC_PROT_ALL);
    if(err != UC_ERR_OK) {
        printf("Failed to map memory %s\n", uc_strerror(err));
        return 1;
    }

    err = uc_mem_write(uc, ESP, &val, sizeof(val));
    if(err != UC_ERR_OK) {
        printf("Failed to write to memory %s\n", uc_strerror(err));
        return 1;
    }


    uc_hook_add(uc, &trace, UC_HOOK_MEM_WRITE | UC_HOOK_MEM_READ, (void *)hook_mem_rw, NULL);

    uc_reg_write(uc, UC_X86_REG_EAX, &EAX);
    uc_reg_write(uc, UC_X86_REG_ESP, &ESP);

    err = uc_emu_start(uc, ADDRESS, ADDRESS + (sizeof(CODE32) - 1), 0, 0);
    if(err) {
        printf("Failed on uc_emu_start() with error returned %u: %s\n", err, uc_strerror(err));

        uc_close(uc);
        return 1;
    }

    uc_reg_read(uc, UC_X86_REG_EAX, &EAX);

    printf(">>> EAX = %08X\n", EAX);

    if(stkval != STACK2)
    {
        printf("=== Beginning test two ===\n");
        ESP = STACK2+0x4;
        EAX = 0;
        stkval = STACK2;
        goto loop;
    }

    uc_close(uc);
    return 0;
}
Beispiel #22
0
static void test_basic_blocks(void **state)
{
    uc_engine *uc = *state;
    uc_hook trace1;

#define BASEADDR    0x1000000

    uint64_t address = BASEADDR;
    const uint8_t code[] = {
        0x33, 0xC0,     // xor  eax, eax
        0x90,           // nop
        0x90,           // nop
        0xEB, 0x00,     // jmp  $+2
        0x90,           // nop
        0x90,           // nop
        0x90,           // nop
    };

    static const struct bb blocks[] = {
        {BASEADDR,      6},
        {BASEADDR+ 6,   3},
    };

    struct bbtest bbtest = {
        .blocks = blocks,
        .blocknum = 0,
    };


#undef BASEADDR

    // map 2MB memory for this emulation
    OK(uc_mem_map(uc, address, 2 * 1024 * 1024, UC_PROT_ALL));

    // write machine code to be emulated to memory
    OK(uc_mem_write(uc, address, code, sizeof(code)));

    // trace all basic blocks
    OK(uc_hook_add(uc, &trace1, UC_HOOK_BLOCK, test_basic_blocks_hook, &bbtest, 1, 0));

    OK(uc_emu_start(uc, address, address+sizeof(code), 0, 0));
}

/******************************************************************************/

// callback for tracing basic blocks
static void hook_block(uc_engine *uc, uint64_t address, uint32_t size, void *user_data)
{
    //printf(">>> Tracing basic block at 0x%"PRIx64 ", block size = 0x%x\n", address, size);
}

// callback for tracing instruction
static void hook_code(uc_engine *uc, uint64_t address, uint32_t size, void *user_data)
{
    //int eflags;
    //printf(">>> Tracing instruction at 0x%"PRIx64 ", instruction size = 0x%x\n", address, size);

    //uc_reg_read(uc, UC_X86_REG_EFLAGS, &eflags);
    //printf(">>> --- EFLAGS is 0x%x\n", eflags);

    // Uncomment below code to stop the emulation using uc_emu_stop()
    // if (address == 0x1000009)
    //    uc_emu_stop(uc);
}

static void test_i386(void **state)
{
    uc_engine *uc;
    uc_err err;
    uint32_t tmp;
    uc_hook trace1, trace2;

    const uint8_t code[] = "\x41\x4a"; // INC ecx; DEC edx
    const uint64_t address = 0x1000000;

    int r_ecx = 0x1234;     // ECX register
    int r_edx = 0x7890;     // EDX register

    // Initialize emulator in X86-32bit mode
    err = uc_open(UC_ARCH_X86, UC_MODE_32, &uc);
    uc_assert_success(err);

    // map 2MB memory for this emulation
    err = uc_mem_map(uc, address, 2 * 1024 * 1024, UC_PROT_ALL);
    uc_assert_success(err);

    // write machine code to be emulated to memory
    err = uc_mem_write(uc, address, code, sizeof(code)-1);
    uc_assert_success(err);

    // initialize machine registers
    err = uc_reg_write(uc, UC_X86_REG_ECX, &r_ecx);
    uc_assert_success(err);
    err = uc_reg_write(uc, UC_X86_REG_EDX, &r_edx);
    uc_assert_success(err);

    // tracing all basic blocks with customized callback
    err = uc_hook_add(uc, &trace1, UC_HOOK_BLOCK, hook_block, NULL, 1, 0);
    uc_assert_success(err);

    // tracing all instruction by having @begin > @end
    err = uc_hook_add(uc, &trace2, UC_HOOK_CODE, hook_code, NULL, 1, 0);
    uc_assert_success(err);

    // emulate machine code in infinite time
    err = uc_emu_start(uc, address, address+sizeof(code)-1, 0, 0);
    uc_assert_success(err);

    // now print out some registers
    //printf(">>> Emulation done. Below is the CPU context\n");

    uc_reg_read(uc, UC_X86_REG_ECX, &r_ecx);
    uc_reg_read(uc, UC_X86_REG_EDX, &r_edx);

    assert_int_equal(r_ecx, 0x1235);
    assert_int_equal(r_edx, 0x788F);

    // read from memory
    err = uc_mem_read(uc, address, (uint8_t *)&tmp, 4);
    uc_assert_success(err);
    //printf(">>> Read 4 bytes from [0x%"PRIX64"] = 0x%x\n", address, tmp);

    uc_close(uc);
}
Beispiel #23
0
static void test_i386_inout(void **state)
{
    uc_engine *uc;
    uc_err err;
    uc_hook trace1, trace2, trace3, trace4;

    int r_eax = 0x1234;     // EAX register
    int r_ecx = 0x6789;     // ECX register

    static const uint64_t address = 0x1000000;
    static const uint8_t code[] = {
        0x41,           // inc  ecx
        0xE4, 0x3F,     // in   al, 0x3F
        0x4A,           // dec  edx
        0xE6, 0x46,     // out  0x46, al
        0x43,           // inc  ebx
    };


    // Initialize emulator in X86-32bit mode
    err = uc_open(UC_ARCH_X86, UC_MODE_32, &uc);
    uc_assert_success(err);

    // map 2MB memory for this emulation
    err = uc_mem_map(uc, address, 2 * 1024 * 1024, UC_PROT_ALL);
    uc_assert_success(err);

    // write machine code to be emulated to memory
    err = uc_mem_write(uc, address, code, sizeof(code));
    uc_assert_success(err);

    // initialize machine registers
    err = uc_reg_write(uc, UC_X86_REG_EAX, &r_eax);
    uc_assert_success(err);
    err = uc_reg_write(uc, UC_X86_REG_ECX, &r_ecx);
    uc_assert_success(err);

    // tracing all basic blocks with customized callback
    err = uc_hook_add(uc, &trace1, UC_HOOK_BLOCK, hook_block, NULL, 1, 0);
    uc_assert_success(err);

    // tracing all instructions
    err = uc_hook_add(uc, &trace2, UC_HOOK_CODE, hook_code, NULL, 1, 0);
    uc_assert_success(err);

    // uc IN instruction
    err = uc_hook_add(uc, &trace3, UC_HOOK_INSN, hook_in, NULL, 1, 0, UC_X86_INS_IN);
    uc_assert_success(err);

    // uc OUT instruction
    err = uc_hook_add(uc, &trace4, UC_HOOK_INSN, hook_out, NULL, 1, 0, UC_X86_INS_OUT);
    uc_assert_success(err);

    // emulate machine code in infinite time
    err = uc_emu_start(uc, address, address+sizeof(code), 0, 0);
    uc_assert_success(err);

    uc_reg_read(uc, UC_X86_REG_EAX, &r_eax);
    uc_reg_read(uc, UC_X86_REG_ECX, &r_ecx);
    //printf(">>> EAX = 0x%x\n", r_eax);
    //printf(">>> ECX = 0x%x\n", r_ecx);
    // TODO: Assert on the register values here

    uc_assert_success(uc_close(uc));
}
int main(int argc, char **argv, char **envp)
{
    uc_engine *uc;
    uc_err err;
    uc_hook hhc;
    uint32_t val;

    // dynamically load shared library
#ifdef DYNLOAD
    uc_dyn_load(NULL, 0);
#endif

    // Initialize emulator in MIPS 32bit little endian mode
    printf("uc_open()\n");
    err = uc_open(UC_ARCH_MIPS, UC_MODE_MIPS32, &uc);
    if (err)
    {
        printf("Failed on uc_open() with error returned: %u\n", err);
        return err;
    }

    // map in a page of mem
    printf("uc_mem_map()\n");
    err = uc_mem_map(uc, addr, 0x1000, UC_PROT_ALL);
    if (err)
    {
        printf("Failed on uc_mem_map() with error returned: %u\n", err);
        return err;
    }

    // hook all instructions by having @begin > @end
    printf("uc_hook_add()\n");
    uc_hook_add(uc, &hhc, UC_HOOK_CODE, mips_codehook, NULL, (uint64_t)1, (uint64_t)0);
    if( err )
    {
        printf("Failed on uc_hook_add(code) with error returned: %u\n", err);
        return err;
    }


    // write test1 code to be emulated to memory
    test_num = 1;
    printf("\nuc_mem_write(1)\n");
    err = uc_mem_write(uc, addr, test_code_1, sizeof(test_code_1));
    if( err )
    {
        printf("Failed on uc_mem_write() with error returned: %u\n", err);
        return err;
    }
    // start executing test code 1
    printf("uc_emu_start(1)\n");
    uc_emu_start(uc, addr, addr+sizeof(test_code_1), 0, 0);
    // read the value from a0 when finished executing
    uc_reg_read(uc, UC_MIPS_REG_A0, &val);	printf("a0 is %X\n", val);
    if( val != 0 )
        test1_delayslot_executed = true;


    // write test2 code to be emulated to memory
    test_num = 2;
    printf("\nuc_mem_write(2)\n");
    err = uc_mem_write(uc, addr, test_code_2, sizeof(test_code_2));
    if( err )
    {
        printf("Failed on uc_mem_write() with error returned: %u\n", err);
        return err;
    }
    // start executing test code 2
    printf("uc_emu_start(2)\n");
    uc_emu_start(uc, addr, addr+sizeof(test_code_2), 0, 0);
    // read the value from a0 when finished executing
    uc_reg_read(uc, UC_MIPS_REG_A0, &val);	printf("a0 is %X\n", val);
    if( val != 0 )
        test2_delayslot_executed = true;


    // free resources
    printf("\nuc_close()\n");
    uc_close(uc);


    // print test results
    printf("\n\nTest 1 SHOULD execute the delay slot instruction:\n");
    printf("  Emulator %s execute the delay slot:  %s\n",
            test1_delayslot_executed ? "did" : "did not",
            test1_delayslot_executed ? "CORRECT" : "WRONG");
    printf("  Emulator %s hook the delay slot:  %s\n",
            test1_delayslot_hooked ? "did" : "did not",
            test1_delayslot_hooked ? "CORRECT" : "WRONG");

    printf("\n\nTest 2 SHOULD NOT execute the delay slot instruction:\n");
    printf("  Emulator %s execute the delay slot:  %s\n",
            test2_delayslot_executed ? "did" : "did not",
            !test2_delayslot_executed ? "CORRECT" : "WRONG");
    printf("  Emulator %s hook the delay slot:  %s\n",
            test2_delayslot_hooked ? "did" : "did not",
            !test2_delayslot_hooked ? "CORRECT" : "WRONG");


    // test 1 SHOULD execute the instruction in the delay slot
    if( test1_delayslot_hooked == true && test1_delayslot_executed == true )
        printf("\n\nTEST 1 PASSED!\n");
    else
        printf("\n\nTEST 1 FAILED!\n");

    // test 2 SHOULD NOT execute the instruction in the delay slot
    if( test2_delayslot_hooked == false && test2_delayslot_executed == false )
        printf("TEST 2 PASSED!\n\n");
    else
        printf("TEST 2 FAILED!\n\n");


    // dynamically free shared library
#ifdef DYNLOAD
    uc_dyn_free();
#endif

    return 0;
}
Beispiel #25
0
int main(int argc, char **argv, char **envp)
{
    uc_engine *uc;
    uc_hook trace1;
    uc_err err;
    uint8_t bytes[8];
    uint32_t esp;
    int map_stack = 0;

    if (argc == 2 && strcmp(argv[1], "--map-stack") == 0) {
        map_stack = 1;
    }

    printf("Memory mapping test\n");

    // Initialize emulator in X86-32bit mode
    err = uc_open(UC_ARCH_X86, UC_MODE_32, &uc);
    if (err) {
        printf("Failed on uc_open() with error returned: %u\n", err);
        return 1;
    }

    uc_mem_map(uc, 0x100000, 0x1000, UC_PROT_ALL);
    uc_mem_map(uc, 0x200000, 0x2000, UC_PROT_ALL);
    uc_mem_map(uc, 0x300000, 0x3000, UC_PROT_ALL);
    uc_mem_map(uc, 0x400000, 0x4000, UC_PROT_READ);

    if (map_stack) {
        printf("Pre-mapping stack\n");
        uc_mem_map(uc, STACK, STACK_SIZE, UC_PROT_READ | UC_PROT_WRITE);
    } else {
        printf("Mapping stack on first invalid memory access\n");
    }

    esp = STACK + STACK_SIZE;

    uc_reg_write(uc, UC_X86_REG_ESP, &esp); 

    // write machine code to be emulated to memory
    if (uc_mem_write(uc, 0x400000, PROGRAM, sizeof(PROGRAM))) {
        printf("Failed to write emulation code to memory, quit!\n");
        return 2;
    } else {
        printf("Allowed to write to read only memory via uc_mem_write\n");
    }

    //uc_hook_add(uc, &trace2, UC_HOOK_CODE, hook_code, NULL, 0x400000, 0x400fff);

    // intercept invalid memory events
    uc_hook_add(uc, &trace1, UC_HOOK_MEM_WRITE_UNMAPPED | UC_HOOK_MEM_WRITE_PROT, hook_mem_invalid, NULL, 1, 0);

    // emulate machine code in infinite time
    printf("BEGIN execution - 1\n");
    err = uc_emu_start(uc, 0x400000, 0x400000 + sizeof(PROGRAM), 0, 10);
    if (err) {
        printf("Expected failue on uc_emu_start() with error returned %u: %s\n",
                err, uc_strerror(err));
    } else {
        printf("UNEXPECTED uc_emu_start returned UC_ERR_OK\n");
    }
    printf("END execution - 1\n");

    // emulate machine code in infinite time
    printf("BEGIN execution - 2\n");
    //update eax to point to aligned memory (same as add eax,7 above)
    uint32_t eax = 0x40002C;
    uc_reg_write(uc, UC_X86_REG_EAX, &eax); 
    //resume execution at the mov dword [eax], 0x87654321
    //to test an aligned write as well
    err = uc_emu_start(uc, 0x400015, 0x400000 + sizeof(PROGRAM), 0, 2);
    if (err) {
        printf("Expected failure on uc_emu_start() with error returned %u: %s\n",
                err, uc_strerror(err));
    } else {
        printf("UNEXPECTED uc_emu_start returned UC_ERR_OK\n");
    }
    printf("END execution - 2\n");

    printf("Verifying content at 0x400025 is unchanged\n");
    if (!uc_mem_read(uc, 0x400025, bytes, 4)) {
        printf(">>> Read 4 bytes from [0x%x] = 0x%x\n", (uint32_t)0x400025, *(uint32_t*) bytes);
        if (0x41414141 != *(uint32_t*) bytes) {
            printf("ERROR content in read only memory changed\n");
        } else {
            printf("SUCCESS content in read only memory unchanged\n");
        }
    } else {
        printf(">>> Failed to read 4 bytes from [0x%x]\n", (uint32_t)(esp - 4));
        return 4;
    }

    printf("Verifying content at 0x40002C is unchanged\n");
    if (!uc_mem_read(uc, 0x40002C, bytes, 4)) {
        printf(">>> Read 4 bytes from [0x%x] = 0x%x\n", (uint32_t)0x40002C, *(uint32_t*) bytes);
        if (0x42424242 != *(uint32_t*) bytes) {
            printf("ERROR content in read only memory changed\n");
        } else {
            printf("SUCCESS content in read only memory unchanged\n");
        }
    } else {
        printf(">>> Failed to read 4 bytes from [0x%x]\n", (uint32_t)(esp - 4));
        return 4;
    }

    printf("Verifying content at bottom of stack is readable and correct\n");
    if (!uc_mem_read(uc, esp - 4, bytes, 4)) {
        printf(">>> Read 4 bytes from [0x%x] = 0x%x\n", (uint32_t)(esp - 4), *(uint32_t*) bytes);
    } else {
        printf(">>> Failed to read 4 bytes from [0x%x]\n", (uint32_t)(esp - 4));
        return 4;
    }

    uc_close(uc);

    return 0;
}
Beispiel #26
0
static void test_x86_64(void **state)
{
    uc_engine *uc;
    uc_err err;
    uc_hook trace1, trace2, trace3, trace4;

    static const uint64_t address = 0x1000000;
    static const uint8_t code[] = "\x41\xBC\x3B\xB0\x28\x2A\x49\x0F\xC9\x90\x4D\x0F\xAD\xCF\x49\x87\xFD\x90\x48\x81\xD2\x8A\xCE\x77\x35\x48\xF7\xD9\x4D\x29\xF4\x49\x81\xC9\xF6\x8A\xC6\x53\x4D\x87\xED\x48\x0F\xAD\xD2\x49\xF7\xD4\x48\xF7\xE1\x4D\x19\xC5\x4D\x89\xC5\x48\xF7\xD6\x41\xB8\x4F\x8D\x6B\x59\x4D\x87\xD0\x68\x6A\x1E\x09\x3C\x59";

    int64_t rax = 0x71f3029efd49d41d;
    int64_t rbx = 0xd87b45277f133ddb;
    int64_t rcx = 0xab40d1ffd8afc461;
    int64_t rdx = 0x919317b4a733f01;
    int64_t rsi = 0x4c24e753a17ea358;
    int64_t rdi = 0xe509a57d2571ce96;
    int64_t r8 = 0xea5b108cc2b9ab1f;
    int64_t r9 = 0x19ec097c8eb618c1;
    int64_t r10 = 0xec45774f00c5f682;
    int64_t r11 = 0xe17e9dbec8c074aa;
    int64_t r12 = 0x80f86a8dc0f6d457;
    int64_t r13 = 0x48288ca5671c5492;
    int64_t r14 = 0x595f72f6e4017f6e;
    int64_t r15 = 0x1efd97aea331cccc;

    int64_t rsp = address + 0x200000;


    // Initialize emulator in X86-64bit mode
    err = uc_open(UC_ARCH_X86, UC_MODE_64, &uc);
    uc_assert_success(err);

    // map 2MB memory for this emulation
    err = uc_mem_map(uc, address, 2 * 1024 * 1024, UC_PROT_ALL);
    uc_assert_success(err);

    // write machine code to be emulated to memory
    err = uc_mem_write(uc, address, code, sizeof(code) - 1);
    uc_assert_success(err);

    // initialize machine registers
    uc_assert_success(uc_reg_write(uc, UC_X86_REG_RSP, &rsp));

    uc_assert_success(uc_reg_write(uc, UC_X86_REG_RAX, &rax));
    uc_assert_success(uc_reg_write(uc, UC_X86_REG_RBX, &rbx));
    uc_assert_success(uc_reg_write(uc, UC_X86_REG_RCX, &rcx));
    uc_assert_success(uc_reg_write(uc, UC_X86_REG_RDX, &rdx));
    uc_assert_success(uc_reg_write(uc, UC_X86_REG_RSI, &rsi));
    uc_assert_success(uc_reg_write(uc, UC_X86_REG_RDI, &rdi));
    uc_assert_success(uc_reg_write(uc, UC_X86_REG_R8,  &r8));
    uc_assert_success(uc_reg_write(uc, UC_X86_REG_R9,  &r9));
    uc_assert_success(uc_reg_write(uc, UC_X86_REG_R10, &r10));
    uc_assert_success(uc_reg_write(uc, UC_X86_REG_R11, &r11));
    uc_assert_success(uc_reg_write(uc, UC_X86_REG_R12, &r12));
    uc_assert_success(uc_reg_write(uc, UC_X86_REG_R13, &r13));
    uc_assert_success(uc_reg_write(uc, UC_X86_REG_R14, &r14));
    uc_assert_success(uc_reg_write(uc, UC_X86_REG_R15, &r15));

    // tracing all basic blocks with customized callback
    err = uc_hook_add(uc, &trace1, UC_HOOK_BLOCK, hook_block, NULL, 1, 0);
    uc_assert_success(err);

    // tracing all instructions in the range [address, address+20]
    err = uc_hook_add(uc, &trace2, UC_HOOK_CODE, hook_code64, NULL, address, address+20);
    uc_assert_success(err);

    // tracing all memory WRITE access (with @begin > @end)
    err = uc_hook_add(uc, &trace3, UC_HOOK_MEM_WRITE, hook_mem64, NULL, 1, 0);
    uc_assert_success(err);

    // tracing all memory READ access (with @begin > @end)
    err = uc_hook_add(uc, &trace4, UC_HOOK_MEM_READ, hook_mem64, NULL, 1, 0);
    uc_assert_success(err);

    // emulate machine code in infinite time (last param = 0), or when
    // finishing all the code.
    err = uc_emu_start(uc, address, address+sizeof(code) - 1, 0, 0);
    uc_assert_success(err);

    // Read registers
    uc_reg_read(uc, UC_X86_REG_RAX, &rax);
    uc_reg_read(uc, UC_X86_REG_RBX, &rbx);
    uc_reg_read(uc, UC_X86_REG_RCX, &rcx);
    uc_reg_read(uc, UC_X86_REG_RDX, &rdx);
    uc_reg_read(uc, UC_X86_REG_RSI, &rsi);
    uc_reg_read(uc, UC_X86_REG_RDI, &rdi);
    uc_reg_read(uc, UC_X86_REG_R8,  &r8);
    uc_reg_read(uc, UC_X86_REG_R9,  &r9);
    uc_reg_read(uc, UC_X86_REG_R10, &r10);
    uc_reg_read(uc, UC_X86_REG_R11, &r11);
    uc_reg_read(uc, UC_X86_REG_R12, &r12);
    uc_reg_read(uc, UC_X86_REG_R13, &r13);
    uc_reg_read(uc, UC_X86_REG_R14, &r14);
    uc_reg_read(uc, UC_X86_REG_R15, &r15);

#if 0
    printf(">>> RAX = 0x%" PRIx64 "\n", rax);
    printf(">>> RBX = 0x%" PRIx64 "\n", rbx);
    printf(">>> RCX = 0x%" PRIx64 "\n", rcx);
    printf(">>> RDX = 0x%" PRIx64 "\n", rdx);
    printf(">>> RSI = 0x%" PRIx64 "\n", rsi);
    printf(">>> RDI = 0x%" PRIx64 "\n", rdi);
    printf(">>> R8 = 0x%" PRIx64 "\n", r8);
    printf(">>> R9 = 0x%" PRIx64 "\n", r9);
    printf(">>> R10 = 0x%" PRIx64 "\n", r10);
    printf(">>> R11 = 0x%" PRIx64 "\n", r11);
    printf(">>> R12 = 0x%" PRIx64 "\n", r12);
    printf(">>> R13 = 0x%" PRIx64 "\n", r13);
    printf(">>> R14 = 0x%" PRIx64 "\n", r14);
    printf(">>> R15 = 0x%" PRIx64 "\n", r15);
#endif

    uc_assert_success(uc_close(uc));
}
Beispiel #27
0
int main(int argc, char **argv, char **envp)
{
    uc_engine *uc;
    uc_hook trace1, trace2;
    uc_err err;
    uint32_t addr, testval;
    int32_t buf1[1024], buf2[1024], readbuf[1024];
    int i;

    //don't really care about quality of randomness
    srand(time(NULL));
    for (i = 0; i < 1024; i++) {
        buf1[i] = rand();
        buf2[i] = rand();
    }

    printf("# Memory unmapping test\n");

    // Initialize emulator in X86-32bit mode
    err = uc_open(UC_ARCH_X86, UC_MODE_32, &uc);
    if (err) {
        printf("not ok %d - Failed on uc_open() with error returned: %u\n", log_num++, err);
        return 1;
    } else {
        printf("ok %d - uc_open() success\n", log_num++);
    }

    uc_mem_map(uc, CODE_SECTION, CODE_SIZE, UC_PROT_READ | UC_PROT_EXEC);
    uc_mem_map(uc, 0x200000, 0x1000, UC_PROT_READ | UC_PROT_WRITE);
    uc_mem_map(uc, 0x300000, 0x1000, UC_PROT_READ | UC_PROT_WRITE);
    uc_mem_map(uc, 0x3ff000, 0x3000, UC_PROT_READ | UC_PROT_WRITE);

    // fill in sections that shouldn't get touched
    if (uc_mem_write(uc, 0x3ff000, buf1, sizeof(buf1))) {
        printf("not ok %d - Failed to write random buffer 1 to memory, quit!\n", log_num++);
        return 2;
    } else {
        printf("ok %d - Random buffer 1 written to memory\n", log_num++);
    }

    if (uc_mem_write(uc, 0x401000, buf2, sizeof(buf1))) {
        printf("not ok %d - Failed to write random buffer 2 to memory, quit!\n", log_num++);
        return 3;
    } else {
        printf("ok %d - Random buffer 2 written to memory\n", log_num++);
    }

    // write machine code to be emulated to memory
    if (uc_mem_write(uc, CODE_SECTION, PROGRAM, sizeof(PROGRAM))) {
        printf("not ok %d - Failed to write emulation code to memory, quit!\n", log_num++);
        return 4;
    } else {
        printf("ok %d - Program written to memory\n", log_num++);
    }

    if (uc_hook_add(uc, &trace2, UC_HOOK_CODE, hook_code, NULL, (uint64_t)1, (uint64_t)0) != UC_ERR_OK) {
        printf("not ok %d - Failed to install UC_HOOK_CODE ucr\n", log_num++);
        return 5;
    } else {
        printf("ok %d - UC_HOOK_CODE installed\n", log_num++);
    }

    // intercept memory write events
    if (uc_hook_add(uc, &trace1, UC_HOOK_MEM_WRITE, hook_mem_write, NULL, (uint64_t)1, (uint64_t)0) != UC_ERR_OK) {
        printf("not ok %d - Failed to install UC_HOOK_MEM_WRITE ucr\n", log_num++);
        return 6;
    } else {
        printf("ok %d - UC_HOOK_MEM_WRITE installed\n", log_num++);
    }

    // intercept invalid memory events
    if (uc_hook_add(uc, &trace1, UC_HOOK_MEM_WRITE_UNMAPPED, hook_mem_invalid, NULL) != UC_ERR_OK) {
        printf("not ok %d - Failed to install memory invalid handler\n", log_num++);
        return 7;
    } else {
        printf("ok %d - memory invalid handler installed\n", log_num++);
    }

    // emulate machine code until told to stop by hook_code
    printf("# BEGIN execution\n");
    err = uc_emu_start(uc, CODE_SECTION, CODE_SECTION + CODE_SIZE, 0, 0);
    if (err != UC_ERR_OK) {
        printf("not ok %d - Failure on uc_emu_start() with error %u:%s\n", log_num++, err, uc_strerror(err));
        return 8;
    } else {
        printf("ok %d - uc_emu_start complete\n", log_num++);
    }
    printf("# END execution\n");

    //read from the remapped memory
    testval = 0x42424242;
    for (addr = 0x200000; addr <= 0x400000; addr += 0x100000) {
        uint32_t val;
        if (uc_mem_read(uc, addr, &val, sizeof(val)) != UC_ERR_OK) {
            printf("not ok %d - Failed uc_mem_read for address 0x%x\n", log_num++, addr);
        } else {
            printf("ok %d - Good uc_mem_read from 0x%x\n", log_num++, addr);
        }
        if (val != testval) {
            printf("not ok %d - Read 0x%x, expected 0x%x\n", log_num++, val, testval);
        } else {
            printf("ok %d - Correct value retrieved\n", log_num++);
        }
        testval += 0x02020202;
    }

    //make sure that random blocks didn't get nuked
    // fill in sections that shouldn't get touched
    if (uc_mem_read(uc, 0x3ff000, readbuf, sizeof(readbuf))) {
        printf("not ok %d - Failed to read random buffer 1 from memory\n", log_num++);
    } else {
        printf("ok %d - Random buffer 1 read from memory\n", log_num++);
        if (memcmp(buf1, readbuf, 4096)) {
            printf("not ok %d - Random buffer 1 contents are incorrect\n", log_num++);
        } else {
            printf("ok %d - Random buffer 1 contents are correct\n", log_num++);
        }
    }

    if (uc_mem_read(uc, 0x401000, readbuf, sizeof(readbuf))) {
        printf("not ok %d - Failed to read random buffer 2 from memory\n", log_num++);
    } else {
        printf("ok %d - Random buffer 2 read from memory\n", log_num++);
        if (memcmp(buf2, readbuf, 4096)) {
            printf("not ok %d - Random buffer 2 contents are incorrect\n", log_num++);
        } else {
            printf("ok %d - Random buffer 2 contents are correct\n", log_num++);
        }
    }

    if (uc_close(uc) == UC_ERR_OK) {
        printf("ok %d - uc_close complete\n", log_num++);
    } else {
        printf("not ok %d - uc_close complete\n", log_num++);
    }

    return 0;
}
int main(int argc, char **argv, char **envp)
{
    uc_engine *uc;
    uc_err err;
	uc_hook hhc;
	uint32_t val;

	// dynamically load shared library
#ifdef DYNLOAD
	uc_dyn_load(NULL, 0);
#endif

	// Initialize emulator in MIPS 32bit little endian mode
    err = uc_open(UC_ARCH_MIPS, UC_MODE_MIPS32, &uc);
    if (err)
	{
        printf("Failed on uc_open() with error returned: %u\n", err);
        return err;
    }

	// map in a page of mem
	err = uc_mem_map(uc, addr, 0x1000, UC_PROT_ALL);
    if (err)
	{
        printf("Failed on uc_mem_map() with error returned: %u\n", err);
        return err;
    }

	// write machine code to be emulated to memory
    err = uc_mem_write(uc, addr, loop_test_code, sizeof(loop_test_code));
	if( err )
	{
        printf("Failed on uc_mem_write() with error returned: %u\n", err);
        return err;
    }
	
    // hook all instructions by having @begin > @end
    uc_hook_add(uc, &hhc, UC_HOOK_CODE, mips_codehook, NULL, (uint64_t)1, (uint64_t)0);
	if( err )
	{
        printf("Failed on uc_hook_add(code) with error returned: %u\n", err);
        return err;
    }
	
    // execute code
	printf("---- Executing Code ----\n");
	err = uc_emu_start(uc, addr, addr + sizeof(loop_test_code), 0, 0);
    if (err)
	{
        printf("Failed on uc_emu_start() with error returned %u: %s\n",
                err, uc_strerror(err));
		return err;
    }

	// done executing, print some reg values as a test
	printf("---- Execution Complete ----\n\n");
	uc_reg_read(uc, UC_MIPS_REG_PC, &val);	printf("pc is %X\n", val);
	uc_reg_read(uc, UC_MIPS_REG_A0, &val);	printf("a0 is %X\n", val);
	
	// free resources
	uc_close(uc);
	
	if( test_passed_ok )
		printf("\n\nTEST PASSED!\n\n");
	else
		printf("\n\nTEST FAILED!\n\n");

	// dynamically free shared library
#ifdef DYNLOAD
    uc_dyn_free();
#endif

	return 0;
}
Beispiel #29
0
static void test_m68k(void)
{
    uc_engine *uc;
    uc_hook trace1, trace2;
    uc_err err;

    int d0 = 0x0000;     // d0 data register
    int d1 = 0x0000;     // d1 data register
    int d2 = 0x0000;     // d2 data register
    int d3 = 0x0000;     // d3 data register
    int d4 = 0x0000;     // d4 data register
    int d5 = 0x0000;     // d5 data register
    int d6 = 0x0000;     // d6 data register
    int d7 = 0x0000;     // d7 data register

    int a0 = 0x0000;     // a0 address register
    int a1 = 0x0000;     // a1 address register
    int a2 = 0x0000;     // a2 address register
    int a3 = 0x0000;     // a3 address register
    int a4 = 0x0000;     // a4 address register
    int a5 = 0x0000;     // a5 address register
    int a6 = 0x0000;     // a6 address register
    int a7 = 0x0000;     // a6 address register

    int pc = 0x0000;     // program counter
    int sr = 0x0000;     // status register

    printf("Emulate M68K code\n");

    // Initialize emulator in M68K mode
    err = uc_open(UC_ARCH_M68K, UC_MODE_BIG_ENDIAN, &uc);
    if (err) {
        printf("Failed on uc_open() with error returned: %u (%s)\n",
                err, uc_strerror(err));
        return;
    }

    // map 2MB memory for this emulation
    uc_mem_map(uc, ADDRESS, 2 * 1024 * 1024, UC_PROT_ALL);

    // write machine code to be emulated to memory
    uc_mem_write(uc, ADDRESS, M68K_CODE, sizeof(M68K_CODE) - 1);

    // initialize machine registers
    uc_reg_write(uc, UC_M68K_REG_D0, &d0);
    uc_reg_write(uc, UC_M68K_REG_D1, &d1);
    uc_reg_write(uc, UC_M68K_REG_D2, &d2);
    uc_reg_write(uc, UC_M68K_REG_D3, &d3);
    uc_reg_write(uc, UC_M68K_REG_D4, &d4);
    uc_reg_write(uc, UC_M68K_REG_D5, &d5);
    uc_reg_write(uc, UC_M68K_REG_D6, &d6);
    uc_reg_write(uc, UC_M68K_REG_D7, &d7);

    uc_reg_write(uc, UC_M68K_REG_A0, &a0);
    uc_reg_write(uc, UC_M68K_REG_A1, &a1);
    uc_reg_write(uc, UC_M68K_REG_A2, &a2);
    uc_reg_write(uc, UC_M68K_REG_A3, &a3);
    uc_reg_write(uc, UC_M68K_REG_A4, &a4);
    uc_reg_write(uc, UC_M68K_REG_A5, &a5);
    uc_reg_write(uc, UC_M68K_REG_A6, &a6);
    uc_reg_write(uc, UC_M68K_REG_A7, &a7);

    uc_reg_write(uc, UC_M68K_REG_PC, &pc);
    uc_reg_write(uc, UC_M68K_REG_SR, &sr);

    // tracing all basic blocks with customized callback
    uc_hook_add(uc, &trace1, UC_HOOK_BLOCK, hook_block, NULL, 1, 0);

    // tracing all instruction
    uc_hook_add(uc, &trace2, UC_HOOK_CODE, hook_code, NULL, 1, 0);

    // emulate machine code in infinite time (last param = 0), or when
    // finishing all the code.
    err = uc_emu_start(uc, ADDRESS, ADDRESS + sizeof(M68K_CODE)-1, 0, 0);
    if (err) {
        printf("Failed on uc_emu_start() with error returned: %u\n", err);
    }

    // now print out some registers
    printf(">>> Emulation done. Below is the CPU context\n");

    uc_reg_read(uc, UC_M68K_REG_D0, &d0);
    uc_reg_read(uc, UC_M68K_REG_D1, &d1);
    uc_reg_read(uc, UC_M68K_REG_D2, &d2);
    uc_reg_read(uc, UC_M68K_REG_D3, &d3);
    uc_reg_read(uc, UC_M68K_REG_D4, &d4);
    uc_reg_read(uc, UC_M68K_REG_D5, &d5);
    uc_reg_read(uc, UC_M68K_REG_D6, &d6);
    uc_reg_read(uc, UC_M68K_REG_D7, &d7);

    uc_reg_read(uc, UC_M68K_REG_A0, &a0);
    uc_reg_read(uc, UC_M68K_REG_A1, &a1);
    uc_reg_read(uc, UC_M68K_REG_A2, &a2);
    uc_reg_read(uc, UC_M68K_REG_A3, &a3);
    uc_reg_read(uc, UC_M68K_REG_A4, &a4);
    uc_reg_read(uc, UC_M68K_REG_A5, &a5);
    uc_reg_read(uc, UC_M68K_REG_A6, &a6);
    uc_reg_read(uc, UC_M68K_REG_A7, &a7);

    uc_reg_read(uc, UC_M68K_REG_PC, &pc);
    uc_reg_read(uc, UC_M68K_REG_SR, &sr);

    printf(">>> A0 = 0x%x\t\t>>> D0 = 0x%x\n", a0, d0);
    printf(">>> A1 = 0x%x\t\t>>> D1 = 0x%x\n", a1, d1);
    printf(">>> A2 = 0x%x\t\t>>> D2 = 0x%x\n", a2, d2);
    printf(">>> A3 = 0x%x\t\t>>> D3 = 0x%x\n", a3, d3);
    printf(">>> A4 = 0x%x\t\t>>> D4 = 0x%x\n", a4, d4);
    printf(">>> A5 = 0x%x\t\t>>> D5 = 0x%x\n", a5, d5);
    printf(">>> A6 = 0x%x\t\t>>> D6 = 0x%x\n", a6, d6);
    printf(">>> A7 = 0x%x\t\t>>> D7 = 0x%x\n", a7, d7);
    printf(">>> PC = 0x%x\n", pc);
    printf(">>> SR = 0x%x\n", sr);

    uc_close(uc);
}
Beispiel #30
0
UNICORN_EXPORT
uc_err uc_emu_start(uc_engine* uc, uint64_t begin, uint64_t until, uint64_t timeout, size_t count)
{
    // reset the counter
    uc->emu_counter = 0;
    uc->invalid_error = UC_ERR_OK;
    uc->block_full = false;
    uc->emulation_done = false;

    switch(uc->arch) {
        default:
            break;

        case UC_ARCH_M68K:
            uc_reg_write(uc, UC_M68K_REG_PC, &begin);
            break;

        case UC_ARCH_X86:
            switch(uc->mode) {
                default:
                    break;
                case UC_MODE_16:
                    uc_reg_write(uc, UC_X86_REG_IP, &begin);
                    break;
                case UC_MODE_32:
                    uc_reg_write(uc, UC_X86_REG_EIP, &begin);
                    break;
                case UC_MODE_64:
                    uc_reg_write(uc, UC_X86_REG_RIP, &begin);
                    break;
            }
            break;

        case UC_ARCH_ARM:
            uc_reg_write(uc, UC_ARM_REG_R15, &begin);
            break;

        case UC_ARCH_ARM64:
            uc_reg_write(uc, UC_ARM64_REG_PC, &begin);
            break;

        case UC_ARCH_MIPS:
            // TODO: MIPS32/MIPS64/BIGENDIAN etc
            uc_reg_write(uc, UC_MIPS_REG_PC, &begin);
            break;

        case UC_ARCH_SPARC:
            // TODO: Sparc/Sparc64
            uc_reg_write(uc, UC_SPARC_REG_PC, &begin);
            break;
    }

    uc->stop_request = false;

    uc->emu_count = count;
    // remove count hook if counting isn't necessary
    if (count <= 0 && uc->count_hook != 0) {
        uc_hook_del(uc, uc->count_hook);
        uc->count_hook = 0;
    }
    // set up count hook to count instructions.
    if (count > 0 && uc->count_hook == 0) {
        uc_err err = uc_hook_add(uc, &uc->count_hook, UC_HOOK_CODE, hook_count_cb, NULL, 1, 0);
        if (err != UC_ERR_OK) {
            return err;
        }
    }

    uc->addr_end = until;

    if (timeout)
        enable_emu_timer(uc, timeout * 1000);   // microseconds -> nanoseconds

    if (uc->vm_start(uc)) {
        return UC_ERR_RESOURCE;
    }

    // emulation is done
    uc->emulation_done = true;

    if (timeout) {
        // wait for the timer to finish
        qemu_thread_join(&uc->timer);
    }

    return uc->invalid_error;
}