// emulate code that loop forever static void test_i386_loop(void) { uc_engine *uc; uc_err err; int r_ecx = 0x1234; // ECX register int r_edx = 0x7890; // EDX register printf("===================================\n"); printf("Emulate i386 code that loop forever\n"); // Initialize emulator in X86-32bit mode err = uc_open(UC_ARCH_X86, UC_MODE_32, &uc); if (err) { printf("Failed on uc_open() with error returned: %u\n", err); return; } // map 2MB memory for this emulation uc_mem_map(uc, ADDRESS, 2 * 1024 * 1024, UC_PROT_ALL); // write machine code to be emulated to memory if (uc_mem_write(uc, ADDRESS, X86_CODE32_LOOP, sizeof(X86_CODE32_LOOP) - 1)) { printf("Failed to write emulation code to memory, quit!\n"); return; } // initialize machine registers uc_reg_write(uc, UC_X86_REG_ECX, &r_ecx); uc_reg_write(uc, UC_X86_REG_EDX, &r_edx); // emulate machine code in 2 seconds, so we can quit even // if the code loops err = uc_emu_start(uc, ADDRESS, ADDRESS + sizeof(X86_CODE32_LOOP) - 1, 2 * UC_SECOND_SCALE, 0); if (err) { printf("Failed on uc_emu_start() with error returned %u: %s\n", err, uc_strerror(err)); } // now print out some registers printf(">>> Emulation done. Below is the CPU context\n"); uc_reg_read(uc, UC_X86_REG_ECX, &r_ecx); uc_reg_read(uc, UC_X86_REG_EDX, &r_edx); printf(">>> ECX = 0x%x\n", r_ecx); printf(">>> EDX = 0x%x\n", r_edx); uc_close(uc); }
static void test_thumb(void) { uc_engine *uc; uc_err err; uc_hook trace1, trace2; int sp = 0x1234; // R0 register printf("Emulate THUMB code\n"); // Initialize emulator in ARM mode err = uc_open(UC_ARCH_ARM, UC_MODE_THUMB, &uc); if (err) { printf("Failed on uc_open() with error returned: %u (%s)\n", err, uc_strerror(err)); return; } // map 2MB memory for this emulation uc_mem_map(uc, ADDRESS, 2 * 1024 * 1024, UC_PROT_ALL); // write machine code to be emulated to memory uc_mem_write(uc, ADDRESS, THUMB_CODE, sizeof(THUMB_CODE) - 1); // initialize machine registers uc_reg_write(uc, UC_ARM_REG_SP, &sp); // tracing all basic blocks with customized callback uc_hook_add(uc, &trace1, UC_HOOK_BLOCK, hook_block, NULL, 1, 0); // tracing one instruction at ADDRESS with customized callback uc_hook_add(uc, &trace2, UC_HOOK_CODE, hook_code, NULL, ADDRESS, ADDRESS); // emulate machine code in infinite time (last param = 0), or when // finishing all the code. err = uc_emu_start(uc, ADDRESS, ADDRESS + sizeof(THUMB_CODE) -1, UC_SECOND_SCALE * TIMEOUT, 0); if (err) { printf("Failed on uc_emu_start() with error returned: %u\n", err); } // now print out some registers printf(">>> Emulation done. Below is the CPU context\n"); uc_reg_read(uc, UC_ARM_REG_SP, &sp); printf(">>> SP = 0x%x\n", sp); uc_close(uc); }
static void test_mips_eb(void) { uc_engine *uc; uc_err err; uc_hook trace1, trace2; int r1 = 0x6789; // R1 register printf("Emulate MIPS code (big-endian)\n"); // Initialize emulator in MIPS mode err = uc_open(UC_ARCH_MIPS, UC_MODE_MIPS32 + UC_MODE_BIG_ENDIAN, &uc); if (err) { printf("Failed on uc_open() with error returned: %u (%s)\n", err, uc_strerror(err)); return; } // map 2MB memory for this emulation uc_mem_map(uc, ADDRESS, 2 * 1024 * 1024, UC_PROT_ALL); // write machine code to be emulated to memory uc_mem_write(uc, ADDRESS, MIPS_CODE_EB, sizeof(MIPS_CODE_EB) - 1); // initialize machine registers uc_reg_write(uc, UC_MIPS_REG_1, &r1); // tracing all basic blocks with customized callback uc_hook_add(uc, &trace1, UC_HOOK_BLOCK, hook_block, NULL, (uint64_t)1, (uint64_t)0); // tracing one instruction at ADDRESS with customized callback uc_hook_add(uc, &trace2, UC_HOOK_CODE, hook_code, NULL, (uint64_t)ADDRESS, (uint64_t)ADDRESS); // emulate machine code in infinite time (last param = 0), or when // finishing all the code. err = uc_emu_start(uc, ADDRESS, ADDRESS + sizeof(MIPS_CODE_EB) - 1, 0, 0); if (err) { printf("Failed on uc_emu_start() with error returned: %u (%s)\n", err, uc_strerror(err)); } // now print out some registers printf(">>> Emulation done. Below is the CPU context\n"); uc_reg_read(uc, UC_MIPS_REG_1, &r1); printf(">>> R1 = 0x%x\n", r1); uc_close(uc); }
// emulate code that loop forever static void test_i386_loop(void **state) { uc_engine *uc; uc_err err; int r_ecx = 0x1234; // ECX register int r_edx = 0x7890; // EDX register static const uint64_t address = 0x1000000; static const uint8_t code[] = { 0x41, // inc ecx 0x4a, // dec edx 0xEB, 0xFE, // jmp $ }; // Initialize emulator in X86-32bit mode err = uc_open(UC_ARCH_X86, UC_MODE_32, &uc); uc_assert_success(err); // map 2MB memory for this emulation err = uc_mem_map(uc, address, 2 * 1024 * 1024, UC_PROT_ALL); uc_assert_success(err); // write machine code to be emulated to memory err = uc_mem_write(uc, address, code, sizeof(code)); uc_assert_success(err); // initialize machine registers err = uc_reg_write(uc, UC_X86_REG_ECX, &r_ecx); uc_assert_success(err); err = uc_reg_write(uc, UC_X86_REG_EDX, &r_edx); uc_assert_success(err); // emulate machine code in 2 seconds, so we can quit even // if the code loops err = uc_emu_start(uc, address, address+sizeof(code), 2*UC_SECOND_SCALE, 0); uc_assert_success(err); // verify register values uc_assert_success(uc_reg_read(uc, UC_X86_REG_ECX, &r_ecx)); uc_assert_success(uc_reg_read(uc, UC_X86_REG_EDX, &r_edx)); assert_int_equal(r_ecx, 0x1235); assert_int_equal(r_edx, 0x788F); uc_assert_success(uc_close(uc)); }
int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { uc_err err; if (initialized == 0) { if (outfile == NULL) { // we compute the output outfile = fopen("/dev/null", "w"); if (outfile == NULL) { printf("failed opening /dev/null\n"); abort(); return 0; } } initialized = 1; } // Not global as we must reset this structure // Initialize emulator in supplied mode err = uc_open(UC_ARCH_X86, UC_MODE_64, &uc); if (err != UC_ERR_OK) { printf("Failed on uc_open() with error returned: %u\n", err); abort(); } // map 4MB memory for this emulation uc_mem_map(uc, ADDRESS, 4 * 1024 * 1024, UC_PROT_ALL); // write machine code to be emulated to memory if (uc_mem_write(uc, ADDRESS, Data, Size)) { printf("Failed to write emulation code to memory, quit!\n"); abort(); } // emulate code in infinite time & 4096 instructions // avoid timeouts with infinite loops err=uc_emu_start(uc, ADDRESS, ADDRESS + Size, 0, 0x1000); if (err) { fprintf(outfile, "Failed on uc_emu_start() with error returned %u: %s\n", err, uc_strerror(err)); } uc_close(uc); return 0; }
static void test_x86_64_syscall(void **state) { uc_engine *uc; uc_hook trace1; uc_err err; static const uint64_t address = 0x1000000; static const uint8_t code[] = { 0x0F, 0x05, // SYSCALL }; int64_t rax = 0x100; // Initialize emulator in X86-64bit mode err = uc_open(UC_ARCH_X86, UC_MODE_64, &uc); uc_assert_success(err); // map 2MB memory for this emulation err = uc_mem_map(uc, address, 2 * 1024 * 1024, UC_PROT_ALL); uc_assert_success(err); // write machine code to be emulated to memory err = uc_mem_write(uc, address, code, sizeof(code)); uc_assert_success(err); // hook interrupts for syscall err = uc_hook_add(uc, &trace1, UC_HOOK_INSN, hook_syscall, NULL, 1, 0, UC_X86_INS_SYSCALL); uc_assert_success(err); // initialize machine registers err = uc_reg_write(uc, UC_X86_REG_RAX, &rax); uc_assert_success(err); // emulate machine code in infinite time (last param = 0), or when // finishing all the code. err = uc_emu_start(uc, address, address + sizeof(code), 0, 0); uc_assert_success(err); // verify register values uc_assert_success(uc_reg_read(uc, UC_X86_REG_RAX, &rax)); assert_int_equal(0x200, rax); uc_assert_success(uc_close(uc)); }
static void test_i386_jump(void) { uc_engine *uc; uc_err err; uc_hook trace1, trace2; printf("===================================\n"); printf("Emulate i386 code with jump\n"); // Initialize emulator in X86-32bit mode err = uc_open(UC_ARCH_X86, UC_MODE_32, &uc); if (err) { printf("Failed on uc_open() with error returned: %u\n", err); return; } // map 2MB memory for this emulation uc_mem_map(uc, ADDRESS, 2 * 1024 * 1024, UC_PROT_ALL); // write machine code to be emulated to memory if (uc_mem_write(uc, ADDRESS, X86_CODE32_JUMP, sizeof(X86_CODE32_JUMP) - 1)) { printf("Failed to write emulation code to memory, quit!\n"); return; } // tracing 1 basic block with customized callback uc_hook_add(uc, &trace1, UC_HOOK_BLOCK, hook_block, NULL, ADDRESS, ADDRESS); // tracing 1 instruction at ADDRESS uc_hook_add(uc, &trace2, UC_HOOK_CODE, hook_code, NULL, ADDRESS, ADDRESS); // emulate machine code in infinite time err = uc_emu_start(uc, ADDRESS, ADDRESS + sizeof(X86_CODE32_JUMP) - 1, 0, 0); if (err) { printf("Failed on uc_emu_start() with error returned %u: %s\n", err, uc_strerror(err)); } printf(">>> Emulation done. Below is the CPU context\n"); uc_close(uc); }
static void test_x86_16(void **state) { uc_engine *uc; uc_err err; uint8_t tmp; static const uint64_t address = 0; static const uint8_t code[] = { 0x00, 0x00, // add byte ptr [bx + si], al }; int32_t eax = 7; int32_t ebx = 5; int32_t esi = 6; // Initialize emulator in X86-16bit mode err = uc_open(UC_ARCH_X86, UC_MODE_16, &uc); uc_assert_success(err); // map 8KB memory for this emulation err = uc_mem_map(uc, address, 8 * 1024, UC_PROT_ALL); uc_assert_success(err); // write machine code to be emulated to memory err = uc_mem_write(uc, address, code, sizeof(code)); uc_assert_success(err); // initialize machine registers uc_assert_success(uc_reg_write(uc, UC_X86_REG_EAX, &eax)); uc_assert_success(uc_reg_write(uc, UC_X86_REG_EBX, &ebx)); uc_assert_success(uc_reg_write(uc, UC_X86_REG_ESI, &esi)); // emulate machine code in infinite time (last param = 0), or when // finishing all the code. err = uc_emu_start(uc, address, address+sizeof(code), 0, 0); uc_assert_success(err); // read from memory uc_assert_success(uc_mem_read(uc, 11, &tmp, 1)); assert_int_equal(7, tmp); uc_assert_success(uc_close(uc)); }
int main(int argc, char **argv, char **envp) { uc_engine *uc; uc_hook trace1, trace2; uc_err err; // Initialize emulator in X86-32bit mode err = uc_open(UC_ARCH_X86, UC_MODE_32, &uc); if (err) { printf("not ok - Failed on uc_open() with error returned: %u\n", err); return -1; } uc_mem_map(uc, 0x1000, 0x1000, UC_PROT_ALL); if (err) { printf("not ok - Failed on uc_mem_map() with error returned: %u\n", err); return -1; } uc_mem_map(uc, 0x4000, 0x1000, UC_PROT_ALL); if (err) { printf("not ok - Failed on uc_mem_map() with error returned: %u\n", err); return -1; } err = uc_mem_unmap(uc, 0x4000, 0x1000); if (err) { printf("not ok - Failed on uc_mem_unmap() with error returned: %u\n", err); return -1; } err = uc_mem_unmap(uc, 0x4000, 0x1000); if (!err) { printf("not ok - second unmap succeeded\n"); return -1; } printf("Tests OK\n"); uc_close(uc); return 0; }
static void test_i386_jump(void **state) { uc_engine *uc; uc_err err; uc_hook trace1, trace2; const uint8_t code[] = "\xeb\x02\x90\x90\x90\x90\x90\x90"; // jmp 4; nop; nop; nop; nop; nop; nop const uint64_t address = 0x1000000; // Initialize emulator in X86-32bit mode err = uc_open(UC_ARCH_X86, UC_MODE_32, &uc); uc_assert_success(err); // map 2MB memory for this emulation err = uc_mem_map(uc, address, 2 * 1024 * 1024, UC_PROT_ALL); uc_assert_success(err); // write machine code to be emulated to memory err = uc_mem_write(uc, address, code, sizeof(code)-1); uc_assert_success(err); // tracing 1 basic block with customized callback err = uc_hook_add(uc, &trace1, UC_HOOK_BLOCK, hook_block, NULL, address, address); uc_assert_success(err); // tracing 1 instruction at address err = uc_hook_add(uc, &trace2, UC_HOOK_CODE, hook_code, NULL, address, address); uc_assert_success(err); // emulate machine code in infinite time err = uc_emu_start(uc, address, address+sizeof(code)-1, 0, 0); uc_assert_success(err); err = uc_close(uc); uc_assert_success(err); }
int main(int argc, char **argv, char **envp) { uc_engine *uc; uc_err err; uc_hook hhc; uint32_t val; // dynamically load shared library #ifdef DYNLOAD uc_dyn_load(NULL, 0); #endif // Initialize emulator in MIPS 32bit little endian mode printf("uc_open()\n"); err = uc_open(UC_ARCH_MIPS, UC_MODE_MIPS32, &uc); if (err) { printf("Failed on uc_open() with error returned: %u\n", err); return err; } // map in a page of mem printf("uc_mem_map()\n"); err = uc_mem_map(uc, addr, 0x1000, UC_PROT_ALL); if (err) { printf("Failed on uc_mem_map() with error returned: %u\n", err); return err; } // hook all instructions by having @begin > @end printf("uc_hook_add()\n"); uc_hook_add(uc, &hhc, UC_HOOK_CODE, mips_codehook, NULL, (uint64_t)1, (uint64_t)0); if( err ) { printf("Failed on uc_hook_add(code) with error returned: %u\n", err); return err; } // write test1 code to be emulated to memory test_num = 1; printf("\nuc_mem_write(1)\n"); err = uc_mem_write(uc, addr, test_code_1, sizeof(test_code_1)); if( err ) { printf("Failed on uc_mem_write() with error returned: %u\n", err); return err; } // start executing test code 1 printf("uc_emu_start(1)\n"); uc_emu_start(uc, addr, addr+sizeof(test_code_1), 0, 0); // read the value from a0 when finished executing uc_reg_read(uc, UC_MIPS_REG_A0, &val); printf("a0 is %X\n", val); if( val != 0 ) test1_delayslot_executed = true; // write test2 code to be emulated to memory test_num = 2; printf("\nuc_mem_write(2)\n"); err = uc_mem_write(uc, addr, test_code_2, sizeof(test_code_2)); if( err ) { printf("Failed on uc_mem_write() with error returned: %u\n", err); return err; } // start executing test code 2 printf("uc_emu_start(2)\n"); uc_emu_start(uc, addr, addr+sizeof(test_code_2), 0, 0); // read the value from a0 when finished executing uc_reg_read(uc, UC_MIPS_REG_A0, &val); printf("a0 is %X\n", val); if( val != 0 ) test2_delayslot_executed = true; // free resources printf("\nuc_close()\n"); uc_close(uc); // print test results printf("\n\nTest 1 SHOULD execute the delay slot instruction:\n"); printf(" Emulator %s execute the delay slot: %s\n", test1_delayslot_executed ? "did" : "did not", test1_delayslot_executed ? "CORRECT" : "WRONG"); printf(" Emulator %s hook the delay slot: %s\n", test1_delayslot_hooked ? "did" : "did not", test1_delayslot_hooked ? "CORRECT" : "WRONG"); printf("\n\nTest 2 SHOULD NOT execute the delay slot instruction:\n"); printf(" Emulator %s execute the delay slot: %s\n", test2_delayslot_executed ? "did" : "did not", !test2_delayslot_executed ? "CORRECT" : "WRONG"); printf(" Emulator %s hook the delay slot: %s\n", test2_delayslot_hooked ? "did" : "did not", !test2_delayslot_hooked ? "CORRECT" : "WRONG"); // test 1 SHOULD execute the instruction in the delay slot if( test1_delayslot_hooked == true && test1_delayslot_executed == true ) printf("\n\nTEST 1 PASSED!\n"); else printf("\n\nTEST 1 FAILED!\n"); // test 2 SHOULD NOT execute the instruction in the delay slot if( test2_delayslot_hooked == false && test2_delayslot_executed == false ) printf("TEST 2 PASSED!\n\n"); else printf("TEST 2 FAILED!\n\n"); // dynamically free shared library #ifdef DYNLOAD uc_dyn_free(); #endif return 0; }
int main(int argc, char **argv, char **envp) { uc_engine *uc; uc_hook trace1; uc_err err; uint8_t bytes[8]; uint32_t esp; int map_stack = 0; if (argc == 2 && strcmp(argv[1], "--map-stack") == 0) { map_stack = 1; } printf("Memory mapping test\n"); // Initialize emulator in X86-32bit mode err = uc_open(UC_ARCH_X86, UC_MODE_32, &uc); if (err) { printf("Failed on uc_open() with error returned: %u\n", err); return 1; } uc_mem_map(uc, 0x100000, 0x1000, UC_PROT_ALL); uc_mem_map(uc, 0x200000, 0x2000, UC_PROT_ALL); uc_mem_map(uc, 0x300000, 0x3000, UC_PROT_ALL); uc_mem_map(uc, 0x400000, 0x4000, UC_PROT_READ); if (map_stack) { printf("Pre-mapping stack\n"); uc_mem_map(uc, STACK, STACK_SIZE, UC_PROT_READ | UC_PROT_WRITE); } else { printf("Mapping stack on first invalid memory access\n"); } esp = STACK + STACK_SIZE; uc_reg_write(uc, UC_X86_REG_ESP, &esp); // write machine code to be emulated to memory if (uc_mem_write(uc, 0x400000, PROGRAM, sizeof(PROGRAM))) { printf("Failed to write emulation code to memory, quit!\n"); return 2; } else { printf("Allowed to write to read only memory via uc_mem_write\n"); } //uc_hook_add(uc, &trace2, UC_HOOK_CODE, hook_code, NULL, 0x400000, 0x400fff); // intercept invalid memory events uc_hook_add(uc, &trace1, UC_HOOK_MEM_WRITE_UNMAPPED | UC_HOOK_MEM_WRITE_PROT, hook_mem_invalid, NULL, 1, 0); // emulate machine code in infinite time printf("BEGIN execution - 1\n"); err = uc_emu_start(uc, 0x400000, 0x400000 + sizeof(PROGRAM), 0, 10); if (err) { printf("Expected failue on uc_emu_start() with error returned %u: %s\n", err, uc_strerror(err)); } else { printf("UNEXPECTED uc_emu_start returned UC_ERR_OK\n"); } printf("END execution - 1\n"); // emulate machine code in infinite time printf("BEGIN execution - 2\n"); //update eax to point to aligned memory (same as add eax,7 above) uint32_t eax = 0x40002C; uc_reg_write(uc, UC_X86_REG_EAX, &eax); //resume execution at the mov dword [eax], 0x87654321 //to test an aligned write as well err = uc_emu_start(uc, 0x400015, 0x400000 + sizeof(PROGRAM), 0, 2); if (err) { printf("Expected failure on uc_emu_start() with error returned %u: %s\n", err, uc_strerror(err)); } else { printf("UNEXPECTED uc_emu_start returned UC_ERR_OK\n"); } printf("END execution - 2\n"); printf("Verifying content at 0x400025 is unchanged\n"); if (!uc_mem_read(uc, 0x400025, bytes, 4)) { printf(">>> Read 4 bytes from [0x%x] = 0x%x\n", (uint32_t)0x400025, *(uint32_t*) bytes); if (0x41414141 != *(uint32_t*) bytes) { printf("ERROR content in read only memory changed\n"); } else { printf("SUCCESS content in read only memory unchanged\n"); } } else { printf(">>> Failed to read 4 bytes from [0x%x]\n", (uint32_t)(esp - 4)); return 4; } printf("Verifying content at 0x40002C is unchanged\n"); if (!uc_mem_read(uc, 0x40002C, bytes, 4)) { printf(">>> Read 4 bytes from [0x%x] = 0x%x\n", (uint32_t)0x40002C, *(uint32_t*) bytes); if (0x42424242 != *(uint32_t*) bytes) { printf("ERROR content in read only memory changed\n"); } else { printf("SUCCESS content in read only memory unchanged\n"); } } else { printf(">>> Failed to read 4 bytes from [0x%x]\n", (uint32_t)(esp - 4)); return 4; } printf("Verifying content at bottom of stack is readable and correct\n"); if (!uc_mem_read(uc, esp - 4, bytes, 4)) { printf(">>> Read 4 bytes from [0x%x] = 0x%x\n", (uint32_t)(esp - 4), *(uint32_t*) bytes); } else { printf(">>> Failed to read 4 bytes from [0x%x]\n", (uint32_t)(esp - 4)); return 4; } uc_close(uc); return 0; }
int main(int argc, char **argv, char **envp) { uc_engine *uc; uc_hook trace1, trace2; uc_err err; uint32_t addr, testval; int32_t buf1[1024], buf2[1024], readbuf[1024]; int i; //don't really care about quality of randomness srand(time(NULL)); for (i = 0; i < 1024; i++) { buf1[i] = rand(); buf2[i] = rand(); } printf("# Memory unmapping test\n"); // Initialize emulator in X86-32bit mode err = uc_open(UC_ARCH_X86, UC_MODE_32, &uc); if (err) { printf("not ok %d - Failed on uc_open() with error returned: %u\n", log_num++, err); return 1; } else { printf("ok %d - uc_open() success\n", log_num++); } uc_mem_map(uc, CODE_SECTION, CODE_SIZE, UC_PROT_READ | UC_PROT_EXEC); uc_mem_map(uc, 0x200000, 0x1000, UC_PROT_READ | UC_PROT_WRITE); uc_mem_map(uc, 0x300000, 0x1000, UC_PROT_READ | UC_PROT_WRITE); uc_mem_map(uc, 0x3ff000, 0x3000, UC_PROT_READ | UC_PROT_WRITE); // fill in sections that shouldn't get touched if (uc_mem_write(uc, 0x3ff000, buf1, sizeof(buf1))) { printf("not ok %d - Failed to write random buffer 1 to memory, quit!\n", log_num++); return 2; } else { printf("ok %d - Random buffer 1 written to memory\n", log_num++); } if (uc_mem_write(uc, 0x401000, buf2, sizeof(buf1))) { printf("not ok %d - Failed to write random buffer 2 to memory, quit!\n", log_num++); return 3; } else { printf("ok %d - Random buffer 2 written to memory\n", log_num++); } // write machine code to be emulated to memory if (uc_mem_write(uc, CODE_SECTION, PROGRAM, sizeof(PROGRAM))) { printf("not ok %d - Failed to write emulation code to memory, quit!\n", log_num++); return 4; } else { printf("ok %d - Program written to memory\n", log_num++); } if (uc_hook_add(uc, &trace2, UC_HOOK_CODE, hook_code, NULL, (uint64_t)1, (uint64_t)0) != UC_ERR_OK) { printf("not ok %d - Failed to install UC_HOOK_CODE ucr\n", log_num++); return 5; } else { printf("ok %d - UC_HOOK_CODE installed\n", log_num++); } // intercept memory write events if (uc_hook_add(uc, &trace1, UC_HOOK_MEM_WRITE, hook_mem_write, NULL, (uint64_t)1, (uint64_t)0) != UC_ERR_OK) { printf("not ok %d - Failed to install UC_HOOK_MEM_WRITE ucr\n", log_num++); return 6; } else { printf("ok %d - UC_HOOK_MEM_WRITE installed\n", log_num++); } // intercept invalid memory events if (uc_hook_add(uc, &trace1, UC_HOOK_MEM_WRITE_UNMAPPED, hook_mem_invalid, NULL) != UC_ERR_OK) { printf("not ok %d - Failed to install memory invalid handler\n", log_num++); return 7; } else { printf("ok %d - memory invalid handler installed\n", log_num++); } // emulate machine code until told to stop by hook_code printf("# BEGIN execution\n"); err = uc_emu_start(uc, CODE_SECTION, CODE_SECTION + CODE_SIZE, 0, 0); if (err != UC_ERR_OK) { printf("not ok %d - Failure on uc_emu_start() with error %u:%s\n", log_num++, err, uc_strerror(err)); return 8; } else { printf("ok %d - uc_emu_start complete\n", log_num++); } printf("# END execution\n"); //read from the remapped memory testval = 0x42424242; for (addr = 0x200000; addr <= 0x400000; addr += 0x100000) { uint32_t val; if (uc_mem_read(uc, addr, &val, sizeof(val)) != UC_ERR_OK) { printf("not ok %d - Failed uc_mem_read for address 0x%x\n", log_num++, addr); } else { printf("ok %d - Good uc_mem_read from 0x%x\n", log_num++, addr); } if (val != testval) { printf("not ok %d - Read 0x%x, expected 0x%x\n", log_num++, val, testval); } else { printf("ok %d - Correct value retrieved\n", log_num++); } testval += 0x02020202; } //make sure that random blocks didn't get nuked // fill in sections that shouldn't get touched if (uc_mem_read(uc, 0x3ff000, readbuf, sizeof(readbuf))) { printf("not ok %d - Failed to read random buffer 1 from memory\n", log_num++); } else { printf("ok %d - Random buffer 1 read from memory\n", log_num++); if (memcmp(buf1, readbuf, 4096)) { printf("not ok %d - Random buffer 1 contents are incorrect\n", log_num++); } else { printf("ok %d - Random buffer 1 contents are correct\n", log_num++); } } if (uc_mem_read(uc, 0x401000, readbuf, sizeof(readbuf))) { printf("not ok %d - Failed to read random buffer 2 from memory\n", log_num++); } else { printf("ok %d - Random buffer 2 read from memory\n", log_num++); if (memcmp(buf2, readbuf, 4096)) { printf("not ok %d - Random buffer 2 contents are incorrect\n", log_num++); } else { printf("ok %d - Random buffer 2 contents are correct\n", log_num++); } } if (uc_close(uc) == UC_ERR_OK) { printf("ok %d - uc_close complete\n", log_num++); } else { printf("not ok %d - uc_close complete\n", log_num++); } return 0; }
int main(int argc, char **argv, char **envp) { uc_engine *uc; uc_err err; uc_hook hhc; uint32_t val; // dynamically load shared library #ifdef DYNLOAD uc_dyn_load(NULL, 0); #endif // Initialize emulator in MIPS 32bit little endian mode err = uc_open(UC_ARCH_MIPS, UC_MODE_MIPS32, &uc); if (err) { printf("Failed on uc_open() with error returned: %u\n", err); return err; } // map in a page of mem err = uc_mem_map(uc, addr, 0x1000, UC_PROT_ALL); if (err) { printf("Failed on uc_mem_map() with error returned: %u\n", err); return err; } // write machine code to be emulated to memory err = uc_mem_write(uc, addr, loop_test_code, sizeof(loop_test_code)); if( err ) { printf("Failed on uc_mem_write() with error returned: %u\n", err); return err; } // hook all instructions by having @begin > @end uc_hook_add(uc, &hhc, UC_HOOK_CODE, mips_codehook, NULL, (uint64_t)1, (uint64_t)0); if( err ) { printf("Failed on uc_hook_add(code) with error returned: %u\n", err); return err; } // execute code printf("---- Executing Code ----\n"); err = uc_emu_start(uc, addr, addr + sizeof(loop_test_code), 0, 0); if (err) { printf("Failed on uc_emu_start() with error returned %u: %s\n", err, uc_strerror(err)); return err; } // done executing, print some reg values as a test printf("---- Execution Complete ----\n\n"); uc_reg_read(uc, UC_MIPS_REG_PC, &val); printf("pc is %X\n", val); uc_reg_read(uc, UC_MIPS_REG_A0, &val); printf("a0 is %X\n", val); // free resources uc_close(uc); if( test_passed_ok ) printf("\n\nTEST PASSED!\n\n"); else printf("\n\nTEST FAILED!\n\n"); // dynamically free shared library #ifdef DYNLOAD uc_dyn_free(); #endif return 0; }
static void test_low_paging(void **state) { uc_engine *uc; uc_err err; int r_eax; /* The following x86 code will map emulated physical memory to virtual memory using pages and attempt to read/write from virtual memory Specifically, the virtual memory address range has been mapped by Unicorn (0x7FF000 - 0x7FFFFF) Memory area purposes: 0x1000 = page directory 0x2000 = page table (identity map first 4 MiB) 0x3000 = page table (0x007FF000 -> 0x00004000) 0x4000 = data area (0xBEEF) */ const uint8_t code[] = { /* Zero memory for page directories and page tables */ 0xBF, 0x00, 0x10, 0x00, 0x00, /* MOV EDI, 0x1000 */ 0xB9, 0x00, 0x10, 0x00, 0x00, /* MOV ECX, 0x1000 */ 0x31, 0xC0, /* XOR EAX, EAX */ 0xF3, 0xAB, /* REP STOSD */ /* Load DWORD [0x4000] with 0xDEADBEEF to retrieve later */ 0xBF, 0x00, 0x40, 0x00, 0x00, /* MOV EDI, 0x4000 */ 0xB8, 0xEF, 0xBE, 0x00, 0x00, /* MOV EAX, 0xBEEF */ 0x89, 0x07, /* MOV [EDI], EAX */ /* Identity map the first 4MiB of memory */ 0xB9, 0x00, 0x04, 0x00, 0x00, /* MOV ECX, 0x400 */ 0xBF, 0x00, 0x20, 0x00, 0x00, /* MOV EDI, 0x2000 */ 0xB8, 0x03, 0x00, 0x00, 0x00, /* MOV EAX, 3 */ /* aLoop: */ 0xAB, /* STOSD */ 0x05, 0x00, 0x10, 0x00, 0x00, /* ADD EAX, 0x1000 */ 0xE2, 0xF8, /* LOOP aLoop */ /* Map physical address 0x4000 to virtual address 0x7FF000 */ 0xBF, 0xFC, 0x3F, 0x00, 0x00, /* MOV EDI, 0x3FFC */ 0xB8, 0x03, 0x40, 0x00, 0x00, /* MOV EAX, 0x4003 */ 0x89, 0x07, /* MOV [EDI], EAX */ /* Add page tables into page directory */ 0xBF, 0x00, 0x10, 0x00, 0x00, /* MOV EDI, 0x1000 */ 0xB8, 0x03, 0x20, 0x00, 0x00, /* MOV EAX, 0x2003 */ 0x89, 0x07, /* MOV [EDI], EAX */ 0xBF, 0x04, 0x10, 0x00, 0x00, /* MOV EDI, 0x1004 */ 0xB8, 0x03, 0x30, 0x00, 0x00, /* MOV EAX, 0x3003 */ 0x89, 0x07, /* MOV [EDI], EAX */ /* Load the page directory register */ 0xB8, 0x00, 0x10, 0x00, 0x00, /* MOV EAX, 0x1000 */ 0x0F, 0x22, 0xD8, /* MOV CR3, EAX */ /* Enable paging */ 0x0F, 0x20, 0xC0, /* MOV EAX, CR0 */ 0x0D, 0x00, 0x00, 0x00, 0x80, /* OR EAX, 0x80000000 */ 0x0F, 0x22, 0xC0, /* MOV CR0, EAX */ /* Clear EAX */ 0x31, 0xC0, /* XOR EAX, EAX */ /* Load using virtual memory address; EAX = 0xBEEF */ 0xBE, 0x00, 0xF0, 0x7F, 0x00, /* MOV ESI, 0x7FF000 */ 0x8B, 0x06, /* MOV EAX, [ESI] */ 0xF4, /* HLT */ }; /* Initialise X86-32bit mode */ err = uc_open(UC_ARCH_X86, UC_MODE_32, &uc); uc_assert_success(err); /* Map 8MB of memory at base address 0 */ err = uc_mem_map(uc, 0, (8 * 1024 * 1024), UC_PROT_ALL); uc_assert_success(err); /* Write code into memory at address 0 */ err = uc_mem_write(uc, 0, code, sizeof(code)); uc_assert_success(err); /* Start emulation */ err = uc_emu_start(uc, 0, sizeof(code), 0, 0); uc_assert_success(err); /* The code should have loaded 0xBEEF into EAX */ uc_reg_read(uc, UC_X86_REG_EAX, &r_eax); assert_int_equal(r_eax, 0xBEEF); uc_close(uc); }
int main(int argc, char **argv, char **envp) { uc_engine *uc; uc_hook trace1, trace2; uc_err err; uint32_t esp, eip; int32_t buf1[1024], buf2[1024], readbuf[1024]; int i; //don't really care about quality of randomness srand(time(NULL)); for (i = 0; i < 1024; i++) { buf1[i] = rand(); buf2[i] = rand(); } printf("# Memory protect test\n"); // Initialize emulator in X86-32bit mode err = uc_open(UC_ARCH_X86, UC_MODE_32, &uc); if (err) { printf("not ok %d - Failed on uc_open() with error returned: %u\n", log_num++, err); return 1; } else { printf("ok %d - uc_open() success\n", log_num++); } uc_mem_map(uc, 0x100000, 0x1000, UC_PROT_READ | UC_PROT_EXEC); uc_mem_map(uc, 0x1ff000, 0x2000, UC_PROT_READ | UC_PROT_WRITE); uc_mem_map(uc, 0x300000, 0x2000, UC_PROT_READ); uc_mem_map(uc, 0xf00000, 0x1000, UC_PROT_READ | UC_PROT_WRITE); esp = 0xf00000 + 0x1000; // Setup stack pointer if (uc_reg_write(uc, UC_X86_REG_ESP, &esp)) { printf("not ok %d - Failed to set esp. quit!\n", log_num++); return 2; } else { printf("ok %d - ESP set\n", log_num++); } // fill in sections that shouldn't get touched if (uc_mem_write(uc, 0x1ff000, buf1, sizeof(buf1))) { printf("not ok %d - Failed to write random buffer 1 to memory, quit!\n", log_num++); return 3; } else { printf("ok %d - Random buffer 1 written to memory\n", log_num++); } if (uc_mem_write(uc, 0x301000, buf2, sizeof(buf2))) { printf("not ok %d - Failed to write random buffer 2 to memory, quit!\n", log_num++); return 4; } else { printf("ok %d - Random buffer 2 written to memory\n", log_num++); } // write machine code to be emulated to memory if (uc_mem_write(uc, 0x100000, PROGRAM, sizeof(PROGRAM))) { printf("not ok %d - Failed to write emulation code to memory, quit!\n", log_num++); return 5; } else { printf("ok %d - Program written to memory\n", log_num++); } if (uc_hook_add(uc, &trace2, UC_HOOK_CODE, hook_code, NULL, 1, 0) != UC_ERR_OK) { printf("not ok %d - Failed to install UC_HOOK_CODE ucr\n", log_num++); return 6; } else { printf("ok %d - UC_HOOK_CODE installed\n", log_num++); } // intercept memory write events if (uc_hook_add(uc, &trace1, UC_HOOK_MEM_WRITE, hook_mem_write, NULL, 1, 0) != UC_ERR_OK) { printf("not ok %d - Failed to install UC_HOOK_MEM_WRITE ucr\n", log_num++); return 7; } else { printf("ok %d - UC_HOOK_MEM_WRITE installed\n", log_num++); } // intercept invalid memory events if (uc_hook_add(uc, &trace1, UC_HOOK_MEM_WRITE_PROT | UC_HOOK_MEM_FETCH_PROT, hook_mem_invalid, NULL, 1, 0) != UC_ERR_OK) { printf("not ok %d - Failed to install memory invalid handler\n", log_num++); return 8; } else { printf("ok %d - memory invalid handler installed\n", log_num++); } // emulate machine code until told to stop by hook_code printf("# BEGIN execution\n"); err = uc_emu_start(uc, 0x100000, 0x400000, 0, 0); if (err != UC_ERR_OK) { printf("not ok %d - Failure on uc_emu_start() with error %u:%s\n", log_num++, err, uc_strerror(err)); return 9; } else { printf("ok %d - uc_emu_start complete\n", log_num++); } printf("# END execution\n"); // get ending EIP if (uc_reg_read(uc, UC_X86_REG_EIP, &eip)) { printf("not ok %d - Failed to read eip.\n", log_num++); } else { printf("ok %d - Ending EIP 0x%x\n", log_num++, eip); } //make sure that random blocks didn't get nuked // fill in sections that shouldn't get touched if (uc_mem_read(uc, 0x1ff000, readbuf, sizeof(readbuf))) { printf("not ok %d - Failed to read random buffer 1 from memory\n", log_num++); } else { printf("ok %d - Random buffer 1 read from memory\n", log_num++); if (memcmp(buf1, readbuf, 4096)) { printf("not ok %d - Random buffer 1 contents are incorrect\n", log_num++); } else { printf("ok %d - Random buffer 1 contents are correct\n", log_num++); } } if (uc_mem_read(uc, 0x301000, readbuf, sizeof(readbuf))) { printf("not ok %d - Failed to read random buffer 2 from memory\n", log_num++); } else { printf("ok %d - Random buffer 2 read from memory\n", log_num++); if (memcmp(buf2, readbuf, 4096)) { printf("not ok %d - Random buffer 2 contents are incorrect\n", log_num++); } else { printf("ok %d - Random buffer 2 contents are correct\n", log_num++); } } if (uc_close(uc) == UC_ERR_OK) { printf("ok %d - uc_close complete\n", log_num++); } else { printf("not ok %d - uc_close complete\n", log_num++); } return 0; }
// emulate code that write invalid memory static void test_i386_invalid_mem_write(void) { uc_engine *uc; uc_err err; uc_hook trace1, trace2, trace3; uint32_t tmp; int r_ecx = 0x1234; // ECX register int r_edx = 0x7890; // EDX register printf("===================================\n"); printf("Emulate i386 code that write to invalid memory\n"); // Initialize emulator in X86-32bit mode err = uc_open(UC_ARCH_X86, UC_MODE_32, &uc); if (err) { printf("Failed on uc_open() with error returned: %u\n", err); return; } // map 2MB memory for this emulation uc_mem_map(uc, ADDRESS, 2 * 1024 * 1024, UC_PROT_ALL); // write machine code to be emulated to memory if (uc_mem_write(uc, ADDRESS, X86_CODE32_MEM_WRITE, sizeof(X86_CODE32_MEM_WRITE) - 1)) { printf("Failed to write emulation code to memory, quit!\n"); return; } // initialize machine registers uc_reg_write(uc, UC_X86_REG_ECX, &r_ecx); uc_reg_write(uc, UC_X86_REG_EDX, &r_edx); // tracing all basic blocks with customized callback uc_hook_add(uc, &trace1, UC_HOOK_BLOCK, hook_block, NULL, 1, 0); // tracing all instruction by having @begin > @end uc_hook_add(uc, &trace2, UC_HOOK_CODE, hook_code, NULL, 1, 0); // intercept invalid memory events uc_hook_add(uc, &trace3, UC_HOOK_MEM_READ_UNMAPPED | UC_HOOK_MEM_WRITE_UNMAPPED, hook_mem_invalid, NULL, 1, 0); // emulate machine code in infinite time err = uc_emu_start(uc, ADDRESS, ADDRESS + sizeof(X86_CODE32_MEM_WRITE) - 1, 0, 0); if (err) { printf("Failed on uc_emu_start() with error returned %u: %s\n", err, uc_strerror(err)); } // now print out some registers printf(">>> Emulation done. Below is the CPU context\n"); uc_reg_read(uc, UC_X86_REG_ECX, &r_ecx); uc_reg_read(uc, UC_X86_REG_EDX, &r_edx); printf(">>> ECX = 0x%x\n", r_ecx); printf(">>> EDX = 0x%x\n", r_edx); // read from memory if (!uc_mem_read(uc, 0xaaaaaaaa, &tmp, sizeof(tmp))) printf(">>> Read 4 bytes from [0x%x] = 0x%x\n", 0xaaaaaaaa, tmp); else printf(">>> Failed to read 4 bytes from [0x%x]\n", 0xaaaaaaaa); if (!uc_mem_read(uc, 0xffffffaa, &tmp, sizeof(tmp))) printf(">>> Read 4 bytes from [0x%x] = 0x%x\n", 0xffffffaa, tmp); else printf(">>> Failed to read 4 bytes from [0x%x]\n", 0xffffffaa); uc_close(uc); }
static void test_x86_64(void **state) { uc_engine *uc; uc_err err; uc_hook trace1, trace2, trace3, trace4; static const uint64_t address = 0x1000000; static const uint8_t code[] = "\x41\xBC\x3B\xB0\x28\x2A\x49\x0F\xC9\x90\x4D\x0F\xAD\xCF\x49\x87\xFD\x90\x48\x81\xD2\x8A\xCE\x77\x35\x48\xF7\xD9\x4D\x29\xF4\x49\x81\xC9\xF6\x8A\xC6\x53\x4D\x87\xED\x48\x0F\xAD\xD2\x49\xF7\xD4\x48\xF7\xE1\x4D\x19\xC5\x4D\x89\xC5\x48\xF7\xD6\x41\xB8\x4F\x8D\x6B\x59\x4D\x87\xD0\x68\x6A\x1E\x09\x3C\x59"; int64_t rax = 0x71f3029efd49d41d; int64_t rbx = 0xd87b45277f133ddb; int64_t rcx = 0xab40d1ffd8afc461; int64_t rdx = 0x919317b4a733f01; int64_t rsi = 0x4c24e753a17ea358; int64_t rdi = 0xe509a57d2571ce96; int64_t r8 = 0xea5b108cc2b9ab1f; int64_t r9 = 0x19ec097c8eb618c1; int64_t r10 = 0xec45774f00c5f682; int64_t r11 = 0xe17e9dbec8c074aa; int64_t r12 = 0x80f86a8dc0f6d457; int64_t r13 = 0x48288ca5671c5492; int64_t r14 = 0x595f72f6e4017f6e; int64_t r15 = 0x1efd97aea331cccc; int64_t rsp = address + 0x200000; // Initialize emulator in X86-64bit mode err = uc_open(UC_ARCH_X86, UC_MODE_64, &uc); uc_assert_success(err); // map 2MB memory for this emulation err = uc_mem_map(uc, address, 2 * 1024 * 1024, UC_PROT_ALL); uc_assert_success(err); // write machine code to be emulated to memory err = uc_mem_write(uc, address, code, sizeof(code) - 1); uc_assert_success(err); // initialize machine registers uc_assert_success(uc_reg_write(uc, UC_X86_REG_RSP, &rsp)); uc_assert_success(uc_reg_write(uc, UC_X86_REG_RAX, &rax)); uc_assert_success(uc_reg_write(uc, UC_X86_REG_RBX, &rbx)); uc_assert_success(uc_reg_write(uc, UC_X86_REG_RCX, &rcx)); uc_assert_success(uc_reg_write(uc, UC_X86_REG_RDX, &rdx)); uc_assert_success(uc_reg_write(uc, UC_X86_REG_RSI, &rsi)); uc_assert_success(uc_reg_write(uc, UC_X86_REG_RDI, &rdi)); uc_assert_success(uc_reg_write(uc, UC_X86_REG_R8, &r8)); uc_assert_success(uc_reg_write(uc, UC_X86_REG_R9, &r9)); uc_assert_success(uc_reg_write(uc, UC_X86_REG_R10, &r10)); uc_assert_success(uc_reg_write(uc, UC_X86_REG_R11, &r11)); uc_assert_success(uc_reg_write(uc, UC_X86_REG_R12, &r12)); uc_assert_success(uc_reg_write(uc, UC_X86_REG_R13, &r13)); uc_assert_success(uc_reg_write(uc, UC_X86_REG_R14, &r14)); uc_assert_success(uc_reg_write(uc, UC_X86_REG_R15, &r15)); // tracing all basic blocks with customized callback err = uc_hook_add(uc, &trace1, UC_HOOK_BLOCK, hook_block, NULL, 1, 0); uc_assert_success(err); // tracing all instructions in the range [address, address+20] err = uc_hook_add(uc, &trace2, UC_HOOK_CODE, hook_code64, NULL, address, address+20); uc_assert_success(err); // tracing all memory WRITE access (with @begin > @end) err = uc_hook_add(uc, &trace3, UC_HOOK_MEM_WRITE, hook_mem64, NULL, 1, 0); uc_assert_success(err); // tracing all memory READ access (with @begin > @end) err = uc_hook_add(uc, &trace4, UC_HOOK_MEM_READ, hook_mem64, NULL, 1, 0); uc_assert_success(err); // emulate machine code in infinite time (last param = 0), or when // finishing all the code. err = uc_emu_start(uc, address, address+sizeof(code) - 1, 0, 0); uc_assert_success(err); // Read registers uc_reg_read(uc, UC_X86_REG_RAX, &rax); uc_reg_read(uc, UC_X86_REG_RBX, &rbx); uc_reg_read(uc, UC_X86_REG_RCX, &rcx); uc_reg_read(uc, UC_X86_REG_RDX, &rdx); uc_reg_read(uc, UC_X86_REG_RSI, &rsi); uc_reg_read(uc, UC_X86_REG_RDI, &rdi); uc_reg_read(uc, UC_X86_REG_R8, &r8); uc_reg_read(uc, UC_X86_REG_R9, &r9); uc_reg_read(uc, UC_X86_REG_R10, &r10); uc_reg_read(uc, UC_X86_REG_R11, &r11); uc_reg_read(uc, UC_X86_REG_R12, &r12); uc_reg_read(uc, UC_X86_REG_R13, &r13); uc_reg_read(uc, UC_X86_REG_R14, &r14); uc_reg_read(uc, UC_X86_REG_R15, &r15); #if 0 printf(">>> RAX = 0x%" PRIx64 "\n", rax); printf(">>> RBX = 0x%" PRIx64 "\n", rbx); printf(">>> RCX = 0x%" PRIx64 "\n", rcx); printf(">>> RDX = 0x%" PRIx64 "\n", rdx); printf(">>> RSI = 0x%" PRIx64 "\n", rsi); printf(">>> RDI = 0x%" PRIx64 "\n", rdi); printf(">>> R8 = 0x%" PRIx64 "\n", r8); printf(">>> R9 = 0x%" PRIx64 "\n", r9); printf(">>> R10 = 0x%" PRIx64 "\n", r10); printf(">>> R11 = 0x%" PRIx64 "\n", r11); printf(">>> R12 = 0x%" PRIx64 "\n", r12); printf(">>> R13 = 0x%" PRIx64 "\n", r13); printf(">>> R14 = 0x%" PRIx64 "\n", r14); printf(">>> R15 = 0x%" PRIx64 "\n", r15); #endif uc_assert_success(uc_close(uc)); }
int main(int argc, char **argv, char **envp) { uc_engine *uc; uc_err err; int ret; uc_hook hhc; uint32_t val; EmuStarterParam_t starter_params; #ifdef _WIN32 HANDLE th = (HANDLE)-1; #else pthread_t th; #endif // dynamically load shared library #ifdef DYNLOAD uc_dyn_load(NULL, 0); #endif // Initialize emulator in MIPS 32bit little endian mode printf("uc_open()\n"); err = uc_open(UC_ARCH_MIPS, UC_MODE_MIPS32, &uc); if (err) { printf("Failed on uc_open() with error returned: %u\n", err); return err; } // map in a page of mem printf("uc_mem_map()\n"); err = uc_mem_map(uc, addr, 0x1000, UC_PROT_ALL); if (err) { printf("Failed on uc_mem_map() with error returned: %u\n", err); return err; } // write machine code to be emulated to memory printf("uc_mem_write()\n"); err = uc_mem_write(uc, addr, loop_test_code, sizeof(loop_test_code)); if( err ) { printf("Failed on uc_mem_write() with error returned: %u\n", err); return err; } // hook all instructions by having @begin > @end printf("uc_hook_add()\n"); uc_hook_add(uc, &hhc, UC_HOOK_CODE, mips_codehook, NULL, 1, 0); if( err ) { printf("Failed on uc_hook_add(code) with error returned: %u\n", err); return err; } // start background thread printf("---- Thread Starting ----\n"); starter_params.uc = uc; starter_params.startAddr = addr; starter_params.endAddr = addr + sizeof(loop_test_code); #ifdef _WIN32 // create thread th = (HANDLE)_beginthreadex(NULL, 0, win32_emu_starter, &starter_params, CREATE_SUSPENDED, NULL); if(th == (HANDLE)-1) { printf("Failed on _beginthreadex() with error returned: %u\n", _errno()); return -1; } // start thread ret = ResumeThread(th); if( ret == -1 ) { printf("Failed on ResumeThread() with error returned: %u\n", _errno()); return -2; } // wait 3 seconds Sleep(3 * 1000); #else // add posix code to start the emu_starter() thread ret = pthread_create(&th, NULL, posix_emu_starter, &starter_params); if( ret ) { printf("Failed on pthread_create() with error returned: %u\n", err); return -2; } // wait 3 seconds sleep(3); #endif // Stop the thread after it has been let to run in the background for a while printf("---- Thread Stopping ----\n"); printf("uc_emu_stop()\n"); err = uc_emu_stop(uc); if( err ) { printf("Failed on uc_emu_stop() with error returned: %u\n", err); return err; } test_passed_ok = true; // done executing, print some reg values as a test uc_reg_read(uc, UC_MIPS_REG_PC, &val); printf("pc is %X\n", val); uc_reg_read(uc, UC_MIPS_REG_A0, &val); printf("a0 is %X\n", val); // free resources printf("uc_close()\n"); uc_close(uc); if( test_passed_ok ) printf("\n\nTEST PASSED!\n\n"); else printf("\n\nTEST FAILED!\n\n"); // dynamically free shared library #ifdef DYNLOAD uc_dyn_free(); #endif return 0; }
static void test_tb_x86_64_32_imul_Gv_Ev_Ib(void **state) { uc_engine *uc = *state; uc_hook trace1, trace2; void *mem; #ifdef RIP_NEXT_TO_THE_SELFMODIFY_OPCODE // These values assumes just before PC = 0x60000021 int64_t eax = 0x00000041; int64_t ecx = 0x5ffffff8; int64_t edx = 0x5ffffff8; int64_t ebx = 0x034a129b; int64_t esp = 0x6010229a; int64_t ebp = 0x60000002; int64_t esi = 0x1f350211; int64_t edi = 0x488ac239; #else // These values assumes PC == 0x6000000 int64_t eax = 0x73952c43; int64_t ecx = 0x6010229a; int64_t edx = 0x2a500e50; int64_t ebx = 0x034a1295; int64_t esp = 0x6010229a; int64_t ebp = 0x60000000; int64_t esi = 0x1f350211; int64_t edi = 0x488ac239; #endif mem = calloc(1, CODE_SPACE); assert_int_not_equal(0, mem); uc_assert_success(uc_open(UC_ARCH_X86, UC_MODE_32, &uc)); uc_assert_success(uc_mem_map(uc, PHY_STACK_REGION, CODE_SPACE, UC_PROT_ALL)); uc_assert_success(uc_mem_write(uc, PHY_STACK_REGION, X86_CODE32_ALPHA_MIXED, sizeof(X86_CODE32_ALPHA_MIXED) - 1)); uc_assert_success(uc_reg_write(uc, UC_X86_REG_EAX, &eax)); uc_assert_success(uc_reg_write(uc, UC_X86_REG_ECX, &ecx)); uc_assert_success(uc_reg_write(uc, UC_X86_REG_EDX, &edx)); uc_assert_success(uc_reg_write(uc, UC_X86_REG_EBX, &ebx)); uc_assert_success(uc_reg_write(uc, UC_X86_REG_ESP, &esp)); uc_assert_success(uc_reg_write(uc, UC_X86_REG_EBP, &ebp)); uc_assert_success(uc_reg_write(uc, UC_X86_REG_ESI, &esi)); uc_assert_success(uc_reg_write(uc, UC_X86_REG_EDI, &edi)); uc_assert_success(uc_hook_add(uc, &trace1, UC_HOOK_CODE, hook_code32, NULL, (uint64_t)1, (uint64_t)0)); uc_assert_success(uc_hook_add(uc, &trace2, UC_HOOK_MEM_VALID, hook_mem32, NULL, (uint64_t)1, (uint64_t)0)); uc_assert_success(uc_emu_start(uc, #ifdef RIP_NEXT_TO_THE_SELFMODIFY_OPCODE // Register set (before self-modifying IMUL opcode) // Start at "0x00000021: xorb %al, 0x30(%ecx) // Start at "0x00000021: xor byte ptr [ecx + 0x30], al PHY_STACK_REGION+0x0021, // 0x0024 didn't work #else PHY_STACK_REGION+0x0000, #endif PHY_STACK_REGION+sizeof(X86_CODE32_ALPHA_MIXED) - 1, 0, 0)); uc_assert_success(uc_close(uc)); }
static void test_i386_inout(void **state) { uc_engine *uc; uc_err err; uc_hook trace1, trace2, trace3, trace4; int r_eax = 0x1234; // EAX register int r_ecx = 0x6789; // ECX register static const uint64_t address = 0x1000000; static const uint8_t code[] = { 0x41, // inc ecx 0xE4, 0x3F, // in al, 0x3F 0x4A, // dec edx 0xE6, 0x46, // out 0x46, al 0x43, // inc ebx }; // Initialize emulator in X86-32bit mode err = uc_open(UC_ARCH_X86, UC_MODE_32, &uc); uc_assert_success(err); // map 2MB memory for this emulation err = uc_mem_map(uc, address, 2 * 1024 * 1024, UC_PROT_ALL); uc_assert_success(err); // write machine code to be emulated to memory err = uc_mem_write(uc, address, code, sizeof(code)); uc_assert_success(err); // initialize machine registers err = uc_reg_write(uc, UC_X86_REG_EAX, &r_eax); uc_assert_success(err); err = uc_reg_write(uc, UC_X86_REG_ECX, &r_ecx); uc_assert_success(err); // tracing all basic blocks with customized callback err = uc_hook_add(uc, &trace1, UC_HOOK_BLOCK, hook_block, NULL, 1, 0); uc_assert_success(err); // tracing all instructions err = uc_hook_add(uc, &trace2, UC_HOOK_CODE, hook_code, NULL, 1, 0); uc_assert_success(err); // uc IN instruction err = uc_hook_add(uc, &trace3, UC_HOOK_INSN, hook_in, NULL, 1, 0, UC_X86_INS_IN); uc_assert_success(err); // uc OUT instruction err = uc_hook_add(uc, &trace4, UC_HOOK_INSN, hook_out, NULL, 1, 0, UC_X86_INS_OUT); uc_assert_success(err); // emulate machine code in infinite time err = uc_emu_start(uc, address, address+sizeof(code), 0, 0); uc_assert_success(err); uc_reg_read(uc, UC_X86_REG_EAX, &r_eax); uc_reg_read(uc, UC_X86_REG_ECX, &r_ecx); //printf(">>> EAX = 0x%x\n", r_eax); //printf(">>> ECX = 0x%x\n", r_ecx); // TODO: Assert on the register values here uc_assert_success(uc_close(uc)); }
int main(int argc, char *argv[]) { uc_engine *uc; uc_hook trace; uc_err err; unsigned int EAX, ESP, val = 0x0c0c0c0c, stkval = STACK; EAX = 0; ESP = STACK+0x4; // Initialize emulator in X86-64bit mode err = uc_open(UC_ARCH_X86, UC_MODE_32, &uc); if(err) { printf("Failed on uc_open() with error returned: %s\n", uc_strerror(err)); return 1; } err = uc_mem_map(uc, ADDRESS, SIZE, UC_PROT_ALL); if(err != UC_ERR_OK) { printf("Failed to map memory %s\n", uc_strerror(err)); return 1; } err = uc_mem_write(uc, ADDRESS, CODE32, sizeof(CODE32) - 1); if(err != UC_ERR_OK) { printf("Failed to write to memory %s\n", uc_strerror(err)); return 1; } loop: err = uc_mem_map(uc, stkval, STACK_SIZE, UC_PROT_ALL); if(err != UC_ERR_OK) { printf("Failed to map memory %s\n", uc_strerror(err)); return 1; } err = uc_mem_write(uc, ESP, &val, sizeof(val)); if(err != UC_ERR_OK) { printf("Failed to write to memory %s\n", uc_strerror(err)); return 1; } uc_hook_add(uc, &trace, UC_HOOK_MEM_WRITE | UC_HOOK_MEM_READ, (void *)hook_mem_rw, NULL); uc_reg_write(uc, UC_X86_REG_EAX, &EAX); uc_reg_write(uc, UC_X86_REG_ESP, &ESP); err = uc_emu_start(uc, ADDRESS, ADDRESS + (sizeof(CODE32) - 1), 0, 0); if(err) { printf("Failed on uc_emu_start() with error returned %u: %s\n", err, uc_strerror(err)); uc_close(uc); return 1; } uc_reg_read(uc, UC_X86_REG_EAX, &EAX); printf(">>> EAX = %08X\n", EAX); if(stkval != STACK2) { printf("=== Beginning test two ===\n"); ESP = STACK2+0x4; EAX = 0; stkval = STACK2; goto loop; } uc_close(uc); return 0; }
static void test_i386_inout(void) { uc_engine *uc; uc_err err; uc_hook trace1, trace2, trace3, trace4; int r_eax = 0x1234; // EAX register int r_ecx = 0x6789; // ECX register printf("===================================\n"); printf("Emulate i386 code with IN/OUT instructions\n"); // Initialize emulator in X86-32bit mode err = uc_open(UC_ARCH_X86, UC_MODE_32, &uc); if (err) { printf("Failed on uc_open() with error returned: %u\n", err); return; } // map 2MB memory for this emulation uc_mem_map(uc, ADDRESS, 2 * 1024 * 1024, UC_PROT_ALL); // write machine code to be emulated to memory if (uc_mem_write(uc, ADDRESS, X86_CODE32_INOUT, sizeof(X86_CODE32_INOUT) - 1)) { printf("Failed to write emulation code to memory, quit!\n"); return; } // initialize machine registers uc_reg_write(uc, UC_X86_REG_EAX, &r_eax); uc_reg_write(uc, UC_X86_REG_ECX, &r_ecx); // tracing all basic blocks with customized callback uc_hook_add(uc, &trace1, UC_HOOK_BLOCK, hook_block, NULL, 1, 0); // tracing all instructions uc_hook_add(uc, &trace2, UC_HOOK_CODE, hook_code, NULL, 1, 0); // uc IN instruction uc_hook_add(uc, &trace3, UC_HOOK_INSN, hook_in, NULL, 1, 0, UC_X86_INS_IN); // uc OUT instruction uc_hook_add(uc, &trace4, UC_HOOK_INSN, hook_out, NULL, 1, 0, UC_X86_INS_OUT); // emulate machine code in infinite time err = uc_emu_start(uc, ADDRESS, ADDRESS + sizeof(X86_CODE32_INOUT) - 1, 0, 0); if (err) { printf("Failed on uc_emu_start() with error returned %u: %s\n", err, uc_strerror(err)); } // now print out some registers printf(">>> Emulation done. Below is the CPU context\n"); uc_reg_read(uc, UC_X86_REG_EAX, &r_eax); uc_reg_read(uc, UC_X86_REG_ECX, &r_ecx); printf(">>> EAX = 0x%x\n", r_eax); printf(">>> ECX = 0x%x\n", r_ecx); uc_close(uc); }
static void test_x86_64(void) { uc_engine *uc; uc_err err; uc_hook trace1, trace2, trace3, trace4; int64_t rax = 0x71f3029efd49d41d; int64_t rbx = 0xd87b45277f133ddb; int64_t rcx = 0xab40d1ffd8afc461; int64_t rdx = 0x919317b4a733f01; int64_t rsi = 0x4c24e753a17ea358; int64_t rdi = 0xe509a57d2571ce96; int64_t r8 = 0xea5b108cc2b9ab1f; int64_t r9 = 0x19ec097c8eb618c1; int64_t r10 = 0xec45774f00c5f682; int64_t r11 = 0xe17e9dbec8c074aa; int64_t r12 = 0x80f86a8dc0f6d457; int64_t r13 = 0x48288ca5671c5492; int64_t r14 = 0x595f72f6e4017f6e; int64_t r15 = 0x1efd97aea331cccc; int64_t rsp = ADDRESS + 0x200000; printf("Emulate x86_64 code\n"); // Initialize emulator in X86-64bit mode err = uc_open(UC_ARCH_X86, UC_MODE_64, &uc); if (err) { printf("Failed on uc_open() with error returned: %u\n", err); return; } // map 2MB memory for this emulation uc_mem_map(uc, ADDRESS, 2 * 1024 * 1024, UC_PROT_ALL); // write machine code to be emulated to memory if (uc_mem_write(uc, ADDRESS, X86_CODE64, sizeof(X86_CODE64) - 1)) { printf("Failed to write emulation code to memory, quit!\n"); return; } // initialize machine registers uc_reg_write(uc, UC_X86_REG_RSP, &rsp); uc_reg_write(uc, UC_X86_REG_RAX, &rax); uc_reg_write(uc, UC_X86_REG_RBX, &rbx); uc_reg_write(uc, UC_X86_REG_RCX, &rcx); uc_reg_write(uc, UC_X86_REG_RDX, &rdx); uc_reg_write(uc, UC_X86_REG_RSI, &rsi); uc_reg_write(uc, UC_X86_REG_RDI, &rdi); uc_reg_write(uc, UC_X86_REG_R8, &r8); uc_reg_write(uc, UC_X86_REG_R9, &r9); uc_reg_write(uc, UC_X86_REG_R10, &r10); uc_reg_write(uc, UC_X86_REG_R11, &r11); uc_reg_write(uc, UC_X86_REG_R12, &r12); uc_reg_write(uc, UC_X86_REG_R13, &r13); uc_reg_write(uc, UC_X86_REG_R14, &r14); uc_reg_write(uc, UC_X86_REG_R15, &r15); // tracing all basic blocks with customized callback uc_hook_add(uc, &trace1, UC_HOOK_BLOCK, hook_block, NULL, 1, 0); // tracing all instructions in the range [ADDRESS, ADDRESS+20] uc_hook_add(uc, &trace2, UC_HOOK_CODE, hook_code64, NULL, ADDRESS, ADDRESS+20); // tracing all memory WRITE access (with @begin > @end) uc_hook_add(uc, &trace3, UC_HOOK_MEM_WRITE, hook_mem64, NULL, 1, 0); // tracing all memory READ access (with @begin > @end) uc_hook_add(uc, &trace4, UC_HOOK_MEM_READ, hook_mem64, NULL, 1, 0); // emulate machine code in infinite time (last param = 0), or when // finishing all the code. err = uc_emu_start(uc, ADDRESS, ADDRESS + sizeof(X86_CODE64) - 1, 0, 0); if (err) { printf("Failed on uc_emu_start() with error returned %u: %s\n", err, uc_strerror(err)); } // now print out some registers printf(">>> Emulation done. Below is the CPU context\n"); uc_reg_read(uc, UC_X86_REG_RAX, &rax); uc_reg_read(uc, UC_X86_REG_RBX, &rbx); uc_reg_read(uc, UC_X86_REG_RCX, &rcx); uc_reg_read(uc, UC_X86_REG_RDX, &rdx); uc_reg_read(uc, UC_X86_REG_RSI, &rsi); uc_reg_read(uc, UC_X86_REG_RDI, &rdi); uc_reg_read(uc, UC_X86_REG_R8, &r8); uc_reg_read(uc, UC_X86_REG_R9, &r9); uc_reg_read(uc, UC_X86_REG_R10, &r10); uc_reg_read(uc, UC_X86_REG_R11, &r11); uc_reg_read(uc, UC_X86_REG_R12, &r12); uc_reg_read(uc, UC_X86_REG_R13, &r13); uc_reg_read(uc, UC_X86_REG_R14, &r14); uc_reg_read(uc, UC_X86_REG_R15, &r15); printf(">>> RAX = 0x%" PRIx64 "\n", rax); printf(">>> RBX = 0x%" PRIx64 "\n", rbx); printf(">>> RCX = 0x%" PRIx64 "\n", rcx); printf(">>> RDX = 0x%" PRIx64 "\n", rdx); printf(">>> RSI = 0x%" PRIx64 "\n", rsi); printf(">>> RDI = 0x%" PRIx64 "\n", rdi); printf(">>> R8 = 0x%" PRIx64 "\n", r8); printf(">>> R9 = 0x%" PRIx64 "\n", r9); printf(">>> R10 = 0x%" PRIx64 "\n", r10); printf(">>> R11 = 0x%" PRIx64 "\n", r11); printf(">>> R12 = 0x%" PRIx64 "\n", r12); printf(">>> R13 = 0x%" PRIx64 "\n", r13); printf(">>> R14 = 0x%" PRIx64 "\n", r14); printf(">>> R15 = 0x%" PRIx64 "\n", r15); uc_close(uc); }
/** * This is the part that launches the code in the Unicorn emulator. **/ int em_code(u8 *code, u32 bytelength, u32 startat, u8 *seed_res, uc_arch arch){ // bit of lazy coding here: update a global arch var, so that // we can easily read the arch from the single step hook. // neither elegant nor dangerous. if (global_arch != arch) global_arch = arch; /* The start address must be aligned to 4KB, or uc_mem_map will * throw a UC_ERR_ARG error. */ u32 round_start = startat & (u32) (~0xFFF); u32 offset = startat - round_start; int errcode = 0; int roundlength = roundup(bytelength); uc_engine *uc; uc_err err; uc_hook hook1; int sys_abi_len; uc_mode mode; int ret_inst; int *sys_abi_vec; /* if (DEBUG){ */ /* printf("IN EMULATOR\n"); */ /* fdump(stdout, code, bytelength); */ /* } */ switch (arch) { case UC_ARCH_X86 : sys_abi_vec = x86_64_syscall_abi; // careful sys_abi_len = x86_64_syscall_abi_len; mode = UC_MODE_64; ret_inst = UC_X86_INS_RET; break; case UC_ARCH_ARM : if (DEBUG) printf("Emulating ARM architecture...\n"); sys_abi_vec = arm_32_syscall_abi; sys_abi_len = arm_32_syscall_abi_len; mode = UC_MODE_ARM; break; default : fprintf(stderr,"Unknown architecture requested of em_code.\nExiting.\n"); exit(EXIT_FAILURE); } union seedvals { u32 words[sys_abi_len]; // wrinkle here: the word size should be dynamic u8 bytes[sys_abi_len * sizeof(word)]; } seedvals; /* fprintf(stderr, "bytelength = %d\nroundlength = %d\nsizeof(seedvals.bytes) = %d\nsizeof(seed_res) = %d\nsizeof(word) * sys_abi_len = %d\n",bytelength, roundlength, sizeof(seedvals.bytes), sizeof(seed_res), (sys_abi_len * sizeof(word))); */ if (!memcpy(seedvals.bytes, seed_res, (sys_abi_len * sizeof(word)))){ fprintf(stderr, "Error in memcpy, in em_code.\n"); } /** * from the unicorn src: "This part of the API is less... clean... * because Unicorn supports arbitrary register types. So the least * intrusive solution is passing individual pointers. On the plus * side, you only need to make this pointer array once." */ void *ptrs[sys_abi_len]; int i; for (i = 0; i < sys_abi_len; i++) { ptrs[i] = &(seedvals.words[i]); } if ((err = uc_open(arch, mode, &uc))) { uc_perror("uc_open", err); return -1; } // seed the registers if ((err = uc_reg_write_batch(uc, sys_abi_vec, ptrs, sys_abi_len))){ uc_perror("uc_reg_write_batch", err); return -1; } /* Add a single-stepping hook if debugging */ if (DEBUG){ if ((err = uc_hook_add(uc, &hook1, UC_HOOK_CODE, hook_step, NULL, 1, 0, 0))) { uc_perror("uc_hook_add", err); return 1; } } // don't leave 0x1000 a magic number if ((err = uc_mem_map(uc, round_start, 0x1000, UC_PROT_ALL))) { // does PROT_ALL mean 777? might want to set to XN for ROP... uc_perror("uc_mem_map", err); return -1; } if ((err = uc_mem_write(uc, startat, (void *) code, bytelength-1))) { uc_perror("uc_mem_write", err); return -1; } // why does the unicorn example suggest sizeof(CODE) -1 // where I have bytelength (sizeof(CODE))? probably because // it's implemented as a string, so it ends with a null byte if ((err = uc_emu_start(uc, startat, startat + bytelength -1, 0, TTL))){ if (DEBUG){ uc_perror("uc_emu_start", err); if (err == UC_ERR_FETCH_UNMAPPED) ret_msg(uc, err, arch); } errcode = -2; } uc_reg_read_batch(uc, sys_abi_vec, ptrs, sys_abi_len); /** for testing **/ if (DEBUG) { printf("syscall vec: {"); for (i = 0; i < sys_abi_len; i++) { if (i != 0) printf(", "); printf(WORDFMT, seedvals.words[i]); } printf("}\n"); } /******************/ memcpy(seed_res, seedvals.bytes, (sys_abi_len * sizeof(word))); uc_close(uc); return errcode; }
// emulate code and save/restore the CPU context static void test_i386_context_save(void) { uc_engine *uc; uc_context *context; uc_err err; int r_eax = 0x1; // EAX register printf("===================================\n"); printf("Save/restore CPU context in opaque blob\n"); // initialize emulator in X86-32bit mode err = uc_open(UC_ARCH_X86, UC_MODE_32, &uc); if (err) { printf("Failed on uc_open() with error returned: %u\n", err); return; } // map 8KB memory for this emulation uc_mem_map(uc, ADDRESS, 8 * 1024, UC_PROT_ALL); // write machine code to be emulated to memory if (uc_mem_write(uc, ADDRESS, X86_CODE32_INC, sizeof(X86_CODE32_INC) - 1)) { printf("Failed to write emulation code to memory, quit!\n"); return; } // initialize machine registers uc_reg_write(uc, UC_X86_REG_EAX, &r_eax); // emulate machine code in infinite time printf(">>> Running emulation for the first time\n"); err = uc_emu_start(uc, ADDRESS, ADDRESS + sizeof(X86_CODE32_INC) - 1, 0, 0); if (err) { printf("Failed on uc_emu_start() with error returned %u: %s\n", err, uc_strerror(err)); } // now print out some registers printf(">>> Emulation done. Below is the CPU context\n"); uc_reg_read(uc, UC_X86_REG_EAX, &r_eax); printf(">>> EAX = 0x%x\n", r_eax); // allocate and save the CPU context printf(">>> Saving CPU context\n"); err = uc_context_alloc(uc, &context); if (err) { printf("Failed on uc_context_alloc() with error returned: %u\n", err); return; } err = uc_context_save(uc, context); if (err) { printf("Failed on uc_context_save() with error returned: %u\n", err); return; } // emulate machine code again printf(">>> Running emulation for the second time\n"); err = uc_emu_start(uc, ADDRESS, ADDRESS + sizeof(X86_CODE32_INC) - 1, 0, 0); if (err) { printf("Failed on uc_emu_start() with error returned %u: %s\n", err, uc_strerror(err)); } // now print out some registers printf(">>> Emulation done. Below is the CPU context\n"); uc_reg_read(uc, UC_X86_REG_EAX, &r_eax); printf(">>> EAX = 0x%x\n", r_eax); // restore CPU context err = uc_context_restore(uc, context); if (err) { printf("Failed on uc_context_restore() with error returned: %u\n", err); return; } // now print out some registers printf(">>> CPU context restored. Below is the CPU context\n"); uc_reg_read(uc, UC_X86_REG_EAX, &r_eax); printf(">>> EAX = 0x%x\n", r_eax); // free the CPU context err = uc_context_free(context); if (err) { printf("Failed on uc_context_free() with error returned: %u\n", err); return; } uc_close(uc); }
static void VM_exec() { uc_engine *uc; uc_err err; uc_hook trace; unsigned int r_eax, eflags, r_esp, r_edi, r_ecx; r_eax = 0xbaadbabe; r_esp = ADDRESS+0x20; r_edi = ADDRESS+0x300; //some safe distance from main code. eflags = 0x00000206; r_ecx = ECX_OPS; // Initialize emulator in X86-32bit mode err = uc_open(UC_ARCH_X86, UC_MODE_32, &uc); if(err) { printf("Failed on uc_open() with error returned: %s\n", uc_strerror(err)); return; } err = uc_mem_map(uc, ADDRESS, (2 * 1024 * 1024), UC_PROT_ALL); if(err != UC_ERR_OK) { printf("Failed to map memory %s\n", uc_strerror(err)); return; } // write machine code to be emulated to memory err = uc_mem_write(uc, ADDRESS, X86_CODE32, sizeof(X86_CODE32) - 1); if(err != UC_ERR_OK) { printf("Failed to write emulation code to memory, quit!: %s(len %lu)\n", uc_strerror(err), (unsigned long)sizeof(X86_CODE32) - 1); return; } // initialize machine registers uc_reg_write(uc, UC_X86_REG_EAX, &r_eax); uc_reg_write(uc, UC_X86_REG_EDI, &r_edi); uc_reg_write(uc, UC_X86_REG_ECX, &r_ecx); uc_reg_write(uc, UC_X86_REG_ESP, &r_esp); //make stack pointer point to already mapped memory so we don't need to hook. uc_reg_write(uc, UC_X86_REG_EFLAGS, &eflags); uc_hook_add(uc, &trace, UC_HOOK_CODE, (void *)hook_ins, NULL, 1, 0); // emulate machine code in infinite time err = uc_emu_start(uc, ADDRESS, ADDRESS + (sizeof(X86_CODE32) - 1), 0, 0); if(err) { printf("Failed on uc_emu_start() with error returned %u: %s\n", err, uc_strerror(err)); uc_close(uc); return; } uc_reg_read(uc, UC_X86_REG_EAX, &r_eax); uc_reg_read(uc, UC_X86_REG_ECX, &r_ecx); uc_reg_read(uc, UC_X86_REG_EDI, &r_edi); uc_reg_read(uc, UC_X86_REG_EFLAGS, &eflags); uc_close(uc); printf("\n>>> Emulation done. Below is the CPU context\n"); printf(">>> EAX = 0x%08X\n", r_eax); printf(">>> ECX = 0x%08X\n", r_ecx); printf(">>> EDI = 0x%08X\n", r_edi); printf(">>> EFLAGS = 0x%08X\n", eflags); printf("\nHook called %lu times. Test %s\n", hook_called, (hook_called == ECX_OPS ? "PASSED!!" : "FAILED!!!")); }
static void VM_exec() { uc_engine *uc; uc_err err; uint32_t tmp; uc_hook trace1, trace2; unsigned int r_eax, r_ebx, r_ecx, r_edx, r_ebp, r_esp, r_esi, r_edi, r_eip, eflags; unsigned int tr_eax, tr_ebx, tr_ecx, tr_edx, tr_ebp, tr_esp, tr_esi, tr_edi, tr_eip, t_eflags; r_eax = tr_eax = 0x1DB10106; r_ebx = tr_ebx = 0x7EFDE000; r_ecx = tr_ecx = 0x7EFDE000; r_edx = tr_edx = 0x00001DB1; r_ebp = tr_ebp = 0x0018FF88; r_esp = tr_esp = 0x0018FF14; r_esi = tr_esi = 0x0; r_edi = tr_edi = 0x0; r_eip = tr_eip = 0x004939F3; t_eflags = eflags = 0x00000206; // Initialize emulator in X86-32bit mode err = uc_open(UC_ARCH_X86, UC_MODE_32, &uc); if(err) { printf("Failed on uc_open() with error returned: %s", uc_strerror(err)); return; } err = uc_mem_map(uc, ADDRESS, (4 * 1024 * 1024), UC_PROT_ALL); if(err != UC_ERR_OK) { printf("Failed to map memory %s", uc_strerror(err)); return; } // write machine code to be emulated to memory err = uc_mem_write(uc, ADDRESS, X86_CODE32, sizeof(X86_CODE32) - 1); if(err != UC_ERR_OK) { printf("Failed to write emulation code to memory, quit!: %s(len %lu)", uc_strerror(err), sizeof(X86_CODE32) - 1); return; } // initialize machine registers uc_reg_write(uc, UC_X86_REG_EAX, &r_eax); uc_reg_write(uc, UC_X86_REG_EBX, &r_ebx); uc_reg_write(uc, UC_X86_REG_ECX, &r_ecx); uc_reg_write(uc, UC_X86_REG_EDX, &r_edx); uc_reg_write(uc, UC_X86_REG_EBP, &r_ebp); uc_reg_write(uc, UC_X86_REG_ESP, &r_esp); uc_reg_write(uc, UC_X86_REG_ESI, &r_esi); uc_reg_write(uc, UC_X86_REG_EDI, &r_edi); uc_reg_write(uc, UC_X86_REG_EFLAGS, &eflags); uc_hook_add(uc, &trace1, UC_HOOK_MEM_READ_UNMAPPED | UC_HOOK_MEM_WRITE_UNMAPPED, (void *)hook_invalid_mem, NULL, 1, 0); // tracing all instruction by having @begin > @end uc_hook_add(uc, &trace2, UC_HOOK_CODE, (void *)hook_ins, NULL, 1, 0); // emulate machine code in infinite time err = uc_emu_start(uc, ADDRESS, ADDRESS + (sizeof(X86_CODE32) - 1), 0, 0); if(err) { printf("Failed on uc_emu_start() with error returned %u: %s", err, uc_strerror(err)); instructions = 0; uc_close(uc); return; } uc_reg_read(uc, UC_X86_REG_EAX, &r_eax); uc_reg_read(uc, UC_X86_REG_EBX, &r_ebx); uc_reg_read(uc, UC_X86_REG_ECX, &r_ecx); uc_reg_read(uc, UC_X86_REG_EDX, &r_edx); uc_reg_read(uc, UC_X86_REG_EBP, &r_ebp); uc_reg_read(uc, UC_X86_REG_ESP, &r_esp); uc_reg_read(uc, UC_X86_REG_ESI, &r_esi); uc_reg_read(uc, UC_X86_REG_EDI, &r_edi); uc_reg_read(uc, UC_X86_REG_EIP, &r_eip); uc_reg_read(uc, UC_X86_REG_EFLAGS, &eflags); uc_close(uc); printf(">>> Emulation done. Below is the CPU context\n"); printf(">>> EAX = 0x%08X %s\n", r_eax, (r_eax == tr_eax ? "" : "(m)")); printf(">>> EBX = 0x%08X %s\n", r_ebx, (r_ebx == tr_ebx ? "" : "(m)")); printf(">>> ECX = 0x%08X %s\n", r_ecx, (r_ecx == tr_ecx ? "" : "(m)")); printf(">>> EDX = 0x%08X %s\n", r_edx, (r_edx == tr_edx ? "" : "(m)")); printf(">>> EBP = 0x%08X %s\n", r_ebp, (r_ebp == tr_ebp ? "" : "(m)")); printf(">>> ESP = 0x%08X %s\n", r_esp, (r_esp == tr_esp ? "" : "(m)")); printf(">>> ESI = 0x%08X %s\n", r_esi, (r_esi == tr_esi ? "" : "(m)")); printf(">>> EDI = 0x%08X %s\n", r_edi, (r_edi == tr_edi ? "" : "(m)")); printf(">>> EIP = 0x%08X %s\n", (r_eip - ADDRESS) + tr_eip, (r_eip == tr_eip ? "" : "(m)\n")); printf(">>> EFLAGS = 0x%08X %s\n", eflags, (eflags == t_eflags ? "" : "(m)")); printf(">>> Instructions executed %" PRIu64 "\n", instructions); assert(r_eax == 0x1DB10106); assert(r_ebx == 0x7EFDE000); assert(r_ecx == 0x00000006); assert(r_edx == 0x00000001); assert(r_ebp == 0x0018FF88); assert(r_esp == 0x0018FF14); assert(r_esi == 0x00000000); assert(r_edi == 0x00000000); assert(eflags == 0x00000206); //we shouldn't fail this assert, eflags should be 0x00000206 because the last AND instruction produces a non-zero result. instructions = 0; }
static void test_m68k(void) { uc_engine *uc; uc_hook trace1, trace2; uc_err err; int d0 = 0x0000; // d0 data register int d1 = 0x0000; // d1 data register int d2 = 0x0000; // d2 data register int d3 = 0x0000; // d3 data register int d4 = 0x0000; // d4 data register int d5 = 0x0000; // d5 data register int d6 = 0x0000; // d6 data register int d7 = 0x0000; // d7 data register int a0 = 0x0000; // a0 address register int a1 = 0x0000; // a1 address register int a2 = 0x0000; // a2 address register int a3 = 0x0000; // a3 address register int a4 = 0x0000; // a4 address register int a5 = 0x0000; // a5 address register int a6 = 0x0000; // a6 address register int a7 = 0x0000; // a6 address register int pc = 0x0000; // program counter int sr = 0x0000; // status register printf("Emulate M68K code\n"); // Initialize emulator in M68K mode err = uc_open(UC_ARCH_M68K, UC_MODE_BIG_ENDIAN, &uc); if (err) { printf("Failed on uc_open() with error returned: %u (%s)\n", err, uc_strerror(err)); return; } // map 2MB memory for this emulation uc_mem_map(uc, ADDRESS, 2 * 1024 * 1024, UC_PROT_ALL); // write machine code to be emulated to memory uc_mem_write(uc, ADDRESS, M68K_CODE, sizeof(M68K_CODE) - 1); // initialize machine registers uc_reg_write(uc, UC_M68K_REG_D0, &d0); uc_reg_write(uc, UC_M68K_REG_D1, &d1); uc_reg_write(uc, UC_M68K_REG_D2, &d2); uc_reg_write(uc, UC_M68K_REG_D3, &d3); uc_reg_write(uc, UC_M68K_REG_D4, &d4); uc_reg_write(uc, UC_M68K_REG_D5, &d5); uc_reg_write(uc, UC_M68K_REG_D6, &d6); uc_reg_write(uc, UC_M68K_REG_D7, &d7); uc_reg_write(uc, UC_M68K_REG_A0, &a0); uc_reg_write(uc, UC_M68K_REG_A1, &a1); uc_reg_write(uc, UC_M68K_REG_A2, &a2); uc_reg_write(uc, UC_M68K_REG_A3, &a3); uc_reg_write(uc, UC_M68K_REG_A4, &a4); uc_reg_write(uc, UC_M68K_REG_A5, &a5); uc_reg_write(uc, UC_M68K_REG_A6, &a6); uc_reg_write(uc, UC_M68K_REG_A7, &a7); uc_reg_write(uc, UC_M68K_REG_PC, &pc); uc_reg_write(uc, UC_M68K_REG_SR, &sr); // tracing all basic blocks with customized callback uc_hook_add(uc, &trace1, UC_HOOK_BLOCK, hook_block, NULL, 1, 0); // tracing all instruction uc_hook_add(uc, &trace2, UC_HOOK_CODE, hook_code, NULL, 1, 0); // emulate machine code in infinite time (last param = 0), or when // finishing all the code. err = uc_emu_start(uc, ADDRESS, ADDRESS + sizeof(M68K_CODE)-1, 0, 0); if (err) { printf("Failed on uc_emu_start() with error returned: %u\n", err); } // now print out some registers printf(">>> Emulation done. Below is the CPU context\n"); uc_reg_read(uc, UC_M68K_REG_D0, &d0); uc_reg_read(uc, UC_M68K_REG_D1, &d1); uc_reg_read(uc, UC_M68K_REG_D2, &d2); uc_reg_read(uc, UC_M68K_REG_D3, &d3); uc_reg_read(uc, UC_M68K_REG_D4, &d4); uc_reg_read(uc, UC_M68K_REG_D5, &d5); uc_reg_read(uc, UC_M68K_REG_D6, &d6); uc_reg_read(uc, UC_M68K_REG_D7, &d7); uc_reg_read(uc, UC_M68K_REG_A0, &a0); uc_reg_read(uc, UC_M68K_REG_A1, &a1); uc_reg_read(uc, UC_M68K_REG_A2, &a2); uc_reg_read(uc, UC_M68K_REG_A3, &a3); uc_reg_read(uc, UC_M68K_REG_A4, &a4); uc_reg_read(uc, UC_M68K_REG_A5, &a5); uc_reg_read(uc, UC_M68K_REG_A6, &a6); uc_reg_read(uc, UC_M68K_REG_A7, &a7); uc_reg_read(uc, UC_M68K_REG_PC, &pc); uc_reg_read(uc, UC_M68K_REG_SR, &sr); printf(">>> A0 = 0x%x\t\t>>> D0 = 0x%x\n", a0, d0); printf(">>> A1 = 0x%x\t\t>>> D1 = 0x%x\n", a1, d1); printf(">>> A2 = 0x%x\t\t>>> D2 = 0x%x\n", a2, d2); printf(">>> A3 = 0x%x\t\t>>> D3 = 0x%x\n", a3, d3); printf(">>> A4 = 0x%x\t\t>>> D4 = 0x%x\n", a4, d4); printf(">>> A5 = 0x%x\t\t>>> D5 = 0x%x\n", a5, d5); printf(">>> A6 = 0x%x\t\t>>> D6 = 0x%x\n", a6, d6); printf(">>> A7 = 0x%x\t\t>>> D7 = 0x%x\n", a7, d7); printf(">>> PC = 0x%x\n", pc); printf(">>> SR = 0x%x\n", sr); uc_close(uc); }
static void test_basic_blocks(void **state) { uc_engine *uc = *state; uc_hook trace1; #define BASEADDR 0x1000000 uint64_t address = BASEADDR; const uint8_t code[] = { 0x33, 0xC0, // xor eax, eax 0x90, // nop 0x90, // nop 0xEB, 0x00, // jmp $+2 0x90, // nop 0x90, // nop 0x90, // nop }; static const struct bb blocks[] = { {BASEADDR, 6}, {BASEADDR+ 6, 3}, }; struct bbtest bbtest = { .blocks = blocks, .blocknum = 0, }; #undef BASEADDR // map 2MB memory for this emulation OK(uc_mem_map(uc, address, 2 * 1024 * 1024, UC_PROT_ALL)); // write machine code to be emulated to memory OK(uc_mem_write(uc, address, code, sizeof(code))); // trace all basic blocks OK(uc_hook_add(uc, &trace1, UC_HOOK_BLOCK, test_basic_blocks_hook, &bbtest, 1, 0)); OK(uc_emu_start(uc, address, address+sizeof(code), 0, 0)); } /******************************************************************************/ // callback for tracing basic blocks static void hook_block(uc_engine *uc, uint64_t address, uint32_t size, void *user_data) { //printf(">>> Tracing basic block at 0x%"PRIx64 ", block size = 0x%x\n", address, size); } // callback for tracing instruction static void hook_code(uc_engine *uc, uint64_t address, uint32_t size, void *user_data) { //int eflags; //printf(">>> Tracing instruction at 0x%"PRIx64 ", instruction size = 0x%x\n", address, size); //uc_reg_read(uc, UC_X86_REG_EFLAGS, &eflags); //printf(">>> --- EFLAGS is 0x%x\n", eflags); // Uncomment below code to stop the emulation using uc_emu_stop() // if (address == 0x1000009) // uc_emu_stop(uc); } static void test_i386(void **state) { uc_engine *uc; uc_err err; uint32_t tmp; uc_hook trace1, trace2; const uint8_t code[] = "\x41\x4a"; // INC ecx; DEC edx const uint64_t address = 0x1000000; int r_ecx = 0x1234; // ECX register int r_edx = 0x7890; // EDX register // Initialize emulator in X86-32bit mode err = uc_open(UC_ARCH_X86, UC_MODE_32, &uc); uc_assert_success(err); // map 2MB memory for this emulation err = uc_mem_map(uc, address, 2 * 1024 * 1024, UC_PROT_ALL); uc_assert_success(err); // write machine code to be emulated to memory err = uc_mem_write(uc, address, code, sizeof(code)-1); uc_assert_success(err); // initialize machine registers err = uc_reg_write(uc, UC_X86_REG_ECX, &r_ecx); uc_assert_success(err); err = uc_reg_write(uc, UC_X86_REG_EDX, &r_edx); uc_assert_success(err); // tracing all basic blocks with customized callback err = uc_hook_add(uc, &trace1, UC_HOOK_BLOCK, hook_block, NULL, 1, 0); uc_assert_success(err); // tracing all instruction by having @begin > @end err = uc_hook_add(uc, &trace2, UC_HOOK_CODE, hook_code, NULL, 1, 0); uc_assert_success(err); // emulate machine code in infinite time err = uc_emu_start(uc, address, address+sizeof(code)-1, 0, 0); uc_assert_success(err); // now print out some registers //printf(">>> Emulation done. Below is the CPU context\n"); uc_reg_read(uc, UC_X86_REG_ECX, &r_ecx); uc_reg_read(uc, UC_X86_REG_EDX, &r_edx); assert_int_equal(r_ecx, 0x1235); assert_int_equal(r_edx, 0x788F); // read from memory err = uc_mem_read(uc, address, (uint8_t *)&tmp, 4); uc_assert_success(err); //printf(">>> Read 4 bytes from [0x%"PRIX64"] = 0x%x\n", address, tmp); uc_close(uc); }