From 2fc483ec47a762ac472448ae09983ee1f1da0321 Mon Sep 17 00:00:00 2001 From: cherepanov74 Date: Mon, 14 Sep 2015 20:42:29 +0200 Subject: [PATCH 01/16] Fixes crash on Windows 64bit --- qemu/include/sysemu/os-win32.h | 1 + 1 file changed, 1 insertion(+) diff --git a/qemu/include/sysemu/os-win32.h b/qemu/include/sysemu/os-win32.h index b683d76..3049cd6 100644 --- a/qemu/include/sysemu/os-win32.h +++ b/qemu/include/sysemu/os-win32.h @@ -28,6 +28,7 @@ #include #include +#include /* Workaround for older versions of MinGW. */ #ifndef ECONNREFUSED From 886946dcf4125e1003823e1a2626084fd930d38c Mon Sep 17 00:00:00 2001 From: Nguyen Anh Quynh Date: Sat, 26 Sep 2015 16:49:00 +0800 Subject: [PATCH 02/16] do not use syscall to quit emulation. this can fix issues #147 & #148 --- qemu/aarch64.h | 1 + qemu/arm.h | 1 + qemu/cpu-exec.c | 12 ------------ qemu/header_gen.py | 1 + qemu/m68k.h | 1 + qemu/mips.h | 1 + qemu/mips64.h | 1 + qemu/mips64el.h | 1 + qemu/mipsel.h | 1 + qemu/powerpc.h | 1 + qemu/sparc.h | 1 + qemu/sparc64.h | 1 + qemu/target-arm/translate-a64.c | 6 ++++-- qemu/target-arm/translate.c | 10 +++++++--- qemu/target-i386/translate.c | 11 +++++++++-- qemu/target-m68k/translate.c | 4 ++-- qemu/target-mips/translate.c | 7 +++++-- qemu/target-sparc/helper.c | 4 ++-- qemu/target-sparc/helper.h | 2 +- qemu/target-sparc/translate.c | 14 +++++++++++++- qemu/x86_64.h | 1 + samples/sample_sparc.c | 4 ++-- 22 files changed, 57 insertions(+), 29 deletions(-) diff --git a/qemu/aarch64.h b/qemu/aarch64.h index 77de164..b888e1c 100644 --- a/qemu/aarch64.h +++ b/qemu/aarch64.h @@ -1,6 +1,7 @@ /* Autogen header for Unicorn Engine - DONOT MODIFY */ #ifndef UNICORN_AUTOGEN_AARCH64_H #define UNICORN_AUTOGEN_AARCH64_H +#define helper_power_down helper_power_down_aarch64 #define check_exit_request check_exit_request_aarch64 #define address_space_unregister address_space_unregister_aarch64 #define tb_invalidate_phys_page_fast tb_invalidate_phys_page_fast_aarch64 diff --git a/qemu/arm.h b/qemu/arm.h index 3d405fa..5f70b6b 100644 --- a/qemu/arm.h +++ b/qemu/arm.h @@ -1,6 +1,7 @@ /* Autogen header for Unicorn Engine - DONOT MODIFY */ #ifndef UNICORN_AUTOGEN_ARM_H #define UNICORN_AUTOGEN_ARM_H +#define helper_power_down helper_power_down_arm #define check_exit_request check_exit_request_arm #define address_space_unregister address_space_unregister_arm #define tb_invalidate_phys_page_fast tb_invalidate_phys_page_fast_arm diff --git a/qemu/cpu-exec.c b/qemu/cpu-exec.c index c83485c..01e8ca7 100644 --- a/qemu/cpu-exec.c +++ b/qemu/cpu-exec.c @@ -108,18 +108,6 @@ int cpu_exec(struct uc_struct *uc, CPUArchState *env) // qq break; } - if ((uc->arch == UC_ARCH_X86 && cpu->exception_index == 0x99) || // X86's Int 0x99 - (uc->arch == UC_ARCH_ARM && cpu->exception_index == 2) || /* ARM's EXCP_SWI */ - (uc->arch == UC_ARCH_ARM64 && cpu->exception_index == 2) || /* ARM's EXCP_SWI */ - (uc->arch == UC_ARCH_MIPS && cpu->exception_index == 17) || /* Mips's EXCP_SYSCALL */ - (uc->arch == UC_ARCH_SPARC && cpu->exception_index == 0x80) || /* Sparc's TT_TRAP */ - (uc->arch == UC_ARCH_SPARC && cpu->exception_index == 0x100) || /* Sparc64's TT_TRAP */ - (uc->arch == UC_ARCH_M68K && cpu->exception_index == 0x2f) /* M68K's EXCP_TRAP15 */ - ) { - cpu->halted = 1; - ret = EXCP_HLT; - break; - } if (cpu->exception_index >= EXCP_INTERRUPT) { /* exit request from the cpu execution loop */ ret = cpu->exception_index; diff --git a/qemu/header_gen.py b/qemu/header_gen.py index 6798250..c513338 100644 --- a/qemu/header_gen.py +++ b/qemu/header_gen.py @@ -7,6 +7,7 @@ import sys symbols = ( + 'helper_power_down', 'check_exit_request', 'address_space_unregister', 'tb_invalidate_phys_page_fast', diff --git a/qemu/m68k.h b/qemu/m68k.h index 4be757b..8a344cb 100644 --- a/qemu/m68k.h +++ b/qemu/m68k.h @@ -1,6 +1,7 @@ /* Autogen header for Unicorn Engine - DONOT MODIFY */ #ifndef UNICORN_AUTOGEN_M68K_H #define UNICORN_AUTOGEN_M68K_H +#define helper_power_down helper_power_down_m68k #define check_exit_request check_exit_request_m68k #define address_space_unregister address_space_unregister_m68k #define tb_invalidate_phys_page_fast tb_invalidate_phys_page_fast_m68k diff --git a/qemu/mips.h b/qemu/mips.h index 7a3e308..2125809 100644 --- a/qemu/mips.h +++ b/qemu/mips.h @@ -1,6 +1,7 @@ /* Autogen header for Unicorn Engine - DONOT MODIFY */ #ifndef UNICORN_AUTOGEN_MIPS_H #define UNICORN_AUTOGEN_MIPS_H +#define helper_power_down helper_power_down_mips #define check_exit_request check_exit_request_mips #define address_space_unregister address_space_unregister_mips #define tb_invalidate_phys_page_fast tb_invalidate_phys_page_fast_mips diff --git a/qemu/mips64.h b/qemu/mips64.h index 9870cb1..d6863cc 100644 --- a/qemu/mips64.h +++ b/qemu/mips64.h @@ -1,6 +1,7 @@ /* Autogen header for Unicorn Engine - DONOT MODIFY */ #ifndef UNICORN_AUTOGEN_MIPS64_H #define UNICORN_AUTOGEN_MIPS64_H +#define helper_power_down helper_power_down_mips64 #define check_exit_request check_exit_request_mips64 #define address_space_unregister address_space_unregister_mips64 #define tb_invalidate_phys_page_fast tb_invalidate_phys_page_fast_mips64 diff --git a/qemu/mips64el.h b/qemu/mips64el.h index 5fde9e5..0711861 100644 --- a/qemu/mips64el.h +++ b/qemu/mips64el.h @@ -1,6 +1,7 @@ /* Autogen header for Unicorn Engine - DONOT MODIFY */ #ifndef UNICORN_AUTOGEN_MIPS64EL_H #define UNICORN_AUTOGEN_MIPS64EL_H +#define helper_power_down helper_power_down_mips64el #define check_exit_request check_exit_request_mips64el #define address_space_unregister address_space_unregister_mips64el #define tb_invalidate_phys_page_fast tb_invalidate_phys_page_fast_mips64el diff --git a/qemu/mipsel.h b/qemu/mipsel.h index caf1fe4..901fb18 100644 --- a/qemu/mipsel.h +++ b/qemu/mipsel.h @@ -1,6 +1,7 @@ /* Autogen header for Unicorn Engine - DONOT MODIFY */ #ifndef UNICORN_AUTOGEN_MIPSEL_H #define UNICORN_AUTOGEN_MIPSEL_H +#define helper_power_down helper_power_down_mipsel #define check_exit_request check_exit_request_mipsel #define address_space_unregister address_space_unregister_mipsel #define tb_invalidate_phys_page_fast tb_invalidate_phys_page_fast_mipsel diff --git a/qemu/powerpc.h b/qemu/powerpc.h index 92e614e..35bf757 100644 --- a/qemu/powerpc.h +++ b/qemu/powerpc.h @@ -1,6 +1,7 @@ /* Autogen header for Unicorn Engine - DONOT MODIFY */ #ifndef UNICORN_AUTOGEN_POWERPC_H #define UNICORN_AUTOGEN_POWERPC_H +#define helper_power_down helper_power_down_powerpc #define check_exit_request check_exit_request_powerpc #define address_space_unregister address_space_unregister_powerpc #define tb_invalidate_phys_page_fast tb_invalidate_phys_page_fast_powerpc diff --git a/qemu/sparc.h b/qemu/sparc.h index 6aa47aa..82bab3a 100644 --- a/qemu/sparc.h +++ b/qemu/sparc.h @@ -1,6 +1,7 @@ /* Autogen header for Unicorn Engine - DONOT MODIFY */ #ifndef UNICORN_AUTOGEN_SPARC_H #define UNICORN_AUTOGEN_SPARC_H +#define helper_power_down helper_power_down_sparc #define check_exit_request check_exit_request_sparc #define address_space_unregister address_space_unregister_sparc #define tb_invalidate_phys_page_fast tb_invalidate_phys_page_fast_sparc diff --git a/qemu/sparc64.h b/qemu/sparc64.h index 6d3d2a1..ac1b66e 100644 --- a/qemu/sparc64.h +++ b/qemu/sparc64.h @@ -1,6 +1,7 @@ /* Autogen header for Unicorn Engine - DONOT MODIFY */ #ifndef UNICORN_AUTOGEN_SPARC64_H #define UNICORN_AUTOGEN_SPARC64_H +#define helper_power_down helper_power_down_sparc64 #define check_exit_request check_exit_request_sparc64 #define address_space_unregister address_space_unregister_sparc64 #define tb_invalidate_phys_page_fast tb_invalidate_phys_page_fast_sparc64 diff --git a/qemu/target-arm/translate-a64.c b/qemu/target-arm/translate-a64.c index d081fc4..8e267f9 100644 --- a/qemu/target-arm/translate-a64.c +++ b/qemu/target-arm/translate-a64.c @@ -10974,7 +10974,8 @@ static void disas_a64_insn(CPUARMState *env, DisasContext *s) // Unicorn: end address tells us to stop emulation if (s->pc == s->uc->addr_end) { - gen_exception_insn(s, 0, EXCP_SWI, 0); + // imitate WFI instruction to halt emulation + s->is_jmp = DISAS_WFI; return; } @@ -11107,8 +11108,9 @@ void gen_intermediate_code_internal_a64(ARMCPU *cpu, // Unicorn: early check to see if the address of this block is the until address if (tb->pc == env->uc->addr_end) { + // imitate WFI instruction to halt emulation gen_tb_start(tcg_ctx); - gen_exception_insn(dc, 0, EXCP_SWI, 0); + dc->is_jmp = DISAS_WFI; goto done_generating; } diff --git a/qemu/target-arm/translate.c b/qemu/target-arm/translate.c index 8875b64..585ca07 100644 --- a/qemu/target-arm/translate.c +++ b/qemu/target-arm/translate.c @@ -10396,7 +10396,8 @@ static void disas_thumb_insn(CPUARMState *env, DisasContext *s) // qq // Unicorn: end address tells us to stop emulation if (s->pc == s->uc->addr_end) { - gen_exception_insn(s, 0, EXCP_SWI, 0); + // imitate WFI instruction to halt emulation + s->is_jmp = DISAS_WFI; return; } @@ -11230,8 +11231,9 @@ static inline void gen_intermediate_code_internal(ARMCPU *cpu, // Unicorn: early check to see if the address of this block is the until address if (tb->pc == env->uc->addr_end) { + // imitate WFI instruction to halt emulation gen_tb_start(tcg_ctx); - gen_exception_insn(dc, 0, EXCP_SWI, 0); + dc->is_jmp = DISAS_WFI; goto done_generating; } @@ -11289,6 +11291,7 @@ static inline void gen_intermediate_code_internal(ARMCPU *cpu, store_cpu_field(tcg_ctx, tmp, condexec_bits); } do { + //printf(">>> arm pc = %x\n", dc->pc); #ifdef CONFIG_USER_ONLY /* Intercept jump to the magic kernel page. */ if (dc->pc >= 0xffff0000) { @@ -11370,7 +11373,8 @@ static inline void gen_intermediate_code_internal(ARMCPU *cpu, // end address tells us to stop emulation if (dc->pc == dc->uc->addr_end) { - gen_exception_insn(dc, 0, EXCP_SWI, 0); + // imitate WFI instruction to halt emulation + dc->is_jmp = DISAS_WFI; } else { insn = arm_ldl_code(env, dc->pc, dc->bswap_code); dc->pc += 4; diff --git a/qemu/target-i386/translate.c b/qemu/target-i386/translate.c index 84db611..a920689 100644 --- a/qemu/target-i386/translate.c +++ b/qemu/target-i386/translate.c @@ -4751,7 +4751,11 @@ static target_ulong disas_insn(CPUX86State *env, DisasContext *s, // end address tells us to stop emulation if (s->pc == s->uc->addr_end) { - gen_interrupt(s, 0x99, pc_start - s->cs_base, pc_start - s->cs_base); + // imitate the HLT instruction + gen_update_cc_op(s); + gen_jmp_im(s, pc_start - s->cs_base); + gen_helper_hlt(tcg_ctx, cpu_env, tcg_const_i32(tcg_ctx, s->pc - pc_start)); + s->is_jmp = DISAS_TB_JUMP; return s->pc; } @@ -8361,8 +8365,11 @@ static inline void gen_intermediate_code_internal(uint8_t *gen_opc_cc_op, // early check to see if the address of this block is the until address if (tb->pc == env->uc->addr_end) { + // imitate the HLT instruction gen_tb_start(tcg_ctx); - gen_interrupt(dc, 0x99, tb->pc - tb->cs_base, tb->pc - tb->cs_base); + gen_jmp_im(dc, tb->pc - tb->cs_base); + gen_helper_hlt(tcg_ctx, tcg_ctx->cpu_env, tcg_const_i32(tcg_ctx, 0)); + dc->is_jmp = DISAS_TB_JUMP; goto done_generating; } diff --git a/qemu/target-m68k/translate.c b/qemu/target-m68k/translate.c index fedffec..109c7f1 100644 --- a/qemu/target-m68k/translate.c +++ b/qemu/target-m68k/translate.c @@ -3038,7 +3038,7 @@ static void disas_m68k_insn(CPUM68KState * env, DisasContext *s) // Unicorn: end address tells us to stop emulation if (s->pc == s->uc->addr_end) { - gen_exception(s, s->pc, EXCP_TRAP15); + gen_exception(s, s->pc, EXCP_HLT); return; } @@ -3104,7 +3104,7 @@ gen_intermediate_code_internal(M68kCPU *cpu, TranslationBlock *tb, // Unicorn: early check to see if the address of this block is the until address if (tb->pc == env->uc->addr_end) { gen_tb_start(tcg_ctx); - gen_exception(dc, dc->pc, EXCP_TRAP15); + gen_exception(dc, dc->pc, EXCP_HLT); goto done_generating; } diff --git a/qemu/target-mips/translate.c b/qemu/target-mips/translate.c index e1ff51a..d9d73f3 100644 --- a/qemu/target-mips/translate.c +++ b/qemu/target-mips/translate.c @@ -19211,7 +19211,8 @@ gen_intermediate_code_internal(MIPSCPU *cpu, TranslationBlock *tb, // Unicorn: early check to see if the address of this block is the until address if (tb->pc == env->uc->addr_end) { gen_tb_start(tcg_ctx); - generate_exception(&ctx, EXCP_SYSCALL); + gen_helper_wait(tcg_ctx, tcg_ctx->cpu_env); + ctx.bstate = BS_EXCP; goto done_generating; } @@ -19229,6 +19230,7 @@ gen_intermediate_code_internal(MIPSCPU *cpu, TranslationBlock *tb, gen_tb_start(tcg_ctx); while (ctx.bstate == BS_NONE) { + // printf(">>> mips pc = %x\n", ctx.pc); if (unlikely(!QTAILQ_EMPTY(&cs->breakpoints))) { QTAILQ_FOREACH(bp, &cs->breakpoints, entry) { if (bp->pc == ctx.pc) { @@ -19261,7 +19263,8 @@ gen_intermediate_code_internal(MIPSCPU *cpu, TranslationBlock *tb, // Unicorn: end address tells us to stop emulation if (ctx.pc == ctx.uc->addr_end) { - generate_exception(&ctx, EXCP_SYSCALL); + gen_helper_wait(tcg_ctx, tcg_ctx->cpu_env); + ctx.bstate = BS_EXCP; break; } else { // Unicorn: save param buffer diff --git a/qemu/target-sparc/helper.c b/qemu/target-sparc/helper.c index 98a80fe..8f60d0a 100644 --- a/qemu/target-sparc/helper.c +++ b/qemu/target-sparc/helper.c @@ -241,7 +241,7 @@ target_ulong helper_tsubcctv(CPUSPARCState *env, target_ulong src1, helper_raise_exception(env, TT_TOVF); } -#ifndef TARGET_SPARC64 +//#ifndef TARGET_SPARC64 void helper_power_down(CPUSPARCState *env) { CPUState *cs = CPU(sparc_env_get_cpu(env)); @@ -252,4 +252,4 @@ void helper_power_down(CPUSPARCState *env) env->npc = env->pc + 4; cpu_loop_exit(cs); } -#endif +//#endif diff --git a/qemu/target-sparc/helper.h b/qemu/target-sparc/helper.h index 14c8a33..2557dd0 100644 --- a/qemu/target-sparc/helper.h +++ b/qemu/target-sparc/helper.h @@ -1,10 +1,10 @@ DEF_HELPER_5(uc_tracecode, void, i32, ptr, ptr, i64, ptr) +DEF_HELPER_1(power_down, void, env) #ifndef TARGET_SPARC64 DEF_HELPER_1(rett, void, env) DEF_HELPER_2(wrpsr, void, env, tl) DEF_HELPER_1(rdpsr, tl, env) -DEF_HELPER_1(power_down, void, env) #else DEF_HELPER_2(wrpil, void, env, tl) DEF_HELPER_2(wrpstate, void, env, tl) diff --git a/qemu/target-sparc/translate.c b/qemu/target-sparc/translate.c index ff68fd6..3551667 100644 --- a/qemu/target-sparc/translate.c +++ b/qemu/target-sparc/translate.c @@ -5405,6 +5405,14 @@ static inline void gen_intermediate_code_internal(SPARCCPU *cpu, if (max_insns == 0) max_insns = CF_COUNT_MASK; + // Unicorn: early check to see if the address of this block is the until address + if (tb->pc == env->uc->addr_end) { + gen_tb_start(tcg_ctx); + save_state(dc); + gen_helper_power_down(tcg_ctx, tcg_ctx->cpu_env); + goto done_generating; + } + // Unicorn: trace this block on request // Only hook this block if it is not broken from previous translation due to // full translation cache @@ -5448,7 +5456,9 @@ static inline void gen_intermediate_code_internal(SPARCCPU *cpu, // gen_io_start(); // Unicorn: end address tells us to stop emulation if (dc->pc == dc->uc->addr_end) { - insn = 0x91d02000; // generate TRAP to end this TB + save_state(dc); + gen_helper_power_down(tcg_ctx, tcg_ctx->cpu_env); + break; } else { last_pc = dc->pc; insn = cpu_ldl_code(env, dc->pc); @@ -5497,6 +5507,8 @@ static inline void gen_intermediate_code_internal(SPARCCPU *cpu, tcg_gen_exit_tb(tcg_ctx, 0); } } + +done_generating: gen_tb_end(tcg_ctx, tb, num_insns); *tcg_ctx->gen_opc_ptr = INDEX_op_end; if (spc) { diff --git a/qemu/x86_64.h b/qemu/x86_64.h index ac9f34f..9c13377 100644 --- a/qemu/x86_64.h +++ b/qemu/x86_64.h @@ -1,6 +1,7 @@ /* Autogen header for Unicorn Engine - DONOT MODIFY */ #ifndef UNICORN_AUTOGEN_X86_64_H #define UNICORN_AUTOGEN_X86_64_H +#define helper_power_down helper_power_down_x86_64 #define check_exit_request check_exit_request_x86_64 #define address_space_unregister address_space_unregister_x86_64 #define tb_invalidate_phys_page_fast tb_invalidate_phys_page_fast_x86_64 diff --git a/samples/sample_sparc.c b/samples/sample_sparc.c index 3f253ff..45c185a 100644 --- a/samples/sample_sparc.c +++ b/samples/sample_sparc.c @@ -59,8 +59,8 @@ static void test_sparc(void) // tracing all basic blocks with customized callback uc_hook_add(uc, &trace1, UC_HOOK_BLOCK, hook_block, NULL, (uint64_t)1, (uint64_t)0); - // tracing one instruction at ADDRESS with customized callback - uc_hook_add(uc, &trace2, UC_HOOK_CODE, hook_code, NULL, (uint64_t)ADDRESS, (uint64_t)ADDRESS); + // tracing all instructions with customized callback + uc_hook_add(uc, &trace2, UC_HOOK_CODE, hook_code, NULL, (uint64_t)1, (uint64_t)0); // emulate machine code in infinite time (last param = 0), or when // finishing all the code. From 4b42b4be5268a0d2d39e0637e7a7c9247041d650 Mon Sep 17 00:00:00 2001 From: Ryan Hileman Date: Sat, 26 Sep 2015 12:48:25 -0700 Subject: [PATCH 03/16] add regress for #155 --- tests/regress/mips_single_step_sp.py | 39 ++++++++++++++++++++++++++++ 1 file changed, 39 insertions(+) create mode 100644 tests/regress/mips_single_step_sp.py diff --git a/tests/regress/mips_single_step_sp.py b/tests/regress/mips_single_step_sp.py new file mode 100644 index 0000000..55d4d26 --- /dev/null +++ b/tests/regress/mips_single_step_sp.py @@ -0,0 +1,39 @@ +from unicorn import * +from unicorn.mips_const import * + +def code_hook(uc, addr, size, user_data): + print 'code hook: pc=%08x sp=%08x' % (addr, uc.reg_read(UC_MIPS_REG_SP)) + +def run(step=False): + addr = 0x4010dc + + code = ( + 'f8ff0124' # addiu $at, $zero, -8 + '24e8a103' # and $sp, $sp, $at + '09f82003' # jalr $t9 + 'e8ffbd23' # addi $sp, $sp, -0x18 + 'b8ffbd27' # addiu $sp, $sp, -0x48 + '00000000' # nop + ).decode('hex') + + uc = Uc(UC_ARCH_MIPS, UC_MODE_MIPS32 + UC_MODE_LITTLE_ENDIAN) + if step: + uc.hook_add(UC_HOOK_CODE, code_hook) + + uc.reg_write(UC_MIPS_REG_SP, 0x60800000) + uc.reg_write(UC_MIPS_REG_T9, addr + len(code) - 8) + + print 'sp =', hex(uc.reg_read(UC_MIPS_REG_SP)) + print 'at =', hex(uc.reg_read(UC_MIPS_REG_AT)) + print ' (single step: %s)' % (str(step)) + + uc.mem_map(addr & ~(0x1000 - 1), 0x2000) + uc.mem_write(addr, code) + uc.emu_start(addr, addr + len(code)) + + print 'sp =', hex(uc.reg_read(UC_MIPS_REG_SP)) + print 'at =', hex(uc.reg_read(UC_MIPS_REG_AT)) + print + +run(step=False) +run(step=True) From 505589951435fb9b3b92dee681fec31ae43b8cbf Mon Sep 17 00:00:00 2001 From: Nguyen Anh Quynh Date: Sun, 27 Sep 2015 11:29:19 +0800 Subject: [PATCH 04/16] clarify that UC_HOOK_INTR is also for handling syscall events --- include/unicorn/unicorn.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/unicorn/unicorn.h b/include/unicorn/unicorn.h index 75f4706..e70ca73 100644 --- a/include/unicorn/unicorn.h +++ b/include/unicorn/unicorn.h @@ -166,7 +166,7 @@ typedef enum uc_mem_type { // All type of hooks for uc_hook_add() API. typedef enum uc_hook_type { - UC_HOOK_INTR = 1 << 0, // Hook all interrupt events + UC_HOOK_INTR = 1 << 0, // Hook all interrupt/syscall events UC_HOOK_INSN = 1 << 1, // Hook a particular instruction UC_HOOK_CODE = 1 << 2, // Hook a range of code UC_HOOK_BLOCK = 1 << 3, // Hook basic blocks From 53ce8f217d51ef3323d0970542d25e01d6335bc7 Mon Sep 17 00:00:00 2001 From: Nguyen Anh Quynh Date: Sun, 27 Sep 2015 15:05:40 +0800 Subject: [PATCH 05/16] mips: handle delay slot better for branch instructions. this should fix issue #155 --- qemu/target-mips/translate.c | 26 +++++++++++++++----------- tests/regress/mips_single_step_sp.py | 2 ++ 2 files changed, 17 insertions(+), 11 deletions(-) mode change 100644 => 100755 tests/regress/mips_single_step_sp.py diff --git a/qemu/target-mips/translate.c b/qemu/target-mips/translate.c index d9d73f3..8f8e09a 100644 --- a/qemu/target-mips/translate.c +++ b/qemu/target-mips/translate.c @@ -11322,7 +11322,7 @@ static int decode_extended_mips16_opc (CPUMIPSState *env, DisasContext *ctx) return 4; } -static int decode_mips16_opc (CPUMIPSState *env, DisasContext *ctx, int is_slot) +static int decode_mips16_opc (CPUMIPSState *env, DisasContext *ctx, bool is_bc_slot) { TCGContext *tcg_ctx = ctx->uc->tcg_ctx; TCGv **cpu_gpr = (TCGv **)tcg_ctx->cpu_gpr; @@ -11343,7 +11343,7 @@ static int decode_mips16_opc (CPUMIPSState *env, DisasContext *ctx, int is_slot) n_bytes = 2; // Unicorn: trace this instruction on request - if (!is_slot && env->uc->hook_insn) { + if (!is_bc_slot && env->uc->hook_insn) { struct hook_struct *trace = hook_find(env->uc, UC_HOOK_CODE, ctx->pc); if (trace) gen_uc_tracecode(tcg_ctx, 0xf8f8f8f8, trace->callback, env->uc, ctx->pc, trace->user_data); @@ -13928,7 +13928,7 @@ static void decode_micromips32_opc (CPUMIPSState *env, DisasContext *ctx, } } -static int decode_micromips_opc (CPUMIPSState *env, DisasContext *ctx, int is_slot) +static int decode_micromips_opc (CPUMIPSState *env, DisasContext *ctx, bool is_bc_slot) { TCGContext *tcg_ctx = env->uc->tcg_ctx; TCGv **cpu_gpr = (TCGv **)tcg_ctx->cpu_gpr; @@ -13943,7 +13943,7 @@ static int decode_micromips_opc (CPUMIPSState *env, DisasContext *ctx, int is_sl } // Unicorn: trace this instruction on request - if (!is_slot && env->uc->hook_insn) { + if (!is_bc_slot && env->uc->hook_insn) { struct hook_struct *trace = hook_find(env->uc, UC_HOOK_CODE, ctx->pc); if (trace) gen_uc_tracecode(tcg_ctx, 0xf8f8f8f8, trace->callback, env->uc, ctx->pc, trace->user_data); @@ -18503,7 +18503,7 @@ static void gen_msa(CPUMIPSState *env, DisasContext *ctx) } } -static void decode_opc (CPUMIPSState *env, DisasContext *ctx, int is_slot) +static void decode_opc (CPUMIPSState *env, DisasContext *ctx, bool is_bc_slot) { TCGContext *tcg_ctx = ctx->uc->tcg_ctx; #if defined(TARGET_MIPS64) @@ -18523,7 +18523,7 @@ static void decode_opc (CPUMIPSState *env, DisasContext *ctx, int is_slot) } // Unicorn: trace this instruction on request - if (!is_slot && env->uc->hook_insn) { + if (!is_bc_slot && env->uc->hook_insn) { struct hook_struct *trace = hook_find(env->uc, UC_HOOK_CODE, ctx->pc); if (trace) gen_uc_tracecode(tcg_ctx, 0xf8f8f8f8, trace->callback, env->uc, ctx->pc, trace->user_data); @@ -19171,6 +19171,7 @@ gen_intermediate_code_internal(MIPSCPU *cpu, TranslationBlock *tb, int max_insns; int insn_bytes; int is_slot = 0; + bool is_bc_slot = false; TCGContext *tcg_ctx = env->uc->tcg_ctx; TCGArg *save_opparam_ptr = NULL; bool block_full = false; @@ -19272,16 +19273,18 @@ gen_intermediate_code_internal(MIPSCPU *cpu, TranslationBlock *tb, save_opparam_ptr = tcg_ctx->gen_opparam_ptr; is_slot = ctx.hflags & MIPS_HFLAG_BMASK; + is_bc_slot = (is_slot & MIPS_HFLAG_BMASK_BASE) == MIPS_HFLAG_BC; + if (!(ctx.hflags & MIPS_HFLAG_M16)) { ctx.opcode = cpu_ldl_code(env, ctx.pc); insn_bytes = 4; - decode_opc(env, &ctx, is_slot); + decode_opc(env, &ctx, is_bc_slot); } else if (ctx.insn_flags & ASE_MICROMIPS) { ctx.opcode = cpu_lduw_code(env, ctx.pc); - insn_bytes = decode_micromips_opc(env, &ctx, is_slot); + insn_bytes = decode_micromips_opc(env, &ctx, is_bc_slot); } else if (ctx.insn_flags & ASE_MIPS16) { ctx.opcode = cpu_lduw_code(env, ctx.pc); - insn_bytes = decode_mips16_opc(env, &ctx, is_slot); + insn_bytes = decode_mips16_opc(env, &ctx, is_bc_slot); } else { generate_exception(&ctx, EXCP_RI); ctx.bstate = BS_STOP; @@ -19289,18 +19292,19 @@ gen_intermediate_code_internal(MIPSCPU *cpu, TranslationBlock *tb, } // Unicorn: patch the callback for the instruction size - if (env->uc->hook_insn) + if (!is_bc_slot && env->uc->hook_insn) *(save_opparam_ptr + 1) = insn_bytes; } if (ctx.hflags & MIPS_HFLAG_BMASK) { if (!(ctx.hflags & (MIPS_HFLAG_BDS16 | MIPS_HFLAG_BDS32 | - MIPS_HFLAG_FBNSLOT))) { + MIPS_HFLAG_FBNSLOT))) { /* force to generate branch as there is neither delay nor forbidden slot */ is_slot = 1; } } + if (is_slot) { gen_branch(&ctx, insn_bytes); } diff --git a/tests/regress/mips_single_step_sp.py b/tests/regress/mips_single_step_sp.py old mode 100644 new mode 100755 index 55d4d26..bacdeb1 --- a/tests/regress/mips_single_step_sp.py +++ b/tests/regress/mips_single_step_sp.py @@ -1,3 +1,5 @@ +#!/usr/bin/python + from unicorn import * from unicorn.mips_const import * From 13be3435c94575b581e2f727f7cf915270b4d11b Mon Sep 17 00:00:00 2001 From: Ryan Hileman Date: Sun, 27 Sep 2015 01:08:46 -0700 Subject: [PATCH 06/16] add regress for #157 --- tests/regress/mips_syscall_pc.py | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) create mode 100644 tests/regress/mips_syscall_pc.py diff --git a/tests/regress/mips_syscall_pc.py b/tests/regress/mips_syscall_pc.py new file mode 100644 index 0000000..97f57e5 --- /dev/null +++ b/tests/regress/mips_syscall_pc.py @@ -0,0 +1,16 @@ +from unicorn import * +from unicorn.mips_const import * + +def intr_hook(uc, intno, data): + print 'interrupt=%d, v0=%d, pc=0x%08x' % (intno, uc.reg_read(UC_MIPS_REG_V0), uc.reg_read(UC_MIPS_REG_PC)) + +addr = 0x40000 +code = '0c000000'.decode('hex') # syscall + +uc = Uc(UC_ARCH_MIPS, UC_MODE_MIPS32 + UC_MODE_LITTLE_ENDIAN) +uc.mem_map(addr, 0x1000) +uc.mem_write(addr, code) +uc.reg_write(UC_MIPS_REG_V0, 100) +uc.hook_add(UC_HOOK_INTR, intr_hook) + +uc.emu_start(addr, len(code)) From 2b0b4169bc0d71bd14c16499d96abe440c2fd54a Mon Sep 17 00:00:00 2001 From: Nguyen Anh Quynh Date: Mon, 28 Sep 2015 10:58:43 +0800 Subject: [PATCH 07/16] mips: advance PC for SYSCALL instruction. this fixes issue #157 --- include/uc_priv.h | 1 + qemu/cpu-exec.c | 3 +++ qemu/target-mips/translate.c | 1 + qemu/tcg/tcg.c | 5 +++++ tests/regress/mips_syscall_pc.py | 4 +++- 5 files changed, 13 insertions(+), 1 deletion(-) mode change 100644 => 100755 tests/regress/mips_syscall_pc.py diff --git a/include/uc_priv.h b/include/uc_priv.h index 1f19a58..de2e457 100644 --- a/include/uc_priv.h +++ b/include/uc_priv.h @@ -185,6 +185,7 @@ struct uc_struct { void *qemu_thread_data; // to support cross compile to Windows (qemu-thread-win32.c) uint32_t target_page_size; uint32_t target_page_align; + uint64_t next_pc; // save next PC for some special cases }; #include "qemu_macro.h" diff --git a/qemu/cpu-exec.c b/qemu/cpu-exec.c index 01e8ca7..33069e3 100644 --- a/qemu/cpu-exec.c +++ b/qemu/cpu-exec.c @@ -136,6 +136,9 @@ int cpu_exec(struct uc_struct *uc, CPUArchState *env) // qq // point EIP to the next instruction after INT env->eip = env->exception_next_eip; #endif +#if defined(TARGET_MIPS) || defined(TARGET_MIPS64) + env->active_tc.PC = uc->next_pc; +#endif #endif } } diff --git a/qemu/target-mips/translate.c b/qemu/target-mips/translate.c index 8f8e09a..c194150 100644 --- a/qemu/target-mips/translate.c +++ b/qemu/target-mips/translate.c @@ -19348,6 +19348,7 @@ gen_intermediate_code_internal(MIPSCPU *cpu, TranslationBlock *tb, switch (ctx.bstate) { case BS_STOP: gen_goto_tb(&ctx, 0, ctx.pc); + env->uc->next_pc = ctx.pc; break; case BS_NONE: save_cpu_state(&ctx, 0); diff --git a/qemu/tcg/tcg.c b/qemu/tcg/tcg.c index 53460c6..381fde9 100644 --- a/qemu/tcg/tcg.c +++ b/qemu/tcg/tcg.c @@ -2586,8 +2586,13 @@ int tcg_gen_code(TCGContext *s, tcg_insn_unit *gen_code_buf) // qq } #endif + //printf("====== before gen code\n"); + //tcg_dump_ops(s); tcg_gen_code_common(s, gen_code_buf, -1); // qq + //printf("====== after gen code\n"); + //tcg_dump_ops(s); + /* flush instruction cache */ flush_icache_range((uintptr_t)s->code_buf, (uintptr_t)s->code_ptr); diff --git a/tests/regress/mips_syscall_pc.py b/tests/regress/mips_syscall_pc.py old mode 100644 new mode 100755 index 97f57e5..3533f3e --- a/tests/regress/mips_syscall_pc.py +++ b/tests/regress/mips_syscall_pc.py @@ -1,3 +1,5 @@ +#!/usr/bin/python + from unicorn import * from unicorn.mips_const import * @@ -13,4 +15,4 @@ uc.mem_write(addr, code) uc.reg_write(UC_MIPS_REG_V0, 100) uc.hook_add(UC_HOOK_INTR, intr_hook) -uc.emu_start(addr, len(code)) +uc.emu_start(addr, addr+len(code)) From 8b4d274c341265707ab037105c981899c983445b Mon Sep 17 00:00:00 2001 From: Nguyen Anh Quynh Date: Mon, 28 Sep 2015 11:57:24 +0800 Subject: [PATCH 08/16] regress: convert some mips tests to use unittest --- tests/regress/mips_single_step_sp.py | 14 ++++++++++++-- tests/regress/mips_syscall_pc.py | 25 +++++++++++++++++-------- 2 files changed, 29 insertions(+), 10 deletions(-) diff --git a/tests/regress/mips_single_step_sp.py b/tests/regress/mips_single_step_sp.py index bacdeb1..b3c7840 100755 --- a/tests/regress/mips_single_step_sp.py +++ b/tests/regress/mips_single_step_sp.py @@ -3,6 +3,8 @@ from unicorn import * from unicorn.mips_const import * +import regress + def code_hook(uc, addr, size, user_data): print 'code hook: pc=%08x sp=%08x' % (addr, uc.reg_read(UC_MIPS_REG_SP)) @@ -36,6 +38,14 @@ def run(step=False): print 'sp =', hex(uc.reg_read(UC_MIPS_REG_SP)) print 'at =', hex(uc.reg_read(UC_MIPS_REG_AT)) print + return uc.reg_read(UC_MIPS_REG_SP) -run(step=False) -run(step=True) + +class MipsSingleStep(regress.RegressTest): + def test(self): + sp1 = run(step=False) + sp2 = run(step=True) + self.assertEqual(sp1, sp2) + +if __name__ == '__main__': + regress.main() diff --git a/tests/regress/mips_syscall_pc.py b/tests/regress/mips_syscall_pc.py index 3533f3e..995b154 100755 --- a/tests/regress/mips_syscall_pc.py +++ b/tests/regress/mips_syscall_pc.py @@ -3,16 +3,25 @@ from unicorn import * from unicorn.mips_const import * +import regress + def intr_hook(uc, intno, data): print 'interrupt=%d, v0=%d, pc=0x%08x' % (intno, uc.reg_read(UC_MIPS_REG_V0), uc.reg_read(UC_MIPS_REG_PC)) -addr = 0x40000 -code = '0c000000'.decode('hex') # syscall +class MipsSyscall(regress.RegressTest): + def test(self): + addr = 0x40000 + code = '0c000000'.decode('hex') # syscall -uc = Uc(UC_ARCH_MIPS, UC_MODE_MIPS32 + UC_MODE_LITTLE_ENDIAN) -uc.mem_map(addr, 0x1000) -uc.mem_write(addr, code) -uc.reg_write(UC_MIPS_REG_V0, 100) -uc.hook_add(UC_HOOK_INTR, intr_hook) + uc = Uc(UC_ARCH_MIPS, UC_MODE_MIPS32 + UC_MODE_LITTLE_ENDIAN) + uc.mem_map(addr, 0x1000) + uc.mem_write(addr, code) + uc.reg_write(UC_MIPS_REG_V0, 100) + uc.hook_add(UC_HOOK_INTR, intr_hook) -uc.emu_start(addr, addr+len(code)) + uc.emu_start(addr, addr+len(code)) + self.assertEqual(0x40004, uc.reg_read(UC_MIPS_REG_PC)) + + +if __name__ == '__main__': + regress.main() From eeebcc5a449c0fce4ce7b96172a90b840ba08223 Mon Sep 17 00:00:00 2001 From: mothran Date: Mon, 28 Sep 2015 21:41:38 -0700 Subject: [PATCH 09/16] added bad_ram regress --- tests/regress/bad_ram.py | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) create mode 100644 tests/regress/bad_ram.py diff --git a/tests/regress/bad_ram.py b/tests/regress/bad_ram.py new file mode 100644 index 0000000..0fc7d0b --- /dev/null +++ b/tests/regress/bad_ram.py @@ -0,0 +1,30 @@ +#!/usr/bin/python + +from unicorn import * +from unicorn.x86_const import * + +import regress + + +class Hang(regress.RegressTest): + + def runTest(self): + CODE_ADDR = 0x400000 + RSP_ADDR = 0x200000 + binary1 = "\xCA\x24\x5D" # retf 0x5d24 + mu = Uc(UC_ARCH_X86, UC_MODE_64) + + mu.mem_map(CODE_ADDR, 0x5000) + mu.mem_map(RSP_ADDR, 0x5000) + + # write machine code to be emulated to memory + mu.mem_write(CODE_ADDR, binary1) + + mu.reg_write(UC_X86_REG_RSP, RSP_ADDR) + + # emu for maximum 1 sec. + mu.emu_start(CODE_ADDR, 0x400000 + 0x5000, 0) + + +if __name__ == '__main__': + regress.main() From 0e258b9587db90f59618a4eff79e9ba286591281 Mon Sep 17 00:00:00 2001 From: mothran Date: Mon, 28 Sep 2015 22:50:27 -0700 Subject: [PATCH 10/16] updated a few small errors in the script --- tests/regress/bad_ram.py | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-) diff --git a/tests/regress/bad_ram.py b/tests/regress/bad_ram.py index 0fc7d0b..7693ccb 100644 --- a/tests/regress/bad_ram.py +++ b/tests/regress/bad_ram.py @@ -9,21 +9,18 @@ import regress class Hang(regress.RegressTest): def runTest(self): + PAGE_SIZE = 0x5000 CODE_ADDR = 0x400000 RSP_ADDR = 0x200000 binary1 = "\xCA\x24\x5D" # retf 0x5d24 mu = Uc(UC_ARCH_X86, UC_MODE_64) - mu.mem_map(CODE_ADDR, 0x5000) - mu.mem_map(RSP_ADDR, 0x5000) + mu.mem_map(CODE_ADDR, PAGE_SIZE) + mu.mem_map(RSP_ADDR, PAGE_SIZE) - # write machine code to be emulated to memory mu.mem_write(CODE_ADDR, binary1) - mu.reg_write(UC_X86_REG_RSP, RSP_ADDR) - - # emu for maximum 1 sec. - mu.emu_start(CODE_ADDR, 0x400000 + 0x5000, 0) + mu.emu_start(CODE_ADDR, CODE_ADDR + PAGE_SIZE, 0) if __name__ == '__main__': From 976950d3c308d1af7761f225e4bdaa57f383b7a4 Mon Sep 17 00:00:00 2001 From: Nguyen Anh Quynh Date: Tue, 29 Sep 2015 15:24:30 +0800 Subject: [PATCH 11/16] chmod +x tests/regress/bad_ram.py --- tests/regress/bad_ram.py | 0 1 file changed, 0 insertions(+), 0 deletions(-) mode change 100644 => 100755 tests/regress/bad_ram.py diff --git a/tests/regress/bad_ram.py b/tests/regress/bad_ram.py old mode 100644 new mode 100755 From 4a42041a8308f5c354fc67e3694fc53c7fe0893a Mon Sep 17 00:00:00 2001 From: Nguyen Anh Quynh Date: Tue, 29 Sep 2015 18:22:22 +0800 Subject: [PATCH 12/16] handle 'bad ram pointer' case. this fixes issue #159 --- qemu/cputlb.c | 23 ++++++++++++++--------- tests/regress/bad_ram.py | 5 ++++- 2 files changed, 18 insertions(+), 10 deletions(-) diff --git a/qemu/cputlb.c b/qemu/cputlb.c index b9b16e3..7439b78 100644 --- a/qemu/cputlb.c +++ b/qemu/cputlb.c @@ -39,7 +39,7 @@ static void tlb_flush_entry(CPUTLBEntry *tlb_entry, target_ulong addr); static bool tlb_is_dirty_ram(CPUTLBEntry *tlbe); -static ram_addr_t qemu_ram_addr_from_host_nofail(struct uc_struct *uc, void *ptr); +static bool qemu_ram_addr_from_host_nofail(struct uc_struct *uc, void *ptr, ram_addr_t *addr); static void tlb_add_large_page(CPUArchState *env, target_ulong vaddr, target_ulong size); static void tlb_set_dirty1(CPUTLBEntry *tlb_entry, target_ulong vaddr); @@ -292,6 +292,7 @@ tb_page_addr_t get_page_addr_code(CPUArchState *env1, target_ulong addr) int mmu_idx, page_index, pd; void *p; MemoryRegion *mr; + ram_addr_t ram_addr; CPUState *cpu = ENV_GET_CPU(env1); page_index = (addr >> TARGET_PAGE_BITS) & (CPU_TLB_SIZE - 1); @@ -321,18 +322,22 @@ tb_page_addr_t get_page_addr_code(CPUArchState *env1, target_ulong addr) } } p = (void *)((uintptr_t)addr + env1->tlb_table[mmu_idx][page_index].addend); - return qemu_ram_addr_from_host_nofail(cpu->uc, p); + if (!qemu_ram_addr_from_host_nofail(cpu->uc, p, &ram_addr)) { + env1->invalid_addr = addr; + env1->invalid_error = UC_ERR_FETCH_INVALID; // FIXME UC_ERR_FETCH_UNMAPPED + return -1; + } else + return ram_addr; } -static ram_addr_t qemu_ram_addr_from_host_nofail(struct uc_struct *uc, void *ptr) +static bool qemu_ram_addr_from_host_nofail(struct uc_struct *uc, void *ptr, ram_addr_t *ram_addr) { - ram_addr_t ram_addr; - - if (qemu_ram_addr_from_host(uc, ptr, &ram_addr) == NULL) { - fprintf(stderr, "Bad ram pointer %p\n", ptr); - abort(); + if (qemu_ram_addr_from_host(uc, ptr, ram_addr) == NULL) { + // fprintf(stderr, "Bad ram pointer %p\n", ptr); + return false; } - return ram_addr; + + return true; } static void tlb_set_dirty1(CPUTLBEntry *tlb_entry, target_ulong vaddr) diff --git a/tests/regress/bad_ram.py b/tests/regress/bad_ram.py index 7693ccb..a74fa49 100755 --- a/tests/regress/bad_ram.py +++ b/tests/regress/bad_ram.py @@ -20,7 +20,10 @@ class Hang(regress.RegressTest): mu.mem_write(CODE_ADDR, binary1) mu.reg_write(UC_X86_REG_RSP, RSP_ADDR) - mu.emu_start(CODE_ADDR, CODE_ADDR + PAGE_SIZE, 0) + try: + self.assertEqual(mu.emu_start(CODE_ADDR, CODE_ADDR + PAGE_SIZE, 0), UC_ERR_FETCH_INVALID) + except UcError as e: + print("ERROR: %s" % e) if __name__ == '__main__': From 3ca8774f1ab174c7aac364b5e9415a9621c69cc9 Mon Sep 17 00:00:00 2001 From: Nguyen Anh Quynh Date: Wed, 30 Sep 2015 14:42:08 +0800 Subject: [PATCH 13/16] arm: properly handle the case when first insn in block is until address --- qemu/target-arm/translate.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/qemu/target-arm/translate.c b/qemu/target-arm/translate.c index 585ca07..83f8ec0 100644 --- a/qemu/target-arm/translate.c +++ b/qemu/target-arm/translate.c @@ -11234,7 +11234,7 @@ static inline void gen_intermediate_code_internal(ARMCPU *cpu, // imitate WFI instruction to halt emulation gen_tb_start(tcg_ctx); dc->is_jmp = DISAS_WFI; - goto done_generating; + goto tb_end; } // Unicorn: trace this block on request @@ -11417,6 +11417,8 @@ static inline void gen_intermediate_code_internal(ARMCPU *cpu, block_full = true; } +tb_end: + /* At this stage dc->condjmp will only be set when the skipped instruction was a conditional branch or trap, and the PC has already been written. */ From 9e64cba6ecfd0cf434a0633d18a7474d725ec9ad Mon Sep 17 00:00:00 2001 From: Nguyen Anh Quynh Date: Wed, 30 Sep 2015 14:46:55 +0800 Subject: [PATCH 14/16] Rename some hook related enums: - UC_ERR_READ_INVALID -> UC_ERR_READ_UNMAPPED - UC_ERR_WRITE_INVALID -> UC_ERR_WRITE_UNMAPPED - UC_ERR_FETCH_INVALID -> UC_ERR_FETCH_UNMAPPED - UC_MEM_READ_INVALID -> UC_MEM_READ_UNMAPPED - UC_MEM_WRITE_INVALID -> UC_MEM_WRITE_UNMAPPED - UC_MEM_FETCH_INVALID -> UC_MEM_FETCH_UNMAPPED - UC_HOOK_MEM_READ_INVALID -> UC_HOOK_MEM_READ_UNMAPPED - UC_HOOK_MEM_WRITE_INVALID -> UC_HOOK_MEM_WRITE_UNMAPPED - UC_HOOK_MEM_FETCH_INVALID -> UC_HOOK_MEM_FETCH_UNMAPPED - UC_HOOK_MEM_INVALID -> UC_HOOK_MEM_UNMAPPED This also renames some newly added macros to use _INVALID postfix: - UC_HOOK_MEM_READ_ERR -> UC_HOOK_MEM_READ_INVALID - UC_HOOK_MEM_WRITE_ERR -> UC_HOOK_MEM_WRITE_INVALID - UC_HOOK_MEM_FETCH_ERR -> UC_HOOK_MEM_FETCH_INVALID - UC_HOOK_MEM_ERR -> UC_HOOK_MEM_INVALID Fixed all the bindings Java, Go & Python. --- bindings/go/unicorn/hook.go | 2 +- bindings/go/unicorn/unicorn_const.go | 39 +++++++++++----------- bindings/java/samples/Sample_x86.java | 2 +- bindings/java/unicorn/Unicorn.java | 14 ++++---- bindings/java/unicorn/UnicornConst.java | 39 +++++++++++----------- bindings/java/unicorn/UnicornErrors.java | 7 ++-- bindings/java/unicorn_Unicorn.c | 8 ++--- bindings/python/sample_x86.py | 4 +-- bindings/python/unicorn/unicorn.py | 4 +-- bindings/python/unicorn/unicorn_const.py | 39 +++++++++++----------- include/unicorn/unicorn.h | 31 +++++++++--------- qemu/cpu-exec.c | 2 +- qemu/cputlb.c | 7 ++-- qemu/softmmu_template.h | 32 +++++++++--------- samples/mem_apis.c | 10 +++--- samples/sample_x86.c | 4 +-- tests/regress/arm_bxeq_hang.py | 3 +- tests/regress/jmp_ebx_hang.py | 4 +-- tests/regress/mem_unmap.c | 2 +- tests/regress/mips_except.py | 4 +-- tests/regress/reg_write_sign_extension.py | 2 +- tests/regress/ro_mem_test.c | 2 +- tests/regress/sparc_reg.py | 2 +- tests/unit/test_x86.c | 6 ++-- uc.c | 40 +++++++++++------------ 25 files changed, 151 insertions(+), 158 deletions(-) diff --git a/bindings/go/unicorn/hook.go b/bindings/go/unicorn/hook.go index c286f08..3176df9 100644 --- a/bindings/go/unicorn/hook.go +++ b/bindings/go/unicorn/hook.go @@ -90,7 +90,7 @@ func (u *uc) HookAdd(htype int, cb interface{}, extra ...uint64) (Hook, error) { } default: // special case for mask - if htype&(HOOK_MEM_READ_INVALID|HOOK_MEM_WRITE_INVALID|HOOK_MEM_FETCH_INVALID| + if htype&(HOOK_MEM_READ_UNMAPPED|HOOK_MEM_WRITE_UNMAPPED|HOOK_MEM_FETCH_UNMAPPED| HOOK_MEM_READ_PROT|HOOK_MEM_WRITE_PROT|HOOK_MEM_FETCH_PROT) != 0 { rangeMode = true callback = C.hookMemInvalid_cgo diff --git a/bindings/go/unicorn/unicorn_const.go b/bindings/go/unicorn/unicorn_const.go index 8bd3534..5afeec4 100644 --- a/bindings/go/unicorn/unicorn_const.go +++ b/bindings/go/unicorn/unicorn_const.go @@ -39,26 +39,25 @@ const ( ERR_HANDLE = 3 ERR_MODE = 4 ERR_VERSION = 5 - ERR_READ_INVALID = 6 - ERR_WRITE_INVALID = 7 - ERR_FETCH_INVALID = 8 - ERR_CODE_INVALID = 9 - ERR_HOOK = 10 - ERR_INSN_INVALID = 11 - ERR_MAP = 12 - ERR_WRITE_PROT = 13 - ERR_READ_PROT = 14 - ERR_FETCH_PROT = 15 - ERR_ARG = 16 - ERR_READ_UNALIGNED = 17 - ERR_WRITE_UNALIGNED = 18 - ERR_FETCH_UNALIGNED = 19 + ERR_READ_UNMAPPED = 6 + ERR_WRITE_UNMAPPED = 7 + ERR_FETCH_UNMAPPED = 8 + ERR_HOOK = 9 + ERR_INSN_INVALID = 10 + ERR_MAP = 11 + ERR_WRITE_PROT = 12 + ERR_READ_PROT = 13 + ERR_FETCH_PROT = 14 + ERR_ARG = 15 + ERR_READ_UNALIGNED = 16 + ERR_WRITE_UNALIGNED = 17 + ERR_FETCH_UNALIGNED = 18 MEM_READ = 16 MEM_WRITE = 17 MEM_FETCH = 18 - MEM_READ_INVALID = 19 - MEM_WRITE_INVALID = 20 - MEM_FETCH_INVALID = 21 + MEM_READ_UNMAPPED = 19 + MEM_WRITE_UNMAPPED = 20 + MEM_FETCH_UNMAPPED = 21 MEM_WRITE_PROT = 22 MEM_READ_PROT = 23 MEM_FETCH_PROT = 24 @@ -66,9 +65,9 @@ const ( HOOK_INSN = 2 HOOK_CODE = 4 HOOK_BLOCK = 8 - HOOK_MEM_READ_INVALID = 16 - HOOK_MEM_WRITE_INVALID = 32 - HOOK_MEM_FETCH_INVALID = 64 + HOOK_MEM_READ_UNMAPPED = 16 + HOOK_MEM_WRITE_UNMAPPED = 32 + HOOK_MEM_FETCH_UNMAPPED = 64 HOOK_MEM_READ_PROT = 128 HOOK_MEM_WRITE_PROT = 256 HOOK_MEM_FETCH_PROT = 512 diff --git a/bindings/java/samples/Sample_x86.java b/bindings/java/samples/Sample_x86.java index edda0e9..91ca269 100644 --- a/bindings/java/samples/Sample_x86.java +++ b/bindings/java/samples/Sample_x86.java @@ -419,7 +419,7 @@ public class Sample_x86 { u.hook_add(new MyCodeHook(), 1, 0, null); // intercept invalid memory events - u.hook_add(new MyWriteInvalidHook(), Unicorn.UC_HOOK_MEM_WRITE_INVALID, null); + u.hook_add(new MyWriteInvalidHook(), Unicorn.UC_HOOK_MEM_WRITE_UNMAPPED, null); // emulate machine code in infinite time try { diff --git a/bindings/java/unicorn/Unicorn.java b/bindings/java/unicorn/Unicorn.java index 9abfeb6..5a28c26 100644 --- a/bindings/java/unicorn/Unicorn.java +++ b/bindings/java/unicorn/Unicorn.java @@ -72,9 +72,9 @@ public class Unicorn implements UnicornConst, ArmConst, Arm64Const, M68kConst, S //required to load native method implementations static { System.loadLibrary("unicorn_java"); //loads unicorn.dll or libunicorn.so - eventMemMap.put(UC_HOOK_MEM_READ_INVALID, UC_MEM_READ_INVALID); - eventMemMap.put(UC_HOOK_MEM_WRITE_INVALID, UC_MEM_WRITE_INVALID); - eventMemMap.put(UC_HOOK_MEM_FETCH_INVALID, UC_MEM_FETCH_INVALID); + eventMemMap.put(UC_HOOK_MEM_READ_UNMAPPED, UC_MEM_READ_UNMAPPED); + eventMemMap.put(UC_HOOK_MEM_WRITE_UNMAPPED, UC_MEM_WRITE_UNMAPPED); + eventMemMap.put(UC_HOOK_MEM_FETCH_UNMAPPED, UC_MEM_FETCH_UNMAPPED); eventMemMap.put(UC_HOOK_MEM_READ_PROT, UC_MEM_READ_PROT); eventMemMap.put(UC_HOOK_MEM_WRITE_PROT, UC_MEM_WRITE_PROT); eventMemMap.put(UC_HOOK_MEM_FETCH_PROT, UC_MEM_FETCH_PROT); @@ -140,10 +140,10 @@ public class Unicorn implements UnicornConst, ArmConst, Arm64Const, M68kConst, S } /** - * Invoke all UC_HOOK_MEM_XXX_INVALID andor UC_HOOK_MEM_XXX_PROT callbacks registered + * Invoke all UC_HOOK_MEM_XXX_UNMAPPED andor UC_HOOK_MEM_XXX_PROT callbacks registered * for a specific Unicorn. * This function gets invoked from the native C callback registered for - * for UC_HOOK_MEM_XXX_INVALID or UC_HOOK_MEM_XXX_PROT + * for UC_HOOK_MEM_XXX_UNMAPPED or UC_HOOK_MEM_XXX_PROT * * @param eng A Unicorn uc_engine* eng returned by uc_open * @param type The type of event that is taking place @@ -535,12 +535,12 @@ public class Unicorn implements UnicornConst, ArmConst, Arm64Const, M68kConst, S } /** - * Hook registration for UC_HOOK_MEM_XXX_INVALID and UC_HOOK_MEM_XXX_PROT hooks. + * Hook registration for UC_HOOK_MEM_XXX_UNMAPPED and UC_HOOK_MEM_XXX_PROT hooks. * The registered callback function will be invoked whenever a read or write is * attempted from an invalid or protected memory address. * * @param callback Implementation of a EventMemHook interface - * @param type Type of memory event being hooked such as UC_HOOK_MEM_READ_INVALID or UC_HOOK_MEM_WRITE_PROT + * @param type Type of memory event being hooked such as UC_HOOK_MEM_READ_UNMAPPED or UC_HOOK_MEM_WRITE_PROT * @param user_data User data to be passed to the callback function each time the event is triggered */ public void hook_add(EventMemHook callback, int type, Object user_data) throws UnicornException { diff --git a/bindings/java/unicorn/UnicornConst.java b/bindings/java/unicorn/UnicornConst.java index 615a690..7cff4e6 100644 --- a/bindings/java/unicorn/UnicornConst.java +++ b/bindings/java/unicorn/UnicornConst.java @@ -41,26 +41,25 @@ public interface UnicornConst { public static final int UC_ERR_HANDLE = 3; public static final int UC_ERR_MODE = 4; public static final int UC_ERR_VERSION = 5; - public static final int UC_ERR_READ_INVALID = 6; - public static final int UC_ERR_WRITE_INVALID = 7; - public static final int UC_ERR_FETCH_INVALID = 8; - public static final int UC_ERR_CODE_INVALID = 9; - public static final int UC_ERR_HOOK = 10; - public static final int UC_ERR_INSN_INVALID = 11; - public static final int UC_ERR_MAP = 12; - public static final int UC_ERR_WRITE_PROT = 13; - public static final int UC_ERR_READ_PROT = 14; - public static final int UC_ERR_FETCH_PROT = 15; - public static final int UC_ERR_ARG = 16; - public static final int UC_ERR_READ_UNALIGNED = 17; - public static final int UC_ERR_WRITE_UNALIGNED = 18; - public static final int UC_ERR_FETCH_UNALIGNED = 19; + public static final int UC_ERR_READ_UNMAPPED = 6; + public static final int UC_ERR_WRITE_UNMAPPED = 7; + public static final int UC_ERR_FETCH_UNMAPPED = 8; + public static final int UC_ERR_HOOK = 9; + public static final int UC_ERR_INSN_INVALID = 10; + public static final int UC_ERR_MAP = 11; + public static final int UC_ERR_WRITE_PROT = 12; + public static final int UC_ERR_READ_PROT = 13; + public static final int UC_ERR_FETCH_PROT = 14; + public static final int UC_ERR_ARG = 15; + public static final int UC_ERR_READ_UNALIGNED = 16; + public static final int UC_ERR_WRITE_UNALIGNED = 17; + public static final int UC_ERR_FETCH_UNALIGNED = 18; public static final int UC_MEM_READ = 16; public static final int UC_MEM_WRITE = 17; public static final int UC_MEM_FETCH = 18; - public static final int UC_MEM_READ_INVALID = 19; - public static final int UC_MEM_WRITE_INVALID = 20; - public static final int UC_MEM_FETCH_INVALID = 21; + public static final int UC_MEM_READ_UNMAPPED = 19; + public static final int UC_MEM_WRITE_UNMAPPED = 20; + public static final int UC_MEM_FETCH_UNMAPPED = 21; public static final int UC_MEM_WRITE_PROT = 22; public static final int UC_MEM_READ_PROT = 23; public static final int UC_MEM_FETCH_PROT = 24; @@ -68,9 +67,9 @@ public interface UnicornConst { public static final int UC_HOOK_INSN = 2; public static final int UC_HOOK_CODE = 4; public static final int UC_HOOK_BLOCK = 8; - public static final int UC_HOOK_MEM_READ_INVALID = 16; - public static final int UC_HOOK_MEM_WRITE_INVALID = 32; - public static final int UC_HOOK_MEM_FETCH_INVALID = 64; + public static final int UC_HOOK_MEM_READ_UNMAPPED = 16; + public static final int UC_HOOK_MEM_WRITE_UNMAPPED = 32; + public static final int UC_HOOK_MEM_FETCH_UNMAPPED = 64; public static final int UC_HOOK_MEM_READ_PROT = 128; public static final int UC_HOOK_MEM_WRITE_PROT = 256; public static final int UC_HOOK_MEM_FETCH_PROT = 512; diff --git a/bindings/java/unicorn/UnicornErrors.java b/bindings/java/unicorn/UnicornErrors.java index 3d74aa3..d3f376f 100644 --- a/bindings/java/unicorn/UnicornErrors.java +++ b/bindings/java/unicorn/UnicornErrors.java @@ -31,9 +31,8 @@ public interface UnicornErrors { public static final int UC_ERR_VERSION = 6; // Unsupported version (bindings) public static final int UC_ERR_MEM_READ = 7; // Quit emulation due to invalid memory READ: uc_emu_start() public static final int UC_ERR_MEM_WRITE = 8; // Quit emulation due to invalid memory WRITE: uc_emu_start() - public static final int UC_ERR_CODE_INVALID = 9; // Quit emulation due to invalid code address: uc_emu_start() - public static final int UC_ERR_HOOK = 10; // Invalid hook type: uc_hook_add() - public static final int UC_ERR_INSN_INVALID = 11; // Quit emulation due to invalid instruction: uc_emu_start() - public static final int UC_ERR_MAP = 12; // Invalid memory mapping: uc_mem_map() + public static final int UC_ERR_HOOK = 9; // Invalid hook type: uc_hook_add() + public static final int UC_ERR_INSN_INVALID = 10; // Quit emulation due to invalid instruction: uc_emu_start() + public static final int UC_ERR_MAP = 11; // Invalid memory mapping: uc_mem_map() } diff --git a/bindings/java/unicorn_Unicorn.c b/bindings/java/unicorn_Unicorn.c index 470c634..a14bd9e 100644 --- a/bindings/java/unicorn_Unicorn.c +++ b/bindings/java/unicorn_Unicorn.c @@ -160,7 +160,7 @@ static void cb_hookmem(uc_engine *eng, uc_mem_type type, (*cachedJVM)->DetachCurrentThread(cachedJVM); } -// Callback function for handling memory events (for UC_HOOK_MEM_INVALID) +// Callback function for handling memory events (for UC_HOOK_MEM_UNMAPPED) // @type: this memory is being READ, or WRITE // @address: address where the code is being executed // @size: size of data being read or written @@ -389,9 +389,9 @@ JNIEXPORT jlong JNICALL Java_unicorn_Unicorn_registerHook__JI } err = uc_hook_add((uc_engine*)eng, &hh, (uc_hook_type)type, cb_hookintr, env); break; - case UC_HOOK_MEM_FETCH_INVALID: // Hook for all invalid memory access events - case UC_HOOK_MEM_READ_INVALID: // Hook for all invalid memory access events - case UC_HOOK_MEM_WRITE_INVALID: // Hook for all invalid memory access events + case UC_HOOK_MEM_FETCH_UNMAPPED: // Hook for all invalid memory access events + case UC_HOOK_MEM_READ_UNMAPPED: // Hook for all invalid memory access events + case UC_HOOK_MEM_WRITE_UNMAPPED: // Hook for all invalid memory access events case UC_HOOK_MEM_FETCH_PROT: // Hook for all invalid memory access events case UC_HOOK_MEM_READ_PROT: // Hook for all invalid memory access events case UC_HOOK_MEM_WRITE_PROT: // Hook for all invalid memory access events diff --git a/bindings/python/sample_x86.py b/bindings/python/sample_x86.py index 151ed73..f4a98b2 100755 --- a/bindings/python/sample_x86.py +++ b/bindings/python/sample_x86.py @@ -33,7 +33,7 @@ def hook_code(uc, address, size, user_data): # callback for tracing invalid memory access (READ or WRITE) def hook_mem_invalid(uc, access, address, size, value, user_data): - if access == UC_MEM_WRITE_INVALID: + if access == UC_MEM_WRITE_UNMAPPED: print(">>> Missing memory is being WRITE at 0x%x, data size = %u, data value = 0x%x" \ %(address, size, value)) # map this memory in with 2MB in size @@ -231,7 +231,7 @@ def test_i386_invalid_mem_write(): #mu.hook_add(UC_HOOK_CODE, hook_code) # intercept invalid memory events - mu.hook_add(UC_HOOK_MEM_READ_INVALID | UC_HOOK_MEM_WRITE_INVALID, hook_mem_invalid) + mu.hook_add(UC_HOOK_MEM_READ_UNMAPPED | UC_HOOK_MEM_WRITE_UNMAPPED, hook_mem_invalid) try: # emulate machine code in infinite time diff --git a/bindings/python/unicorn/unicorn.py b/bindings/python/unicorn/unicorn.py index dd67306..d8fc62b 100644 --- a/bindings/python/unicorn/unicorn.py +++ b/bindings/python/unicorn/unicorn.py @@ -272,8 +272,8 @@ class Uc(object): cb = ctypes.cast(UC_HOOK_CODE_CB(self._hookcode_cb), UC_HOOK_CODE_CB) status = _uc.uc_hook_add(self._uch, ctypes.byref(_h2), htype, cb, \ ctypes.cast(self._callback_count, ctypes.c_void_p), begin, end) - elif htype & UC_HOOK_MEM_READ_INVALID or htype & UC_HOOK_MEM_WRITE_INVALID or \ - htype & UC_HOOK_MEM_FETCH_INVALID or htype & UC_HOOK_MEM_READ_PROT or \ + elif htype & UC_HOOK_MEM_READ_UNMAPPED or htype & UC_HOOK_MEM_WRITE_UNMAPPED or \ + htype & UC_HOOK_MEM_FETCH_UNMAPPED or htype & UC_HOOK_MEM_READ_PROT or \ htype & UC_HOOK_MEM_WRITE_PROT or htype & UC_HOOK_MEM_FETCH_PROT: cb = ctypes.cast(UC_HOOK_MEM_INVALID_CB(self._hook_mem_invalid_cb), UC_HOOK_MEM_INVALID_CB) status = _uc.uc_hook_add(self._uch, ctypes.byref(_h2), htype, \ diff --git a/bindings/python/unicorn/unicorn_const.py b/bindings/python/unicorn/unicorn_const.py index 467cdd2..a401c83 100644 --- a/bindings/python/unicorn/unicorn_const.py +++ b/bindings/python/unicorn/unicorn_const.py @@ -37,26 +37,25 @@ UC_ERR_ARCH = 2 UC_ERR_HANDLE = 3 UC_ERR_MODE = 4 UC_ERR_VERSION = 5 -UC_ERR_READ_INVALID = 6 -UC_ERR_WRITE_INVALID = 7 -UC_ERR_FETCH_INVALID = 8 -UC_ERR_CODE_INVALID = 9 -UC_ERR_HOOK = 10 -UC_ERR_INSN_INVALID = 11 -UC_ERR_MAP = 12 -UC_ERR_WRITE_PROT = 13 -UC_ERR_READ_PROT = 14 -UC_ERR_FETCH_PROT = 15 -UC_ERR_ARG = 16 -UC_ERR_READ_UNALIGNED = 17 -UC_ERR_WRITE_UNALIGNED = 18 -UC_ERR_FETCH_UNALIGNED = 19 +UC_ERR_READ_UNMAPPED = 6 +UC_ERR_WRITE_UNMAPPED = 7 +UC_ERR_FETCH_UNMAPPED = 8 +UC_ERR_HOOK = 9 +UC_ERR_INSN_INVALID = 10 +UC_ERR_MAP = 11 +UC_ERR_WRITE_PROT = 12 +UC_ERR_READ_PROT = 13 +UC_ERR_FETCH_PROT = 14 +UC_ERR_ARG = 15 +UC_ERR_READ_UNALIGNED = 16 +UC_ERR_WRITE_UNALIGNED = 17 +UC_ERR_FETCH_UNALIGNED = 18 UC_MEM_READ = 16 UC_MEM_WRITE = 17 UC_MEM_FETCH = 18 -UC_MEM_READ_INVALID = 19 -UC_MEM_WRITE_INVALID = 20 -UC_MEM_FETCH_INVALID = 21 +UC_MEM_READ_UNMAPPED = 19 +UC_MEM_WRITE_UNMAPPED = 20 +UC_MEM_FETCH_UNMAPPED = 21 UC_MEM_WRITE_PROT = 22 UC_MEM_READ_PROT = 23 UC_MEM_FETCH_PROT = 24 @@ -64,9 +63,9 @@ UC_HOOK_INTR = 1 UC_HOOK_INSN = 2 UC_HOOK_CODE = 4 UC_HOOK_BLOCK = 8 -UC_HOOK_MEM_READ_INVALID = 16 -UC_HOOK_MEM_WRITE_INVALID = 32 -UC_HOOK_MEM_FETCH_INVALID = 64 +UC_HOOK_MEM_READ_UNMAPPED = 16 +UC_HOOK_MEM_WRITE_UNMAPPED = 32 +UC_HOOK_MEM_FETCH_UNMAPPED = 64 UC_HOOK_MEM_READ_PROT = 128 UC_HOOK_MEM_WRITE_PROT = 256 UC_HOOK_MEM_FETCH_PROT = 512 diff --git a/include/unicorn/unicorn.h b/include/unicorn/unicorn.h index e70ca73..bc4edd4 100644 --- a/include/unicorn/unicorn.h +++ b/include/unicorn/unicorn.h @@ -111,10 +111,9 @@ typedef enum uc_err { UC_ERR_HANDLE, // Invalid handle UC_ERR_MODE, // Invalid/unsupported mode: uc_open() UC_ERR_VERSION, // Unsupported version (bindings) - UC_ERR_READ_INVALID, // Quit emulation due to invalid memory READ: uc_emu_start() - UC_ERR_WRITE_INVALID, // Quit emulation due to invalid memory WRITE: uc_emu_start() - UC_ERR_FETCH_INVALID, // Quit emulation due to invalid memory FETCH: uc_emu_start() - UC_ERR_CODE_INVALID, // Quit emulation due to invalid code address: uc_emu_start() + UC_ERR_READ_UNMAPPED, // Quit emulation due to READ on unmapped memory: uc_emu_start() + UC_ERR_WRITE_UNMAPPED, // Quit emulation due to WRITE on unmapped memory: uc_emu_start() + UC_ERR_FETCH_UNMAPPED, // Quit emulation due to FETCH on unmapped memory: uc_emu_start() UC_ERR_HOOK, // Invalid hook type: uc_hook_add() UC_ERR_INSN_INVALID, // Quit emulation due to invalid instruction: uc_emu_start() UC_ERR_MAP, // Invalid memory mapping: uc_mem_map() @@ -156,9 +155,9 @@ typedef enum uc_mem_type { UC_MEM_READ = 16, // Memory is read from UC_MEM_WRITE, // Memory is written to UC_MEM_FETCH, // Memory is fetched - UC_MEM_READ_INVALID, // Unmapped memory is read from - UC_MEM_WRITE_INVALID, // Unmapped memory is written to - UC_MEM_FETCH_INVALID, // Unmapped memory is fetched + UC_MEM_READ_UNMAPPED, // Unmapped memory is read from + UC_MEM_WRITE_UNMAPPED, // Unmapped memory is written to + UC_MEM_FETCH_UNMAPPED, // Unmapped memory is fetched UC_MEM_WRITE_PROT, // Write to write protected, but mapped, memory UC_MEM_READ_PROT, // Read from read protected, but mapped, memory UC_MEM_FETCH_PROT, // Fetch from non-executable, but mapped, memory @@ -170,9 +169,9 @@ typedef enum uc_hook_type { UC_HOOK_INSN = 1 << 1, // Hook a particular instruction UC_HOOK_CODE = 1 << 2, // Hook a range of code UC_HOOK_BLOCK = 1 << 3, // Hook basic blocks - UC_HOOK_MEM_READ_INVALID = 1 << 4, // Hook for invalid memory read events - UC_HOOK_MEM_WRITE_INVALID = 1 << 5, // Hook for invalid memory write events - UC_HOOK_MEM_FETCH_INVALID = 1 << 6, // Hook for invalid memory fetch for execution events + UC_HOOK_MEM_READ_UNMAPPED = 1 << 4, // Hook for memory read on unmapped memory + UC_HOOK_MEM_WRITE_UNMAPPED = 1 << 5, // Hook for invalid memory write events + UC_HOOK_MEM_FETCH_UNMAPPED = 1 << 6, // Hook for invalid memory fetch for execution events UC_HOOK_MEM_READ_PROT = 1 << 7, // Hook for memory read on read-protected memory UC_HOOK_MEM_WRITE_PROT = 1 << 8, // Hook for memory write on write-protected memory UC_HOOK_MEM_FETCH_PROT = 1 << 9, // Hook for memory fetch on non-executable memory @@ -182,17 +181,17 @@ typedef enum uc_hook_type { } uc_hook_type; // hook type for all events of unmapped memory access -#define UC_HOOK_MEM_INVALID (UC_HOOK_MEM_READ_INVALID + UC_HOOK_MEM_WRITE_INVALID + UC_HOOK_MEM_FETCH_INVALID) +#define UC_HOOK_MEM_UNMAPPED (UC_HOOK_MEM_READ_UNMAPPED + UC_HOOK_MEM_WRITE_UNMAPPED + UC_HOOK_MEM_FETCH_UNMAPPED) // hook type for all events of illegal protected memory access #define UC_HOOK_MEM_PROT (UC_HOOK_MEM_READ_PROT + UC_HOOK_MEM_WRITE_PROT + UC_HOOK_MEM_FETCH_PROT) // hook type for all events of illegal read memory access -#define UC_HOOK_MEM_READ_ERR (UC_HOOK_MEM_READ_PROT + UC_HOOK_MEM_READ_INVALID) +#define UC_HOOK_MEM_READ_INVALID (UC_HOOK_MEM_READ_PROT + UC_HOOK_MEM_READ_UNMAPPED) // hook type for all events of illegal write memory access -#define UC_HOOK_MEM_WRITE_ERR (UC_HOOK_MEM_WRITE_PROT + UC_HOOK_MEM_WRITE_INVALID) +#define UC_HOOK_MEM_WRITE_INVALID (UC_HOOK_MEM_WRITE_PROT + UC_HOOK_MEM_WRITE_UNMAPPED) // hook type for all events of illegal fetch memory access -#define UC_HOOK_MEM_FETCH_ERR (UC_HOOK_MEM_FETCH_PROT + UC_HOOK_MEM_FETCH_INVALID) +#define UC_HOOK_MEM_FETCH_INVALID (UC_HOOK_MEM_FETCH_PROT + UC_HOOK_MEM_FETCH_UNMAPPED) // hook type for all events of illegal memory access -#define UC_HOOK_MEM_ERR (UC_HOOK_MEM_INVALID + UC_HOOK_MEM_PROT) +#define UC_HOOK_MEM_INVALID (UC_HOOK_MEM_UNMAPPED + UC_HOOK_MEM_PROT) // Callback function for hooking memory (UC_MEM_READ, UC_MEM_WRITE & UC_MEM_FETCH) // @type: this memory is being READ, or WRITE @@ -203,7 +202,7 @@ typedef enum uc_hook_type { typedef void (*uc_cb_hookmem_t)(uc_engine *uc, uc_mem_type type, uint64_t address, int size, int64_t value, void *user_data); -// Callback function for handling invalid memory access events (UC_MEM_*_INVALID and +// Callback function for handling invalid memory access events (UC_MEM_*_UNMAPPED and // UC_MEM_*PROT events) // @type: this memory is being READ, or WRITE // @address: address where the code is being executed diff --git a/qemu/cpu-exec.c b/qemu/cpu-exec.c index 33069e3..b74e8e8 100644 --- a/qemu/cpu-exec.c +++ b/qemu/cpu-exec.c @@ -200,7 +200,7 @@ int cpu_exec(struct uc_struct *uc, CPUArchState *env) // qq have_tb_lock = true; tb = tb_find_fast(env); // qq if (!tb) { // invalid TB due to invalid code? - uc->invalid_error = UC_ERR_CODE_INVALID; + uc->invalid_error = UC_ERR_FETCH_UNMAPPED; ret = EXCP_HLT; break; } diff --git a/qemu/cputlb.c b/qemu/cputlb.c index 7439b78..468219a 100644 --- a/qemu/cputlb.c +++ b/qemu/cputlb.c @@ -302,7 +302,6 @@ tb_page_addr_t get_page_addr_code(CPUArchState *env1, target_ulong addr) cpu_ldub_code(env1, addr); //check for NX related error from softmmu if (env1->invalid_error == UC_ERR_FETCH_PROT) { - env1->invalid_error = UC_ERR_CODE_INVALID; return -1; } } @@ -317,14 +316,14 @@ tb_page_addr_t get_page_addr_code(CPUArchState *env1, target_ulong addr) //cpu_abort(cpu, "Trying to execute code outside RAM or ROM at 0x" // TARGET_FMT_lx "\n", addr); // qq env1->invalid_addr = addr; - env1->invalid_error = UC_ERR_CODE_INVALID; - return -1; // qq FIXME + env1->invalid_error = UC_ERR_FETCH_UNMAPPED; + return -1; } } p = (void *)((uintptr_t)addr + env1->tlb_table[mmu_idx][page_index].addend); if (!qemu_ram_addr_from_host_nofail(cpu->uc, p, &ram_addr)) { env1->invalid_addr = addr; - env1->invalid_error = UC_ERR_FETCH_INVALID; // FIXME UC_ERR_FETCH_UNMAPPED + env1->invalid_error = UC_ERR_FETCH_UNMAPPED; return -1; } else return ram_addr; diff --git a/qemu/softmmu_template.h b/qemu/softmmu_template.h index 9730c84..2818bde 100644 --- a/qemu/softmmu_template.h +++ b/qemu/softmmu_template.h @@ -185,14 +185,14 @@ WORD_TYPE helper_le_ld_name(CPUArchState *env, target_ulong addr, int mmu_idx, // memory can be unmapped while reading or fetching if (mr == NULL) { #if defined(SOFTMMU_CODE_ACCESS) - error_code = UC_ERR_FETCH_INVALID; + error_code = UC_ERR_FETCH_UNMAPPED; if (uc->hook_mem_fetch_idx != 0 && ((uc_cb_eventmem_t)uc->hook_callbacks[uc->hook_mem_fetch_idx].callback)( - uc, UC_MEM_FETCH_INVALID, addr, DATA_SIZE, 0, + uc, UC_MEM_FETCH_UNMAPPED, addr, DATA_SIZE, 0, uc->hook_callbacks[uc->hook_mem_fetch_idx].user_data)) { #else - error_code = UC_ERR_READ_INVALID; + error_code = UC_ERR_READ_UNMAPPED; if (uc->hook_mem_read_idx != 0 && ((uc_cb_eventmem_t)uc->hook_callbacks[uc->hook_mem_read_idx].callback)( - uc, UC_MEM_READ_INVALID, addr, DATA_SIZE, 0, + uc, UC_MEM_READ_UNMAPPED, addr, DATA_SIZE, 0, uc->hook_callbacks[uc->hook_mem_read_idx].user_data)) { #endif env->invalid_error = UC_ERR_OK; @@ -284,7 +284,7 @@ WORD_TYPE helper_le_ld_name(CPUArchState *env, target_ulong addr, int mmu_idx, ioaddr = env->iotlb[mmu_idx][index]; if (ioaddr == 0) { env->invalid_addr = addr; - env->invalid_error = UC_ERR_READ_INVALID; + env->invalid_error = UC_ERR_READ_UNMAPPED; // printf("Invalid memory read at " TARGET_FMT_lx "\n", addr); cpu_exit(env->uc->current_cpu); return 0; @@ -376,14 +376,14 @@ WORD_TYPE helper_be_ld_name(CPUArchState *env, target_ulong addr, int mmu_idx, // memory can be unmapped while reading or fetching if (mr == NULL) { #if defined(SOFTMMU_CODE_ACCESS) - error_code = UC_ERR_FETCH_INVALID; + error_code = UC_ERR_FETCH_UNMAPPED; if (uc->hook_mem_fetch_idx != 0 && ((uc_cb_eventmem_t)uc->hook_callbacks[uc->hook_mem_fetch_idx].callback)( - uc, UC_MEM_FETCH_INVALID, addr, DATA_SIZE, 0, + uc, UC_MEM_FETCH_UNMAPPED, addr, DATA_SIZE, 0, uc->hook_callbacks[uc->hook_mem_fetch_idx].user_data)) { #else - error_code = UC_ERR_READ_INVALID; + error_code = UC_ERR_READ_UNMAPPED; if (uc->hook_mem_read_idx != 0 && ((uc_cb_eventmem_t)uc->hook_callbacks[uc->hook_mem_read_idx].callback)( - uc, UC_MEM_READ_INVALID, addr, DATA_SIZE, 0, + uc, UC_MEM_READ_UNMAPPED, addr, DATA_SIZE, 0, uc->hook_callbacks[uc->hook_mem_read_idx].user_data)) { #endif env->invalid_error = UC_ERR_OK; @@ -475,7 +475,7 @@ WORD_TYPE helper_be_ld_name(CPUArchState *env, target_ulong addr, int mmu_idx, if (ioaddr == 0) { env->invalid_addr = addr; - env->invalid_error = UC_ERR_READ_INVALID; + env->invalid_error = UC_ERR_READ_UNMAPPED; // printf("Invalid memory read at " TARGET_FMT_lx "\n", addr); cpu_exit(env->uc->current_cpu); return 0; @@ -612,11 +612,11 @@ void helper_le_st_name(CPUArchState *env, target_ulong addr, DATA_TYPE val, // Unicorn: callback on invalid memory if (uc->hook_mem_write_idx && mr == NULL) { if (!((uc_cb_eventmem_t)uc->hook_callbacks[uc->hook_mem_write_idx].callback)( - uc, UC_MEM_WRITE_INVALID, addr, DATA_SIZE, (int64_t)val, + uc, UC_MEM_WRITE_UNMAPPED, addr, DATA_SIZE, (int64_t)val, uc->hook_callbacks[uc->hook_mem_write_idx].user_data)) { // save error & quit env->invalid_addr = addr; - env->invalid_error = UC_ERR_WRITE_INVALID; + env->invalid_error = UC_ERR_WRITE_UNMAPPED; // printf("***** Invalid memory write at " TARGET_FMT_lx "\n", addr); cpu_exit(uc->current_cpu); return; @@ -673,7 +673,7 @@ void helper_le_st_name(CPUArchState *env, target_ulong addr, DATA_TYPE val, ioaddr = env->iotlb[mmu_idx][index]; if (ioaddr == 0) { env->invalid_addr = addr; - env->invalid_error = UC_ERR_WRITE_INVALID; + env->invalid_error = UC_ERR_WRITE_UNMAPPED; // printf("***** Invalid memory write at " TARGET_FMT_lx "\n", addr); cpu_exit(env->uc->current_cpu); return; @@ -759,11 +759,11 @@ void helper_be_st_name(CPUArchState *env, target_ulong addr, DATA_TYPE val, // Unicorn: callback on invalid memory if (uc->hook_mem_write_idx && mr == NULL) { if (!((uc_cb_eventmem_t)uc->hook_callbacks[uc->hook_mem_write_idx].callback)( - uc, UC_MEM_WRITE_INVALID, addr, DATA_SIZE, (int64_t)val, + uc, UC_MEM_WRITE_UNMAPPED, addr, DATA_SIZE, (int64_t)val, uc->hook_callbacks[uc->hook_mem_write_idx].user_data)) { // save error & quit env->invalid_addr = addr; - env->invalid_error = UC_ERR_WRITE_INVALID; + env->invalid_error = UC_ERR_WRITE_UNMAPPED; // printf("***** Invalid memory write at " TARGET_FMT_lx "\n", addr); cpu_exit(uc->current_cpu); return; @@ -820,7 +820,7 @@ void helper_be_st_name(CPUArchState *env, target_ulong addr, DATA_TYPE val, ioaddr = env->iotlb[mmu_idx][index]; if (ioaddr == 0) { env->invalid_addr = addr; - env->invalid_error = UC_ERR_WRITE_INVALID; + env->invalid_error = UC_ERR_WRITE_UNMAPPED; // printf("***** Invalid memory write at " TARGET_FMT_lx "\n", addr); cpu_exit(env->uc->current_cpu); return; diff --git a/samples/mem_apis.c b/samples/mem_apis.c index 28f2b60..db0240d 100644 --- a/samples/mem_apis.c +++ b/samples/mem_apis.c @@ -79,10 +79,10 @@ static bool hook_mem_invalid(uc_engine *uc, uc_mem_type type, default: printf("not ok - UC_HOOK_MEM_INVALID type: %d at 0x%" PRIx64 "\n", type, addr); return false; - case UC_MEM_READ_INVALID: + case UC_MEM_READ_UNMAPPED: printf("not ok - Read from invalid memory at 0x%"PRIx64 ", data size = %u\n", addr, size); return false; - case UC_MEM_WRITE_INVALID: + case UC_MEM_WRITE_UNMAPPED: printf("not ok - Write to invalid memory at 0x%"PRIx64 ", data size = %u, data value = 0x%"PRIx64 "\n", addr, size, value); return false; case UC_MEM_FETCH_PROT: @@ -147,7 +147,7 @@ static void do_nx_demo(bool cause_fault) // intercept code and invalid memory events if (uc_hook_add(uc, &trace2, UC_HOOK_CODE, hook_code, NULL, (uint64_t)1, (uint64_t)0) != UC_ERR_OK || - uc_hook_add(uc, &trace1, UC_HOOK_MEM_ERR, + uc_hook_add(uc, &trace1, UC_HOOK_MEM_INVALID, hook_mem_invalid, NULL) != UC_ERR_OK) { printf("not ok - Failed to install hooks\n"); return; @@ -228,7 +228,7 @@ static void do_perms_demo(bool change_perms) // intercept code and invalid memory events if (uc_hook_add(uc, &trace2, UC_HOOK_CODE, hook_code, NULL, (uint64_t)1, (uint64_t)0) != UC_ERR_OK || uc_hook_add(uc, &trace1, - UC_HOOK_MEM_READ_INVALID | UC_HOOK_MEM_WRITE_INVALID | UC_HOOK_MEM_FETCH_INVALID | UC_HOOK_MEM_FETCH_PROT | UC_HOOK_MEM_WRITE_PROT | UC_HOOK_MEM_READ_PROT, + UC_HOOK_MEM_INVALID, hook_mem_invalid, NULL) != UC_ERR_OK) { printf("not ok - Failed to install hooks\n"); return; @@ -306,7 +306,7 @@ static void do_unmap_demo(bool do_unmap) // intercept code and invalid memory events if (uc_hook_add(uc, &trace2, UC_HOOK_CODE, hook_code, NULL, (uint64_t)1, (uint64_t)0) != UC_ERR_OK || uc_hook_add(uc, &trace1, - UC_HOOK_MEM_READ_INVALID | UC_HOOK_MEM_WRITE_INVALID | UC_HOOK_MEM_FETCH_INVALID | UC_HOOK_MEM_FETCH_PROT | UC_HOOK_MEM_WRITE_PROT | UC_HOOK_MEM_READ_PROT, + UC_HOOK_MEM_INVALID, hook_mem_invalid, NULL) != UC_ERR_OK) { printf("not ok - Failed to install hooks\n"); return; diff --git a/samples/sample_x86.c b/samples/sample_x86.c index f2a2891..49118e4 100644 --- a/samples/sample_x86.c +++ b/samples/sample_x86.c @@ -73,7 +73,7 @@ static bool hook_mem_invalid(uc_engine *uc, uc_mem_type type, default: // return false to indicate we want to stop emulation return false; - case UC_MEM_WRITE_INVALID: + case UC_MEM_WRITE_UNMAPPED: printf(">>> Missing memory is being WRITE at 0x%"PRIx64 ", data size = %u, data value = 0x%"PRIx64 "\n", address, size, value); // map this memory in with 2MB in size @@ -421,7 +421,7 @@ static void test_i386_invalid_mem_write(void) uc_hook_add(uc, &trace2, UC_HOOK_CODE, hook_code, NULL, (uint64_t)1, (uint64_t)0); // intercept invalid memory events - uc_hook_add(uc, &trace3, UC_HOOK_MEM_READ_INVALID | UC_HOOK_MEM_WRITE_INVALID, hook_mem_invalid, NULL); + uc_hook_add(uc, &trace3, UC_HOOK_MEM_READ_UNMAPPED | UC_HOOK_MEM_WRITE_UNMAPPED, hook_mem_invalid, NULL); // emulate machine code in infinite time err = uc_emu_start(uc, ADDRESS, ADDRESS + sizeof(X86_CODE32_MEM_WRITE) - 1, 0, 0); diff --git a/tests/regress/arm_bxeq_hang.py b/tests/regress/arm_bxeq_hang.py index 12f4a2a..5040d72 100755 --- a/tests/regress/arm_bxeq_hang.py +++ b/tests/regress/arm_bxeq_hang.py @@ -10,8 +10,9 @@ class BxHang(regress.RegressTest): def runTest(self): uc = Uc(UC_ARCH_ARM, UC_MODE_ARM) uc.mem_map(0x1000, 0x1000) - uc.mem_write(0x1000, '1eff2f010000a0e1'.decode('hex')) + uc.mem_write(0x1000, '1eff2f010000a0e1'.decode('hex')) # bxeq lr; mov r0, r0 uc.count = 0 + def hook_block(uc, addr, *args): print 'enter block 0x%04x' % addr uc.count += 1 diff --git a/tests/regress/jmp_ebx_hang.py b/tests/regress/jmp_ebx_hang.py index 602c594..221765d 100755 --- a/tests/regress/jmp_ebx_hang.py +++ b/tests/regress/jmp_ebx_hang.py @@ -22,7 +22,7 @@ class JumEbxHang(regress.RegressTest): with self.assertRaises(UcError) as m: mu.emu_start(CODE_ADDR, CODE_ADDR + 2, count=1) - self.assertEqual(m.exception.errno, unicorn.UC_ERR_CODE_INVALID) + self.assertEqual(m.exception.errno, unicorn.UC_ERR_FETCH_UNMAPPED) print(">>> jmp ebx (ebx = 0xaa96a47f)"); mu = unicorn.Uc(unicorn.UC_ARCH_X86, unicorn.UC_MODE_32) @@ -33,7 +33,7 @@ class JumEbxHang(regress.RegressTest): with self.assertRaises(UcError) as m: mu.emu_start(CODE_ADDR, CODE_ADDR + 2, count=1) - self.assertEqual(m.exception.errno, unicorn.UC_ERR_CODE_INVALID) + self.assertEqual(m.exception.errno, unicorn.UC_ERR_FETCH_UNMAPPED) if __name__ == '__main__': regress.main() diff --git a/tests/regress/mem_unmap.c b/tests/regress/mem_unmap.c index 06223bf..98e209f 100644 --- a/tests/regress/mem_unmap.c +++ b/tests/regress/mem_unmap.c @@ -224,7 +224,7 @@ int main(int argc, char **argv, char **envp) } // intercept invalid memory events - if (uc_hook_add(uc, &trace1, UC_HOOK_MEM_WRITE_INVALID, hook_mem_invalid, NULL) != UC_ERR_OK) { + if (uc_hook_add(uc, &trace1, UC_HOOK_MEM_WRITE_UNMAPPED, hook_mem_invalid, NULL) != UC_ERR_OK) { printf("not ok %d - Failed to install memory invalid handler\n", log_num++); return 7; } else { diff --git a/tests/regress/mips_except.py b/tests/regress/mips_except.py index 23969e9..b400efe 100755 --- a/tests/regress/mips_except.py +++ b/tests/regress/mips_except.py @@ -28,13 +28,13 @@ class MipsExcept(regress.RegressTest): uc.reg_write(UC_MIPS_REG_SP, 0xFFFFFFF0) uc.emu_start(CODE, CODE + len(asm), 200) - self.assertEqual(UC_ERR_READ_INVALID, m.exception.errno) + self.assertEqual(UC_ERR_READ_UNMAPPED, m.exception.errno) with self.assertRaises(UcError) as m: uc.reg_write(UC_MIPS_REG_SP, 0x80000000) uc.emu_start(CODE, CODE + len(asm), 100) - self.assertEqual(UC_ERR_READ_INVALID, m.exception.errno) + self.assertEqual(UC_ERR_READ_UNMAPPED, m.exception.errno) if __name__ == '__main__': regress.main() diff --git a/tests/regress/reg_write_sign_extension.py b/tests/regress/reg_write_sign_extension.py index 34d6550..b7d3be5 100755 --- a/tests/regress/reg_write_sign_extension.py +++ b/tests/regress/reg_write_sign_extension.py @@ -24,7 +24,7 @@ class RegWriteSignExt(regress.RegressTest): # jmp ebx mu.mem_write(0x10000000, b'\xff\xe3') - mu.hook_add(unicorn.UC_HOOK_MEM_FETCH_INVALID | unicorn.UC_HOOK_MEM_FETCH_PROT, hook_mem_invalid) + mu.hook_add(unicorn.UC_HOOK_MEM_FETCH_UNMAPPED | unicorn.UC_HOOK_MEM_FETCH_PROT, hook_mem_invalid) mu.emu_start(0x10000000, 0x10000000 + 2, count=1) if __name__ == '__main__': diff --git a/tests/regress/ro_mem_test.c b/tests/regress/ro_mem_test.c index 1e61203..7b43049 100644 --- a/tests/regress/ro_mem_test.c +++ b/tests/regress/ro_mem_test.c @@ -142,7 +142,7 @@ int main(int argc, char **argv, char **envp) //uc_hook_add(uc, &trace2, UC_HOOK_CODE, hook_code, NULL, (uint64_t)0x400000, (uint64_t)0x400fff); // intercept invalid memory events - uc_hook_add(uc, &trace1, UC_HOOK_MEM_WRITE_INVALID | UC_HOOK_MEM_WRITE_PROT, hook_mem_invalid, NULL); + uc_hook_add(uc, &trace1, UC_HOOK_MEM_WRITE_UNMAPPED | UC_HOOK_MEM_WRITE_PROT, hook_mem_invalid, NULL); // emulate machine code in infinite time printf("BEGIN execution - 1\n"); diff --git a/tests/regress/sparc_reg.py b/tests/regress/sparc_reg.py index 326d00e..03832de 100755 --- a/tests/regress/sparc_reg.py +++ b/tests/regress/sparc_reg.py @@ -164,7 +164,7 @@ def print_registers(mu): print_registers(uc) -assert uc.reg_read(UC_SPARC_REG_PC) == 128 # make sure we executed all instructions +assert uc.reg_read(UC_SPARC_REG_PC) == 132 # make sure we executed all instructions assert uc.reg_read(UC_SPARC_REG_SP) == 101 assert uc.reg_read(UC_SPARC_REG_FP) == 201 diff --git a/tests/unit/test_x86.c b/tests/unit/test_x86.c index e1d6856..0444112 100644 --- a/tests/unit/test_x86.c +++ b/tests/unit/test_x86.c @@ -408,7 +408,7 @@ static void test_i386_invalid_mem_read(void **state) // emulate machine code in infinite time err = uc_emu_start(uc, address, address+sizeof(code), 0, 0); - uc_assert_err(UC_ERR_READ_INVALID, err); + uc_assert_err(UC_ERR_READ_UNMAPPED, err); uc_assert_success(uc_close(uc)); } @@ -438,7 +438,7 @@ static void test_i386_invalid_mem_write(void **state) // emulate machine code in infinite time err = uc_emu_start(uc, address, address+sizeof(code), 0, 0); - uc_assert_err(UC_ERR_WRITE_INVALID, err); + uc_assert_err(UC_ERR_WRITE_UNMAPPED, err); uc_assert_success(uc_close(uc)); @@ -469,7 +469,7 @@ static void test_i386_jump_invalid(void **state) // emulate machine code in infinite time err = uc_emu_start(uc, address, address+sizeof(code), 0, 0); - uc_assert_err(UC_ERR_CODE_INVALID, err); + uc_assert_err(UC_ERR_FETCH_UNMAPPED, err); uc_assert_success(uc_close(uc)); diff --git a/uc.c b/uc.c index d521954..b87d1a6 100644 --- a/uc.c +++ b/uc.c @@ -69,14 +69,12 @@ const char *uc_strerror(uc_err code) return "Invalid mode (UC_ERR_MODE)"; case UC_ERR_VERSION: return "Different API version between core & binding (UC_ERR_VERSION)"; - case UC_ERR_READ_INVALID: - return "Invalid memory read (UC_ERR_READ_INVALID)"; - case UC_ERR_WRITE_INVALID: - return "Invalid memory write (UC_ERR_WRITE_INVALID)"; - case UC_ERR_FETCH_INVALID: - return "Invalid memory fetch (UC_ERR_FETCH_INVALID)"; - case UC_ERR_CODE_INVALID: - return "Invalid code address (UC_ERR_CODE_INVALID)"; + case UC_ERR_READ_UNMAPPED: + return "Invalid memory read (UC_ERR_READ_UNMAPPED)"; + case UC_ERR_WRITE_UNMAPPED: + return "Invalid memory write (UC_ERR_WRITE_UNMAPPED)"; + case UC_ERR_FETCH_UNMAPPED: + return "Invalid memory fetch (UC_ERR_FETCH_UNMAPPED)"; case UC_ERR_HOOK: return "Invalid hook type (UC_ERR_HOOK)"; case UC_ERR_INSN_INVALID: @@ -343,7 +341,7 @@ uc_err uc_mem_read(uc_engine *uc, uint64_t address, void *_bytes, size_t size) uint8_t *bytes = _bytes; if (!check_mem_area(uc, address, size)) - return UC_ERR_READ_INVALID; + return UC_ERR_READ_UNMAPPED; size_t count = 0, len; @@ -364,7 +362,7 @@ uc_err uc_mem_read(uc_engine *uc, uint64_t address, void *_bytes, size_t size) if (count == size) return UC_ERR_OK; else - return UC_ERR_READ_INVALID; + return UC_ERR_READ_UNMAPPED; } UNICORN_EXPORT @@ -373,7 +371,7 @@ uc_err uc_mem_write(uc_engine *uc, uint64_t address, const void *_bytes, size_t const uint8_t *bytes = _bytes; if (!check_mem_area(uc, address, size)) - return UC_ERR_WRITE_INVALID; + return UC_ERR_WRITE_UNMAPPED; size_t count = 0, len; @@ -404,7 +402,7 @@ uc_err uc_mem_write(uc_engine *uc, uint64_t address, const void *_bytes, size_t if (count == size) return UC_ERR_OK; else - return UC_ERR_WRITE_INVALID; + return UC_ERR_WRITE_UNMAPPED; } #define TIMEOUT_STEP 2 // microseconds @@ -842,15 +840,15 @@ static uc_err _hook_mem_invalid(struct uc_struct* uc, int type, uc_cb_eventmem_t uc->hook_callbacks[i].callback = callback; uc->hook_callbacks[i].user_data = user_data; *evh = i; - if (type & UC_HOOK_MEM_READ_INVALID) + if (type & UC_HOOK_MEM_READ_UNMAPPED) uc->hook_mem_read_idx = i; if (type & UC_HOOK_MEM_READ_PROT) uc->hook_mem_read_prot_idx = i; - if (type & UC_HOOK_MEM_WRITE_INVALID) + if (type & UC_HOOK_MEM_WRITE_UNMAPPED) uc->hook_mem_write_idx = i; if (type & UC_HOOK_MEM_WRITE_PROT) uc->hook_mem_write_prot_idx = i; - if (type & UC_HOOK_MEM_FETCH_INVALID) + if (type & UC_HOOK_MEM_FETCH_UNMAPPED) uc->hook_mem_fetch_idx = i; if (type & UC_HOOK_MEM_FETCH_PROT) uc->hook_mem_fetch_prot_idx = i; @@ -940,14 +938,14 @@ uc_err uc_hook_add(uc_engine *uc, uc_hook *hh, int type, void *callback, void *u va_start(valist, user_data); - if (type & UC_HOOK_MEM_READ_INVALID) - ret = _hook_mem_invalid(uc, UC_HOOK_MEM_READ_INVALID, callback, user_data, hh); + if (type & UC_HOOK_MEM_READ_UNMAPPED) + ret = _hook_mem_invalid(uc, UC_HOOK_MEM_READ_UNMAPPED, callback, user_data, hh); - if (type & UC_HOOK_MEM_WRITE_INVALID) - ret = _hook_mem_invalid(uc, UC_HOOK_MEM_WRITE_INVALID, callback, user_data, hh); + if (type & UC_HOOK_MEM_WRITE_UNMAPPED) + ret = _hook_mem_invalid(uc, UC_HOOK_MEM_WRITE_UNMAPPED, callback, user_data, hh); - if (type & UC_HOOK_MEM_FETCH_INVALID) - ret = _hook_mem_invalid(uc, UC_HOOK_MEM_FETCH_INVALID, callback, user_data, hh); + if (type & UC_HOOK_MEM_FETCH_UNMAPPED) + ret = _hook_mem_invalid(uc, UC_HOOK_MEM_FETCH_UNMAPPED, callback, user_data, hh); if (type & UC_HOOK_MEM_READ_PROT) ret = _hook_mem_invalid(uc, UC_HOOK_MEM_READ_PROT, callback, user_data, hh); From f62418fc073c1dfe086624122ec48ecb9cfe07a0 Mon Sep 17 00:00:00 2001 From: Sean Heelan Date: Sat, 3 Oct 2015 12:22:41 +0700 Subject: [PATCH 15/16] Regression test for issue #161 --- tests/regress/ensure_typedef_consts_generated.py | 6 ++++++ 1 file changed, 6 insertions(+) create mode 100644 tests/regress/ensure_typedef_consts_generated.py diff --git a/tests/regress/ensure_typedef_consts_generated.py b/tests/regress/ensure_typedef_consts_generated.py new file mode 100644 index 0000000..5c5adf4 --- /dev/null +++ b/tests/regress/ensure_typedef_consts_generated.py @@ -0,0 +1,6 @@ +import unicorn + +try: + unicorn.UC_HOOK_MEM_UNMAPPED +except AttributeError: + assert(False and "Definition for UC_HOOK_MEM_UNMAPPED not generated") From fd6b510038232eea02b23d5fdb82b5cf002667e2 Mon Sep 17 00:00:00 2001 From: Sean Heelan Date: Sat, 3 Oct 2015 12:36:17 +0700 Subject: [PATCH 16/16] Added a comment explaining what is being tested for --- tests/regress/ensure_typedef_consts_generated.py | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/tests/regress/ensure_typedef_consts_generated.py b/tests/regress/ensure_typedef_consts_generated.py index 5c5adf4..186cbc4 100644 --- a/tests/regress/ensure_typedef_consts_generated.py +++ b/tests/regress/ensure_typedef_consts_generated.py @@ -1,3 +1,10 @@ +"""See https://github.com/unicorn-engine/unicorn/issues/161 + +Ensure that constants which are specified via a typedef, rather than an enum, +are included in the bindings by the script for autogenerating mappings for +constants. +""" + import unicorn try: