unicorn
unicorn copied to clipboard
not support CASA instruction on aarch64?
when I emulate Android 12 libc.so scudo::HybridMutex::tryLock
function
error: Unhandled CPU exception (UC_ERR_EXCEPTION)
the instruction is CASA W8, W9, [X0]
.text:0000000000040460 ; __int64 __fastcall scudo::HybridMutex::tryLock(scudo::HybridMutex *__hidden this)
.text:0000000000040460 _ZN5scudo11HybridMutex7tryLockEv ; CODE XREF: scudo::Allocator<scudo::AndroidConfig,&(scudo_malloc_postinit)>::allocate(ulong,scudo::Chunk::Origin,ulong,bool)+11C↓p
.text:0000000000040460 ; scudo::HybridMutex::lock(void)+10↓p ...
.text:0000000000040460 ; __unwind {
.text:0000000000040460 MOV W8, WZR
.text:0000000000040464 MOV W9, #1
.text:0000000000040468 CASA W8, W9, [X0]
.text:000000000004046C CMP W8, #0
.text:0000000000040470 CSET W0, EQ
.text:0000000000040474 RET
.text:0000000000040474 ; } // starts at 40460
.text:0000000000040474 ; End of function scudo::HybridMutex::tryLock(void)
Do you have a PoC?
I use latest qiling dev branch to reproduce that
error instruction is CASAH W10, W9, [X0]
, which at linker64 + 0x98B8C
poc is here, just run python test_android12.py
~~pocdemo.zip~~
I add intno
to print for error, intno is 1
which means undefined instruction (?)
this is my question, thank you.
File "/home/kali/Desktop/qiling/qiling/core_hooks.py", line 130, in _hook_intr_cb
raise QlErrorCoreHook(f"_hook_intr_cb : not handled {intno}")
qiling.exception.QlErrorCoreHook: _hook_intr_cb : not handled 1
ctl_set_cpu_model CPU_AARCH64_MAX fix it