From fb45b287ba937a7b54f705df112b26dfba8e8099 Mon Sep 17 00:00:00 2001 From: lazymio Date: Mon, 1 Nov 2021 14:00:43 +0100 Subject: [PATCH] Add multiple exits mechanism and tests&samples --- include/uc_priv.h | 2 +- samples/sample_ctl.c | 102 +++++++++++++++++++++++++++++++++++++++++- tests/unit/test_ctl.c | 45 +++++++++++++++++++ uc.c | 18 ++++---- 4 files changed, 157 insertions(+), 10 deletions(-) diff --git a/include/uc_priv.h b/include/uc_priv.h index 19dbecda..7af8d91a 100644 --- a/include/uc_priv.h +++ b/include/uc_priv.h @@ -300,7 +300,7 @@ struct uc_struct { uint64_t invalid_addr; // invalid address to be accessed int invalid_error; // invalid memory code: 1 = READ, 2 = WRITE, 3 = CODE - int use_exit; + int use_exits; GTree *exits; // addresses where emulation stops (@until param of // uc_emu_start()) Also see UC_CTL_USE_EXITS for more details. diff --git a/samples/sample_ctl.c b/samples/sample_ctl.c index 65aeff62..88e570aa 100644 --- a/samples/sample_ctl.c +++ b/samples/sample_ctl.c @@ -7,7 +7,17 @@ #include // code to be emulated -#define X86_CODE32 "\x41\x4a" // INC ecx; DEC edx; PXOR xmm0, xmm1 + +// INC ecx; DEC edx; PXOR xmm0, xmm1 +#define X86_CODE32 "\x41\x4a" +// cmp eax, 0; +// jg lb; +// inc eax; +// nop; +// lb: +// inc ebx; +// nop; +#define X86_JUMP_CODE "\x83\xf8\x00\x7f\x02\x40\x90\x43\x90" // memory address where emulation starts #define ADDRESS 0x10000 @@ -62,9 +72,99 @@ static void test_uc_ctl_read(void) uc_close(uc); } +void test_uc_ctl_exits() +{ + uc_engine *uc; + uc_err err; + int r_eax, r_ebx; + uint64_t exits[] = {ADDRESS + 6, ADDRESS + 8}; + + printf("Using multiple exits by uc_ctl.\n"); + + // Initialize emulator in X86-32bit mode + err = uc_open(UC_ARCH_X86, UC_MODE_32, &uc); + if (err) { + printf("Failed on uc_open() with error returned: %u\n", err); + return; + } + + err = uc_mem_map(uc, ADDRESS, 0x1000, UC_PROT_ALL); + if (err) { + printf("Failed on uc_mem_map() with error returned: %u\n", err); + return; + } + + // Write our code to the memory. + err = uc_mem_write(uc, ADDRESS, X86_JUMP_CODE, sizeof(X86_JUMP_CODE) - 1); + if (err) { + printf("Failed on uc_mem_write() with error returned: %u\n", err); + return; + } + + // Enable multiple exits. + err = uc_ctl_exits_enabled(uc, true); + if (err) { + printf("Failed on uc_ctl() with error returned: %u\n", err); + return; + } + + err = uc_ctl_set_exists(uc, exits, 2); + if (err) { + printf("Failed on uc_ctl() with error returned: %u\n", err); + return; + } + + // This should stop at ADDRESS + 6 and increase eax, even thouhg we don't + // provide an exit. + err = uc_emu_start(uc, ADDRESS, 0, 0, 0); + if (err) { + printf("Failed on uc_emu_start() with error returned: %u\n", err); + return; + } + + err = uc_reg_read(uc, UC_X86_REG_EAX, &r_eax); + if (err) { + printf("Failed on uc_reg_read() with error returned: %u\n", err); + return; + } + err = uc_reg_read(uc, UC_X86_REG_EBX, &r_ebx); + if (err) { + printf("Failed on uc_reg_read() with error returned: %u\n", err); + return; + } + printf(">>> eax = %" PRId32 " and ebx = %" PRId32 + " after the first emulation\n", + r_eax, r_ebx); + + // This should stop at ADDRESS + 8, even thouhg we don't provide an exit. + err = uc_emu_start(uc, ADDRESS, 0, 0, 0); + if (err) { + printf("Failed on uc_emu_start() with error returned: %u\n", err); + return; + } + + err = uc_reg_read(uc, UC_X86_REG_EAX, &r_eax); + if (err) { + printf("Failed on uc_reg_read() with error returned: %u\n", err); + return; + } + err = uc_reg_read(uc, UC_X86_REG_EBX, &r_ebx); + if (err) { + printf("Failed on uc_reg_read() with error returned: %u\n", err); + return; + } + printf(">>> eax = %" PRId32 " and ebx = %" PRId32 + " after the second emulation\n", + r_eax, r_ebx); + + uc_close(uc); +} + int main(int argc, char **argv, char **envp) { test_uc_ctl_read(); + printf("====================\n"); + test_uc_ctl_exits(); return 0; } diff --git a/tests/unit/test_ctl.c b/tests/unit/test_ctl.c index 30d0dede..5cf19096 100644 --- a/tests/unit/test_ctl.c +++ b/tests/unit/test_ctl.c @@ -3,6 +3,14 @@ const uint64_t code_start = 0x1000; const uint64_t code_len = 0x4000; +static void uc_common_setup(uc_engine **uc, uc_arch arch, uc_mode mode, + const char *code, uint64_t size) +{ + OK(uc_open(arch, mode, uc)); + OK(uc_mem_map(*uc, code_start, code_len, UC_PROT_ALL)); + OK(uc_mem_write(*uc, code_start, code, size)); +} + #define GEN_SIMPLE_READ_TEST(field, ctl_type, arg_type, expected) \ static void test_uc_ctl_##field() \ { \ @@ -19,8 +27,45 @@ GEN_SIMPLE_READ_TEST(arch, UC_CTL_UC_ARCH, int, 4) GEN_SIMPLE_READ_TEST(page_size, UC_CTL_UC_PAGE_SIZE, uint32_t, 4096) GEN_SIMPLE_READ_TEST(time_out, UC_CTL_UC_TIMEOUT, uint64_t, 0) +static void test_uc_ctl_exits() +{ + uc_engine *uc; + // cmp eax, 0; + // jg lb; + // inc eax; + // nop; <---- exit1 + // lb: + // inc ebx; + // nop; <---- exit2 + char code[] = "\x83\xf8\x00\x7f\x02\x40\x90\x43\x90"; + int r_eax; + int r_ebx; + uint64_t exits[] = {code_start + 6, code_start + 8}; + + uc_common_setup(&uc, UC_ARCH_X86, UC_MODE_32, code, sizeof(code) - 1); + OK(uc_ctl_exits_enabled(uc, true)); + OK(uc_ctl_set_exists(uc, exits, 2)); + r_eax = 0; + r_ebx = 0; + OK(uc_reg_write(uc, UC_X86_REG_EAX, &r_eax)); + OK(uc_reg_write(uc, UC_X86_REG_EAX, &r_ebx)); + + // Run two times. + OK(uc_emu_start(uc, code_start, 0, 0, 0)); + OK(uc_emu_start(uc, code_start, 0, 0, 0)); + + OK(uc_reg_read(uc, UC_X86_REG_EAX, &r_eax)); + OK(uc_reg_read(uc, UC_X86_REG_EAX, &r_ebx)); + + TEST_CHECK(r_eax == 1); + TEST_CHECK(r_ebx == 1); + + OK(uc_close(uc)); +} + TEST_LIST = {{"test_uc_ctl_mode", test_uc_ctl_mode}, {"test_uc_ctl_page_size", test_uc_ctl_page_size}, {"test_uc_ctl_arch", test_uc_ctl_arch}, {"test_uc_ctl_time_out", test_uc_ctl_time_out}, + {"test_uc_ctl_exits", test_uc_ctl_exits}, {NULL, NULL}}; \ No newline at end of file diff --git a/uc.c b/uc.c index d023918e..b8351c97 100644 --- a/uc.c +++ b/uc.c @@ -753,10 +753,12 @@ uc_err uc_emu_start(uc_engine *uc, uint64_t begin, uint64_t until, } } - // This is low efficiency for compatibility. - // Consider a new uc_ctl to set not updating uc->exists in uc_emu_start? - g_tree_remove_all(uc->exits); - uc_add_exit(uc, until); + // If UC_CTL_UC_USE_EXITS is set, then the @until param won't have any + // effect. This is designed for the backward compatibility. + if (!uc->use_exits) { + g_tree_remove_all(uc->exits); + uc_add_exit(uc, until); + } if (timeout) { enable_emu_timer(uc, timeout * 1000); // microseconds -> nanoseconds @@ -1848,8 +1850,8 @@ uc_err uc_ctl(uc_engine *uc, uc_control_type control, ...) } case UC_CTL_UC_USE_EXITS: { if (rw == UC_CTL_IO_WRITE) { - int use_exit = va_arg(args, int); - uc->use_exit = use_exit; + int use_exits = va_arg(args, int); + uc->use_exits = use_exits; } else { err = UC_ERR_ARG; } @@ -1857,7 +1859,7 @@ uc_err uc_ctl(uc_engine *uc, uc_control_type control, ...) } case UC_CTL_UC_EXITS_CNT: { - if (!uc->use_exit) { + if (!uc->use_exits) { err = UC_ERR_ARG; } else if (rw == UC_CTL_IO_READ) { size_t *exits_cnt = va_arg(args, size_t *); @@ -1869,7 +1871,7 @@ uc_err uc_ctl(uc_engine *uc, uc_control_type control, ...) } case UC_CTL_UC_EXITS: { - if (!uc->use_exit) { + if (!uc->use_exits) { err = UC_ERR_ARG; } else if (rw == UC_CTL_IO_READ) { uint64_t *exits = va_arg(args, uint64_t *);