unicorn icon indicating copy to clipboard operation
unicorn copied to clipboard

not support CASA instruction on aarch64?

Open SeeFlowerX opened this issue 2 years ago • 1 comments

when I emulate Android 12 libc.so scudo::HybridMutex::tryLock function

error: Unhandled CPU exception (UC_ERR_EXCEPTION)

the instruction is CASA W8, W9, [X0]

.text:0000000000040460 ; __int64 __fastcall scudo::HybridMutex::tryLock(scudo::HybridMutex *__hidden this)
.text:0000000000040460 _ZN5scudo11HybridMutex7tryLockEv        ; CODE XREF: scudo::Allocator<scudo::AndroidConfig,&(scudo_malloc_postinit)>::allocate(ulong,scudo::Chunk::Origin,ulong,bool)+11C↓p
.text:0000000000040460                                         ; scudo::HybridMutex::lock(void)+10↓p ...
.text:0000000000040460 ; __unwind {
.text:0000000000040460                 MOV             W8, WZR
.text:0000000000040464                 MOV             W9, #1
.text:0000000000040468                 CASA            W8, W9, [X0]
.text:000000000004046C                 CMP             W8, #0
.text:0000000000040470                 CSET            W0, EQ
.text:0000000000040474                 RET
.text:0000000000040474 ; } // starts at 40460
.text:0000000000040474 ; End of function scudo::HybridMutex::tryLock(void)

SeeFlowerX avatar Jul 25 '22 03:07 SeeFlowerX

Do you have a PoC?

wtdcode avatar Jul 26 '22 14:07 wtdcode

I use latest qiling dev branch to reproduce that

error instruction is CASAH W10, W9, [X0], which at linker64 + 0x98B8C

poc is here, just run python test_android12.py

~~pocdemo.zip~~

I add intno to print for error, intno is 1 which means undefined instruction (?)

this is my question, thank you.

  File "/home/kali/Desktop/qiling/qiling/core_hooks.py", line 130, in _hook_intr_cb
    raise QlErrorCoreHook(f"_hook_intr_cb : not handled {intno}")
qiling.exception.QlErrorCoreHook: _hook_intr_cb : not handled 1

SeeFlowerX avatar Aug 11 '22 03:08 SeeFlowerX

ctl_set_cpu_model CPU_AARCH64_MAX fix it

SeeFlowerX avatar Dec 06 '23 06:12 SeeFlowerX