Add ability to mark memory are read only. Add new API uc_mem_map_ex to allow permissions to be passed. Change MemoryBlock to track created MemoryRegions. Add regress/ro_mem_test.c

include/uc_priv.h

@@ -16,7 +16,7 @@
 QTAILQ_HEAD(CPUTailQ, CPUState);
 
 typedef struct MemoryBlock {
-   uint64_t begin;  //inclusive
+   MemoryRegion *region;  //inclusive
    uint64_t end;    //exclusive
    uint32_t perms;
 } MemoryBlock;
@@ -51,7 +51,9 @@ typedef void (*uc_args_uc_long_t)(struct uc_struct*, unsigned long);
 
 typedef void (*uc_args_uc_u64_t)(struct uc_struct *, uint64_t addr);
 
-typedef int (*uc_args_uc_ram_size_t)(struct uc_struct*,  ram_addr_t begin, size_t size);
+typedef MemoryRegion* (*uc_args_uc_ram_size_t)(struct uc_struct*,  ram_addr_t begin, size_t size, uint32_t perms);
+
+typedef void (*uc_readonly_mem_t)(MemoryRegion *mr, bool readonly);
 
 // which interrupt should make emulation stop?
 typedef bool (*uc_args_int_t)(int intno);
@@ -94,6 +96,7 @@ struct uc_struct {
     uc_args_tcg_enable_t tcg_enabled;
     uc_args_uc_long_t tcg_exec_init;
     uc_args_uc_ram_size_t memory_map;
+    uc_readonly_mem_t readonly_mem;
     // list of cpu
     void* cpu;
 

include/unicorn/unicorn.h

@@ -392,7 +392,8 @@ typedef enum uc_prot {
 
 /*
  Map memory in for emulation.
- This API adds a memory region that can be used by emulation.
+ This API adds a memory region that can be used by emulation. The region is mapped
+ with permissions UC_PROT_READ | UC_PROT_WRITE | UC_PROT_EXEC.
 
  @handle: handle returned by uc_open()
  @address: starting address of the new memory region to be mapped in.
@@ -406,6 +407,25 @@ typedef enum uc_prot {
 UNICORN_EXPORT
 uc_err uc_mem_map(uch handle, uint64_t address, size_t size);
 
+/*
+ Map memory in for emulation.
+ This API adds a memory region that can be used by emulation.
+
+ @handle: handle returned by uc_open()
+ @address: starting address of the new memory region to be mapped in.
+    This address must be aligned to 4KB, or this will return with UC_ERR_MAP error.
+ @size: size of the new memory region to be mapped in.
+    This size must be multiple of 4KB, or this will return with UC_ERR_MAP error.
+ @perms: Permissions for the newly mapped region.
+    This must be some combination of UC_PROT_READ | UC_PROT_WRITE | UC_PROT_EXEC,
+    or this will return with UC_ERR_MAP error.
+
+ @return UC_ERR_OK on success, or other value on failure (refer to uc_err enum
+ for detailed error).
+*/
+UNICORN_EXPORT
+uc_err uc_mem_map_ex(uch handle, uint64_t address, size_t size, uint32_t perms);
+
 #ifdef __cplusplus
 }
 #endif

qemu/include/exec/memory.h

@@ -315,12 +315,14 @@ void memory_region_init_io(struct uc_struct *uc, MemoryRegion *mr,
  * @owner: the object that tracks the region's reference count
  * @name: the name of the region.
  * @size: size of the region.
+ * @perms: permissions on the region (UC_PROT_READ, UC_PROT_WRITE, UC_PROT_EXEC).
  * @errp: pointer to Error*, to store an error if it happens.
  */
 void memory_region_init_ram(struct uc_struct *uc, MemoryRegion *mr,
                             struct Object *owner,
                             const char *name,
                             uint64_t size,
+                            uint32_t perms,
                             Error **errp);
 
 /**
@@ -934,7 +936,7 @@ void address_space_unmap(AddressSpace *as, void *buffer, hwaddr len,
 
 void memory_register_types(struct uc_struct *uc);
 
-int memory_map(struct uc_struct *uc, ram_addr_t begin, size_t size);
+MemoryRegion *memory_map(struct uc_struct *uc, ram_addr_t begin, size_t size, uint32_t perms);
 int memory_free(struct uc_struct *uc);
 
 #endif

qemu/memory.c

@@ -31,18 +31,18 @@
 
 
 // Unicorn engine
-int memory_map(struct uc_struct *uc, ram_addr_t begin, size_t size)
+MemoryRegion *memory_map(struct uc_struct *uc, ram_addr_t begin, size_t size, uint32_t perms)
 {
     uc->ram = g_new(MemoryRegion, 1);
 
-    memory_region_init_ram(uc, uc->ram, NULL, "pc.ram", size, &error_abort);
+    memory_region_init_ram(uc, uc->ram, NULL, "pc.ram", size, perms, &error_abort);
 
     memory_region_add_subregion(get_system_memory(uc), begin, uc->ram);
 
     if (uc->current_cpu)
         tlb_flush(uc->current_cpu, 1);
 
-    return 0;
+    return uc->ram;
 }
 
 int memory_free(struct uc_struct *uc)
@@ -1151,10 +1151,14 @@ void memory_region_init_ram(struct uc_struct *uc, MemoryRegion *mr,
                             Object *owner,
                             const char *name,
                             uint64_t size,
+                            uint32_t perms,
                             Error **errp)
 {
     memory_region_init(uc, mr, owner, name, size);
     mr->ram = true;
+    if (!(perms & UC_PROT_WRITE)) {
+        mr->readonly = true;
+    }
     mr->terminates = true;
     mr->destructor = memory_region_destructor_ram;
     mr->ram_addr = qemu_ram_alloc(size, mr, errp);

qemu/unicorn_common.h

@@ -73,6 +73,7 @@ static inline void uc_common_init(struct uc_struct* uc)
     uc->pause_all_vcpus = pause_all_vcpus;
     uc->vm_start = vm_start;
     uc->memory_map = memory_map;
+    uc->readonly_mem = memory_region_set_readonly;
 
     if (!uc->release)
         uc->release = release_common;

regress/ro_mem_test.c

@@ -0,0 +1,64 @@
+#include <inttypes.h>
+#include <string.h>
+#include <unistd.h>
+
+#include <unicorn/unicorn.h>
+
+#define PROGRAM "\xeb\x08\x58\xc7\x00\x78\x56\x34\x12\x90\xe8\xf3\xff\xff\xff"
+
+/*
+bits 32
+
+   jmp short bottom
+top:
+   pop eax
+   mov dword [eax], 0x12345678
+   nop
+bottom:
+   call top
+*/
+
+int main(int argc, char **argv, char **envp) {
+    uch handle;
+    uc_err err;
+    uint8_t bytes[8];
+
+    printf("Memory mapping test\n");
+
+    // Initialize emulator in X86-32bit mode
+    err = uc_open(UC_ARCH_X86, UC_MODE_32, &handle);
+    if (err) {
+        printf("Failed on uc_open() with error returned: %u\n", err);
+        return;
+    }
+
+    uc_mem_map(handle, 0x100000, 0x1000);
+    uc_mem_map(handle, 0x200000, 0x2000);
+    uc_mem_map(handle, 0x300000, 0x3000);
+    uc_mem_map_ex(handle, 0x400000, 0x4000, UC_PROT_READ | UC_PROT_EXEC);
+
+    // write machine code to be emulated to memory
+    if (uc_mem_write(handle, 0x400000, PROGRAM, sizeof(PROGRAM))) {
+        printf("Failed to write emulation code to memory, quit!\n");
+        return;
+    }
+    else {
+        printf("Allowed to write to read only memory via uc_mem_write\n");
+    }
+
+    // emulate machine code in infinite time
+    printf("BEGIN execution\n");
+    err = uc_emu_start(handle, 0x400000, 0x400000 + sizeof(PROGRAM), 0, 5);
+    if (err) {
+        printf("Failed on uc_emu_start() with error returned %u: %s\n",
+                err, uc_strerror(err));
+    }
+    printf("END execution\n");
+
+    if (!uc_mem_read(handle, 0x400000 + sizeof(PROGRAM) - 1, bytes, 4))
+        printf(">>> Read 4 bytes from [0x%x] = 0x%x\n", 0x400000 + sizeof(PROGRAM) - 1,*(uint32_t*) bytes);
+    else
+        printf(">>> Failed to read 4 bytes from [0x%x]\n", 0x400000 + sizeof(PROGRAM) - 1);
+
+    uc_close(&handle);
+}

uc.c

@@ -350,7 +350,18 @@ uc_err uc_mem_read(uch handle, uint64_t address, uint8_t *bytes, size_t size)
 
     return UC_ERR_OK;
 }
+static const MemoryBlock *getMemoryBlock(struct uc_struct *uc, uint64_t address);
+static const MemoryBlock *getMemoryBlock(struct uc_struct *uc, uint64_t address) {
+    unsigned int i;
 
+    for(i = 0; i < uc->mapped_block_count; i++) {
+        if (address >= uc->mapped_blocks[i].region->addr && address < uc->mapped_blocks[i].end)
+            return &uc->mapped_blocks[i];
+    }
+
+    // not found
+    return NULL;   
+}
 
 UNICORN_EXPORT
 uc_err uc_mem_write(uch handle, uint64_t address, const uint8_t *bytes, size_t size)
@@ -361,9 +372,21 @@ uc_err uc_mem_write(uch handle, uint64_t address, const uint8_t *bytes, size_t s
         // invalid handle
         return UC_ERR_UCH;
 
+    const MemoryBlock *mb = getMemoryBlock(uc, address);
+    if (mb == NULL)
+        return UC_ERR_MEM_WRITE;
+
+    if (!(mb->perms & UC_PROT_WRITE)) //write protected
+        //but this is not the program accessing memory, so temporarily mark writable
+        uc->readonly_mem(mb->region, false);
+
     if (uc->write_mem(&uc->as, address, bytes, size) == false)
         return UC_ERR_MEM_WRITE;
 
+    if (!(mb->perms & UC_PROT_WRITE)) //write protected
+        //now write protect it again
+        uc->readonly_mem(mb->region, true);
+
     return UC_ERR_OK;
 }
 
@@ -529,7 +552,7 @@ static uc_err _hook_mem_access(uch handle, uc_mem_type type,
 }
 
 UNICORN_EXPORT
-uc_err uc_mem_map(uch handle, uint64_t address, size_t size)
+uc_err uc_mem_map_ex(uch handle, uint64_t address, size_t size, uint32_t perms)
 {
     MemoryBlock *blocks;
     struct uc_struct* uc = (struct uc_struct *)handle;
@@ -550,6 +573,10 @@ uc_err uc_mem_map(uch handle, uint64_t address, size_t size)
     if ((size & (4*1024 - 1)) != 0)
         return UC_ERR_MAP;
 
+    // check for only valid permissions
+    if ((perms & ~(UC_PROT_READ | UC_PROT_WRITE | UC_PROT_EXEC)) != 0)
+        return UC_ERR_MAP;
+
     if ((uc->mapped_block_count & (MEM_BLOCK_INCR - 1)) == 0) {  //time to grow
         blocks = realloc(uc->mapped_blocks, sizeof(MemoryBlock) * (uc->mapped_block_count + MEM_BLOCK_INCR));
         if (blocks == NULL) {
@@ -557,22 +584,28 @@ uc_err uc_mem_map(uch handle, uint64_t address, size_t size)
         }
         uc->mapped_blocks = blocks;
     }
-    uc->mapped_blocks[uc->mapped_block_count].begin = address;
     uc->mapped_blocks[uc->mapped_block_count].end = address + size;
     //TODO extend uc_mem_map to accept permissions, figure out how to pass this down to qemu
-    uc->mapped_blocks[uc->mapped_block_count].perms = UC_PROT_READ | UC_PROT_WRITE | UC_PROT_EXEC;
-    uc->memory_map(uc, address, size);
+    uc->mapped_blocks[uc->mapped_block_count].perms = perms;
+    uc->mapped_blocks[uc->mapped_block_count].region = uc->memory_map(uc, address, size, perms);
     uc->mapped_block_count++;
 
     return UC_ERR_OK;
 }
 
+UNICORN_EXPORT
+uc_err uc_mem_map(uch handle, uint64_t address, size_t size)
+{
+    //old api, maps RWX by default
+    return uc_mem_map_ex(handle, address, size, UC_PROT_READ | UC_PROT_WRITE | UC_PROT_EXEC);
+}
+
 bool memory_mapping(struct uc_struct* uc, uint64_t address)
 {
     unsigned int i;
 
     for(i = 0; i < uc->mapped_block_count; i++) {
-        if (address >= uc->mapped_blocks[i].begin && address < uc->mapped_blocks[i].end)
+        if (address >= uc->mapped_blocks[i].region->addr && address < uc->mapped_blocks[i].end)
             return true;
     }