unicorn
unicorn copied to clipboard
Handle pathological cases more consistently
These are two changes I've needed to make to make angr work with unicorn 2.
First commit: presently, if we try to execute a non-executable region, the lifting code never checks to see if reads succeed, it just blindly trusts the result. As a consequence, we may execute some non-executable guest code or hooks before checking cpu->exit_request and breaking out of the loop. This fixes that.
Second commit: If you respond to an unmapped memory fault during instruction fetch by mapping the related memory in a callback, qemu will only attempt to lift a single instruction for the current block. This is incredibly annoying (and breaks angr's tests, which are sensitive to block counts and boundaries), so I fixed it.
I have added a third commit which should address my concerns on #1627. This uses the uc->size_recur_mem field, which from what I can tell was completely unused prior to this, to detect whether we are in an unaligned write (which is implementing by a recursive call into the write helper).
I have added a third commit which should address my concerns on #1627. This uses the uc->size_recur_mem field, which from what I can tell was completely unused prior to this, to detect whether we are in an unaligned write (which is implementing by a recursive call into the write helper).
Regarding #1627, could you add a unit test? I assume it should be easy to reproduce?
Pushed!
Idk what's up with the failing test - it passed on my previous commit and I only changed an unrelated testcase. Is it flaky?
Idk what's up with the failing test - it passed on my previous commit and I only changed an unrelated testcase. Is it flaky?
mingw32 runner has some bugs for a while… I really should disable it. Anyway let me rerun and it will be fine.
thanks @wtdcode for directing to this. I try this patch for issue #1041, this patch fixes the write hook, but not for the read hook.
@firodj please try the commit that I just pushed!
@wtdcode I believe this is ready to merge.
It seems that CI is failing on aarch64 and ppc64le platforms. I don't have either of those machines to debug this. How can I proceed?
It seems that CI is failing on aarch64 and ppc64le platforms. I don't have either of those machines to debug this. How can I proceed?
Weird, I can't come up with why your code will fail on these platforms. Maybe any undefined behaviors? Let me re-run it firstly.
Merged and fixed in dev
branch. Thanks!
When performing memory read operation on aarch64 and ppc64, no load_helper
is generated...