static void test_x86_64_syscall(void) { uc_engine *uc; uc_hook trace1; uc_err err; int64_t rax = 0x100; printf("===================================\n"); printf("Emulate x86_64 code with 'syscall' instruction\n"); // Initialize emulator in X86-64bit mode err = uc_open(UC_ARCH_X86, UC_MODE_64, &uc); if (err) { printf("Failed on uc_open() with error returned: %u\n", err); return; } // map 2MB memory for this emulation uc_mem_map(uc, ADDRESS, 2 * 1024 * 1024, UC_PROT_ALL); // write machine code to be emulated to memory if (uc_mem_write(uc, ADDRESS, X86_CODE64_SYSCALL, sizeof(X86_CODE64_SYSCALL) - 1)) { printf("Failed to write emulation code to memory, quit!\n"); return; } // hook interrupts for syscall uc_hook_add(uc, &trace1, UC_HOOK_INSN, hook_syscall, NULL, 1, 0, UC_X86_INS_SYSCALL); // initialize machine registers uc_reg_write(uc, UC_X86_REG_RAX, &rax); // emulate machine code in infinite time (last param = 0), or when // finishing all the code. err = uc_emu_start(uc, ADDRESS, ADDRESS + sizeof(X86_CODE64_SYSCALL) - 1, 0, 0); if (err) { printf("Failed on uc_emu_start() with error returned %u: %s\n", err, uc_strerror(err)); } // now print out some registers printf(">>> Emulation done. Below is the CPU context\n"); uc_reg_read(uc, UC_X86_REG_RAX, &rax); printf(">>> RAX = 0x%" PRIx64 "\n", rax); uc_close(uc); }
static void test_thumb(void) { uc_engine *uc; uc_err err; uc_hook trace1, trace2; int sp = 0x1234; // R0 register printf("Emulate THUMB code\n"); // Initialize emulator in ARM mode err = uc_open(UC_ARCH_ARM, UC_MODE_THUMB, &uc); if (err) { printf("Failed on uc_open() with error returned: %u (%s)\n", err, uc_strerror(err)); return; } // map 2MB memory for this emulation uc_mem_map(uc, ADDRESS, 2 * 1024 * 1024, UC_PROT_ALL); // write machine code to be emulated to memory uc_mem_write(uc, ADDRESS, THUMB_CODE, sizeof(THUMB_CODE) - 1); // initialize machine registers uc_reg_write(uc, UC_ARM_REG_SP, &sp); // tracing all basic blocks with customized callback uc_hook_add(uc, &trace1, UC_HOOK_BLOCK, hook_block, NULL, 1, 0); // tracing one instruction at ADDRESS with customized callback uc_hook_add(uc, &trace2, UC_HOOK_CODE, hook_code, NULL, ADDRESS, ADDRESS); // emulate machine code in infinite time (last param = 0), or when // finishing all the code. // Note we start at ADDRESS | 1 to indicate THUMB mode. err = uc_emu_start(uc, ADDRESS | 1, ADDRESS + sizeof(THUMB_CODE) -1, 0, 0); if (err) { printf("Failed on uc_emu_start() with error returned: %u\n", err); } // now print out some registers printf(">>> Emulation done. Below is the CPU context\n"); uc_reg_read(uc, UC_ARM_REG_SP, &sp); printf(">>> SP = 0x%x\n", sp); uc_close(uc); }
static void test_mips_el(void) { uc_engine *uc; uc_err err; uc_hook trace1, trace2; int r1 = 0x6789; // R1 register printf("===========================\n"); printf("Emulate MIPS code (little-endian)\n"); // Initialize emulator in MIPS mode err = uc_open(UC_ARCH_MIPS, UC_MODE_MIPS32, &uc); if (err) { printf("Failed on uc_open() with error returned: %u (%s)\n", err, uc_strerror(err)); return; } // map 2MB memory for this emulation uc_mem_map(uc, ADDRESS, 2 * 1024 * 1024, UC_PROT_ALL); // write machine code to be emulated to memory uc_mem_write(uc, ADDRESS, MIPS_CODE_EL, sizeof(MIPS_CODE_EL) - 1); // initialize machine registers uc_reg_write(uc, UC_MIPS_REG_1, &r1); // tracing all basic blocks with customized callback uc_hook_add(uc, &trace1, UC_HOOK_BLOCK, hook_block, NULL, (uint64_t)1, (uint64_t)0); // tracing one instruction at ADDRESS with customized callback uc_hook_add(uc, &trace2, UC_HOOK_CODE, hook_code, NULL, (uint64_t)ADDRESS, (uint64_t)ADDRESS); // emulate machine code in infinite time (last param = 0), or when // finishing all the code. err = uc_emu_start(uc, ADDRESS, ADDRESS + sizeof(MIPS_CODE_EL) - 1, 0, 0); if (err) { printf("Failed on uc_emu_start() with error returned: %u (%s)\n", err, uc_strerror(err)); } // now print out some registers printf(">>> Emulation done. Below is the CPU context\n"); uc_reg_read(uc, UC_MIPS_REG_1, &r1); printf(">>> R1 = 0x%x\n", r1); uc_close(uc); }
static void test_x86_64_syscall(void **state) { uc_engine *uc; uc_hook trace1; uc_err err; static const uint64_t address = 0x1000000; static const uint8_t code[] = { 0x0F, 0x05, // SYSCALL }; int64_t rax = 0x100; // Initialize emulator in X86-64bit mode err = uc_open(UC_ARCH_X86, UC_MODE_64, &uc); uc_assert_success(err); // map 2MB memory for this emulation err = uc_mem_map(uc, address, 2 * 1024 * 1024, UC_PROT_ALL); uc_assert_success(err); // write machine code to be emulated to memory err = uc_mem_write(uc, address, code, sizeof(code)); uc_assert_success(err); // hook interrupts for syscall err = uc_hook_add(uc, &trace1, UC_HOOK_INSN, hook_syscall, NULL, 1, 0, UC_X86_INS_SYSCALL); uc_assert_success(err); // initialize machine registers err = uc_reg_write(uc, UC_X86_REG_RAX, &rax); uc_assert_success(err); // emulate machine code in infinite time (last param = 0), or when // finishing all the code. err = uc_emu_start(uc, address, address + sizeof(code), 0, 0); uc_assert_success(err); // verify register values uc_assert_success(uc_reg_read(uc, UC_X86_REG_RAX, &rax)); assert_int_equal(0x200, rax); uc_assert_success(uc_close(uc)); }
bool hook_mem_rw(uc_engine *uc, uc_mem_type type, uint64_t address, int size, int64_t value, void *user_data) { unsigned int EIP; uc_reg_read(uc, UC_X86_REG_EIP, &EIP); switch(type) { default: return false; break; case UC_MEM_WRITE: printf("Hooked write to address 0x%08"PRIX64" with value 0x%08"PRIX64" at EIP %08X\n", address, value, EIP); return true; break; case UC_MEM_READ: printf("Hooked read from address 0x%08"PRIX64" with value 0x%08"PRIX64" at EIP %08X\n", address, value, EIP); return true; break; } }
// callback for IN instruction (X86). // this returns the data read from the port static uint32_t hook_in(uc_engine *uc, uint32_t port, int size, void *user_data) { uint32_t eip; uc_reg_read(uc, UC_X86_REG_EIP, &eip); //printf("--- reading from port 0x%x, size: %u, address: 0x%x\n", port, size, eip); switch(size) { default: return 0; // should never reach this case 1: // read 1 byte to AL return 0xf1; case 2: // read 2 byte to AX return 0xf2; case 4: // read 4 byte to EAX return 0xf4; } }
static void print_registers(uc_engine *uc) { int32_t eax, ecx, edx, ebx; int32_t esp, ebp, esi, edi; uc_reg_read(uc, UC_X86_REG_EAX, &eax); uc_reg_read(uc, UC_X86_REG_ECX, &ecx); uc_reg_read(uc, UC_X86_REG_EDX, &edx); uc_reg_read(uc, UC_X86_REG_EBX, &ebx); uc_reg_read(uc, UC_X86_REG_ESP, &esp); uc_reg_read(uc, UC_X86_REG_EBP, &ebp); uc_reg_read(uc, UC_X86_REG_ESI, &esi); uc_reg_read(uc, UC_X86_REG_EDI, &edi); printf("Register dump:\n"); printf("eax %8.8x ", eax); printf("ecx %8.8x ", ecx); printf("edx %8.8x ", edx); printf("ebx %8.8x\n", ebx); printf("esp %8.8x ", esp); printf("ebp %8.8x ", ebp); printf("esi %8.8x ", esi); printf("edi %8.8x ", edi); printf("\n"); }
//if a read is performed from a big address whith a non-zero last digit, 0 will be read static void test_high_address_read_values(void **state) { uc_engine *uc = *state; uint64_t addr = 0x0010000000000001; //addr = 0x000ffffffffffff8; // uncomment to fix wrong behaviour //addr = 90000000; // uncomment to fix wrong behaviour // uint8_t content[] = {0x42,0x42,0x42,0x42, 0x42,0x42,0x42,0x42}; uc_assert_success(uc_mem_map(uc, addr-(addr%4096), 4096*2, UC_PROT_ALL)); uc_assert_success(uc_mem_write(uc, addr, content, 8)); uc_assert_success(uc_reg_write(uc, UC_X86_REG_RAX, &addr)); const uint64_t base_addr = 0x40000; uint8_t code[] = {0x48,0x8b,0x00,0x90,0x90,0x90,0x90}; // mov rax, [rax], nops uc_assert_success(uc_mem_map(uc, base_addr, 4096, UC_PROT_ALL)); uc_assert_success(uc_mem_write(uc, base_addr, code, 7)); uc_assert_success(uc_emu_start(uc, base_addr, base_addr + 3, 0, 0)); uint64_t rax = 0; uc_assert_success(uc_reg_read(uc, UC_X86_REG_RAX, &rax)); if(rax != 0x4242424242424242) { fail_msg("wrong memory read from code %"PRIx64, rax); } }
static void test_i386(void) { uc_engine *uc; uc_err err; uint32_t tmp; uc_hook trace1, trace2; int r_ecx = 0x1234; // ECX register int r_edx = 0x7890; // EDX register // XMM0 and XMM1 registers, low qword then high qword uint64_t r_xmm0[2] = {0x08090a0b0c0d0e0f, 0x0001020304050607}; uint64_t r_xmm1[2] = {0x8090a0b0c0d0e0f0, 0x0010203040506070}; printf("Emulate i386 code\n"); // Initialize emulator in X86-32bit mode err = uc_open(UC_ARCH_X86, UC_MODE_32, &uc); if (err) { printf("Failed on uc_open() with error returned: %u\n", err); return; } // map 2MB memory for this emulation uc_mem_map(uc, ADDRESS, 2 * 1024 * 1024, UC_PROT_ALL); // write machine code to be emulated to memory if (uc_mem_write(uc, ADDRESS, X86_CODE32, sizeof(X86_CODE32) - 1)) { printf("Failed to write emulation code to memory, quit!\n"); return; } // initialize machine registers uc_reg_write(uc, UC_X86_REG_ECX, &r_ecx); uc_reg_write(uc, UC_X86_REG_EDX, &r_edx); uc_reg_write(uc, UC_X86_REG_XMM0, &r_xmm0); uc_reg_write(uc, UC_X86_REG_XMM1, &r_xmm1); // tracing all basic blocks with customized callback uc_hook_add(uc, &trace1, UC_HOOK_BLOCK, hook_block, NULL, 1, 0); // tracing all instruction by having @begin > @end uc_hook_add(uc, &trace2, UC_HOOK_CODE, hook_code, NULL, 1, 0); // emulate machine code in infinite time err = uc_emu_start(uc, ADDRESS, ADDRESS + sizeof(X86_CODE32) - 1, 0, 0); if (err) { printf("Failed on uc_emu_start() with error returned %u: %s\n", err, uc_strerror(err)); } // now print out some registers printf(">>> Emulation done. Below is the CPU context\n"); uc_reg_read(uc, UC_X86_REG_ECX, &r_ecx); uc_reg_read(uc, UC_X86_REG_EDX, &r_edx); uc_reg_read(uc, UC_X86_REG_XMM0, &r_xmm0); printf(">>> ECX = 0x%x\n", r_ecx); printf(">>> EDX = 0x%x\n", r_edx); printf(">>> XMM0 = 0x%.16"PRIx64"%.16"PRIx64"\n", r_xmm0[1], r_xmm0[0]); // read from memory if (!uc_mem_read(uc, ADDRESS, &tmp, sizeof(tmp))) printf(">>> Read 4 bytes from [0x%x] = 0x%x\n", ADDRESS, tmp); else printf(">>> Failed to read 4 bytes from [0x%x]\n", ADDRESS); uc_close(uc); }
static void test_i386_map_ptr(void) { uc_engine *uc; uc_err err; uint32_t tmp; uc_hook trace1, trace2; void *mem; int r_ecx = 0x1234; // ECX register int r_edx = 0x7890; // EDX register printf("===================================\n"); printf("Emulate i386 code - use uc_mem_map_ptr()\n"); // Initialize emulator in X86-32bit mode err = uc_open(UC_ARCH_X86, UC_MODE_32, &uc); if (err) { printf("Failed on uc_open() with error returned: %u\n", err); return; } // malloc 2MB memory for this emulation mem = calloc(1, 2 * 1024 * 1024); if (mem == NULL) { printf("Failed to malloc()\n"); return; } uc_mem_map_ptr(uc, ADDRESS, 2 * 1024 * 1024, UC_PROT_ALL, mem); // write machine code to be emulated to memory if (!memcpy(mem, X86_CODE32, sizeof(X86_CODE32) - 1)) { printf("Failed to write emulation code to memory, quit!\n"); return; } // initialize machine registers uc_reg_write(uc, UC_X86_REG_ECX, &r_ecx); uc_reg_write(uc, UC_X86_REG_EDX, &r_edx); // tracing all basic blocks with customized callback uc_hook_add(uc, &trace1, UC_HOOK_BLOCK, hook_block, NULL, 1, 0); // tracing all instruction by having @begin > @end uc_hook_add(uc, &trace2, UC_HOOK_CODE, hook_code, NULL, 1, 0); // emulate machine code in infinite time err = uc_emu_start(uc, ADDRESS, ADDRESS + sizeof(X86_CODE32) - 1, 0, 0); if (err) { printf("Failed on uc_emu_start() with error returned %u: %s\n", err, uc_strerror(err)); } // now print out some registers printf(">>> Emulation done. Below is the CPU context\n"); uc_reg_read(uc, UC_X86_REG_ECX, &r_ecx); uc_reg_read(uc, UC_X86_REG_EDX, &r_edx); printf(">>> ECX = 0x%x\n", r_ecx); printf(">>> EDX = 0x%x\n", r_edx); // read from memory if (!uc_mem_read(uc, ADDRESS, &tmp, sizeof(tmp))) printf(">>> Read 4 bytes from [0x%x] = 0x%x\n", ADDRESS, tmp); else printf(">>> Failed to read 4 bytes from [0x%x]\n", ADDRESS); uc_close(uc); }
int main(int argc, char **argv, char **envp) { uc_engine *uc; uc_err err; uc_hook hhc; uint32_t val; // dynamically load shared library #ifdef DYNLOAD uc_dyn_load(NULL, 0); #endif // Initialize emulator in MIPS 32bit little endian mode printf("uc_open()\n"); err = uc_open(UC_ARCH_MIPS, UC_MODE_MIPS32, &uc); if (err) { printf("Failed on uc_open() with error returned: %u\n", err); return err; } // map in a page of mem printf("uc_mem_map()\n"); err = uc_mem_map(uc, addr, 0x1000, UC_PROT_ALL); if (err) { printf("Failed on uc_mem_map() with error returned: %u\n", err); return err; } // hook all instructions by having @begin > @end printf("uc_hook_add()\n"); uc_hook_add(uc, &hhc, UC_HOOK_CODE, mips_codehook, NULL, (uint64_t)1, (uint64_t)0); if( err ) { printf("Failed on uc_hook_add(code) with error returned: %u\n", err); return err; } // write test1 code to be emulated to memory test_num = 1; printf("\nuc_mem_write(1)\n"); err = uc_mem_write(uc, addr, test_code_1, sizeof(test_code_1)); if( err ) { printf("Failed on uc_mem_write() with error returned: %u\n", err); return err; } // start executing test code 1 printf("uc_emu_start(1)\n"); uc_emu_start(uc, addr, addr+sizeof(test_code_1), 0, 0); // read the value from a0 when finished executing uc_reg_read(uc, UC_MIPS_REG_A0, &val); printf("a0 is %X\n", val); if( val != 0 ) test1_delayslot_executed = true; // write test2 code to be emulated to memory test_num = 2; printf("\nuc_mem_write(2)\n"); err = uc_mem_write(uc, addr, test_code_2, sizeof(test_code_2)); if( err ) { printf("Failed on uc_mem_write() with error returned: %u\n", err); return err; } // start executing test code 2 printf("uc_emu_start(2)\n"); uc_emu_start(uc, addr, addr+sizeof(test_code_2), 0, 0); // read the value from a0 when finished executing uc_reg_read(uc, UC_MIPS_REG_A0, &val); printf("a0 is %X\n", val); if( val != 0 ) test2_delayslot_executed = true; // free resources printf("\nuc_close()\n"); uc_close(uc); // print test results printf("\n\nTest 1 SHOULD execute the delay slot instruction:\n"); printf(" Emulator %s execute the delay slot: %s\n", test1_delayslot_executed ? "did" : "did not", test1_delayslot_executed ? "CORRECT" : "WRONG"); printf(" Emulator %s hook the delay slot: %s\n", test1_delayslot_hooked ? "did" : "did not", test1_delayslot_hooked ? "CORRECT" : "WRONG"); printf("\n\nTest 2 SHOULD NOT execute the delay slot instruction:\n"); printf(" Emulator %s execute the delay slot: %s\n", test2_delayslot_executed ? "did" : "did not", !test2_delayslot_executed ? "CORRECT" : "WRONG"); printf(" Emulator %s hook the delay slot: %s\n", test2_delayslot_hooked ? "did" : "did not", !test2_delayslot_hooked ? "CORRECT" : "WRONG"); // test 1 SHOULD execute the instruction in the delay slot if( test1_delayslot_hooked == true && test1_delayslot_executed == true ) printf("\n\nTEST 1 PASSED!\n"); else printf("\n\nTEST 1 FAILED!\n"); // test 2 SHOULD NOT execute the instruction in the delay slot if( test2_delayslot_hooked == false && test2_delayslot_executed == false ) printf("TEST 2 PASSED!\n\n"); else printf("TEST 2 FAILED!\n\n"); // dynamically free shared library #ifdef DYNLOAD uc_dyn_free(); #endif return 0; }
static void test_low_paging(void **state) { uc_engine *uc; uc_err err; int r_eax; /* The following x86 code will map emulated physical memory to virtual memory using pages and attempt to read/write from virtual memory Specifically, the virtual memory address range has been mapped by Unicorn (0x7FF000 - 0x7FFFFF) Memory area purposes: 0x1000 = page directory 0x2000 = page table (identity map first 4 MiB) 0x3000 = page table (0x007FF000 -> 0x00004000) 0x4000 = data area (0xBEEF) */ const uint8_t code[] = { /* Zero memory for page directories and page tables */ 0xBF, 0x00, 0x10, 0x00, 0x00, /* MOV EDI, 0x1000 */ 0xB9, 0x00, 0x10, 0x00, 0x00, /* MOV ECX, 0x1000 */ 0x31, 0xC0, /* XOR EAX, EAX */ 0xF3, 0xAB, /* REP STOSD */ /* Load DWORD [0x4000] with 0xDEADBEEF to retrieve later */ 0xBF, 0x00, 0x40, 0x00, 0x00, /* MOV EDI, 0x4000 */ 0xB8, 0xEF, 0xBE, 0x00, 0x00, /* MOV EAX, 0xBEEF */ 0x89, 0x07, /* MOV [EDI], EAX */ /* Identity map the first 4MiB of memory */ 0xB9, 0x00, 0x04, 0x00, 0x00, /* MOV ECX, 0x400 */ 0xBF, 0x00, 0x20, 0x00, 0x00, /* MOV EDI, 0x2000 */ 0xB8, 0x03, 0x00, 0x00, 0x00, /* MOV EAX, 3 */ /* aLoop: */ 0xAB, /* STOSD */ 0x05, 0x00, 0x10, 0x00, 0x00, /* ADD EAX, 0x1000 */ 0xE2, 0xF8, /* LOOP aLoop */ /* Map physical address 0x4000 to virtual address 0x7FF000 */ 0xBF, 0xFC, 0x3F, 0x00, 0x00, /* MOV EDI, 0x3FFC */ 0xB8, 0x03, 0x40, 0x00, 0x00, /* MOV EAX, 0x4003 */ 0x89, 0x07, /* MOV [EDI], EAX */ /* Add page tables into page directory */ 0xBF, 0x00, 0x10, 0x00, 0x00, /* MOV EDI, 0x1000 */ 0xB8, 0x03, 0x20, 0x00, 0x00, /* MOV EAX, 0x2003 */ 0x89, 0x07, /* MOV [EDI], EAX */ 0xBF, 0x04, 0x10, 0x00, 0x00, /* MOV EDI, 0x1004 */ 0xB8, 0x03, 0x30, 0x00, 0x00, /* MOV EAX, 0x3003 */ 0x89, 0x07, /* MOV [EDI], EAX */ /* Load the page directory register */ 0xB8, 0x00, 0x10, 0x00, 0x00, /* MOV EAX, 0x1000 */ 0x0F, 0x22, 0xD8, /* MOV CR3, EAX */ /* Enable paging */ 0x0F, 0x20, 0xC0, /* MOV EAX, CR0 */ 0x0D, 0x00, 0x00, 0x00, 0x80, /* OR EAX, 0x80000000 */ 0x0F, 0x22, 0xC0, /* MOV CR0, EAX */ /* Clear EAX */ 0x31, 0xC0, /* XOR EAX, EAX */ /* Load using virtual memory address; EAX = 0xBEEF */ 0xBE, 0x00, 0xF0, 0x7F, 0x00, /* MOV ESI, 0x7FF000 */ 0x8B, 0x06, /* MOV EAX, [ESI] */ 0xF4, /* HLT */ }; /* Initialise X86-32bit mode */ err = uc_open(UC_ARCH_X86, UC_MODE_32, &uc); uc_assert_success(err); /* Map 8MB of memory at base address 0 */ err = uc_mem_map(uc, 0, (8 * 1024 * 1024), UC_PROT_ALL); uc_assert_success(err); /* Write code into memory at address 0 */ err = uc_mem_write(uc, 0, code, sizeof(code)); uc_assert_success(err); /* Start emulation */ err = uc_emu_start(uc, 0, sizeof(code), 0, 0); uc_assert_success(err); /* The code should have loaded 0xBEEF into EAX */ uc_reg_read(uc, UC_X86_REG_EAX, &r_eax); assert_int_equal(r_eax, 0xBEEF); uc_close(uc); }
int main(int argc, char **argv, char **envp) { uc_engine *uc; uc_err err; uc_hook hhc; uint32_t val; // dynamically load shared library #ifdef DYNLOAD uc_dyn_load(NULL, 0); #endif // Initialize emulator in MIPS 32bit little endian mode err = uc_open(UC_ARCH_MIPS, UC_MODE_MIPS32, &uc); if (err) { printf("Failed on uc_open() with error returned: %u\n", err); return err; } // map in a page of mem err = uc_mem_map(uc, addr, 0x1000, UC_PROT_ALL); if (err) { printf("Failed on uc_mem_map() with error returned: %u\n", err); return err; } // write machine code to be emulated to memory err = uc_mem_write(uc, addr, loop_test_code, sizeof(loop_test_code)); if( err ) { printf("Failed on uc_mem_write() with error returned: %u\n", err); return err; } // hook all instructions by having @begin > @end uc_hook_add(uc, &hhc, UC_HOOK_CODE, mips_codehook, NULL, (uint64_t)1, (uint64_t)0); if( err ) { printf("Failed on uc_hook_add(code) with error returned: %u\n", err); return err; } // execute code printf("---- Executing Code ----\n"); err = uc_emu_start(uc, addr, addr + sizeof(loop_test_code), 0, 0); if (err) { printf("Failed on uc_emu_start() with error returned %u: %s\n", err, uc_strerror(err)); return err; } // done executing, print some reg values as a test printf("---- Execution Complete ----\n\n"); uc_reg_read(uc, UC_MIPS_REG_PC, &val); printf("pc is %X\n", val); uc_reg_read(uc, UC_MIPS_REG_A0, &val); printf("a0 is %X\n", val); // free resources uc_close(uc); if( test_passed_ok ) printf("\n\nTEST PASSED!\n\n"); else printf("\n\nTEST FAILED!\n\n"); // dynamically free shared library #ifdef DYNLOAD uc_dyn_free(); #endif return 0; }
static void test_i386_reg_save(void **state) { uc_engine *uc; uc_context *saved_context; static const uint64_t address = 0; static const uint8_t code[] = { 0x40 // inc eax }; int32_t eax = 1; // Initialize emulator uc_assert_success(uc_open(UC_ARCH_X86, UC_MODE_32, &uc)); // map 8KB memory for this emulation uc_assert_success(uc_mem_map(uc, address, 8 * 1024, UC_PROT_ALL)); // write machine code to be emulated to memory uc_assert_success(uc_mem_write(uc, address, code, sizeof(code))); // set eax to 1 uc_assert_success(uc_reg_write(uc, UC_X86_REG_EAX, &eax)); // step one instruction uc_assert_success(uc_emu_start(uc, address, address+1, 0, 0)); // grab a buffer to use for state saving uc_assert_success(uc_context_alloc(uc, &saved_context)); // save the state uc_assert_success(uc_context_save(uc, saved_context)); // step one instruction uc_assert_success(uc_emu_start(uc, address, address+1, 0, 0)); // check that eax == 3 uc_assert_success(uc_reg_read(uc, UC_X86_REG_EAX, &eax)); assert_int_equal(eax, 3); // restore the state uc_context_restore(uc, saved_context); // check that eax == 2 uc_assert_success(uc_reg_read(uc, UC_X86_REG_EAX, &eax)); assert_int_equal(eax, 2); // step one instruction uc_assert_success(uc_emu_start(uc, address, address+1, 0, 0)); // check that eax == 3 uc_assert_success(uc_reg_read(uc, UC_X86_REG_EAX, &eax)); assert_int_equal(eax, 3); // restore the state uc_context_restore(uc, saved_context); // check that eax == 2 uc_assert_success(uc_reg_read(uc, UC_X86_REG_EAX, &eax)); assert_int_equal(eax, 2); // clean up; uc_context_free(saved_context); uc_assert_success(uc_close(uc)); }
int main(int argc, char **argv, char **envp) { uc_engine *uc; uc_err err; int ret; uc_hook hhc; uint32_t val; EmuStarterParam_t starter_params; #ifdef _WIN32 HANDLE th = (HANDLE)-1; #else pthread_t th; #endif // dynamically load shared library #ifdef DYNLOAD uc_dyn_load(NULL, 0); #endif // Initialize emulator in MIPS 32bit little endian mode printf("uc_open()\n"); err = uc_open(UC_ARCH_MIPS, UC_MODE_MIPS32, &uc); if (err) { printf("Failed on uc_open() with error returned: %u\n", err); return err; } // map in a page of mem printf("uc_mem_map()\n"); err = uc_mem_map(uc, addr, 0x1000, UC_PROT_ALL); if (err) { printf("Failed on uc_mem_map() with error returned: %u\n", err); return err; } // write machine code to be emulated to memory printf("uc_mem_write()\n"); err = uc_mem_write(uc, addr, loop_test_code, sizeof(loop_test_code)); if( err ) { printf("Failed on uc_mem_write() with error returned: %u\n", err); return err; } // hook all instructions by having @begin > @end printf("uc_hook_add()\n"); uc_hook_add(uc, &hhc, UC_HOOK_CODE, mips_codehook, NULL, 1, 0); if( err ) { printf("Failed on uc_hook_add(code) with error returned: %u\n", err); return err; } // start background thread printf("---- Thread Starting ----\n"); starter_params.uc = uc; starter_params.startAddr = addr; starter_params.endAddr = addr + sizeof(loop_test_code); #ifdef _WIN32 // create thread th = (HANDLE)_beginthreadex(NULL, 0, win32_emu_starter, &starter_params, CREATE_SUSPENDED, NULL); if(th == (HANDLE)-1) { printf("Failed on _beginthreadex() with error returned: %u\n", _errno()); return -1; } // start thread ret = ResumeThread(th); if( ret == -1 ) { printf("Failed on ResumeThread() with error returned: %u\n", _errno()); return -2; } // wait 3 seconds Sleep(3 * 1000); #else // add posix code to start the emu_starter() thread ret = pthread_create(&th, NULL, posix_emu_starter, &starter_params); if( ret ) { printf("Failed on pthread_create() with error returned: %u\n", err); return -2; } // wait 3 seconds sleep(3); #endif // Stop the thread after it has been let to run in the background for a while printf("---- Thread Stopping ----\n"); printf("uc_emu_stop()\n"); err = uc_emu_stop(uc); if( err ) { printf("Failed on uc_emu_stop() with error returned: %u\n", err); return err; } test_passed_ok = true; // done executing, print some reg values as a test uc_reg_read(uc, UC_MIPS_REG_PC, &val); printf("pc is %X\n", val); uc_reg_read(uc, UC_MIPS_REG_A0, &val); printf("a0 is %X\n", val); // free resources printf("uc_close()\n"); uc_close(uc); if( test_passed_ok ) printf("\n\nTEST PASSED!\n\n"); else printf("\n\nTEST FAILED!\n\n"); // dynamically free shared library #ifdef DYNLOAD uc_dyn_free(); #endif return 0; }
static void test_i386_inout(void **state) { uc_engine *uc; uc_err err; uc_hook trace1, trace2, trace3, trace4; int r_eax = 0x1234; // EAX register int r_ecx = 0x6789; // ECX register static const uint64_t address = 0x1000000; static const uint8_t code[] = { 0x41, // inc ecx 0xE4, 0x3F, // in al, 0x3F 0x4A, // dec edx 0xE6, 0x46, // out 0x46, al 0x43, // inc ebx }; // Initialize emulator in X86-32bit mode err = uc_open(UC_ARCH_X86, UC_MODE_32, &uc); uc_assert_success(err); // map 2MB memory for this emulation err = uc_mem_map(uc, address, 2 * 1024 * 1024, UC_PROT_ALL); uc_assert_success(err); // write machine code to be emulated to memory err = uc_mem_write(uc, address, code, sizeof(code)); uc_assert_success(err); // initialize machine registers err = uc_reg_write(uc, UC_X86_REG_EAX, &r_eax); uc_assert_success(err); err = uc_reg_write(uc, UC_X86_REG_ECX, &r_ecx); uc_assert_success(err); // tracing all basic blocks with customized callback err = uc_hook_add(uc, &trace1, UC_HOOK_BLOCK, hook_block, NULL, 1, 0); uc_assert_success(err); // tracing all instructions err = uc_hook_add(uc, &trace2, UC_HOOK_CODE, hook_code, NULL, 1, 0); uc_assert_success(err); // uc IN instruction err = uc_hook_add(uc, &trace3, UC_HOOK_INSN, hook_in, NULL, 1, 0, UC_X86_INS_IN); uc_assert_success(err); // uc OUT instruction err = uc_hook_add(uc, &trace4, UC_HOOK_INSN, hook_out, NULL, 1, 0, UC_X86_INS_OUT); uc_assert_success(err); // emulate machine code in infinite time err = uc_emu_start(uc, address, address+sizeof(code), 0, 0); uc_assert_success(err); uc_reg_read(uc, UC_X86_REG_EAX, &r_eax); uc_reg_read(uc, UC_X86_REG_ECX, &r_ecx); //printf(">>> EAX = 0x%x\n", r_eax); //printf(">>> ECX = 0x%x\n", r_ecx); // TODO: Assert on the register values here uc_assert_success(uc_close(uc)); }
static void test_basic_blocks(void **state) { uc_engine *uc = *state; uc_hook trace1; #define BASEADDR 0x1000000 uint64_t address = BASEADDR; const uint8_t code[] = { 0x33, 0xC0, // xor eax, eax 0x90, // nop 0x90, // nop 0xEB, 0x00, // jmp $+2 0x90, // nop 0x90, // nop 0x90, // nop }; static const struct bb blocks[] = { {BASEADDR, 6}, {BASEADDR+ 6, 3}, }; struct bbtest bbtest = { .blocks = blocks, .blocknum = 0, }; #undef BASEADDR // map 2MB memory for this emulation OK(uc_mem_map(uc, address, 2 * 1024 * 1024, UC_PROT_ALL)); // write machine code to be emulated to memory OK(uc_mem_write(uc, address, code, sizeof(code))); // trace all basic blocks OK(uc_hook_add(uc, &trace1, UC_HOOK_BLOCK, test_basic_blocks_hook, &bbtest, 1, 0)); OK(uc_emu_start(uc, address, address+sizeof(code), 0, 0)); } /******************************************************************************/ // callback for tracing basic blocks static void hook_block(uc_engine *uc, uint64_t address, uint32_t size, void *user_data) { //printf(">>> Tracing basic block at 0x%"PRIx64 ", block size = 0x%x\n", address, size); } // callback for tracing instruction static void hook_code(uc_engine *uc, uint64_t address, uint32_t size, void *user_data) { //int eflags; //printf(">>> Tracing instruction at 0x%"PRIx64 ", instruction size = 0x%x\n", address, size); //uc_reg_read(uc, UC_X86_REG_EFLAGS, &eflags); //printf(">>> --- EFLAGS is 0x%x\n", eflags); // Uncomment below code to stop the emulation using uc_emu_stop() // if (address == 0x1000009) // uc_emu_stop(uc); } static void test_i386(void **state) { uc_engine *uc; uc_err err; uint32_t tmp; uc_hook trace1, trace2; const uint8_t code[] = "\x41\x4a"; // INC ecx; DEC edx const uint64_t address = 0x1000000; int r_ecx = 0x1234; // ECX register int r_edx = 0x7890; // EDX register // Initialize emulator in X86-32bit mode err = uc_open(UC_ARCH_X86, UC_MODE_32, &uc); uc_assert_success(err); // map 2MB memory for this emulation err = uc_mem_map(uc, address, 2 * 1024 * 1024, UC_PROT_ALL); uc_assert_success(err); // write machine code to be emulated to memory err = uc_mem_write(uc, address, code, sizeof(code)-1); uc_assert_success(err); // initialize machine registers err = uc_reg_write(uc, UC_X86_REG_ECX, &r_ecx); uc_assert_success(err); err = uc_reg_write(uc, UC_X86_REG_EDX, &r_edx); uc_assert_success(err); // tracing all basic blocks with customized callback err = uc_hook_add(uc, &trace1, UC_HOOK_BLOCK, hook_block, NULL, 1, 0); uc_assert_success(err); // tracing all instruction by having @begin > @end err = uc_hook_add(uc, &trace2, UC_HOOK_CODE, hook_code, NULL, 1, 0); uc_assert_success(err); // emulate machine code in infinite time err = uc_emu_start(uc, address, address+sizeof(code)-1, 0, 0); uc_assert_success(err); // now print out some registers //printf(">>> Emulation done. Below is the CPU context\n"); uc_reg_read(uc, UC_X86_REG_ECX, &r_ecx); uc_reg_read(uc, UC_X86_REG_EDX, &r_edx); assert_int_equal(r_ecx, 0x1235); assert_int_equal(r_edx, 0x788F); // read from memory err = uc_mem_read(uc, address, (uint8_t *)&tmp, 4); uc_assert_success(err); //printf(">>> Read 4 bytes from [0x%"PRIX64"] = 0x%x\n", address, tmp); uc_close(uc); }
int main(int argc, char *argv[]) { uc_engine *uc; uc_hook trace; uc_err err; unsigned int EAX, ESP, val = 0x0c0c0c0c, stkval = STACK; EAX = 0; ESP = STACK+0x4; // Initialize emulator in X86-64bit mode err = uc_open(UC_ARCH_X86, UC_MODE_32, &uc); if(err) { printf("Failed on uc_open() with error returned: %s\n", uc_strerror(err)); return 1; } err = uc_mem_map(uc, ADDRESS, SIZE, UC_PROT_ALL); if(err != UC_ERR_OK) { printf("Failed to map memory %s\n", uc_strerror(err)); return 1; } err = uc_mem_write(uc, ADDRESS, CODE32, sizeof(CODE32) - 1); if(err != UC_ERR_OK) { printf("Failed to write to memory %s\n", uc_strerror(err)); return 1; } loop: err = uc_mem_map(uc, stkval, STACK_SIZE, UC_PROT_ALL); if(err != UC_ERR_OK) { printf("Failed to map memory %s\n", uc_strerror(err)); return 1; } err = uc_mem_write(uc, ESP, &val, sizeof(val)); if(err != UC_ERR_OK) { printf("Failed to write to memory %s\n", uc_strerror(err)); return 1; } uc_hook_add(uc, &trace, UC_HOOK_MEM_WRITE | UC_HOOK_MEM_READ, (void *)hook_mem_rw, NULL); uc_reg_write(uc, UC_X86_REG_EAX, &EAX); uc_reg_write(uc, UC_X86_REG_ESP, &ESP); err = uc_emu_start(uc, ADDRESS, ADDRESS + (sizeof(CODE32) - 1), 0, 0); if(err) { printf("Failed on uc_emu_start() with error returned %u: %s\n", err, uc_strerror(err)); uc_close(uc); return 1; } uc_reg_read(uc, UC_X86_REG_EAX, &EAX); printf(">>> EAX = %08X\n", EAX); if(stkval != STACK2) { printf("=== Beginning test two ===\n"); ESP = STACK2+0x4; EAX = 0; stkval = STACK2; goto loop; } uc_close(uc); return 0; }
static void test_i386_inout(void) { uc_engine *uc; uc_err err; uc_hook trace1, trace2, trace3, trace4; int r_eax = 0x1234; // EAX register int r_ecx = 0x6789; // ECX register printf("===================================\n"); printf("Emulate i386 code with IN/OUT instructions\n"); // Initialize emulator in X86-32bit mode err = uc_open(UC_ARCH_X86, UC_MODE_32, &uc); if (err) { printf("Failed on uc_open() with error returned: %u\n", err); return; } // map 2MB memory for this emulation uc_mem_map(uc, ADDRESS, 2 * 1024 * 1024, UC_PROT_ALL); // write machine code to be emulated to memory if (uc_mem_write(uc, ADDRESS, X86_CODE32_INOUT, sizeof(X86_CODE32_INOUT) - 1)) { printf("Failed to write emulation code to memory, quit!\n"); return; } // initialize machine registers uc_reg_write(uc, UC_X86_REG_EAX, &r_eax); uc_reg_write(uc, UC_X86_REG_ECX, &r_ecx); // tracing all basic blocks with customized callback uc_hook_add(uc, &trace1, UC_HOOK_BLOCK, hook_block, NULL, 1, 0); // tracing all instructions uc_hook_add(uc, &trace2, UC_HOOK_CODE, hook_code, NULL, 1, 0); // uc IN instruction uc_hook_add(uc, &trace3, UC_HOOK_INSN, hook_in, NULL, 1, 0, UC_X86_INS_IN); // uc OUT instruction uc_hook_add(uc, &trace4, UC_HOOK_INSN, hook_out, NULL, 1, 0, UC_X86_INS_OUT); // emulate machine code in infinite time err = uc_emu_start(uc, ADDRESS, ADDRESS + sizeof(X86_CODE32_INOUT) - 1, 0, 0); if (err) { printf("Failed on uc_emu_start() with error returned %u: %s\n", err, uc_strerror(err)); } // now print out some registers printf(">>> Emulation done. Below is the CPU context\n"); uc_reg_read(uc, UC_X86_REG_EAX, &r_eax); uc_reg_read(uc, UC_X86_REG_ECX, &r_ecx); printf(">>> EAX = 0x%x\n", r_eax); printf(">>> ECX = 0x%x\n", r_ecx); uc_close(uc); }
// emulate code and save/restore the CPU context static void test_i386_context_save(void) { uc_engine *uc; uc_context *context; uc_err err; int r_eax = 0x1; // EAX register printf("===================================\n"); printf("Save/restore CPU context in opaque blob\n"); // initialize emulator in X86-32bit mode err = uc_open(UC_ARCH_X86, UC_MODE_32, &uc); if (err) { printf("Failed on uc_open() with error returned: %u\n", err); return; } // map 8KB memory for this emulation uc_mem_map(uc, ADDRESS, 8 * 1024, UC_PROT_ALL); // write machine code to be emulated to memory if (uc_mem_write(uc, ADDRESS, X86_CODE32_INC, sizeof(X86_CODE32_INC) - 1)) { printf("Failed to write emulation code to memory, quit!\n"); return; } // initialize machine registers uc_reg_write(uc, UC_X86_REG_EAX, &r_eax); // emulate machine code in infinite time printf(">>> Running emulation for the first time\n"); err = uc_emu_start(uc, ADDRESS, ADDRESS + sizeof(X86_CODE32_INC) - 1, 0, 0); if (err) { printf("Failed on uc_emu_start() with error returned %u: %s\n", err, uc_strerror(err)); } // now print out some registers printf(">>> Emulation done. Below is the CPU context\n"); uc_reg_read(uc, UC_X86_REG_EAX, &r_eax); printf(">>> EAX = 0x%x\n", r_eax); // allocate and save the CPU context printf(">>> Saving CPU context\n"); err = uc_context_alloc(uc, &context); if (err) { printf("Failed on uc_context_alloc() with error returned: %u\n", err); return; } err = uc_context_save(uc, context); if (err) { printf("Failed on uc_context_save() with error returned: %u\n", err); return; } // emulate machine code again printf(">>> Running emulation for the second time\n"); err = uc_emu_start(uc, ADDRESS, ADDRESS + sizeof(X86_CODE32_INC) - 1, 0, 0); if (err) { printf("Failed on uc_emu_start() with error returned %u: %s\n", err, uc_strerror(err)); } // now print out some registers printf(">>> Emulation done. Below is the CPU context\n"); uc_reg_read(uc, UC_X86_REG_EAX, &r_eax); printf(">>> EAX = 0x%x\n", r_eax); // restore CPU context err = uc_context_restore(uc, context); if (err) { printf("Failed on uc_context_restore() with error returned: %u\n", err); return; } // now print out some registers printf(">>> CPU context restored. Below is the CPU context\n"); uc_reg_read(uc, UC_X86_REG_EAX, &r_eax); printf(">>> EAX = 0x%x\n", r_eax); // free the CPU context err = uc_context_free(context); if (err) { printf("Failed on uc_context_free() with error returned: %u\n", err); return; } uc_close(uc); }
static void VM_exec() { uc_engine *uc; uc_err err; uint32_t tmp; uc_hook trace1, trace2; unsigned int r_eax, r_ebx, r_ecx, r_edx, r_ebp, r_esp, r_esi, r_edi, r_eip, eflags; unsigned int tr_eax, tr_ebx, tr_ecx, tr_edx, tr_ebp, tr_esp, tr_esi, tr_edi, tr_eip, t_eflags; r_eax = tr_eax = 0x1DB10106; r_ebx = tr_ebx = 0x7EFDE000; r_ecx = tr_ecx = 0x7EFDE000; r_edx = tr_edx = 0x00001DB1; r_ebp = tr_ebp = 0x0018FF88; r_esp = tr_esp = 0x0018FF14; r_esi = tr_esi = 0x0; r_edi = tr_edi = 0x0; r_eip = tr_eip = 0x004939F3; t_eflags = eflags = 0x00000206; // Initialize emulator in X86-32bit mode err = uc_open(UC_ARCH_X86, UC_MODE_32, &uc); if(err) { printf("Failed on uc_open() with error returned: %s", uc_strerror(err)); return; } err = uc_mem_map(uc, ADDRESS, (4 * 1024 * 1024), UC_PROT_ALL); if(err != UC_ERR_OK) { printf("Failed to map memory %s", uc_strerror(err)); return; } // write machine code to be emulated to memory err = uc_mem_write(uc, ADDRESS, X86_CODE32, sizeof(X86_CODE32) - 1); if(err != UC_ERR_OK) { printf("Failed to write emulation code to memory, quit!: %s(len %lu)", uc_strerror(err), sizeof(X86_CODE32) - 1); return; } // initialize machine registers uc_reg_write(uc, UC_X86_REG_EAX, &r_eax); uc_reg_write(uc, UC_X86_REG_EBX, &r_ebx); uc_reg_write(uc, UC_X86_REG_ECX, &r_ecx); uc_reg_write(uc, UC_X86_REG_EDX, &r_edx); uc_reg_write(uc, UC_X86_REG_EBP, &r_ebp); uc_reg_write(uc, UC_X86_REG_ESP, &r_esp); uc_reg_write(uc, UC_X86_REG_ESI, &r_esi); uc_reg_write(uc, UC_X86_REG_EDI, &r_edi); uc_reg_write(uc, UC_X86_REG_EFLAGS, &eflags); uc_hook_add(uc, &trace1, UC_HOOK_MEM_READ_UNMAPPED | UC_HOOK_MEM_WRITE_UNMAPPED, (void *)hook_invalid_mem, NULL, 1, 0); // tracing all instruction by having @begin > @end uc_hook_add(uc, &trace2, UC_HOOK_CODE, (void *)hook_ins, NULL, 1, 0); // emulate machine code in infinite time err = uc_emu_start(uc, ADDRESS, ADDRESS + (sizeof(X86_CODE32) - 1), 0, 0); if(err) { printf("Failed on uc_emu_start() with error returned %u: %s", err, uc_strerror(err)); instructions = 0; uc_close(uc); return; } uc_reg_read(uc, UC_X86_REG_EAX, &r_eax); uc_reg_read(uc, UC_X86_REG_EBX, &r_ebx); uc_reg_read(uc, UC_X86_REG_ECX, &r_ecx); uc_reg_read(uc, UC_X86_REG_EDX, &r_edx); uc_reg_read(uc, UC_X86_REG_EBP, &r_ebp); uc_reg_read(uc, UC_X86_REG_ESP, &r_esp); uc_reg_read(uc, UC_X86_REG_ESI, &r_esi); uc_reg_read(uc, UC_X86_REG_EDI, &r_edi); uc_reg_read(uc, UC_X86_REG_EIP, &r_eip); uc_reg_read(uc, UC_X86_REG_EFLAGS, &eflags); uc_close(uc); printf(">>> Emulation done. Below is the CPU context\n"); printf(">>> EAX = 0x%08X %s\n", r_eax, (r_eax == tr_eax ? "" : "(m)")); printf(">>> EBX = 0x%08X %s\n", r_ebx, (r_ebx == tr_ebx ? "" : "(m)")); printf(">>> ECX = 0x%08X %s\n", r_ecx, (r_ecx == tr_ecx ? "" : "(m)")); printf(">>> EDX = 0x%08X %s\n", r_edx, (r_edx == tr_edx ? "" : "(m)")); printf(">>> EBP = 0x%08X %s\n", r_ebp, (r_ebp == tr_ebp ? "" : "(m)")); printf(">>> ESP = 0x%08X %s\n", r_esp, (r_esp == tr_esp ? "" : "(m)")); printf(">>> ESI = 0x%08X %s\n", r_esi, (r_esi == tr_esi ? "" : "(m)")); printf(">>> EDI = 0x%08X %s\n", r_edi, (r_edi == tr_edi ? "" : "(m)")); printf(">>> EIP = 0x%08X %s\n", (r_eip - ADDRESS) + tr_eip, (r_eip == tr_eip ? "" : "(m)\n")); printf(">>> EFLAGS = 0x%08X %s\n", eflags, (eflags == t_eflags ? "" : "(m)")); printf(">>> Instructions executed %" PRIu64 "\n", instructions); assert(r_eax == 0x1DB10106); assert(r_ebx == 0x7EFDE000); assert(r_ecx == 0x00000006); assert(r_edx == 0x00000001); assert(r_ebp == 0x0018FF88); assert(r_esp == 0x0018FF14); assert(r_esi == 0x00000000); assert(r_edi == 0x00000000); assert(eflags == 0x00000206); //we shouldn't fail this assert, eflags should be 0x00000206 because the last AND instruction produces a non-zero result. instructions = 0; }
int main(int argc, char **argv, char **envp) { uc_engine *uc; uc_hook trace1, trace2; uc_err err; uint32_t esp, eip; int32_t buf1[1024], buf2[1024], readbuf[1024]; int i; //don't really care about quality of randomness srand(time(NULL)); for (i = 0; i < 1024; i++) { buf1[i] = rand(); buf2[i] = rand(); } printf("# Memory protect test\n"); // Initialize emulator in X86-32bit mode err = uc_open(UC_ARCH_X86, UC_MODE_32, &uc); if (err) { printf("not ok %d - Failed on uc_open() with error returned: %u\n", log_num++, err); return 1; } else { printf("ok %d - uc_open() success\n", log_num++); } uc_mem_map(uc, 0x100000, 0x1000, UC_PROT_READ | UC_PROT_EXEC); uc_mem_map(uc, 0x1ff000, 0x2000, UC_PROT_READ | UC_PROT_WRITE); uc_mem_map(uc, 0x300000, 0x2000, UC_PROT_READ); uc_mem_map(uc, 0xf00000, 0x1000, UC_PROT_READ | UC_PROT_WRITE); esp = 0xf00000 + 0x1000; // Setup stack pointer if (uc_reg_write(uc, UC_X86_REG_ESP, &esp)) { printf("not ok %d - Failed to set esp. quit!\n", log_num++); return 2; } else { printf("ok %d - ESP set\n", log_num++); } // fill in sections that shouldn't get touched if (uc_mem_write(uc, 0x1ff000, buf1, sizeof(buf1))) { printf("not ok %d - Failed to write random buffer 1 to memory, quit!\n", log_num++); return 3; } else { printf("ok %d - Random buffer 1 written to memory\n", log_num++); } if (uc_mem_write(uc, 0x301000, buf2, sizeof(buf2))) { printf("not ok %d - Failed to write random buffer 2 to memory, quit!\n", log_num++); return 4; } else { printf("ok %d - Random buffer 2 written to memory\n", log_num++); } // write machine code to be emulated to memory if (uc_mem_write(uc, 0x100000, PROGRAM, sizeof(PROGRAM))) { printf("not ok %d - Failed to write emulation code to memory, quit!\n", log_num++); return 5; } else { printf("ok %d - Program written to memory\n", log_num++); } if (uc_hook_add(uc, &trace2, UC_HOOK_CODE, hook_code, NULL, 1, 0) != UC_ERR_OK) { printf("not ok %d - Failed to install UC_HOOK_CODE ucr\n", log_num++); return 6; } else { printf("ok %d - UC_HOOK_CODE installed\n", log_num++); } // intercept memory write events if (uc_hook_add(uc, &trace1, UC_HOOK_MEM_WRITE, hook_mem_write, NULL, 1, 0) != UC_ERR_OK) { printf("not ok %d - Failed to install UC_HOOK_MEM_WRITE ucr\n", log_num++); return 7; } else { printf("ok %d - UC_HOOK_MEM_WRITE installed\n", log_num++); } // intercept invalid memory events if (uc_hook_add(uc, &trace1, UC_HOOK_MEM_WRITE_PROT | UC_HOOK_MEM_FETCH_PROT, hook_mem_invalid, NULL, 1, 0) != UC_ERR_OK) { printf("not ok %d - Failed to install memory invalid handler\n", log_num++); return 8; } else { printf("ok %d - memory invalid handler installed\n", log_num++); } // emulate machine code until told to stop by hook_code printf("# BEGIN execution\n"); err = uc_emu_start(uc, 0x100000, 0x400000, 0, 0); if (err != UC_ERR_OK) { printf("not ok %d - Failure on uc_emu_start() with error %u:%s\n", log_num++, err, uc_strerror(err)); return 9; } else { printf("ok %d - uc_emu_start complete\n", log_num++); } printf("# END execution\n"); // get ending EIP if (uc_reg_read(uc, UC_X86_REG_EIP, &eip)) { printf("not ok %d - Failed to read eip.\n", log_num++); } else { printf("ok %d - Ending EIP 0x%x\n", log_num++, eip); } //make sure that random blocks didn't get nuked // fill in sections that shouldn't get touched if (uc_mem_read(uc, 0x1ff000, readbuf, sizeof(readbuf))) { printf("not ok %d - Failed to read random buffer 1 from memory\n", log_num++); } else { printf("ok %d - Random buffer 1 read from memory\n", log_num++); if (memcmp(buf1, readbuf, 4096)) { printf("not ok %d - Random buffer 1 contents are incorrect\n", log_num++); } else { printf("ok %d - Random buffer 1 contents are correct\n", log_num++); } } if (uc_mem_read(uc, 0x301000, readbuf, sizeof(readbuf))) { printf("not ok %d - Failed to read random buffer 2 from memory\n", log_num++); } else { printf("ok %d - Random buffer 2 read from memory\n", log_num++); if (memcmp(buf2, readbuf, 4096)) { printf("not ok %d - Random buffer 2 contents are incorrect\n", log_num++); } else { printf("ok %d - Random buffer 2 contents are correct\n", log_num++); } } if (uc_close(uc) == UC_ERR_OK) { printf("ok %d - uc_close complete\n", log_num++); } else { printf("not ok %d - uc_close complete\n", log_num++); } return 0; }
static void VM_exec() { uc_engine *uc; uc_err err; uc_hook trace; unsigned int r_eax, eflags, r_esp, r_edi, r_ecx; r_eax = 0xbaadbabe; r_esp = ADDRESS+0x20; r_edi = ADDRESS+0x300; //some safe distance from main code. eflags = 0x00000206; r_ecx = ECX_OPS; // Initialize emulator in X86-32bit mode err = uc_open(UC_ARCH_X86, UC_MODE_32, &uc); if(err) { printf("Failed on uc_open() with error returned: %s\n", uc_strerror(err)); return; } err = uc_mem_map(uc, ADDRESS, (2 * 1024 * 1024), UC_PROT_ALL); if(err != UC_ERR_OK) { printf("Failed to map memory %s\n", uc_strerror(err)); return; } // write machine code to be emulated to memory err = uc_mem_write(uc, ADDRESS, X86_CODE32, sizeof(X86_CODE32) - 1); if(err != UC_ERR_OK) { printf("Failed to write emulation code to memory, quit!: %s(len %lu)\n", uc_strerror(err), (unsigned long)sizeof(X86_CODE32) - 1); return; } // initialize machine registers uc_reg_write(uc, UC_X86_REG_EAX, &r_eax); uc_reg_write(uc, UC_X86_REG_EDI, &r_edi); uc_reg_write(uc, UC_X86_REG_ECX, &r_ecx); uc_reg_write(uc, UC_X86_REG_ESP, &r_esp); //make stack pointer point to already mapped memory so we don't need to hook. uc_reg_write(uc, UC_X86_REG_EFLAGS, &eflags); uc_hook_add(uc, &trace, UC_HOOK_CODE, (void *)hook_ins, NULL, 1, 0); // emulate machine code in infinite time err = uc_emu_start(uc, ADDRESS, ADDRESS + (sizeof(X86_CODE32) - 1), 0, 0); if(err) { printf("Failed on uc_emu_start() with error returned %u: %s\n", err, uc_strerror(err)); uc_close(uc); return; } uc_reg_read(uc, UC_X86_REG_EAX, &r_eax); uc_reg_read(uc, UC_X86_REG_ECX, &r_ecx); uc_reg_read(uc, UC_X86_REG_EDI, &r_edi); uc_reg_read(uc, UC_X86_REG_EFLAGS, &eflags); uc_close(uc); printf("\n>>> Emulation done. Below is the CPU context\n"); printf(">>> EAX = 0x%08X\n", r_eax); printf(">>> ECX = 0x%08X\n", r_ecx); printf(">>> EDI = 0x%08X\n", r_edi); printf(">>> EFLAGS = 0x%08X\n", eflags); printf("\nHook called %lu times. Test %s\n", hook_called, (hook_called == ECX_OPS ? "PASSED!!" : "FAILED!!!")); }
static void test_x86_64(void **state) { uc_engine *uc; uc_err err; uc_hook trace1, trace2, trace3, trace4; static const uint64_t address = 0x1000000; static const uint8_t code[] = "\x41\xBC\x3B\xB0\x28\x2A\x49\x0F\xC9\x90\x4D\x0F\xAD\xCF\x49\x87\xFD\x90\x48\x81\xD2\x8A\xCE\x77\x35\x48\xF7\xD9\x4D\x29\xF4\x49\x81\xC9\xF6\x8A\xC6\x53\x4D\x87\xED\x48\x0F\xAD\xD2\x49\xF7\xD4\x48\xF7\xE1\x4D\x19\xC5\x4D\x89\xC5\x48\xF7\xD6\x41\xB8\x4F\x8D\x6B\x59\x4D\x87\xD0\x68\x6A\x1E\x09\x3C\x59"; int64_t rax = 0x71f3029efd49d41d; int64_t rbx = 0xd87b45277f133ddb; int64_t rcx = 0xab40d1ffd8afc461; int64_t rdx = 0x919317b4a733f01; int64_t rsi = 0x4c24e753a17ea358; int64_t rdi = 0xe509a57d2571ce96; int64_t r8 = 0xea5b108cc2b9ab1f; int64_t r9 = 0x19ec097c8eb618c1; int64_t r10 = 0xec45774f00c5f682; int64_t r11 = 0xe17e9dbec8c074aa; int64_t r12 = 0x80f86a8dc0f6d457; int64_t r13 = 0x48288ca5671c5492; int64_t r14 = 0x595f72f6e4017f6e; int64_t r15 = 0x1efd97aea331cccc; int64_t rsp = address + 0x200000; // Initialize emulator in X86-64bit mode err = uc_open(UC_ARCH_X86, UC_MODE_64, &uc); uc_assert_success(err); // map 2MB memory for this emulation err = uc_mem_map(uc, address, 2 * 1024 * 1024, UC_PROT_ALL); uc_assert_success(err); // write machine code to be emulated to memory err = uc_mem_write(uc, address, code, sizeof(code) - 1); uc_assert_success(err); // initialize machine registers uc_assert_success(uc_reg_write(uc, UC_X86_REG_RSP, &rsp)); uc_assert_success(uc_reg_write(uc, UC_X86_REG_RAX, &rax)); uc_assert_success(uc_reg_write(uc, UC_X86_REG_RBX, &rbx)); uc_assert_success(uc_reg_write(uc, UC_X86_REG_RCX, &rcx)); uc_assert_success(uc_reg_write(uc, UC_X86_REG_RDX, &rdx)); uc_assert_success(uc_reg_write(uc, UC_X86_REG_RSI, &rsi)); uc_assert_success(uc_reg_write(uc, UC_X86_REG_RDI, &rdi)); uc_assert_success(uc_reg_write(uc, UC_X86_REG_R8, &r8)); uc_assert_success(uc_reg_write(uc, UC_X86_REG_R9, &r9)); uc_assert_success(uc_reg_write(uc, UC_X86_REG_R10, &r10)); uc_assert_success(uc_reg_write(uc, UC_X86_REG_R11, &r11)); uc_assert_success(uc_reg_write(uc, UC_X86_REG_R12, &r12)); uc_assert_success(uc_reg_write(uc, UC_X86_REG_R13, &r13)); uc_assert_success(uc_reg_write(uc, UC_X86_REG_R14, &r14)); uc_assert_success(uc_reg_write(uc, UC_X86_REG_R15, &r15)); // tracing all basic blocks with customized callback err = uc_hook_add(uc, &trace1, UC_HOOK_BLOCK, hook_block, NULL, 1, 0); uc_assert_success(err); // tracing all instructions in the range [address, address+20] err = uc_hook_add(uc, &trace2, UC_HOOK_CODE, hook_code64, NULL, address, address+20); uc_assert_success(err); // tracing all memory WRITE access (with @begin > @end) err = uc_hook_add(uc, &trace3, UC_HOOK_MEM_WRITE, hook_mem64, NULL, 1, 0); uc_assert_success(err); // tracing all memory READ access (with @begin > @end) err = uc_hook_add(uc, &trace4, UC_HOOK_MEM_READ, hook_mem64, NULL, 1, 0); uc_assert_success(err); // emulate machine code in infinite time (last param = 0), or when // finishing all the code. err = uc_emu_start(uc, address, address+sizeof(code) - 1, 0, 0); uc_assert_success(err); // Read registers uc_reg_read(uc, UC_X86_REG_RAX, &rax); uc_reg_read(uc, UC_X86_REG_RBX, &rbx); uc_reg_read(uc, UC_X86_REG_RCX, &rcx); uc_reg_read(uc, UC_X86_REG_RDX, &rdx); uc_reg_read(uc, UC_X86_REG_RSI, &rsi); uc_reg_read(uc, UC_X86_REG_RDI, &rdi); uc_reg_read(uc, UC_X86_REG_R8, &r8); uc_reg_read(uc, UC_X86_REG_R9, &r9); uc_reg_read(uc, UC_X86_REG_R10, &r10); uc_reg_read(uc, UC_X86_REG_R11, &r11); uc_reg_read(uc, UC_X86_REG_R12, &r12); uc_reg_read(uc, UC_X86_REG_R13, &r13); uc_reg_read(uc, UC_X86_REG_R14, &r14); uc_reg_read(uc, UC_X86_REG_R15, &r15); #if 0 printf(">>> RAX = 0x%" PRIx64 "\n", rax); printf(">>> RBX = 0x%" PRIx64 "\n", rbx); printf(">>> RCX = 0x%" PRIx64 "\n", rcx); printf(">>> RDX = 0x%" PRIx64 "\n", rdx); printf(">>> RSI = 0x%" PRIx64 "\n", rsi); printf(">>> RDI = 0x%" PRIx64 "\n", rdi); printf(">>> R8 = 0x%" PRIx64 "\n", r8); printf(">>> R9 = 0x%" PRIx64 "\n", r9); printf(">>> R10 = 0x%" PRIx64 "\n", r10); printf(">>> R11 = 0x%" PRIx64 "\n", r11); printf(">>> R12 = 0x%" PRIx64 "\n", r12); printf(">>> R13 = 0x%" PRIx64 "\n", r13); printf(">>> R14 = 0x%" PRIx64 "\n", r14); printf(">>> R15 = 0x%" PRIx64 "\n", r15); #endif uc_assert_success(uc_close(uc)); }
static void hook_code32(uc_engine *uc, uint64_t address, uint32_t size, void *user_data) { //uint8_t opcode[256]; uint8_t tmp[16]; uint32_t tmp4[1]; uint32_t ecx; printf("\nhook_code32: Address: %"PRIx64", Opcode Size: %d\n", address, size); print_registers(uc); size = MIN(sizeof(tmp), size); if (!uc_mem_read(uc, address, tmp, size)) { uint32_t i; printf("Opcode: "); for (i=0; i<size; i++) { printf("%x ", tmp[i]); } printf("\n"); } dump_stack_mem(uc); if (address == 0x60000025) { // double-check that opcode is // IMUL aex,[eax+0x41],0x10 if ((tmp[0] != 0x6b) || (tmp[1] != 0x41) || (tmp[2] != 0x41) || (tmp[3] != 0x10)) { printf("FAILED set-up of opcode\n"); exit(-1); } printf("IMUL eax,[ecx+0x41],0x10\n"); // double-check that memory operand points to 0x6000003a uc_reg_read(uc, UC_X86_REG_ECX, &ecx); if (ecx != 0x5ffffff9) { printf("FAILED EAX register not having 0x5ffffff9\n"); exit(-1); } printf("ECX = %8.8x\n", ecx); printf("%8.8x + 0x41 = %8.8x\n", 0x5ffffff9, 0x5ffffff9 + 0x41); // double-check that memory location 0x60000039 // contains 0x5151494a if (!uc_mem_read(uc, 0x6000003a, tmp4, 4)) { if (tmp4[0] != 0x5151494a) { printf("FAILED set-up\n"); exit(-1); } printf("Proved that 0x6000003a contains the proper 0x5151494a\n"); } // dump_stack_mem(uc); } // Stop after 'imul eax,[ecx+0x41],0x10 if (address == 0x60000029) { uint32_t eax; // IMUL eax,mem,Ib // mem = [ecx+0x41] // ecx = 0x5ffffff9 // [6000003A] = 0x5151494a // Stop after 'imul eax,[ecx+0x41],0x10 // This step basically shifts left 8-bit...elaborately. // multiplying 0x5151494a x 0x10 = 0x151494a0 uc_reg_read(uc, UC_X86_REG_EAX, &eax); if (eax != 0x151494a0) { fail_msg("FAIL: TB did not flush; eax is not the expected 0x151494a0\n"); print_registers(uc); //dump_stack_mem(uc); exit(-1); } printf("PASS\n"); } print_registers(uc); // dump_stack_mem(uc); return; }
// emulate code that write invalid memory static void test_i386_invalid_mem_write(void) { uc_engine *uc; uc_err err; uc_hook trace1, trace2, trace3; uint32_t tmp; int r_ecx = 0x1234; // ECX register int r_edx = 0x7890; // EDX register printf("===================================\n"); printf("Emulate i386 code that write to invalid memory\n"); // Initialize emulator in X86-32bit mode err = uc_open(UC_ARCH_X86, UC_MODE_32, &uc); if (err) { printf("Failed on uc_open() with error returned: %u\n", err); return; } // map 2MB memory for this emulation uc_mem_map(uc, ADDRESS, 2 * 1024 * 1024, UC_PROT_ALL); // write machine code to be emulated to memory if (uc_mem_write(uc, ADDRESS, X86_CODE32_MEM_WRITE, sizeof(X86_CODE32_MEM_WRITE) - 1)) { printf("Failed to write emulation code to memory, quit!\n"); return; } // initialize machine registers uc_reg_write(uc, UC_X86_REG_ECX, &r_ecx); uc_reg_write(uc, UC_X86_REG_EDX, &r_edx); // tracing all basic blocks with customized callback uc_hook_add(uc, &trace1, UC_HOOK_BLOCK, hook_block, NULL, 1, 0); // tracing all instruction by having @begin > @end uc_hook_add(uc, &trace2, UC_HOOK_CODE, hook_code, NULL, 1, 0); // intercept invalid memory events uc_hook_add(uc, &trace3, UC_HOOK_MEM_READ_UNMAPPED | UC_HOOK_MEM_WRITE_UNMAPPED, hook_mem_invalid, NULL, 1, 0); // emulate machine code in infinite time err = uc_emu_start(uc, ADDRESS, ADDRESS + sizeof(X86_CODE32_MEM_WRITE) - 1, 0, 0); if (err) { printf("Failed on uc_emu_start() with error returned %u: %s\n", err, uc_strerror(err)); } // now print out some registers printf(">>> Emulation done. Below is the CPU context\n"); uc_reg_read(uc, UC_X86_REG_ECX, &r_ecx); uc_reg_read(uc, UC_X86_REG_EDX, &r_edx); printf(">>> ECX = 0x%x\n", r_ecx); printf(">>> EDX = 0x%x\n", r_edx); // read from memory if (!uc_mem_read(uc, 0xaaaaaaaa, &tmp, sizeof(tmp))) printf(">>> Read 4 bytes from [0x%x] = 0x%x\n", 0xaaaaaaaa, tmp); else printf(">>> Failed to read 4 bytes from [0x%x]\n", 0xaaaaaaaa); if (!uc_mem_read(uc, 0xffffffaa, &tmp, sizeof(tmp))) printf(">>> Read 4 bytes from [0x%x] = 0x%x\n", 0xffffffaa, tmp); else printf(">>> Failed to read 4 bytes from [0x%x]\n", 0xffffffaa); uc_close(uc); }
static void test_m68k(void) { uc_engine *uc; uc_hook trace1, trace2; uc_err err; int d0 = 0x0000; // d0 data register int d1 = 0x0000; // d1 data register int d2 = 0x0000; // d2 data register int d3 = 0x0000; // d3 data register int d4 = 0x0000; // d4 data register int d5 = 0x0000; // d5 data register int d6 = 0x0000; // d6 data register int d7 = 0x0000; // d7 data register int a0 = 0x0000; // a0 address register int a1 = 0x0000; // a1 address register int a2 = 0x0000; // a2 address register int a3 = 0x0000; // a3 address register int a4 = 0x0000; // a4 address register int a5 = 0x0000; // a5 address register int a6 = 0x0000; // a6 address register int a7 = 0x0000; // a6 address register int pc = 0x0000; // program counter int sr = 0x0000; // status register printf("Emulate M68K code\n"); // Initialize emulator in M68K mode err = uc_open(UC_ARCH_M68K, UC_MODE_BIG_ENDIAN, &uc); if (err) { printf("Failed on uc_open() with error returned: %u (%s)\n", err, uc_strerror(err)); return; } // map 2MB memory for this emulation uc_mem_map(uc, ADDRESS, 2 * 1024 * 1024, UC_PROT_ALL); // write machine code to be emulated to memory uc_mem_write(uc, ADDRESS, M68K_CODE, sizeof(M68K_CODE) - 1); // initialize machine registers uc_reg_write(uc, UC_M68K_REG_D0, &d0); uc_reg_write(uc, UC_M68K_REG_D1, &d1); uc_reg_write(uc, UC_M68K_REG_D2, &d2); uc_reg_write(uc, UC_M68K_REG_D3, &d3); uc_reg_write(uc, UC_M68K_REG_D4, &d4); uc_reg_write(uc, UC_M68K_REG_D5, &d5); uc_reg_write(uc, UC_M68K_REG_D6, &d6); uc_reg_write(uc, UC_M68K_REG_D7, &d7); uc_reg_write(uc, UC_M68K_REG_A0, &a0); uc_reg_write(uc, UC_M68K_REG_A1, &a1); uc_reg_write(uc, UC_M68K_REG_A2, &a2); uc_reg_write(uc, UC_M68K_REG_A3, &a3); uc_reg_write(uc, UC_M68K_REG_A4, &a4); uc_reg_write(uc, UC_M68K_REG_A5, &a5); uc_reg_write(uc, UC_M68K_REG_A6, &a6); uc_reg_write(uc, UC_M68K_REG_A7, &a7); uc_reg_write(uc, UC_M68K_REG_PC, &pc); uc_reg_write(uc, UC_M68K_REG_SR, &sr); // tracing all basic blocks with customized callback uc_hook_add(uc, &trace1, UC_HOOK_BLOCK, hook_block, NULL, 1, 0); // tracing all instruction uc_hook_add(uc, &trace2, UC_HOOK_CODE, hook_code, NULL, 1, 0); // emulate machine code in infinite time (last param = 0), or when // finishing all the code. err = uc_emu_start(uc, ADDRESS, ADDRESS + sizeof(M68K_CODE)-1, 0, 0); if (err) { printf("Failed on uc_emu_start() with error returned: %u\n", err); } // now print out some registers printf(">>> Emulation done. Below is the CPU context\n"); uc_reg_read(uc, UC_M68K_REG_D0, &d0); uc_reg_read(uc, UC_M68K_REG_D1, &d1); uc_reg_read(uc, UC_M68K_REG_D2, &d2); uc_reg_read(uc, UC_M68K_REG_D3, &d3); uc_reg_read(uc, UC_M68K_REG_D4, &d4); uc_reg_read(uc, UC_M68K_REG_D5, &d5); uc_reg_read(uc, UC_M68K_REG_D6, &d6); uc_reg_read(uc, UC_M68K_REG_D7, &d7); uc_reg_read(uc, UC_M68K_REG_A0, &a0); uc_reg_read(uc, UC_M68K_REG_A1, &a1); uc_reg_read(uc, UC_M68K_REG_A2, &a2); uc_reg_read(uc, UC_M68K_REG_A3, &a3); uc_reg_read(uc, UC_M68K_REG_A4, &a4); uc_reg_read(uc, UC_M68K_REG_A5, &a5); uc_reg_read(uc, UC_M68K_REG_A6, &a6); uc_reg_read(uc, UC_M68K_REG_A7, &a7); uc_reg_read(uc, UC_M68K_REG_PC, &pc); uc_reg_read(uc, UC_M68K_REG_SR, &sr); printf(">>> A0 = 0x%x\t\t>>> D0 = 0x%x\n", a0, d0); printf(">>> A1 = 0x%x\t\t>>> D1 = 0x%x\n", a1, d1); printf(">>> A2 = 0x%x\t\t>>> D2 = 0x%x\n", a2, d2); printf(">>> A3 = 0x%x\t\t>>> D3 = 0x%x\n", a3, d3); printf(">>> A4 = 0x%x\t\t>>> D4 = 0x%x\n", a4, d4); printf(">>> A5 = 0x%x\t\t>>> D5 = 0x%x\n", a5, d5); printf(">>> A6 = 0x%x\t\t>>> D6 = 0x%x\n", a6, d6); printf(">>> A7 = 0x%x\t\t>>> D7 = 0x%x\n", a7, d7); printf(">>> PC = 0x%x\n", pc); printf(">>> SR = 0x%x\n", sr); uc_close(uc); }
static void test_x86_64(void) { uc_engine *uc; uc_err err; uc_hook trace1, trace2, trace3, trace4; int64_t rax = 0x71f3029efd49d41d; int64_t rbx = 0xd87b45277f133ddb; int64_t rcx = 0xab40d1ffd8afc461; int64_t rdx = 0x919317b4a733f01; int64_t rsi = 0x4c24e753a17ea358; int64_t rdi = 0xe509a57d2571ce96; int64_t r8 = 0xea5b108cc2b9ab1f; int64_t r9 = 0x19ec097c8eb618c1; int64_t r10 = 0xec45774f00c5f682; int64_t r11 = 0xe17e9dbec8c074aa; int64_t r12 = 0x80f86a8dc0f6d457; int64_t r13 = 0x48288ca5671c5492; int64_t r14 = 0x595f72f6e4017f6e; int64_t r15 = 0x1efd97aea331cccc; int64_t rsp = ADDRESS + 0x200000; printf("Emulate x86_64 code\n"); // Initialize emulator in X86-64bit mode err = uc_open(UC_ARCH_X86, UC_MODE_64, &uc); if (err) { printf("Failed on uc_open() with error returned: %u\n", err); return; } // map 2MB memory for this emulation uc_mem_map(uc, ADDRESS, 2 * 1024 * 1024, UC_PROT_ALL); // write machine code to be emulated to memory if (uc_mem_write(uc, ADDRESS, X86_CODE64, sizeof(X86_CODE64) - 1)) { printf("Failed to write emulation code to memory, quit!\n"); return; } // initialize machine registers uc_reg_write(uc, UC_X86_REG_RSP, &rsp); uc_reg_write(uc, UC_X86_REG_RAX, &rax); uc_reg_write(uc, UC_X86_REG_RBX, &rbx); uc_reg_write(uc, UC_X86_REG_RCX, &rcx); uc_reg_write(uc, UC_X86_REG_RDX, &rdx); uc_reg_write(uc, UC_X86_REG_RSI, &rsi); uc_reg_write(uc, UC_X86_REG_RDI, &rdi); uc_reg_write(uc, UC_X86_REG_R8, &r8); uc_reg_write(uc, UC_X86_REG_R9, &r9); uc_reg_write(uc, UC_X86_REG_R10, &r10); uc_reg_write(uc, UC_X86_REG_R11, &r11); uc_reg_write(uc, UC_X86_REG_R12, &r12); uc_reg_write(uc, UC_X86_REG_R13, &r13); uc_reg_write(uc, UC_X86_REG_R14, &r14); uc_reg_write(uc, UC_X86_REG_R15, &r15); // tracing all basic blocks with customized callback uc_hook_add(uc, &trace1, UC_HOOK_BLOCK, hook_block, NULL, 1, 0); // tracing all instructions in the range [ADDRESS, ADDRESS+20] uc_hook_add(uc, &trace2, UC_HOOK_CODE, hook_code64, NULL, ADDRESS, ADDRESS+20); // tracing all memory WRITE access (with @begin > @end) uc_hook_add(uc, &trace3, UC_HOOK_MEM_WRITE, hook_mem64, NULL, 1, 0); // tracing all memory READ access (with @begin > @end) uc_hook_add(uc, &trace4, UC_HOOK_MEM_READ, hook_mem64, NULL, 1, 0); // emulate machine code in infinite time (last param = 0), or when // finishing all the code. err = uc_emu_start(uc, ADDRESS, ADDRESS + sizeof(X86_CODE64) - 1, 0, 0); if (err) { printf("Failed on uc_emu_start() with error returned %u: %s\n", err, uc_strerror(err)); } // now print out some registers printf(">>> Emulation done. Below is the CPU context\n"); uc_reg_read(uc, UC_X86_REG_RAX, &rax); uc_reg_read(uc, UC_X86_REG_RBX, &rbx); uc_reg_read(uc, UC_X86_REG_RCX, &rcx); uc_reg_read(uc, UC_X86_REG_RDX, &rdx); uc_reg_read(uc, UC_X86_REG_RSI, &rsi); uc_reg_read(uc, UC_X86_REG_RDI, &rdi); uc_reg_read(uc, UC_X86_REG_R8, &r8); uc_reg_read(uc, UC_X86_REG_R9, &r9); uc_reg_read(uc, UC_X86_REG_R10, &r10); uc_reg_read(uc, UC_X86_REG_R11, &r11); uc_reg_read(uc, UC_X86_REG_R12, &r12); uc_reg_read(uc, UC_X86_REG_R13, &r13); uc_reg_read(uc, UC_X86_REG_R14, &r14); uc_reg_read(uc, UC_X86_REG_R15, &r15); printf(">>> RAX = 0x%" PRIx64 "\n", rax); printf(">>> RBX = 0x%" PRIx64 "\n", rbx); printf(">>> RCX = 0x%" PRIx64 "\n", rcx); printf(">>> RDX = 0x%" PRIx64 "\n", rdx); printf(">>> RSI = 0x%" PRIx64 "\n", rsi); printf(">>> RDI = 0x%" PRIx64 "\n", rdi); printf(">>> R8 = 0x%" PRIx64 "\n", r8); printf(">>> R9 = 0x%" PRIx64 "\n", r9); printf(">>> R10 = 0x%" PRIx64 "\n", r10); printf(">>> R11 = 0x%" PRIx64 "\n", r11); printf(">>> R12 = 0x%" PRIx64 "\n", r12); printf(">>> R13 = 0x%" PRIx64 "\n", r13); printf(">>> R14 = 0x%" PRIx64 "\n", r14); printf(">>> R15 = 0x%" PRIx64 "\n", r15); uc_close(uc); }