135 lines
6.4 KiB
Python
Executable File
135 lines
6.4 KiB
Python
Executable File
from unicorn import *
|
|
from unicorn.arm_const import *
|
|
import binascii
|
|
|
|
MB = 1024 * 1024
|
|
PAGE = 4 * 1024
|
|
|
|
def PrintArmRegisters(uc_emu):
|
|
print 'R0 : '+hex(uc_emu.reg_read(UC_ARM_REG_R0))
|
|
print 'R1 : '+hex(uc_emu.reg_read(UC_ARM_REG_R1))
|
|
print 'R2 : '+hex(uc_emu.reg_read(UC_ARM_REG_R2))
|
|
print 'R3 : '+hex(uc_emu.reg_read(UC_ARM_REG_R3))
|
|
print 'R4 : '+hex(uc_emu.reg_read(UC_ARM_REG_R4))
|
|
print 'R5 : '+hex(uc_emu.reg_read(UC_ARM_REG_R5))
|
|
print 'R6 : '+hex(uc_emu.reg_read(UC_ARM_REG_R6))
|
|
print 'R7 : '+hex(uc_emu.reg_read(UC_ARM_REG_R7))
|
|
print 'R8 : '+hex(uc_emu.reg_read(UC_ARM_REG_R8))
|
|
print 'R9 : '+hex(uc_emu.reg_read(UC_ARM_REG_R9))
|
|
print 'R10 : '+hex(uc_emu.reg_read(UC_ARM_REG_R10))
|
|
print 'R11 : '+hex(uc_emu.reg_read(UC_ARM_REG_R11))
|
|
print 'R12 : '+hex(uc_emu.reg_read(UC_ARM_REG_R12))
|
|
print 'SP : '+hex(uc_emu.reg_read(UC_ARM_REG_SP))
|
|
print 'LR : '+hex(uc_emu.reg_read(UC_ARM_REG_LR))
|
|
print 'PC : '+hex(uc_emu.reg_read(UC_ARM_REG_PC))
|
|
flags = uc_emu.reg_read(UC_ARM_REG_CPSR)
|
|
print 'carry : '+str(flags >> 29 & 0x1)
|
|
print 'overflow : '+str(flags >> 28 & 0x1)
|
|
print 'negative : '+str(flags >> 31 & 0x1)
|
|
print 'zero : '+str(flags >> 30 & 0x1)
|
|
|
|
'''
|
|
issue #287
|
|
Initial Register States: R0=3, R1=24, R2=16, R3=0
|
|
----- code start -----
|
|
CMP R0,R1,LSR#3
|
|
SUBCS R0,R0,R1,LSR#3 # CPU flags got changed in these two instructions, and *REMEMBERED*, now NF == VF == 0
|
|
CMP R0,#1 # CPU flags changed again, now NF == 1, VF == 0, but they are not properly *REMEMBERED*
|
|
MOV R1,R1,LSR#4
|
|
SUBGES R2,R2,#4 # according to the result of CMP, we should skip this op
|
|
|
|
MOVGE R3,#100 # since changed flags are not *REMEMBERED* in CMP, now NF == VF == 0, which result in wrong branch
|
|
# at the end of this code block, should R3 == 0
|
|
----- code end ------
|
|
|
|
# TCG ops are correct, plain op translation is done correctly,
|
|
# but there're In-Memory bits invisible from ops that control the host code generation.
|
|
# all these codes are in one TCG translation-block, so wrong things could happen.
|
|
# detail explanation is given on the right side.
|
|
# remember, both set_label and brcond are point to refresh the dead_temps and mem_temps states in TCG
|
|
----- TCG ops ------
|
|
ld_i32 tmp5,env,$0xfffffffffffffff4
|
|
movi_i32 tmp6,$0x0
|
|
brcond_i32 tmp5,tmp6,ne,$0x0
|
|
mov_i32 tmp5,r1 -------------------------
|
|
movi_i32 tmp6,$0x3 |
|
|
shr_i32 tmp5,r1,tmp6 |
|
|
mov_i32 tmp6,r0 |
|
|
sub_i32 NF,r0,tmp5 |
|
|
mov_i32 ZF,NF |
|
|
setcond_i32 CF,r0,tmp5,geu | # This part is "CMP R0,R1,LSR#3"
|
|
xor_i32 VF,NF,r0 |-----> # and "SUBCS R0,R0,R1,LSR#3"
|
|
xor_i32 tmp7,r0,tmp5 | # the last op in this block, set_label get a chance to refresh the TCG globals memory states,
|
|
and_i32 VF,VF,tmp7 | # so things get back to normal states
|
|
mov_i32 tmp6,NF | # these codes are not affected by the bug. Let's called this Part-D
|
|
movi_i32 tmp5,$0x0 |
|
|
brcond_i32 CF,tmp5,eq,$0x1 |
|
|
mov_i32 tmp5,r1 |
|
|
movi_i32 tmp6,$0x3 |
|
|
shr_i32 tmp5,r1,tmp6 |
|
|
mov_i32 tmp6,r0 |
|
|
sub_i32 tmp6,r0,tmp5 |
|
|
mov_i32 r0,tmp6 |
|
|
set_label $0x1 -------------------------
|
|
movi_i32 tmp5,$0x1 ----------------- # Let's called this Part-C
|
|
mov_i32 tmp6,r0 | # NF is used as output operand again!
|
|
sub_i32 NF,r0,tmp5 ----------------|-----> # but it is stated as Not-In-Memory,
|
|
mov_i32 ZF,NF | # no need to sync it after calculation.
|
|
setcond_i32 CF,r0,tmp5,geu | # the generated host code does not write NF
|
|
xor_i32 VF,NF,r0 | # back to its memory location, hence forgot. And the CPU flags after this calculation is not changed.
|
|
xor_i32 tmp7,r0,tmp5 | # Caution: the following SUBGES's condition check is right, even though the generated host code does not *REMEMBER* NF, it will cache the calculated result and serve SUBGES correctly
|
|
and_i32 VF,VF,tmp7 |
|
|
mov_i32 tmp6,NF |
|
|
mov_i32 tmp5,r1 | # this part is "CMP R0,#1"
|
|
movi_i32 tmp6,$0x4 | # and "MOV R1,R1,LSR#4"
|
|
shr_i32 tmp5,r1,tmp6 | # and "SUBGES R2,R2,#4"
|
|
mov_i32 r1,tmp5 |-----> # This is the part where problem start to arise
|
|
xor_i32 tmp5,VF,NF |
|
|
movi_i32 tmp6,$0x0 |
|
|
brcond_i32 tmp5,tmp6,lt,$0x2 --------|-----> # QEMU will refresh the InMemory bit for TCG globals here, but Unicorn won't
|
|
movi_i32 tmp5,$0x4 |
|
|
mov_i32 tmp6,r2 | # this is the 1st bug-related op get analyzed.
|
|
sub_i32 NF,r2,tmp5 ----------------|-----> # here, NF is an output operand, it's flagged dead
|
|
mov_i32 ZF,NF | # and the InMemory bit is clear, tell the previous(above) ops
|
|
setcond_i32 CF,r2,tmp5,geu | # if it is used as output operand again, do not sync it
|
|
xor_i32 VF,NF,r2 | # so the generated host-code for previous ops will not write it back to Memory
|
|
xor_i32 tmp7,r2,tmp5 | # Caution: the CPU flags after this calculation is also right, because the set_label is a point of refresh, make them *REMEMBERED*
|
|
and_i32 VF,VF,tmp7 | # Let's call this Part-B
|
|
mov_i32 tmp6,NF |
|
|
mov_i32 r2,ZF |
|
|
set_label $0x2 -----------------
|
|
xor_i32 tmp5,VF,NF -----------------
|
|
movi_i32 tmp6,$0x0 |
|
|
brcond_i32 tmp5,tmp6,lt,$0x3 | # Let's call this Part-A
|
|
movi_i32 tmp5,$0x64 | # if Part-B is not skipped, this part won't go wrong, because we'll check the CPU flags as the result of Part-B, it's *REMEMBERED*
|
|
movi_i32 r3,$0x64 |-----> # but if Part-B is skipped,
|
|
set_label $0x3 | # what should we expected? we will check the condition based on the result of Part-D!!!
|
|
call wfi,$0x0,$0,env | # because result of Part-C is lost. this is why things go wrong.
|
|
set_label $0x0 |
|
|
exit_tb $0x7f6401714013 -----------------
|
|
###########
|
|
----- TCG ends ------
|
|
'''
|
|
|
|
TestCode = b'\xa1\x01\x50\xe1\xa1\x01\x40\x20\x01\x00\x50\xe3\x21\x12\xa0\xe1\x04\x20\x52\xa2\x64\x30\xa0\xa3'
|
|
|
|
def UseUcToEmulate():
|
|
try:
|
|
uc_emu = Uc(UC_ARCH_ARM, UC_MODE_ARM)
|
|
#if LoadCode(uc_emu, 2*MB, 0x9004):
|
|
uc_emu.mem_map(0, 2*MB)
|
|
uc_emu.reg_write(UC_ARM_REG_SP, 0x40000)
|
|
uc_emu.reg_write(UC_ARM_REG_R0, 3)
|
|
uc_emu.reg_write(UC_ARM_REG_R1, 24)
|
|
uc_emu.reg_write(UC_ARM_REG_R2, 16)
|
|
uc_emu.mem_write(0, TestCode)
|
|
uc_emu.emu_start(0, 24)
|
|
PrintArmRegisters(uc_emu)
|
|
|
|
except UcError as e:
|
|
print("ERROR: %s" % e)
|
|
PrintArmRegisters(uc_emu)
|
|
|
|
|
|
UseUcToEmulate()
|