unicorn v1.0.3 Bug : IT 指令不能工作

测试代码

sample_arm.cview raw
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
/* Unicorn Emulator Engine */
/* By Nguyen Anh Quynh, 2015 */

/* Sample code to demonstrate how to emulate ARM code */

#include <unicorn/unicorn.h>
#include <string.h>


// code to be emulated
#define THUMB_CODE "\x10\xb5\x4f\xf6\x00\x74\xe8\xbf\x10\xbd"

// memory address where emulation starts

int STACK_MEMORY_BASE = 0x00000000;
int STACK_MEMORY_SIZE = 0x00800000;

int HOOK_MEMORY_BASE = 0x1000000;
int HOOK_MEMORY_SIZE = 0x0800000;



static void hook_code(uc_engine *uc, uint64_t address, uint32_t size, void *user_data)
{
    unsigned char bytes[8];
    char instruction[32] = {0};
    int i = 0;
    uc_mem_read(uc,address,bytes,size);
    for(i = 0; i < size; i++){
      sprintf(instruction + i * 3,"%02x ", bytes[i]);
    }
    printf(">>> Tracing instruction at 0x%"PRIx64 ", instruction size = 0x%x, instruction = %s\n", address, size, instruction);
    
    
}

unsigned char bytes[32];
char instruction[64] = {0};
static void test_thumb(void)
{
    uc_engine *uc;
    uc_err err;
    uc_hook trace2;

    int sp = 1024;     // R0 register
    int code_length;

    printf("Emulate THUMB code\n");

    // Initialize emulator in ARM mode
    err = uc_open(UC_ARCH_ARM, UC_MODE_THUMB, &uc);
    if (err) {
        printf("Failed on uc_open() with error returned: %u (%s)\n",
                err, uc_strerror(err));
        return;
    }

    // map 2MB memory for this emulation
    uc_mem_map(uc, HOOK_MEMORY_BASE, HOOK_MEMORY_SIZE, UC_PROT_ALL);
    uc_mem_map(uc, STACK_MEMORY_BASE, STACK_MEMORY_SIZE, UC_PROT_ALL);

    // write machine code to be emulated to memory
    code_length = sizeof(THUMB_CODE) - 1;
    
    uc_mem_write(uc, HOOK_MEMORY_BASE, THUMB_CODE, code_length);
    

    // initialize machine registers
    int lr = HOOK_MEMORY_BASE + 0x80;
    sp = STACK_MEMORY_BASE + STACK_MEMORY_SIZE;
    uc_reg_write(uc, UC_ARM_REG_SP, &sp);
    printf(">>> SP = 0x%x\n", sp);
    uc_reg_write(uc, UC_ARM_REG_LR, &lr);

    // tracing all basic blocks with customized callback
    //uc_hook_add(uc, &trace1, UC_HOOK_BLOCK, hook_block, NULL, 1, 0);

    // tracing one instruction at ADDRESS with customized callback
    uc_hook_add(uc, &trace2, UC_HOOK_CODE, hook_code, NULL, HOOK_MEMORY_BASE, HOOK_MEMORY_BASE + HOOK_MEMORY_SIZE);

    // emulate machine code in infinite time (last param = 0), or when
    // finishing all the code.
    // Note we start at ADDRESS | 1 to indicate THUMB mode.
    err = uc_emu_start(uc, (HOOK_MEMORY_BASE) | 1, lr, 0, 0);
    if (err) {
        printf("Failed on uc_emu_start() with error returned: %u\n", err);
    }

    // now print out some registers
    printf(">>> Emulation done. Below is the CPU context\n");

    uc_reg_read(uc, UC_ARM_REG_SP, &sp);
    printf(">>> SP = 0x%x\n", sp);

    uc_close(uc);
}

int main(int argc, char **argv, char **envp)
{
    // dynamically load shared library
#ifdef DYNLOAD
    if (!uc_dyn_load(NULL, 0)) {
        printf("Error dynamically loading shared library.\n");
        printf("Please check that unicorn.dll/unicorn.so is available as well as\n");
        printf("any other dependent dll/so files.\n");
        printf("The easiest way is to place them in the same directory as this app.\n");
        return 1;
    }
#endif
    
    // test_arm();
    printf("==========================\n");
    test_thumb();

    // dynamically free shared library
#ifdef DYNLOAD
    uc_dyn_free();
#endif
    
    return 0;
}

V1.0.2 输出

1
2
3
4
5
6
7
8
9
==========================
Emulate THUMB code
>>> SP = 0x800000
>>> Tracing instruction at 0x1000000, instruction size = 0x2, instruction = 10 b5
>>> Tracing instruction at 0x1000002, instruction size = 0x4, instruction = 4f f6 00 74
>>> Tracing instruction at 0x1000006, instruction size = 0x2, instruction = e8 bf
>>> Tracing instruction at 0x1000008, instruction size = 0x2, instruction = 10 bd
>>> Emulation done. Below is the CPU context
>>> SP = 0x800000

V1.0.3 输出

1
2
3
4
5
6
7
8
9
10
11
==========================
Emulate THUMB code
>>> SP = 0x800000
thumb insn: 0xb510
thumb insn: 0xb510 gen_uc_tracecode
thumb2:insn: 0xf64f
thumb insn: 0xbfe8
>>> Tracing instruction at 0x1000000, instruction size = 0x2, instruction = 10 b5
>>> Tracing instruction at 0x1000002, instruction size = 0x4, instruction = 4f f6 00 74
>>> Emulation done. Below is the CPU context
>>> SP = 0x800000

尝试修复

修复的具体进展：issues #1412

笔者通过自己阅读源代码发现，可能是修复 issues #853引入的BUG，代码差异：

qemu/target-arm/translate.c

  • Version 1.0.2

    1
    2
    default:
      gen_uc_tracecode(tcg_ctx, 2, UC_HOOK_CODE_IDX, s->uc, s->pc);

  • Version 1.0.3

    1
    2
    3
    4
    default:
      if (!((insn & 0xff00) == 0xbf00)){
        gen_uc_tracecode(tcg_ctx, 2, UC_HOOK_CODE_IDX, s->uc, s->pc);
      }

但是简单还原为1.0.2的代码，也不能正常运行。期待issues #1412的解决。