diff --git a/.gitignore b/.gitignore index d1522566..99d9edc7 100644 --- a/.gitignore +++ b/.gitignore @@ -87,3 +87,4 @@ regress/block_test regress/map_write regress/ro_mem_test regress/nr_mem_test +regress/timeout_segfault diff --git a/docs/unicorn-logo.txt b/docs/unicorn-logo.txt index 943c0ad2..3b6e96af 100644 --- a/docs/unicorn-logo.txt +++ b/docs/unicorn-logo.txt @@ -1,19 +1,19 @@ - /\'. _,, - |.\ \ .'_/ - _.-- |(\\ \ .'_.' - _.-' \_\\ \\_),/ _/ - _).' .:::::::.___ .' - // ' ./::::::\\o\( - // //::/ '"( \ - //_ //::( '. '. - /_'/ /||:::\ '. \ - '// '\\:::':\_ -<_' _'- - / | '\::/|::::.._ _ )( - | | \:| \:( '.(_'._) + /\'. _,. + |:\ \. .'_/ + _.- |(\\ \ .'_.' + _.-' ,__\\ \\_),/ _/ + _:.' .:::::::.___ ,' + // ' ./::::::\invalid_error = UC_ERR_CODE_INVALID; + ret = EXCP_HLT; break; } /* Note: we do it here to avoid a gcc bug on Mac OS X when diff --git a/qemu/target-i386/fpu_helper.c b/qemu/target-i386/fpu_helper.c index 1d4eee39..a74380f0 100644 --- a/qemu/target-i386/fpu_helper.c +++ b/qemu/target-i386/fpu_helper.c @@ -986,12 +986,22 @@ void helper_fstenv(CPUX86State *env, target_ulong ptr, int data32) } } } - if (data32) { + + // DFLAG enum: tcg.h, case here to int + if (env->hflags & HF_CS64_MASK) { + cpu_stl_data(env, ptr, env->fpuc); + cpu_stl_data(env, ptr + 4, fpus); + cpu_stl_data(env, ptr + 8, fptag); + cpu_stl_data(env, ptr + 12, env->fpip); /* fpip */ + cpu_stl_data(env, ptr + 20, 0); /* fpcs */ + cpu_stl_data(env, ptr + 24, 0); /* fpoo */ + cpu_stl_data(env, ptr + 28, 0); /* fpos */ + } else if (data32) { /* 32 bit */ cpu_stl_data(env, ptr, env->fpuc); cpu_stl_data(env, ptr + 4, fpus); cpu_stl_data(env, ptr + 8, fptag); - cpu_stl_data(env, ptr + 12, 0); /* fpip */ + cpu_stl_data(env, ptr + 12, env->fpip); /* fpip */ cpu_stl_data(env, ptr + 16, 0); /* fpcs */ cpu_stl_data(env, ptr + 20, 0); /* fpoo */ cpu_stl_data(env, ptr + 24, 0); /* fpos */ @@ -1000,11 +1010,12 @@ void helper_fstenv(CPUX86State *env, target_ulong ptr, int data32) cpu_stw_data(env, ptr, env->fpuc); cpu_stw_data(env, ptr + 2, fpus); cpu_stw_data(env, ptr + 4, fptag); - cpu_stw_data(env, ptr + 6, 0); + cpu_stw_data(env, ptr + 6, env->fpip); cpu_stw_data(env, ptr + 8, 0); cpu_stw_data(env, ptr + 10, 0); cpu_stw_data(env, ptr + 12, 0); } + } void helper_fldenv(CPUX86State *env, target_ulong ptr, int data32) diff --git a/qemu/target-i386/translate.c b/qemu/target-i386/translate.c index 10dc33d8..a3b09fd5 100644 --- a/qemu/target-i386/translate.c +++ b/qemu/target-i386/translate.c @@ -248,6 +248,11 @@ static void gen_update_cc_op(DisasContext *s) } } +static void fpu_update_ip(CPUX86State *env, target_ulong pc) +{ + env->fpip = pc; +} + #ifdef TARGET_X86_64 #define NB_OP_SIZES 4 @@ -6110,6 +6115,7 @@ static target_ulong disas_insn(CPUX86State *env, DisasContext *s, /* fcomp needs pop */ gen_helper_fpop(tcg_ctx, cpu_env); } + fpu_update_ip(env, pc_start); } break; case 0x08: /* flds */ @@ -6194,6 +6200,7 @@ static target_ulong disas_insn(CPUX86State *env, DisasContext *s, gen_helper_fpop(tcg_ctx, cpu_env); break; } + fpu_update_ip(env, pc_start); break; case 0x0c: /* fldenv mem */ gen_update_cc_op(s); @@ -6219,12 +6226,14 @@ static target_ulong disas_insn(CPUX86State *env, DisasContext *s, gen_update_cc_op(s); gen_jmp_im(s, pc_start - s->cs_base); gen_helper_fldt_ST0(tcg_ctx, cpu_env, cpu_A0); + fpu_update_ip(env, pc_start); break; case 0x1f: /* fstpt mem */ gen_update_cc_op(s); gen_jmp_im(s, pc_start - s->cs_base); gen_helper_fstt_ST0(tcg_ctx, cpu_env, cpu_A0); gen_helper_fpop(tcg_ctx, cpu_env); + fpu_update_ip(env, pc_start); break; case 0x2c: /* frstor mem */ gen_update_cc_op(s); @@ -6245,21 +6254,25 @@ static target_ulong disas_insn(CPUX86State *env, DisasContext *s, gen_update_cc_op(s); gen_jmp_im(s, pc_start - s->cs_base); gen_helper_fbld_ST0(tcg_ctx, cpu_env, cpu_A0); + fpu_update_ip(env, pc_start); break; case 0x3e: /* fbstp */ gen_update_cc_op(s); gen_jmp_im(s, pc_start - s->cs_base); gen_helper_fbst_ST0(tcg_ctx, cpu_env, cpu_A0); gen_helper_fpop(tcg_ctx, cpu_env); + fpu_update_ip(env, pc_start); break; case 0x3d: /* fildll */ tcg_gen_qemu_ld_i64(s->uc, cpu_tmp1_i64, cpu_A0, s->mem_index, MO_LEQ); gen_helper_fildll_ST0(tcg_ctx, cpu_env, cpu_tmp1_i64); + fpu_update_ip(env, pc_start); break; case 0x3f: /* fistpll */ gen_helper_fistll_ST0(tcg_ctx, cpu_tmp1_i64, cpu_env); tcg_gen_qemu_st_i64(s->uc, cpu_tmp1_i64, cpu_A0, s->mem_index, MO_LEQ); gen_helper_fpop(tcg_ctx, cpu_env); + fpu_update_ip(env, pc_start); break; default: goto illegal_op; @@ -6574,6 +6587,7 @@ static target_ulong disas_insn(CPUX86State *env, DisasContext *s, default: goto illegal_op; } + fpu_update_ip(env, pc_start); } break; /************************/ diff --git a/regress/fpu_ip.py b/regress/fpu_ip.py new file mode 100755 index 00000000..77efa21b --- /dev/null +++ b/regress/fpu_ip.py @@ -0,0 +1,61 @@ +#!/usr/bin/python +from unicorn import * +from unicorn.x86_const import * +from capstone import * + +ESP = 0x2000 +PAGE_SIZE = 2 * 1024 * 1024 + +# mov [esp], DWORD 0x37f +# fldcw [esp] +# fnop +# fnstenv [esp + 8] +# pop ecx +CODE = b'\xc7\x04\x24\x7f\x03\x00\x00\xd9\x2c\x24\xd9\xd0\xd9\x74\x24\x08\x59' + +class SimpleEngine: + def __init__(self): + self.capmd = Cs(CS_ARCH_X86, CS_MODE_32) + + def disas_single(self, data): + for i in self.capmd.disasm(data, 16): + print("\t%s\t%s" % (i.mnemonic, i.op_str)) + break + +disasm = SimpleEngine() + +def hook_code(uc, addr, size, user_data): + mem = uc.mem_read(addr, size) + print(" 0x%X:" % (addr)), + disasm.disas_single(str(mem)) + +def mem_reader(addr, size): + tmp = mu.mem_read(addr, size) + + for i in tmp: + print(" 0x%x" % i), + print("") + + +mu = Uc(UC_ARCH_X86, UC_MODE_32) + +mu.mem_map(0x0, PAGE_SIZE) +mu.mem_write(0x4000, CODE) +mu.reg_write(UC_X86_REG_ESP, ESP) +mu.hook_add(UC_HOOK_CODE, hook_code) + + +mu.emu_start(0x4000, 0, 0, 5) +esp = mu.reg_read(UC_X86_REG_ESP) +print("value at ESP [0x%X - 4]: " % esp) +mem_reader(esp + 14, 4) + +# EXPECTED OUTPUT: +# 0x4000: mov dword ptr [esp], 0x37f +# 0x4007: fldcw word ptr [esp] +# 0x400A: fnop +# 0x400C: fnstenv dword ptr [esp + 8] +# 0x4010: pop ecx +# value at ESP [0x2004 - 4]: +# 0x0 0x0 0xa 0x40 +# ^ this value should match the fnop instuction addr \ No newline at end of file diff --git a/regress/fpu_ip64.py b/regress/fpu_ip64.py new file mode 100755 index 00000000..dd0b5c1c --- /dev/null +++ b/regress/fpu_ip64.py @@ -0,0 +1,62 @@ +#!/usr/bin/python +from unicorn import * +from unicorn.x86_const import * +from capstone import * + +ESP = 0x2000 +PAGE_SIZE = 2 * 1024 * 1024 + +# mov [esp], DWORD 0x37f +# fldcw [esp] +# fnop +# fnstenv [esp + 8] +# pop ecx +CODE = "C704247F030000D92C24D9D0D974240859".decode('hex') + +class SimpleEngine: + def __init__(self): + self.capmd = Cs(CS_ARCH_X86, CS_MODE_64) + + def disas_single(self, data): + for i in self.capmd.disasm(data, 16): + print("\t%s\t%s" % (i.mnemonic, i.op_str)) + break + +disasm = SimpleEngine() + +def hook_code(uc, addr, size, user_data): + mem = uc.mem_read(addr, size) + print(" 0x%X:" % (addr)), + disasm.disas_single(str(mem)) + +def mem_reader(addr, size): + tmp = mu.mem_read(addr, size) + + for i in tmp: + print(" 0x%x" % i), + print("") + + +mu = Uc(UC_ARCH_X86, UC_MODE_64) + +mu.mem_map(0x0, PAGE_SIZE) +mu.mem_write(0x4000, CODE) +mu.reg_write(UC_X86_REG_RSP, ESP) +mu.hook_add(UC_HOOK_CODE, hook_code) + + +mu.emu_start(0x4000, 0, 0, 5) +rsp = mu.reg_read(UC_X86_REG_RSP) +print("Value of FPIP: [0x%X]" % (rsp + 10)) +mem_reader(rsp + 10, 8) +# EXPECTED OUTPUT: + +# 0x4000: mov dword ptr [rsp], 0x37f +# 0x4007: fldcw word ptr [rsp] +# 0x400A: fnop +# 0x400C: fnstenv dword ptr [rsp + 8] +# 0x4010: pop rcx +# Value of FPIP: [0x2012] +# 0x0 0x0 0xa 0x40 0x0 0x0 0x0 0x0 + +# WHERE: the value of FPIP should be the address of fnop \ No newline at end of file diff --git a/regress/jmp_ebx_hang.py b/regress/jmp_ebx_hang.py index 1b78d89c..5683de89 100755 --- a/regress/jmp_ebx_hang.py +++ b/regress/jmp_ebx_hang.py @@ -4,20 +4,23 @@ import unicorn CODE_ADDR = 0x10101000 -CODE = b'\xff\xe3' +CODE = b'\xff\xe3' # jmp ebx mu = unicorn.Uc(unicorn.UC_ARCH_X86, unicorn.UC_MODE_32) mu.mem_map(CODE_ADDR, 1024 * 4) mu.mem_write(CODE_ADDR, CODE) # If EBX is zero then an exception is raised, as expected mu.reg_write(unicorn.x86_const.UC_X86_REG_EBX, 0x0) +print(">>> jmp ebx (ebx = 0)"); try: mu.emu_start(CODE_ADDR, CODE_ADDR + 2, count=1) except unicorn.UcError as e: + print("ERROR: %s" % e) assert(e.errno == unicorn.UC_ERR_CODE_INVALID) else: assert(False) +print(">>> jmp ebx (ebx = 0xaa96a47f)"); mu = unicorn.Uc(unicorn.UC_ARCH_X86, unicorn.UC_MODE_32) mu.mem_map(CODE_ADDR, 1024 * 4) # If we write this address to EBX then the emulator hangs on emu_start @@ -26,6 +29,7 @@ mu.mem_write(CODE_ADDR, CODE) try: mu.emu_start(CODE_ADDR, CODE_ADDR + 2, count=1) except unicorn.UcError as e: + print("ERROR: %s" % e) assert(e.errno == unicorn.UC_ERR_CODE_INVALID) else: assert(False) diff --git a/regress/pshufb.py b/regress/pshufb.py new file mode 100755 index 00000000..0d01bf5e --- /dev/null +++ b/regress/pshufb.py @@ -0,0 +1,12 @@ +#!/usr/bin/python +# By Ryan Hileman, issue #91 + +# Invalid instruction = test failed + +from unicorn import * +from unicorn.x86_const import * +uc = Uc(UC_ARCH_X86, UC_MODE_64) +uc.mem_map(0x2000, 0x1000) +# pshufb xmm0, xmm1 +uc.mem_write(0x2000, '660f3800c1'.decode('hex')) +uc.emu_start(0x2000, 0)