mirrors
/
unicorn
mirror of https://github.com/unicorn-engine/unicorn
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'master' into mem_map_ex_cse

This commit is contained in:
Chris Eagle 2015-08-31 23:49:54 -07:00
parent 658e399776 9dbd674a04
commit 73027026ce
9 changed files with 189 additions and 22 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
.gitignore vendored
View File

@ -87,3 +87,4 @@ regress/block_test
regress/map_write
regress/ro_mem_test
regress/nr_mem_test
regress/timeout_segfault

36
docs/unicorn-logo.txt
View File

@ -1,19 +1,19 @@
/\'. _,,
|.\ \ .'_/
_.-- |(\\ \ .'_.'
_.-' \_\\ \\_),/ _/
_).' .:::::::.___ .'
// ' ./::::::\\o\(
// //::/ '"( \
//_ //::( '. '.
/_'/ /||:::\ '. \
'// '\\:::':\_ -<_' _'-
/ | '\::/|::::.._ _ )(
| | \:| \:( '.(_'._)
/\'. _,.
|:\ \. .'_/
_.- |(\\ \ .'_.'
_.-' ,__\\ \\_),/ _/
_:.' .:::::::.___ ,'
// ' ./::::::\<o\(
// /|::/ `"( \
;/_ / ::( `. `.
/_'/ | ::::\ `. \
'// '\ :::':\_ _, ` _'-
/ | '\.:/|::::.._ `-__ )/
| | \;| \:( '.(_ \_)
| | \( \::. '-)
\ \ . '""""---.
\ \ \ . _.-...)
\ \/\. \:.___.-'..:::/
\ |\\:..\:::::'.::::/
' '.:::::'..:::"'
'":::""'
\ \ , '""""---.
\ \ \ , _.-...)
\ \/\. \:,___.-'..:::/
\ |\\:,.\:::::'.::::/
` `:;::::'.::;::'
'":;:""'

2
qemu/cpu-exec.c
View File

@ -205,6 +205,8 @@ int cpu_exec(struct uc_struct *uc, CPUArchState *env) // qq
have_tb_lock = true;
tb = tb_find_fast(env); // qq
if (!tb) { // invalid TB due to invalid code?
uc->invalid_error = UC_ERR_CODE_INVALID;
ret = EXCP_HLT;
break;
}
/* Note: we do it here to avoid a gcc bug on Mac OS X when

17
qemu/target-i386/fpu_helper.c
View File

@ -986,12 +986,22 @@ void helper_fstenv(CPUX86State *env, target_ulong ptr, int data32)
}
}
}
if (data32) {
// DFLAG enum: tcg.h, case here to int
if (env->hflags & HF_CS64_MASK) {
cpu_stl_data(env, ptr, env->fpuc);
cpu_stl_data(env, ptr + 4, fpus);
cpu_stl_data(env, ptr + 8, fptag);
cpu_stl_data(env, ptr + 12, env->fpip); /* fpip */
cpu_stl_data(env, ptr + 20, 0); /* fpcs */
cpu_stl_data(env, ptr + 24, 0); /* fpoo */
cpu_stl_data(env, ptr + 28, 0); /* fpos */
} else if (data32) {
/* 32 bit */
cpu_stl_data(env, ptr, env->fpuc);
cpu_stl_data(env, ptr + 4, fpus);
cpu_stl_data(env, ptr + 8, fptag);
cpu_stl_data(env, ptr + 12, 0); /* fpip */
cpu_stl_data(env, ptr + 12, env->fpip); /* fpip */
cpu_stl_data(env, ptr + 16, 0); /* fpcs */
cpu_stl_data(env, ptr + 20, 0); /* fpoo */
cpu_stl_data(env, ptr + 24, 0); /* fpos */
@ -1000,11 +1010,12 @@ void helper_fstenv(CPUX86State *env, target_ulong ptr, int data32)
cpu_stw_data(env, ptr, env->fpuc);
cpu_stw_data(env, ptr + 2, fpus);
cpu_stw_data(env, ptr + 4, fptag);
cpu_stw_data(env, ptr + 6, 0);
cpu_stw_data(env, ptr + 6, env->fpip);
cpu_stw_data(env, ptr + 8, 0);
cpu_stw_data(env, ptr + 10, 0);
cpu_stw_data(env, ptr + 12, 0);
}
}
void helper_fldenv(CPUX86State *env, target_ulong ptr, int data32)

14
qemu/target-i386/translate.c
View File

@ -248,6 +248,11 @@ static void gen_update_cc_op(DisasContext *s)
}
}
static void fpu_update_ip(CPUX86State *env, target_ulong pc)
{
env->fpip = pc;
}
#ifdef TARGET_X86_64
#define NB_OP_SIZES 4
@ -6110,6 +6115,7 @@ static target_ulong disas_insn(CPUX86State *env, DisasContext *s,
/* fcomp needs pop */
gen_helper_fpop(tcg_ctx, cpu_env);
}
fpu_update_ip(env, pc_start);
}
break;
case 0x08: /* flds */
@ -6194,6 +6200,7 @@ static target_ulong disas_insn(CPUX86State *env, DisasContext *s,
gen_helper_fpop(tcg_ctx, cpu_env);
break;
}
fpu_update_ip(env, pc_start);
break;
case 0x0c: /* fldenv mem */
gen_update_cc_op(s);
@ -6219,12 +6226,14 @@ static target_ulong disas_insn(CPUX86State *env, DisasContext *s,
gen_update_cc_op(s);
gen_jmp_im(s, pc_start - s->cs_base);
gen_helper_fldt_ST0(tcg_ctx, cpu_env, cpu_A0);
fpu_update_ip(env, pc_start);
break;
case 0x1f: /* fstpt mem */
gen_update_cc_op(s);
gen_jmp_im(s, pc_start - s->cs_base);
gen_helper_fstt_ST0(tcg_ctx, cpu_env, cpu_A0);
gen_helper_fpop(tcg_ctx, cpu_env);
fpu_update_ip(env, pc_start);
break;
case 0x2c: /* frstor mem */
gen_update_cc_op(s);
@ -6245,21 +6254,25 @@ static target_ulong disas_insn(CPUX86State *env, DisasContext *s,
gen_update_cc_op(s);
gen_jmp_im(s, pc_start - s->cs_base);
gen_helper_fbld_ST0(tcg_ctx, cpu_env, cpu_A0);
fpu_update_ip(env, pc_start);
break;
case 0x3e: /* fbstp */
gen_update_cc_op(s);
gen_jmp_im(s, pc_start - s->cs_base);
gen_helper_fbst_ST0(tcg_ctx, cpu_env, cpu_A0);
gen_helper_fpop(tcg_ctx, cpu_env);
fpu_update_ip(env, pc_start);
break;
case 0x3d: /* fildll */
tcg_gen_qemu_ld_i64(s->uc, cpu_tmp1_i64, cpu_A0, s->mem_index, MO_LEQ);
gen_helper_fildll_ST0(tcg_ctx, cpu_env, cpu_tmp1_i64);
fpu_update_ip(env, pc_start);
break;
case 0x3f: /* fistpll */
gen_helper_fistll_ST0(tcg_ctx, cpu_tmp1_i64, cpu_env);
tcg_gen_qemu_st_i64(s->uc, cpu_tmp1_i64, cpu_A0, s->mem_index, MO_LEQ);
gen_helper_fpop(tcg_ctx, cpu_env);
fpu_update_ip(env, pc_start);
break;
default:
goto illegal_op;
@ -6574,6 +6587,7 @@ static target_ulong disas_insn(CPUX86State *env, DisasContext *s,
default:
goto illegal_op;
}
fpu_update_ip(env, pc_start);
}
break;
/************************/

61
regress/fpu_ip.py Executable file
View File

@ -0,0 +1,61 @@
#!/usr/bin/python
from unicorn import *
from unicorn.x86_const import *
from capstone import *
ESP = 0x2000
PAGE_SIZE = 2 * 1024 * 1024
# mov [esp], DWORD 0x37f
# fldcw [esp]
# fnop
# fnstenv [esp + 8]
# pop ecx
CODE = b'\xc7\x04\x24\x7f\x03\x00\x00\xd9\x2c\x24\xd9\xd0\xd9\x74\x24\x08\x59'
class SimpleEngine:
def __init__(self):
self.capmd = Cs(CS_ARCH_X86, CS_MODE_32)
def disas_single(self, data):
for i in self.capmd.disasm(data, 16):
print("\t%s\t%s" % (i.mnemonic, i.op_str))
break
disasm = SimpleEngine()
def hook_code(uc, addr, size, user_data):
mem = uc.mem_read(addr, size)
print(" 0x%X:" % (addr)),
disasm.disas_single(str(mem))
def mem_reader(addr, size):
tmp = mu.mem_read(addr, size)
for i in tmp:
print(" 0x%x" % i),
print("")
mu = Uc(UC_ARCH_X86, UC_MODE_32)
mu.mem_map(0x0, PAGE_SIZE)
mu.mem_write(0x4000, CODE)
mu.reg_write(UC_X86_REG_ESP, ESP)
mu.hook_add(UC_HOOK_CODE, hook_code)
mu.emu_start(0x4000, 0, 0, 5)
esp = mu.reg_read(UC_X86_REG_ESP)
print("value at ESP [0x%X - 4]: " % esp)
mem_reader(esp + 14, 4)
# EXPECTED OUTPUT:
# 0x4000: mov dword ptr [esp], 0x37f
# 0x4007: fldcw word ptr [esp]
# 0x400A: fnop
# 0x400C: fnstenv dword ptr [esp + 8]
# 0x4010: pop ecx
# value at ESP [0x2004 - 4]:
# 0x0 0x0 0xa 0x40
# ^ this value should match the fnop instuction addr

62
regress/fpu_ip64.py Executable file
View File

@ -0,0 +1,62 @@
#!/usr/bin/python
from unicorn import *
from unicorn.x86_const import *
from capstone import *
ESP = 0x2000
PAGE_SIZE = 2 * 1024 * 1024
# mov [esp], DWORD 0x37f
# fldcw [esp]
# fnop
# fnstenv [esp + 8]
# pop ecx
CODE = "C704247F030000D92C24D9D0D974240859".decode('hex')
class SimpleEngine:
def __init__(self):
self.capmd = Cs(CS_ARCH_X86, CS_MODE_64)
def disas_single(self, data):
for i in self.capmd.disasm(data, 16):
print("\t%s\t%s" % (i.mnemonic, i.op_str))
break
disasm = SimpleEngine()
def hook_code(uc, addr, size, user_data):
mem = uc.mem_read(addr, size)
print(" 0x%X:" % (addr)),
disasm.disas_single(str(mem))
def mem_reader(addr, size):
tmp = mu.mem_read(addr, size)
for i in tmp:
print(" 0x%x" % i),
print("")
mu = Uc(UC_ARCH_X86, UC_MODE_64)
mu.mem_map(0x0, PAGE_SIZE)
mu.mem_write(0x4000, CODE)
mu.reg_write(UC_X86_REG_RSP, ESP)
mu.hook_add(UC_HOOK_CODE, hook_code)
mu.emu_start(0x4000, 0, 0, 5)
rsp = mu.reg_read(UC_X86_REG_RSP)
print("Value of FPIP: [0x%X]" % (rsp + 10))
mem_reader(rsp + 10, 8)
# EXPECTED OUTPUT:
# 0x4000: mov dword ptr [rsp], 0x37f
# 0x4007: fldcw word ptr [rsp]
# 0x400A: fnop
# 0x400C: fnstenv dword ptr [rsp + 8]
# 0x4010: pop rcx
# Value of FPIP: [0x2012]
# 0x0 0x0 0xa 0x40 0x0 0x0 0x0 0x0
# WHERE: the value of FPIP should be the address of fnop

6
regress/jmp_ebx_hang.py
View File

@ -4,20 +4,23 @@
import unicorn
CODE_ADDR = 0x10101000
CODE = b'\xff\xe3'
CODE = b'\xff\xe3' # jmp ebx
mu = unicorn.Uc(unicorn.UC_ARCH_X86, unicorn.UC_MODE_32)
mu.mem_map(CODE_ADDR, 1024 * 4)
mu.mem_write(CODE_ADDR, CODE)
# If EBX is zero then an exception is raised, as expected
mu.reg_write(unicorn.x86_const.UC_X86_REG_EBX, 0x0)
print(">>> jmp ebx (ebx = 0)");
try:
mu.emu_start(CODE_ADDR, CODE_ADDR + 2, count=1)
except unicorn.UcError as e:
print("ERROR: %s" % e)
assert(e.errno == unicorn.UC_ERR_CODE_INVALID)
else:
assert(False)
print(">>> jmp ebx (ebx = 0xaa96a47f)");
mu = unicorn.Uc(unicorn.UC_ARCH_X86, unicorn.UC_MODE_32)
mu.mem_map(CODE_ADDR, 1024 * 4)
# If we write this address to EBX then the emulator hangs on emu_start
@ -26,6 +29,7 @@ mu.mem_write(CODE_ADDR, CODE)
try:
mu.emu_start(CODE_ADDR, CODE_ADDR + 2, count=1)
except unicorn.UcError as e:
print("ERROR: %s" % e)
assert(e.errno == unicorn.UC_ERR_CODE_INVALID)
else:
assert(False)

12
regress/pshufb.py Executable file
View File

@ -0,0 +1,12 @@
#!/usr/bin/python
# By Ryan Hileman, issue #91
# Invalid instruction = test failed
from unicorn import *
from unicorn.x86_const import *
uc = Uc(UC_ARCH_X86, UC_MODE_64)
uc.mem_map(0x2000, 0x1000)
# pshufb xmm0, xmm1
uc.mem_write(0x2000, '660f3800c1'.decode('hex'))
uc.emu_start(0x2000, 0)