def main():
mu = Uc(UC_ARCH_ARM, UC_MODE_THUMB)
mu.last_instr = ""
setup_hooks(mu)
load_mem(mu, 0x9FD6, 0x9FF8 - 0x9FD6)
load_mem(mu, 0x35000, 0x4000)
sram_addr = 0x20000000 & PAGE_MASK
sram_size = ((0x40000) & PAGE_MASK) + PAGE_SIZE
mu.mem_map(sram_addr, sram_size)
setup_stack(mu)
# mu.reg_write(UC_ARM_REG_R0, gps_cfg['addr'])
print("[Starting Emulation]")
mu.emu_start(0x0369E0 | 1, 0x369FE)
with open("data_0x200000D8_7bc.bin", "wb") as fh:
mem = mu.mem_read(0x200000D8, 0x7BC)
fh.write(mem)
fh.close()
print("[Done]")
def run():
print("Start emulate ARM...")
try:
# 创建虚拟机
mu = Uc(UC_ARCH_ARM, UC_MODE_THUMB)
# 分配内存
ADDRESS = 0x10000
mu.mem_map(ADDRESS, 0x1000)
mu.mem_write(ADDRESS, ARM_CODE)
# 写寄存器
mu.reg_write(UC_ARM_REG_R0, 0x1234)
mu.reg_write(UC_ARM_REG_R2, 0x6789)
mu.reg_write(UC_ARM_REG_R3, 0x3333)
# Hook 代码
mu.hook_add(UC_HOOK_CODE, hook_code, None, ADDRESS, ADDRESS + 0x1000)
# 启动虚拟机
mu.emu_start(ADDRESS, ADDRESS + len(ARM_CODE))
# 获取结果
r0 = mu.reg_read(UC_ARM_REG_R0)
r1 = mu.reg_read(UC_ARM_REG_R1)
print(f">>> R0 = 0x{r0:x}")
print(f">>> R1 = 0x{r1:x}")
except UcError as e:
print(f"Emulate error: {e}")
def test_multiprocess(self):
record = []
def hook(uc, address, size, userdata):
record.append(address)
uc1 = Uc(UC_ARCH_X86, UC_MODE_32)
uc1.hook_add(UC_HOOK_CODE, hook)
uc1.mem_map(0, 0x2000)
uc2 = Uc(UC_ARCH_X86, UC_MODE_32)
uc2.hook_add(UC_HOOK_CODE, hook)
uc2.mem_map(0, 0x2000)
uc1.emu_start(0x1000, 0x1006)
self.assertListEqual(record, [0x1000, 0x1002, 0x1004])
uc2.emu_start(0x1000, 0x1006)
self.assertListEqual(record,
[0x1000, 0x1002, 0x1004, 0x1000, 0x1002, 0x1004])
uc1.reg_write(UC_X86_REG_EAX, 5)
context1 = uc1.context_save()
uc2.reg_write(UC_X86_REG_EAX, 6)
context2 = uc2.context_save()
self.assertEqual(uc1.reg_read(UC_X86_REG_EAX), 5)
self.assertEqual(uc2.reg_read(UC_X86_REG_EAX), 6)
uc2.context_restore(context1)
uc1.context_restore(context2)
self.assertEqual(uc1.reg_read(UC_X86_REG_EAX), 6)
self.assertEqual(uc2.reg_read(UC_X86_REG_EAX), 5)
def load_test_case(self, test_case: TestCase) -> None:
self.test_case = test_case
# create and read a binary
with open(test_case.bin_path, 'rb') as f:
code = f.read()
self.code_end = self.code_start + len(code)
# initialize emulator in x86-64 mode
emulator = Uc(uni.UC_ARCH_X86, uni.UC_MODE_64)
try:
# allocate memory
emulator.mem_map(self.code_start, self.CODE_SIZE)
emulator.mem_map(self.sandbox_base - self.WORKING_MEMORY_SIZE // 2,
self.WORKING_MEMORY_SIZE)
# write machine code to be emulated to memory
emulator.mem_write(self.code_start, code)
# set up callbacks
emulator.hook_add(uni.UC_HOOK_MEM_READ | uni.UC_HOOK_MEM_WRITE, self.trace_mem_access,
self)
emulator.hook_add(uni.UC_HOOK_CODE, self.instruction_hook, self)
self.emulator = emulator
except UcError as e:
LOGGER.error("[X86UnicornModel:load_test_case] %s" % e)
def test_hooks(self):
record = []
def hook(uc, address, size, userdata):
record.append(address)
uc = Uc(UC_ARCH_X86, UC_MODE_32)
uc.mem_map(0, 0x2000)
uc.hook_add(UC_HOOK_CODE, hook)
uc.emu_start(0x1000, 0x1006)
self.assertListEqual(record, [0x1000, 0x1002, 0x1004])
def emulate(data, mode):
try:
stack = 0x90000
uc = Uc(UC_ARCH_X86, mode)
uc.mem_map(stack, 0x1000 * 10)
uc.mem_map(shellcode_code_base, 0x100000)
uc.mem_write(shellcode_code_base, data)
uc.reg_write(UC_X86_REG_ESP, stack + 0x1000)
uc.hook_add(UC_HOOK_CODE, hook_instr, user_data=mode)
uc.emu_start(shellcode_code_base, shellcode_code_base + len(data), 0,
shellcode_limit)
except unicorn.UcError:
pass
def test_setip_after_emustop(self):
record = []
uc = Uc(UC_ARCH_X86, UC_MODE_32)
def hook(uc, address, size, userdata):
record.append(address)
def hook_stop(uc, address, size, userdata):
if address == 0x1002:
uc.emu_stop()
uc.reg_write(UC_X86_REG_EIP, 0x1006)
uc.mem_map(0, 0x2000)
uc.hook_add(UC_HOOK_CODE, hook)
uc.hook_add(UC_HOOK_CODE, hook_stop)
uc.emu_start(0x1000, 0x1008)
self.assertListEqual(record, [0x1000, 0x1002, 0x1006])
def load_mem(mu: Uc, addr, size):
filename = "7.4AT-02+V2.001.EFM.bin"
data = None
with open(filename, "rb") as fh:
fh.seek(addr)
data = fh.read(size)
_addr = addr & PAGE_MASK
_size = ((size) & PAGE_MASK) + PAGE_SIZE
print(f"[+] Mapping Memory:\n\tAddress: {_addr:08X}\n\tSize: {_size:X}")
mu.mem_map(_addr, _size)
load_addr = addr
load_size = size
print(
f"[>] Loading Memory:\n\tAddress: {load_addr:08X}\n\tSize: {load_size:X}"
)
mu.mem_write(load_addr, data)
def test_exception_in_hook(self):
uc = Uc(UC_ARCH_X86, UC_MODE_64)
uc.mem_map(CODE_ADDR, 0x1000)
uc.mem_write(CODE_ADDR, CODE)
counter = HookCounter()
uc.hook_add(UC_HOOK_CODE,
counter.good_code_hook,
begin=CODE_ADDR,
end=CODE_ADDR + len(CODE))
uc.hook_add(UC_HOOK_CODE,
counter.bad_code_hook,
begin=CODE_ADDR,
end=CODE_ADDR + len(CODE))
self.assertRaises(ValueError, uc.emu_start, CODE_ADDR,
CODE_ADDR + len(CODE))
# Make sure hooks calls finish before raising (hook_calls == 2)
self.assertEqual(counter.hook_calls, 2)
class Emulator:
"""
:type filename str
:type mu Uc
:type memory Memory
"""
def __init__(self):
# Initialize unicorn.
self.mu = Uc(UC_ARCH_ARM, UC_MODE_ARM)
# Initialize stack.
self.mu.mem_map(config.STACK_ADDR, config.STACK_SIZE)
self.mu.reg_write(UC_ARM_REG_SP, config.STACK_ADDR + config.STACK_SIZE)
self.modules = Modules(self)
self.memory = Memory(self)
def load_library(self, filename):
return self.modules.load_module(filename)
def map_page(self, uc: Uc, addr: int) -> None:
"""
Maps a page at addr in the harness, asking probe_wrapper.
:param uc: The unicore
:param addr: The address
"""
page_size = self.config.PAGE_SIZE
base_address = self.get_base(addr)
if base_address not in self._mapped_page_cache.keys():
input_file_name = os.path.join(self.requestdir,
"{:016x}".format(addr))
dump_file_name = os.path.join(self.statedir,
"{:016x}".format(base_address))
if os.path.isfile(dump_file_name + REJECTED_ENDING):
print("CAN I HAZ EXPLOIT?")
os.kill(os.getpid(), signal.SIGSEGV)
if not os.path.isfile(dump_file_name):
open(input_file_name, "a").close()
print("mapping {}".format(hex(base_address)))
while 1:
try:
if os.path.isfile(dump_file_name + REJECTED_ENDING):
print("CAN I HAZ EXPLOIT?")
os.kill(os.getpid(), signal.SIGSEGV)
with open(dump_file_name, "rb") as f:
content = f.read()
if len(content) < page_size:
time.sleep(0.001)
continue
self._mapped_page_cache[base_address] = content
uc.mem_map(base_address, len(content))
uc.mem_write(base_address, content)
self.set_exits(uc, base_address, self.exits)
return
except IOError:
pass
except UcError as ex:
return
except Exception as ex: # todo this should never happen if we don't map like idiots
print(
"map_page_blocking failed: base address=0x{:016x} ({})"
.format(base_address, ex))
def test_x86_64_syscall(self):
print("Emulate x86_64 code with 'syscall' instruction")
ADDRESS = 0x1000000
X86_CODE64_SYSCALL = b"\x0f\x05" # SYSCALL
# Initialize emulator in X86-64bit mode
mu = Uc(UC_ARCH_X86, UC_MODE_64)
# map 2MB memory for this emulation
mu.mem_map(ADDRESS, 2 * 1024 * 1024)
# write machine code to be emulated to memory
mu.mem_write(ADDRESS, X86_CODE64_SYSCALL)
def hook_syscall(mu, user_data):
rax = mu.reg_read(UC_X86_REG_RAX)
if rax == 0x100:
mu.reg_write(UC_X86_REG_RAX, 0x200)
else:
print("ERROR: was not expecting rax=%d in syscall" % rax)
# hook interrupts for syscall
mu.hook_add(UC_HOOK_INSN, hook_syscall, None, 1, 0, UC_X86_INS_SYSCALL)
# syscall handler is expecting rax=0x100
mu.reg_write(UC_X86_REG_RAX, 0x100)
try:
# emulate machine code in infinite time
mu.emu_start(ADDRESS, ADDRESS + len(X86_CODE64_SYSCALL))
except UcError as e:
print("ERROR: %s" % e)
# now print out some registers
print(">>> Emulation done. Below is the CPU context")
rax = mu.reg_read(UC_X86_REG_RAX)
print(">>> RAX = 0x%x" % rax)
class CPU:
def __init__(self,
firmware: Firmware = None,
state: CpuState = None,
verbose=0,
init=True):
self.firmware = firmware
self.uc = Uc(UC_ARCH_ARM, UC_MODE_THUMB)
self.cs = Cs(CS_ARCH_ARM, CS_MODE_THUMB)
self.cs.detail = True
self.state = state
self.has_error = None
self.last_addr = None
self.ready = False
self.context = None
self.verbose = verbose
if init:
self.init()
def init(self):
if self.firmware:
self.firmware.refresh()
self.state.verify()
self.init_memory()
self.init_hook()
self.init_firmware()
self.context = self.uc.context_save()
self.reset()
self.ready = True
def init_firmware(self):
if not self.firmware:
raise Exception("firmware missing error")
addr = MemoryMap.FLASH.address
self.uc.mem_write(addr, self.firmware.buffer)
def reset(self):
addr = MemoryMap.FLASH.address
self.uc.context_restore(self.context)
self.uc.reg_write(UC_ARM_REG_PC,
from_bytes(self.uc.mem_read(addr + 4, 4)))
def run(self):
if not self.ready:
raise Exception("init() does not called")
INST_SIZE = 2
if self.firmware:
self.last_func = self.firmware.text_map[self.uc.reg_read(
UC_ARM_REG_PC)]
if self.verbose >= 2:
print(self.last_func)
try:
while self.step():
pass
except UcError as e:
print("ERROR:", e)
addr = self.uc.reg_read(UC_ARM_REG_PC)
self.debug_addr(addr - INST_SIZE * 8 - 2, count=7)
print(">", end=" ")
self.debug_addr(addr)
self.debug_addr(addr + INST_SIZE, count=7)
for reg in REGS:
uc_value = self.uc.reg_read(reg)
print(REGS_NAME[reg].ljust(5), hex32(uc_value), sep='\t')
raise
def step(self, count=None):
addr = self.uc.reg_read(UC_ARM_REG_PC)
cycle = self.state.cycle
if count is not None:
self.state.cycle = count
try:
self.uc.emu_start(addr | 1, MemoryMap.FLASH.address_until, 0,
self.state.cycle)
finally:
if count is not None:
self.state.cycle = cycle
if self.has_error:
raise UcError(0)
return True
def init_memory(self):
for region in MemoryMap: # type: MemoryRegion
self.uc.mem_map(region.address, region.size, region.uc_mode)
def init_hook(self):
peripheral = MemoryMap.PERIPHERAL
self.uc.hook_add(
UC_HOOK_MEM_READ,
self.hook_peripheral_read,
None,
peripheral.address,
peripheral.address_until,
)
self.uc.hook_add(UC_HOOK_MEM_WRITE, self.hook_peripheral_write, None,
peripheral.address, peripheral.address_until)
self.uc.hook_add(
UC_HOOK_MEM_READ_UNMAPPED | UC_HOOK_MEM_WRITE_UNMAPPED,
self.hook_unmapped)
self.uc.hook_add(
UC_HOOK_INTR,
self.hook_intr,
)
if self.verbose >= 2:
self.uc.hook_add(UC_HOOK_CODE, self.hook_inst)
def hook_intr(self, uc: Uc, intno, user_data):
# self.debug_addr(uc.reg_read(UC_ARM_REG_PC) - 40, 40)
if intno == 2:
swi = from_bytes(uc.mem_read(uc.reg_read(UC_ARM_REG_PC) - 2, 1))
r0 = uc.reg_read(UC_ARM_REG_R0)
r1 = uc.reg_read(UC_ARM_REG_R1)
r2 = uc.reg_read(UC_ARM_REG_R2)
r3 = uc.reg_read(UC_ARM_REG_R3)
if swi == 0:
print("done?")
print(intno, swi, ":", uc.reg_read(UC_ARM_REG_R0),
uc.reg_read(UC_ARM_REG_R1), uc.reg_read(UC_ARM_REG_R2),
uc.reg_read(UC_ARM_REG_R3))
uc.reg_write(UC_ARM_REG_R0, 16)
uc.reg_write(UC_ARM_REG_R1, 32)
uc.reg_write(UC_ARM_REG_R2, 48)
uc.reg_write(UC_ARM_REG_R3, 64)
elif swi == 1:
# TODO: address and size vaild required?
buffer = uc.mem_read(r0, r1).decode('utf-8', 'replace')
if self.state.write_to_stdout:
print("API_REQ", buffer)
self.api_response("hello")
self.uc.emu_stop()
else:
self.has_error = True
self.uc.emu_stop()
def api_response(self, *args):
bufs = json.dumps(args)
buf = bufs.encode("utf-8")
if self.state.write_to_stdout:
print("API_RES", buf)
self.uc.mem_write(MemoryMap.SYSCALL_BUFFER.address, buf)
self.uc.mem_write(MemoryMap.SYSCALL_BUFFER.address + len(buf), b'\0')
self.uc.reg_write(UC_ARM_REG_R0, MemoryMap.SYSCALL_BUFFER.address)
self.uc.reg_write(UC_ARM_REG_R1, len(buf))
def hook_peripheral_read(self, uc: Uc, access, address, size, value, data):
if address == PeripheralAddress.OP_CON_RAM_SIZE:
uc.mem_write(address, to_bytes(self.state.ram_size))
elif address == PeripheralAddress.OP_IO_RXR:
if self.state.input_buffer:
uc.mem_write(address, to_bytes(self.state.input_buffer.pop(0)))
else:
uc.mem_write(address, to_bytes(0))
elif address == PeripheralAddress.OP_RTC_TICKS_MS:
pass
# uc.mem_write(address, to_bytes(int((time.time() - self.state.epoch) * 1000)))
else:
if self.verbose >= 1:
print("read", access, hex(address), size, value, data)
def hook_peripheral_write(self, uc: Uc, access, address, size, value,
data):
if address == PeripheralAddress.OP_CON_PENDING:
if self.verbose >= 1:
print("OPENPYTHON_CONTROLLER_PENDING", value)
elif address == PeripheralAddress.OP_CON_EXCEPTION:
if self.verbose >= 1:
print("OPENPYTHON_CONTROLLER_EXCEPTION", value)
elif address == PeripheralAddress.OP_CON_INTR_CHAR:
if self.verbose >= 1:
print("OPENPYTHON_CONTROLLER_INTR_CHAR", value)
elif address == PeripheralAddress.OP_IO_TXR:
self.state.output_storage.append(value)
if self.state.write_to_stdout:
print(chr(value), end="")
sys.stdout.flush()
else:
if self.verbose >= 1:
print("write", access, hex(address), size, value, data)
def hook_unmapped(self, uc: Uc, access, address, size, value, data):
print("unmapped:", access, hex(address), size, value, data)
uc.emu_stop()
self.has_error = True
def hook_inst(self, uc: Uc, address, size, data):
func = None
if self.firmware:
func = self.firmware.text_map[address]
if func in HELPER_FUNCTIONS:
return
if self.last_func != func:
self.last_func = func
print("#inst", hex(address), func)
self.last_addr = address
def report_memory(self):
total_size = 0
for mem_start, mem_end, perm in self.uc.mem_regions():
total_size += mem_end - mem_start
print("memory:", hex(mem_start), hex(mem_end - mem_start), perm)
print("memory total:", total_size / 1024, "kb")
INST_SIZE = 2
def debug_addr(self, addr, count=1, *, end="\n"):
INST_SIZE = 4
try:
for inst in self.cs.disasm(
self.uc.mem_read(addr, INST_SIZE * count), addr,
count): # type: CsInsn
if self.firmware:
print(self.firmware.text_map[inst.address], end=" ")
print(hex(inst.address),
hex(from_bytes(inst.bytes)),
inst.mnemonic,
inst.op_str,
end=end)
except UcError as exc:
if exc.errno == UC_ERR_READ_UNMAPPED:
print("fail to read memory", hex(addr))
def debug_addr_bin(self, addr, count=1):
INST_SIZE = 4
try:
for inst in self.cs.disasm(
self.uc.mem_read(addr, INST_SIZE * count), addr,
count): # type: CsInsn
if self.firmware:
print(self.firmware.text_map[inst.address], end=" ")
if len(inst.bytes) != 2:
raise Exception(
f"len(inst) != 2; {inst.bytes} => {inst.mnemonic} {inst.op_str}"
)
bcode = bin(from_bytes(inst.bytes))[2:].zfill(16)
print(hex(inst.address), bcode[0:4], bcode[4:8], bcode[8:12],
bcode[12:16], inst.mnemonic, inst.op_str)
except UcError as exc:
if exc.errno == UC_ERR_READ_UNMAPPED:
print("fail to read memory", hex(addr))
class Emulator:
"""
:type mu Uc
:type modules Modules
:type memory Memory
"""
def __init__(self, vfs_root=None, vfp_inst_set=False):
# Unicorn.
self.mu = Uc(UC_ARCH_ARM, UC_MODE_ARM)
if vfp_inst_set:
self._enable_vfp()
# Android
self.system_properties = {"libc.debug.malloc.options": ""}
# Stack.
self.mu.mem_map(config.STACK_ADDR, config.STACK_SIZE)
self.mu.reg_write(UC_ARM_REG_SP, config.STACK_ADDR + config.STACK_SIZE)
# Executable data.
self.modules = Modules(self)
self.memory = Memory(self)
# CPU
self.interrupt_handler = InterruptHandler(self.mu)
self.syscall_handler = SyscallHandlers(self.interrupt_handler)
self.syscall_hooks = SyscallHooks(self.mu, self.syscall_handler)
# File System
if vfs_root is not None:
self.vfs = VirtualFileSystem(vfs_root, self.syscall_handler)
else:
self.vfs = None
# Hooker
self.mu.mem_map(config.HOOK_MEMORY_BASE, config.HOOK_MEMORY_SIZE)
self.hooker = Hooker(self, config.HOOK_MEMORY_BASE,
config.HOOK_MEMORY_SIZE)
# JavaVM
self.java_classloader = JavaClassLoader()
self.java_vm = JavaVM(self, self.java_classloader, self.hooker)
# Native
self.native_memory = NativeMemory(self.mu, config.HEAP_BASE,
config.HEAP_SIZE,
self.syscall_handler)
self.native_hooks = NativeHooks(self, self.native_memory, self.modules,
self.hooker)
# Tracer
self.tracer = Tracer(self.mu, self.modules)
# https://github.com/unicorn-engine/unicorn/blob/8c6cbe3f3cabed57b23b721c29f937dd5baafc90/tests/regress/arm_fp_vfp_disabled.py#L15
def _enable_vfp(self):
# MRC p15, #0, r1, c1, c0, #2
# ORR r1, r1, #(0xf << 20)
# MCR p15, #0, r1, c1, c0, #2
# MOV r1, #0
# MCR p15, #0, r1, c7, c5, #4
# MOV r0,#0x40000000
# FMXR FPEXC, r0
code = '11EE501F'
code += '41F47001'
code += '01EE501F'
code += '4FF00001'
code += '07EE951F'
code += '4FF08040'
code += 'E8EE100A'
# vpush {d8}
code += '2ded028b'
address = 0x1000
mem_size = 0x1000
code_bytes = bytes.fromhex(code)
try:
self.mu.mem_map(address, mem_size)
self.mu.mem_write(address, code_bytes)
self.mu.reg_write(UC_ARM_REG_SP, address + mem_size)
self.mu.emu_start(address | 1, address + len(code_bytes))
finally:
self.mu.mem_unmap(address, mem_size)
def _call_init_array(self):
pass
def load_library(self, filename, do_init=True):
libmod = self.modules.load_module(filename)
if do_init:
logger.debug("Calling Init for: %s " % filename)
for fun_ptr in libmod.init_array:
logger.debug("Calling Init function: %x " % fun_ptr)
self.call_native(fun_ptr)
return libmod
def call_symbol(self, module, symbol_name, *argv):
symbol = module.find_symbol(symbol_name)
if symbol is None:
logger.error('Unable to find symbol \'%s\' in module \'%s\'.' %
(symbol_name, module.filename))
return
self.call_native(symbol.address, *argv)
def call_native(self, addr, *argv):
# Detect JNI call
is_jni = False
if len(argv) >= 1:
is_jni = argv[0] == self.java_vm.address_ptr or argv[
0] == self.java_vm.jni_env.address_ptr
# TODO: Write JNI args to local ref table if jni.
try:
# Execute native call.
native_write_args(self, *argv)
stop_pos = randint(HOOK_MEMORY_BASE,
HOOK_MEMORY_BASE + HOOK_MEMORY_SIZE) | 1
self.mu.reg_write(UC_ARM_REG_LR, stop_pos)
self.mu.emu_start(addr, stop_pos - 1)
# Read result from locals if jni.
if is_jni:
result_idx = self.mu.reg_read(UC_ARM_REG_R0)
result = self.java_vm.jni_env.get_local_reference(result_idx)
if result is None:
return result
return result.value
finally:
# Clear locals if jni.
if is_jni:
self.java_vm.jni_env.clear_locals()
def dump(self, out_dir):
os.makedirs(out_dir)
for begin, end, prot in [reg for reg in self.mu.mem_regions()]:
filename = "{:#010x}-{:#010x}.bin".format(begin, end)
pathname = os.path.join(out_dir, filename)
with open(pathname, "w") as f:
f.write(
hexdump.hexdump(self.mu.mem_read(begin, end - begin),
result='return'))
def _init_uc(self, uc: Uc):
uc.mem_map(self._start, self._end - self._start,
UC_PROT_READ | UC_PROT_WRITE)
if p_flags & P_FLAGS.PF_W != 0:
ret |= UC_PROT_WRITE
if p_flags & P_FLAGS.PF_X != 0:
ret |= UC_PROT_EXEC
return ret
load_base = 0
emu = Uc(UC_ARCH_ARM, UC_MODE_LITTLE_ENDIAN)
load_segments = [
x for x in elf.iter_segments() if x.header.p_type == 'PT_LOAD'
]
for segment in load_segments:
fr_addr, size = align(load_base + segment.header.p_vaddr,
segment.header.p_memsz, segment.header.p_align)
emu.mem_map(fr_addr, size, pflags2prot(segment.header.p_flags))
emu.mem_write(load_base + segment.header.p_vaddr, segment.data())
STACK_ADDR = 0x7F000000
STACK_SIZE = 1024 * 1024
start_addr = None
emu.mem_map(STACK_ADDR, STACK_SIZE, UC_PROT_READ | UC_PROT_WRITE)
bss_section_header = elf.get_section_by_name('.bss').header
bss_section_start, bss_section_end = bss_section_header.sh_addr, bss_section_header.sh_addr + bss_section_header.sh_size
data_section_header = elf.get_section_by_name('.data').header
data_section_start, data_section_end = data_section_header.sh_addr, data_section_header.sh_addr + data_section_header.sh_size
def dbg_hook_memory_access(uc: Uc, access, address, size, value, data):
if access == UC_MEM_WRITE:
def setup_stack(mu: Uc):
stack_base = STACK_ADDR - STACK_SIZE
mu.mem_map(stack_base, STACK_SIZE)
mu.reg_write(UC_ARM_REG_SP, STACK_ADDR)
class emu:
"""
Loads ELF file to unicorn, sets watchpoints and stdin
"""
def __init__(self, fname, stdin, watchpoints=[], drcov=True, emulator_base=None, fw_entry_symbol="cont"):
self.stdin = stdin
self.exception = ""
self.uc = Uc(UC_ARCH_ARM, UC_MODE_ARM)
self.fname = fname
self.fd = open(fname, "rb")
self.elf = elffile.ELFFile(self.fd)
self.symbols = {}
self.symbols_reverse = {}
for i in range(self.elf.num_sections()):
sec = self.elf.get_section(i)
if sec.name == ".symtab":
for sym in sec.iter_symbols():
self.symbols[sym.name] = sym.entry["st_value"]
self.symbols_reverse[sym.entry["st_value"]] = sym.name
self.results = []
self.result_id = 0
self.coverage_pc = set()
self.coverage_bb = set()
self.read = set()
self.write = set()
self.trace_initialized = False
self.coverage_activity = {}
self.read_activity = {}
self.write_activity = {}
self.stdout = ""
self.stderr = ""
self.emulator_base_start = None
self.emulator_base_stop = None
if fw_entry_symbol in self.symbols:
self.fw_entry = self.symbols[fw_entry_symbol] # ignore everything until that symbol
else:
self.fw_entry = None
#loading prog headrs
self.state = []
self.segments = []
for i in range(self.elf.num_sections()):
section = self.elf.get_section(i)
if section.header["sh_flags"] & SH_FLAGS.SHF_ALLOC != 0:
addr = section.header["sh_addr"]
size = section.header["sh_size"]
name = section.name
#NOBITS sections contains no data in file
#Will be initialized with zero
if section.header["sh_type"] == "SHT_NOBITS":
data = b"\x00" * size
else:
data = section.data()
print("Found %s @ 0x%x - 0x%x (%d bytes)" % (name, addr, addr+len(data), len(data)))
if emulator_base == addr:
self.emulator_base_start = emulator_base
self.emulator_base_stop = emulator_base + size
self.segments += [(name, addr, size)]
self.state += [(addr, size, data)]
#compute memory map from sections
self.maps = []
if self.emulator_base_start is not None:
self.maps += [(self.emulator_base_start, self.emulator_base_stop)]
self.segments = sorted(self.segments, key=lambda x:x[0])
for name, addr, size in self.segments:
size += addr & 0x3ff
addr = addr & (~0x3ff)
altered = False
for i in range(len(self.maps)):
map_addr, map_size = self.maps[i]
offset = addr - map_addr
if addr >= map_addr and addr <= map_addr + map_size:
self.maps[i] = (map_addr, self.pageresize(max(map_size, offset+size)))
altered = True
if not altered:
self.maps += [(addr, self.pageresize(size))]
for addr, size in self.maps:
print("Mapping 0x%x - 0x%x (%d bytes)" % (addr, addr+size, size))
self.uc.mem_map(addr, size, UC_PROT_ALL)
for addr,size,data in self.state:
print("Loading 0x%x - 0x%x (%d bytes)" % (addr, addr+len(data), len(data)))
self.uc.mem_write(addr, data)
#stack
stack = 0xdead0000
stack_size = 16384
print("Mapping Stack 0x%x - 0x%x (%d bytes)" % (stack, stack+stack_size, stack_size))
self.uc.mem_map(stack, stack_size, UC_PROT_ALL)
self.uc.reg_write(arm_const.UC_ARM_REG_SP, stack + stack_size)
#syscalls
self.uc.hook_add(UC_HOOK_INTR, self.hook_intr, self)
#tracing
self.watchpoints = watchpoints
self.uc.hook_add(UC_HOOK_CODE, self.hook_code, self)
self.uc.hook_add(UC_HOOK_MEM_READ | UC_HOOK_MEM_WRITE, self.hook_mem_access, self)
#prepare drcov file
self.drcov = drcov
if drcov:
self.uc.hook_add(UC_HOOK_BLOCK, self.hook_bb, self)
def pageresize(self, s, pagesize=1024):
if s % pagesize == 0:
return s
return (int(s / pagesize) + 1) * pagesize
"""
We need to emulate read and write for emulation
"""
@staticmethod
def hook_intr(uc, size, self):
#print hex(uc.reg_read(arm_const.UC_ARM_REG_PC))
pc = uc.reg_read(arm_const.UC_ARM_REG_PC)
for name in ["read","write"]:
if self.symbols[name] <= pc and self.symbols[name] + 8 >= pc:
#print name
if name == "read":
fd = uc.reg_read(arm_const.UC_ARM_REG_R0)
target = uc.reg_read(arm_const.UC_ARM_REG_R1)
size = uc.reg_read(arm_const.UC_ARM_REG_R2)
data = self.stdin[:size]
self.stdin = self.stdin[size:]
uc.mem_write(target, data)
self.uc.reg_write(arm_const.UC_ARM_REG_R0, len(data))
elif name == "write":
fd = uc.reg_read(arm_const.UC_ARM_REG_R0)
target = uc.reg_read(arm_const.UC_ARM_REG_R1)
size = uc.reg_read(arm_const.UC_ARM_REG_R2)
data = uc.mem_read(target, size)
if fd == 1:
self.stdout += data.decode("utf-8")
sys.stdout.write(data.decode("utf-8"))
else:
self.stderr += data.decode("utf-8")
sys.stderr.write(data.decode("utf-8"))
else:
print("unknown intr")
"""
Implement memory and code watchpoints
"""
@staticmethod
def hook_bb(uc, address, size, self):
if self.emulator_base_start is not None:
if address >= self.emulator_base_start and address < self.emulator_base_stop:
return
#print(hex(address))
self.coverage_bb.add((address, size))
@staticmethod
def hook_code(uc, address, size, self):
# Unicorn will for some reason giv old register values after a crash
# The last update seems to be on the entry of the bb
self.regs = {}
self.regs["r0"] = self.uc.reg_read(arm_const.UC_ARM_REG_R0)
self.regs["r1"] = self.uc.reg_read(arm_const.UC_ARM_REG_R1)
self.regs["r2"] = self.uc.reg_read(arm_const.UC_ARM_REG_R2)
self.regs["r3"] = self.uc.reg_read(arm_const.UC_ARM_REG_R3)
self.regs["r4"] = self.uc.reg_read(arm_const.UC_ARM_REG_R4)
self.regs["r5"] = self.uc.reg_read(arm_const.UC_ARM_REG_R5)
self.regs["r6"] = self.uc.reg_read(arm_const.UC_ARM_REG_R6)
self.regs["r7"] = self.uc.reg_read(arm_const.UC_ARM_REG_R7)
self.regs["r8"] = self.uc.reg_read(arm_const.UC_ARM_REG_R8)
self.regs["r9"] = self.uc.reg_read(arm_const.UC_ARM_REG_R9)
self.regs["r10"] = self.uc.reg_read(arm_const.UC_ARM_REG_R10)
self.regs["r11"] = self.uc.reg_read(arm_const.UC_ARM_REG_R11)
self.regs["r12"] = self.uc.reg_read(arm_const.UC_ARM_REG_R12)
self.regs["sp"] = self.uc.reg_read(arm_const.UC_ARM_REG_R13)
self.regs["lr"] = self.uc.reg_read(arm_const.UC_ARM_REG_R14)
self.regs["pc"] = self.uc.reg_read(arm_const.UC_ARM_REG_R15)
if self.fw_entry is not None and address & 0xfffffffe == self.fw_entry & 0xfffffffe:
self.trace_init_state()
if self.fw_entry is None and not self.trace_initialized:
self.trace_init_state()
if self.emulator_base_start is not None:
if address >= self.emulator_base_start and address < self.emulator_base_stop:
return
self.coverage_pc.add(address)
if address in self.coverage_activity:
self.coverage_activity[address] += 1
else:
self.coverage_activity[address] = 1
if address in self.watchpoints or address^1 in self.watchpoints:
self.trace_state_change("Execute")
@staticmethod
def hook_mem_access(uc, access, address, size, value, self):
pc = self.uc.reg_read(arm_const.UC_ARM_REG_R15)
if self.emulator_base_start is not None:
if pc >= self.emulator_base_start and pc < self.emulator_base_stop:
return
if access == UC_MEM_WRITE:
self.write.add((pc, address, value))
if address in self.write_activity:
self.write_activity[address] += 1
else:
self.write_activity[address] = 1
else:
self.read.add((pc, address))
if address in self.read_activity:
self.read_activity[address] += 1
else:
self.read_activity[address] = 1
if address in self.watchpoints:
if access == UC_MEM_WRITE:
self.trace_state_change("Write 0x%x" % address)
else:
self.trace_state_change("Read 0x%x" % address)
"""
For each tracepoint that was hit
Dump Registers
Do Memory Dump
"""
def trace_init_state(self):
self.state = []
self.trace_initialized = True
for name, addr, size in self.segments:
data = self.uc.mem_read(addr, size)
#data = list(map(chr, data))
self.state += [(addr, size, data)]
"""
Called if a tracepoint is hit
Will save registers and analyzes changes made im memory
"""
def trace_state_change(self, reason):
print(reason)
new_state = []
memdiff = []
for addr, size, data in self.state:
new_data = self.uc.mem_read(addr, size)
#new_data = list(map(chr, new_data))
if data != new_data:
new = old = ""
for i in range(len(data)):
if data[i] != new_data[i]:
old += "%02x" % data[i]
new += "%02x" % new_data[i]
elif new != "":
memdiff += [(i+addr-len(new), old, new)]
new = old = ""
new_state += [(addr, size, new_data)]
#XXX
memdif_rendered = self.render_mem_diff()
sys.stderr.write(self.stderr)
sys.stderr.write("\n"+memdif_rendered+"\n")
self.state = new_state
# disassemble current instruction
try:
pc = self.regs["pc"]
md = capstone.Cs(capstone.CS_ARCH_ARM, capstone.CS_MODE_THUMB)
instr = list(md.disasm(self.uc.mem_read(pc, 4), pc))[0]
instr = instr.mnemonic + " " + instr.op_str
except:
import traceback; traceback.print_exc()
instr = hexlify(self.uc.mem_read(pc, 4))
# Save tracepoint object
tp = {}
tp["reason"] = reason
tp["regs"] = self.regs
tp["instr"] = instr
tp["memdiff"] = memdiff
tp["memdif_rendered"] = memdif_rendered
tp["stdout"] = self.stdout
tp["stderr"] = self.stderr
tp["resid"] = self.result_id
self.results += [tp]
self.stdout = ""
self.stderr = ""
self.result_id += 1
return [{"regs": self.regs, "memdiff": sorted(memdiff)}]
def render_mem_diff(self, block_size=32):
ret = "----------" + ("-"*(3*block_size+1)) + "\n"
ret += " |\n"
print_dots = False
for addr, size, data in self.state:
new_data = self.uc.mem_read(addr, size)
#new_data = list(map(chr, new_data))
current_offset = 0
#print(len(data), len(new_data), size)
#for each hexdump row
while current_offset < size:
old_row = data[current_offset: current_offset+block_size]
new_row = new_data[current_offset: current_offset+block_size]
#ugly equal comparison
equal = True
for x,y in zip(new_row, old_row):
equal = equal and (x==y)
if not equal:
hex_new = "%8x | " % (addr + current_offset)
hex_old = " | "
symbols = ""
#render diff
for i in range(min(block_size, len(new_row))):
if new_row[i] == old_row[i]:
hex_new += "%02x " % new_row[i]
hex_old += " "
else:
hex_new += "\033[;32m%02x\033[;00m " % new_row[i]
hex_old += "\033[;31m%02x\033[;00m " % old_row[i]
if (addr + current_offset + i) in self.watchpoints:
symbols += " | "
if len("Watchpoint") < 3*i - 1:
symbols += " " * (3*i - len("Watchpoint") - 1)
symbols += "\033[;33mWatchpoint ^^\033[;00m\n"
else:
symbols += " " * i
symbols += "\033[;33m^^ Watchpoint\033[;00m\n"
elif (addr + current_offset + i) in self.symbols_reverse:
name = self.symbols_reverse[addr + current_offset + i]
symbols += " | "
if len(name) < 3*i - 1:
symbols += " " * (3*i - len(name) - 1)
symbols += "%s ^^\n" % name
else:
symbols += " " * i
symbols += "^^ %s\n" % name
ret += hex_new + "\n" + hex_old + "\n"
if len(symbols) > 1:
ret += symbols
print_dots = True
else:
if print_dots:
print_dots = False
ret += " |\n"
ret += " |" + ("-"*(3*block_size+1)) + "\n"
ret += " |\n"
current_offset += block_size
#cleanup end
split = ret.split("\n")
if len(split) <= 3:
return ""
ret = "\n".join(split[:-3]) + "\n"
ret += "----------" + ("-"*(3*block_size+1)) + "\n"
return ret
"""
Run the Emulation
"""
def run(self, timeout=300):
try:
print("running until exit @ 0x%x" % self.symbols["exit"])
self.uc.emu_start(self.elf.header.e_entry, self.symbols["exit"], timeout=timeout*UC_SECOND_SCALE)
self.trace_state_change("Exit")
except KeyboardInterrupt:
sys.exit(1)
except Exception as e:
self.exception = str(e)
print(e)
import traceback; traceback.print_exc()
print(hex(self.uc.reg_read(arm_const.UC_ARM_REG_PC)))
self.trace_state_change(str(e))
# Seems to be broken n lighthouse
def get_drcov(self):
drcov = b"DRCOV VERSION: 2\nDRCOV FLAVOR: drcov\n"
drcov += b"Module Table: version 2, count %d\n" % len(self.state)
drcov += b"Columns: id, base, end, entry, path\n"
for i in range(len(self.state)):
addr, size, _ = self.state[i]
drcov += b"%d, 0x%x, 0x%x, 0x%x, %s\n" % (i, addr, addr+size+1, addr, os.path.basename(self.fname).encode())
drcov += b"BB Table: %d bbs\n" % len(self.coverage_bb)
bb_table = b""
for address, size in self.coverage_bb:
for module_id in range(len(self.state)):
base_addr, module_size, _ = self.state[module_id]
if address >= base_addr and address <= base_addr + module_size:
bb_table += struct.pack("<Ihh", address - base_addr, size, module_id)
break
return drcov + bb_table
def get_tracefile(self):
trace = ""
for address in self.coverage_pc:
trace += "0x%x\n" % address
return trace.encode()
# memory address where emulation starts
ADDRESS = 0x1000000
try:
# Initialize the disassembler in x86 mode
md = Cs(CS_ARCH_X86, CS_MODE_64)
# iterate over each instruction and print it
for instruction in md.disasm(X86_MACHINE_CODE, 0x1000):
print("0x%x:\t%s\t%s" %
(instruction.address, instruction.mnemonic, instruction.op_str))
except CsError as e:
print("Capstone Error: %s" % e)
try:
# Initialize emulator in x86_64 mode
mu = Uc(UC_ARCH_X86, UC_MODE_64)
# map 2MB memory for this emulation
mu.mem_map(ADDRESS, 2 * 1024 * 1024)
# write machine code to be emulated to memory
mu.mem_write(ADDRESS, X86_MACHINE_CODE)
# Set the r0 register in the code to the number of 7
mu.reg_write(UC_X86_REG_RDI, 7)
# emulate code in infinite time & unlimited instructions
mu.emu_start(ADDRESS, ADDRESS + len(X86_MACHINE_CODE))
# now print out the R0 register
print("Emulation done. Below is the result")
rax = mu.reg_read(UC_X86_REG_RAX)
print(">>> RAX = %u" % rax)
except UcError as e:
print("Unicorn Error: %s" % e)
INT_0x80 = b'\xCD\x80'
X86_CODE32 = b''
trip0 = b'\0' * 3
from unicorn import Uc, UC_ARCH_X86, UC_MODE_32, UC_HOOK_INTR
from kernels.linux.x86_32.d7_26_2020.L2_6 import linux_kernel_2_6
mu = Uc(UC_ARCH_X86, UC_MODE_32) # <-------|
# |
Mem_size = 4 * 1024 #<--------------------------------- These are specific to the functionality surrounding assembly parsing and execution.
mu.mem_map(
0, Mem_size
) # | In this case, the kernel is emulated, the assembly pushs data onto a syscall that calls the kernel to
mu.hook_add(
UC_HOOK_INTR, linux_kernel_2_6
) #<---| then call the kernel function with the data and parameters passed to syscall at the assembly level.
def printf(chars_, *va_list):
global mu, INT_0x80, trip0, linux_kernel_2_6
entry_point = 0x0a00
for a in chars_ % va_list:
l = b'\xBA\1' + trip0 + b'\xB9' + eval(
f"b'{chr(a)if hex(a)!='0xa'else''}'"
) + trip0 + b'\xBB\1' + trip0 + b'\xB8\4' + trip0 + INT_0x80
mu.mem_write(entry_point, l)
mu.emu_start(entry_point, entry_point + len(l))
del l
#del [list(map(lambda a: print(chr(a), end=''), chars_ % va_list)).pop()][0] # <-- This version of 'printf' is for when you don't need a kernel during runtime. Plus, it deletes itself after structuring and executing based on size of scope that needed to be addressed.
class Emulator:
"""
:type mu Uc
:type modules Modules
"""
def __init__(self, vfs_root: str = None, vfp_inst_set: bool = False):
# Unicorn.
self.mu = Uc(UC_ARCH_ARM, UC_MODE_ARM)
if vfp_inst_set:
self._enable_vfp()
# Android
self.system_properties = {"libc.debug.malloc.options": ""}
# Stack.
self.mu.mem_map(STACK_ADDR, STACK_SIZE)
self.mu.reg_write(UC_ARM_REG_SP, STACK_ADDR + STACK_SIZE)
# Executable data.
self.modules = Modules(self)
self.memory_manager = MemoryManager(self.mu)
# CPU
self.interrupt_handler = InterruptHandler(self.mu)
self.syscall_handler = SyscallHandlers(self.interrupt_handler)
self.syscall_hooks = SyscallHooks(self.mu, self.syscall_handler, self.modules)
self.syscall_hooks_memory = SyscallHooksMemory(self.mu, self.memory_manager, self.syscall_handler)
# File System
if vfs_root is not None:
self.vfs = VirtualFileSystem(vfs_root, self.syscall_handler)
else:
self.vfs = None
# Hooker
self.mu.mem_map(HOOK_MEMORY_BASE, HOOK_MEMORY_SIZE)
self.hooker = Hooker(self, HOOK_MEMORY_BASE, HOOK_MEMORY_SIZE)
# JavaVM
self.java_classloader = JavaClassLoader()
self.java_vm = JavaVM(self, self.java_classloader, self.hooker)
# Native
self.native_hooks = NativeHooks(self, self.memory_manager, self.modules, self.hooker)
# Tracer
self.tracer = Tracer(self.mu, self.modules)
# Thread.
self._setup_thread_register()
# https://github.com/unicorn-engine/unicorn/blob/8c6cbe3f3cabed57b23b721c29f937dd5baafc90/tests/regress/arm_fp_vfp_disabled.py#L15
def _enable_vfp(self):
# MRC p15, #0, r1, c1, c0, #2
# ORR r1, r1, #(0xf << 20)
# MCR p15, #0, r1, c1, c0, #2
# MOV r1, #0
# MCR p15, #0, r1, c7, c5, #4
# MOV r0,#0x40000000
# FMXR FPEXC, r0
code = '11EE501F'
code += '41F47001'
code += '01EE501F'
code += '4FF00001'
code += '07EE951F'
code += '4FF08040'
code += 'E8EE100A'
# vpush {d8}
code += '2ded028b'
address = 0x1000
mem_size = 0x1000
code_bytes = bytes.fromhex(code)
try:
self.mu.mem_map(address, mem_size)
self.mu.mem_write(address, code_bytes)
self.mu.reg_write(UC_ARM_REG_SP, address + mem_size)
self.mu.emu_start(address | 1, address + len(code_bytes))
finally:
self.mu.mem_unmap(address, mem_size)
def _setup_thread_register(self):
"""
Set up thread register.
This is currently not accurate and just filled with garbage to ensure the emulator does not crash.
https://developer.arm.com/documentation/ddi0211/k/system-control-coprocessor/system-control-coprocessor-register-descriptions/c13--thread-and-process-id-registers
"""
thread_info_size = 64
thread_info = self.memory_manager.allocate(thread_info_size * 5)
thread_info_1 = thread_info + (thread_info_size * 0)
thread_info_2 = thread_info + (thread_info_size * 1)
thread_info_3 = thread_info + (thread_info_size * 2)
thread_info_4 = thread_info + (thread_info_size * 3)
thread_info_5 = thread_info + (thread_info_size * 4)
# Thread name
write_utf8(self.mu, thread_info_5, "AndroidNativeEmu")
# R4
self.mu.mem_write(thread_info_2 + 0x4, int(thread_info_5).to_bytes(4, byteorder='little'))
self.mu.mem_write(thread_info_2 + 0xC, int(thread_info_3).to_bytes(4, byteorder='little'))
# R1
self.mu.mem_write(thread_info_1 + 0x4, int(thread_info_4).to_bytes(4, byteorder='little'))
self.mu.mem_write(thread_info_1 + 0xC, int(thread_info_2).to_bytes(4, byteorder='little'))
self.mu.reg_write(UC_ARM_REG_C13_C0_3, thread_info_1)
def load_library(self, filename, do_init=True):
libmod = self.modules.load_module(filename)
if do_init:
logger.debug("Calling init for: %s " % filename)
for fun_ptr in libmod.init_array:
logger.debug("Calling Init function: %x " % fun_ptr)
self.call_native(fun_ptr, 0, 0, 0)
return libmod
def call_symbol(self, module, symbol_name, *argv, is_return_jobject=True):
symbol = module.find_symbol(symbol_name)
if symbol is None:
logger.error('Unable to find symbol \'%s\' in module \'%s\'.' % (symbol_name, module.filename))
return
return self.call_native(symbol.address, *argv, is_return_jobject=is_return_jobject)
def call_native(self, addr, *argv, is_return_jobject=True):
# Detect JNI call
is_jni = False
if len(argv) >= 1:
is_jni = argv[0] == self.java_vm.address_ptr or argv[0] == self.java_vm.jni_env.address_ptr
# TODO: Write JNI args to local ref table if jni.
try:
# Execute native call.
self.mu.reg_write(UC_ARM_REG_SP, STACK_ADDR + STACK_SIZE)
native_write_args(self, *argv)
stop_pos = randint(HOOK_MEMORY_BASE, HOOK_MEMORY_BASE + HOOK_MEMORY_SIZE) | 1
self.mu.reg_write(UC_ARM_REG_LR, stop_pos)
self.mu.emu_start(addr, stop_pos - 1)
# Read result from locals if jni.
if is_jni and is_return_jobject:
result_idx = self.mu.reg_read(UC_ARM_REG_R0)
result = self.java_vm.jni_env.get_local_reference(result_idx)
if result is None:
return result
return result.value
else:
return self.mu.reg_read(UC_ARM_REG_R0)
finally:
# Clear locals if jni.
if is_jni:
self.java_vm.jni_env.clear_locals()
def dump(self, out_dir):
os.makedirs(out_dir)
for begin, end, prot in [reg for reg in self.mu.mem_regions()]:
filename = "{:#010x}-{:#010x}.bin".format(begin, end)
pathname = os.path.join(out_dir, filename)
with open(pathname, "w") as f:
f.write(hexdump.hexdump(self.mu.mem_read(begin, end - begin), result='return'))
class Emulator:
"""
:type mu Uc
:type modules Modules
:type memory Memory
"""
def __init__(self, vfs_root=None, vfp_inst_set=False):
# Unicorn.
self.mu = Uc(UC_ARCH_ARM, UC_MODE_ARM)
if vfp_inst_set:
self._enable_vfp()
# Stack.
self.mu.mem_map(config.STACK_ADDR, config.STACK_SIZE)
self.mu.reg_write(UC_ARM_REG_SP, config.STACK_ADDR + config.STACK_SIZE)
# Executable data.
self.modules = Modules(self)
self.memory = Memory(self)
# CPU
self.interrupt_handler = InterruptHandler(self.mu)
self.syscall_handler = SyscallHandlers(self.interrupt_handler)
self.syscall_hooks = SyscallHooks(self.mu, self.syscall_handler)
# File System
if vfs_root is not None:
self.vfs = VirtualFileSystem(vfs_root, self.syscall_handler)
else:
self.vfs = None
# Hooker
self.mu.mem_map(config.MEMORY_BASE, config.MEMORY_SIZE)
self.hooker = Hooker(self, config.MEMORY_BASE, config.MEMORY_SIZE)
# JavaVM
self.java_classloader = JavaClassLoader()
self.java_vm = JavaVM(self.java_classloader, self.hooker)
# Native
self.native_memory = NativeMemory(self.mu, config.MEMORY_DYN_BASE,
config.MEMORY_DYN_SIZE,
self.syscall_handler)
self.native_hooks = NativeHooks(self.native_memory, self.modules,
self.hooker)
# https://github.com/unicorn-engine/unicorn/blob/8c6cbe3f3cabed57b23b721c29f937dd5baafc90/tests/regress/arm_fp_vfp_disabled.py#L15
def _enable_vfp(self):
# MRC p15, #0, r1, c1, c0, #2
# ORR r1, r1, #(0xf << 20)
# MCR p15, #0, r1, c1, c0, #2
# MOV r1, #0
# MCR p15, #0, r1, c7, c5, #4
# MOV r0,#0x40000000
# FMXR FPEXC, r0
code = '11EE501F'
code += '41F47001'
code += '01EE501F'
code += '4FF00001'
code += '07EE951F'
code += '4FF08040'
code += 'E8EE100A'
# vpush {d8}
code += '2ded028b'
address = 0x1000
mem_size = 0x1000
code_bytes = bytes.fromhex(code)
try:
self.mu.mem_map(address, mem_size)
self.mu.mem_write(address, code_bytes)
self.mu.reg_write(UC_ARM_REG_SP, address + mem_size)
self.mu.emu_start(address | 1, address + len(code_bytes))
finally:
self.mu.mem_unmap(address, mem_size)
def load_library(self, filename):
return self.modules.load_module(filename)
def call_symbol(self, module, symbol_name, *argv):
symbol = module.find_symbol(symbol_name)
if symbol is None:
logger.error('Unable to find symbol \'%s\' in module \'%s\'.' %
(symbol_name, module.filename))
return
self.call_native(symbol.address, *argv)
def call_native(self, addr, *argv):
# Detect JNI call
is_jni = False
if len(argv) >= 1:
is_jni = argv[0] == self.java_vm.address_ptr or argv[
0] == self.java_vm.jni_env.address_ptr
# TODO: Write JNI args to local ref table if jni.
try:
# Execute native call.
native_write_args(self.mu, *argv)
stop_pos = randint(MEMORY_BASE, MEMORY_BASE + MEMORY_SIZE) | 1
self.mu.reg_write(UC_ARM_REG_LR, stop_pos)
self.mu.emu_start(addr, stop_pos - 1)
# Read result from locals if jni.
if is_jni:
result_idx = self.mu.reg_read(UC_ARM_REG_R0)
result = self.java_vm.jni_env.get_local_reference(result_idx)
if result is None:
return result
return result.value
finally:
# Clear locals if jni.
if is_jni:
self.java_vm.jni_env.clear_locals()
def hook_code(uc, address, size, user_data):
print(f">>> Tracing instruction at 0x{address:x}, run size = 0x{size:x}")
def hook_memory(uc, access, address, size, value, user_data):
pc = uc.reg_read(UC_ARM_REG_PC)
print(f">>> Memory err pc:0x{pc:x} address:0x{address:x}, size:0x{size:x}")
a1 = b'123'
mu = Uc(UC_ARCH_ARM, UC_MODE_THUMB)
# 分配 so 内存
image_base = 0x0
image_size = 0x10000 * 8
mu.mem_map(image_base, image_size)
with open("libnative-lib.so", "rb") as f:
sofile = f.read()
mu.mem_write(image_base, sofile)
# 分配 Stack 内存
stack_base = 0xA0000
stack_size = 0x10000 * 3
stack_top = stack_base + stack_size - 0x4
mu.mem_map(stack_base, stack_size)
mu.reg_write(UC_ARM_REG_SP, stack_top)
# 分配数据内存
data_base = 0xF0000
data_size = 0x10000 * 3
mu.mem_map(data_base, data_size)
class ConcreteUnicornEmulator:
"""
Helper class to emulate instructions in bulk via Unicorn.
---
The regular Unicorn Emulator is used as a fallback for emulating single instructions that don't have their own
implementations in Manticore. This Emulator is instead intended to completely replace Manticore's executor when
operating on purely concrete data.
To use the emulator, register a callback for the will_run event that calls `state.cpu.emulate_until` with an
address at which it should switch back from Unicorn to Manticore. Passing 0 will result in the entire target being
executed concretely.
As a result of the concrete data requirement, this emulator is good for preloading concrete state, but typically
should not be used once symbolic data is introduced. At time of writing, if you try emulate under Unicorn up until
the point where symbolic data is introduced, switch to Manticore, fork states, then switch back, it *definitely*
won't work.
Only supports X86_64 for now.
"""
def __init__(self, cpu):
self._cpu = cpu
self._mem_delta = {}
self.flag_registers = {"CF", "PF", "AF", "ZF", "SF", "IF", "DF", "OF"}
self.write_backs_disabled = False
self._stop_at = None
# Holds key of range (addr, addr + size) and value of permissions
# Key doesn't include permissions because unmap doesn't care about permissions
self.already_mapped: IntervalTree = IntervalTree()
cpu.subscribe("did_write_memory", self.write_back_memory)
cpu.subscribe("did_write_register", self.write_back_register)
cpu.subscribe("did_set_descriptor", self.update_segment)
cpu.subscribe("did_map_memory", self.map_memory_callback)
cpu.subscribe("did_unmap_memory", self.unmap_memory_callback)
cpu.subscribe("did_protect_memory", self.protect_memory_callback)
if self._cpu.arch == CS_ARCH_X86:
self._uc_arch = UC_ARCH_X86
self._uc_mode = {
CS_MODE_32: UC_MODE_32,
CS_MODE_64: UC_MODE_64
}[self._cpu.mode]
else:
raise NotImplementedError(
f"Unsupported architecture: {self._cpu.arch}")
self.reset()
self._emu.hook_add(UC_HOOK_MEM_READ_UNMAPPED, self._hook_unmapped)
self._emu.hook_add(UC_HOOK_MEM_WRITE_UNMAPPED, self._hook_unmapped)
self._emu.hook_add(UC_HOOK_MEM_FETCH_UNMAPPED, self._hook_unmapped)
self._emu.hook_add(UC_HOOK_MEM_WRITE, self._hook_write_mem)
self._emu.hook_add(UC_HOOK_INTR, self._interrupt)
self._emu.hook_add(UC_HOOK_INSN,
self._hook_syscall,
arg1=UC_X86_INS_SYSCALL)
self.registers = set(self._cpu.canonical_registers)
# The last 8 canonical registers of x86 are individual flags; replace with the eflags
self.registers -= self.flag_registers
self.registers.add("EFLAGS")
self.load_state_from_manticore()
def reset(self):
self._emu = Uc(self._uc_arch, self._uc_mode)
self._to_raise = None
def copy_memory(self, address: int, size: int):
"""
Copy the bytes from address to address+size into Unicorn
Used primarily for copying memory maps
:param address: start of buffer to copy
:param size: How many bytes to copy
"""
start_time = time.time()
map_bytes = self._cpu._raw_read(address, size, force=True)
self._emu.mem_write(address, map_bytes)
if time.time() - start_time > 3:
logger.info(
f"Copying {hr_size(size)} map at {address:#x} took {time.time() - start_time} seconds"
)
def load_state_from_manticore(self) -> None:
for reg in self.registers:
val = self._cpu.read_register(reg)
if issymbolic(val):
from ..native.cpu.abstractcpu import ConcretizeRegister
raise ConcretizeRegister(self._cpu,
reg,
"Concretizing for emulation.",
policy="ONE")
if reg in {"FS", "GS"}:
if reg == "FS" and val in self._cpu._segments:
base, limit, perms = self._cpu._segments[val]
self.update_segment(val, base, limit, perms)
continue
logger.debug("Writing {val} into {reg}")
self.msr_write(reg, val)
continue
logger.debug("Writing {val} into {reg}")
self._emu.reg_write(self._to_unicorn_id(reg), val)
for m in self._cpu.memory.maps:
self.map_memory_callback(m.start, len(m), m.perms, m.name, 0,
m.start)
def map_memory_callback(self, address: int, size: int, perms: str,
name: str, offset: int, result: int) -> None:
"""
Catches did_map_memory and copies the mapping into Manticore
"""
begin = address
end = address + size
perms_value = convert_permissions(perms)
# Check for exact match
# Overlap match
if (Interval(begin, end, perms_value) not in self.already_mapped
and not self.already_mapped.overlaps(begin, end)
and not self.already_mapped.envelop(begin, end)):
logger.info(" ".join((
"Mapping Memory @",
hex(address),
":",
hex(address + size),
hr_size(size),
"-",
perms,
"-",
f"{name}:{offset:#x}" if name else "",
"->",
hex(result),
)))
self._emu.mem_map(begin, size, perms_value)
self.already_mapped[begin:end] = perms_value
logger.debug(" ".join((
"Copying Memory @",
hex(address),
hr_size(size),
"-",
perms,
"-",
f"{name}:{offset:#x}" if name else "",
"->",
hex(result),
)))
self.copy_memory(address, size)
self.protect_memory_callback(address, size, perms)
def unmap_memory_callback(self, start, size):
"""Unmap Unicorn maps when Manticore unmaps them"""
# Need this check because our memory events are leaky to internal implementation details
end = start + size
parent_map = self.already_mapped.overlap(start, end)
# Only unmap whole original maps
if (len(parent_map) == 1 and list(parent_map)[0].begin == start
and list(parent_map)[0].end == end):
mask = (1 << 12) - 1
if (start & mask) != 0:
logger.error("Memory to be unmapped is not aligned to a page")
if (size & mask) != 0:
size = ((size >> 12) + 1) << 12
logger.warning("Forcing unmap size to align to a page")
logger.info(f"Unmapping memory from {start:#x} to {start+size:#x}")
self._emu.mem_unmap(start, size)
self.already_mapped.remove_overlap(start, start + size)
else:
logger.debug(
f"Not unmapping because bounds ({start:#x} - {start+size:#x}) are enveloped in existing map:"
)
logger.debug(f"\tParent map(s) {parent_map}")
def protect_memory_callback(self, start, size, perms):
""" Set memory protections in Unicorn correctly """
logger.debug(
f"Changing permissions on {start:#x}:{start+size:#x} to '{perms}'")
self._emu.mem_protect(start, size, convert_permissions(perms))
def get_unicorn_pc(self):
"""Get the program counter from Unicorn regardless of architecture.
Legacy method, since this module only works on x86."""
if self._cpu.arch == CS_ARCH_ARM:
return self._emu.reg_read(UC_ARM_REG_R15)
elif self._cpu.arch == CS_ARCH_X86:
if self._cpu.mode == CS_MODE_32:
return self._emu.reg_read(UC_X86_REG_EIP)
elif self._cpu.mode == CS_MODE_64:
return self._emu.reg_read(UC_X86_REG_RIP)
def _hook_syscall(self, uc, data):
"""
Unicorn hook that transfers control to Manticore so it can execute the syscall
"""
logger.debug(
f"Stopping emulation at {uc.reg_read(self._to_unicorn_id('RIP')):#x} to perform syscall"
)
self.sync_unicorn_to_manticore()
from ..native.cpu.abstractcpu import Syscall
self._to_raise = Syscall()
uc.emu_stop()
def _hook_write_mem(self, uc, _access, address: int, size: int, value: int,
_data) -> bool:
"""
Captures memory written by Unicorn
"""
self._mem_delta[address] = (value, size)
return True
def _hook_unmapped(self, uc, access, address, size, value, _data) -> bool:
"""
We hit an unmapped region; map it into unicorn.
"""
try:
self.sync_unicorn_to_manticore()
logger.warning(
f"Encountered an operation on unmapped memory at {address:#x}")
m = self._cpu.memory.map_containing(address)
self.copy_memory(m.start, m.end - m.start)
except MemoryException as e:
logger.error(
f"Failed to map memory {address:#x}-{address+size:#x}, ({access}): {e}"
)
self._to_raise = e
self._should_try_again = False
return False
self._should_try_again = True
return False
def _interrupt(self, uc, number: int, _data) -> bool:
"""
Handle software interrupt (SVC/INT)
"""
logger.info(f"Caught interrupt: {number}")
from ..native.cpu.abstractcpu import Interruption # prevent circular imports
self._to_raise = Interruption(number)
return True
def _to_unicorn_id(self, reg_name: str) -> int:
if self._cpu.arch == CS_ARCH_ARM:
return globals()["UC_ARM_REG_" + reg_name]
elif self._cpu.arch == CS_ARCH_X86:
# TODO(yan): This needs to handle AF register
custom_mapping = {
"PC": "RIP",
"STACK": "RSP",
"FRAME": "RBP",
"FS_BASE": "FS_BASE"
}
try:
return globals()["UC_X86_REG_" +
custom_mapping.get(reg_name, reg_name)]
except KeyError:
logger.error("Can't find register UC_X86_REG_%s",
str(reg_name))
raise
else:
# TODO(yan): raise a more appropriate exception
raise TypeError
def emulate(self, instruction) -> None:
"""
Wrapper that runs the _step function in a loop while handling exceptions
"""
# The emulation might restart if Unicorn needs to bring in a memory map
# or bring a value from Manticore state.
while True:
# Try emulation
self._should_try_again = False
self._to_raise = None
self._step(instruction)
if not self._should_try_again:
break
def _step(self, instruction, chunksize: int = 0) -> None:
"""
Execute a chunk fo instructions starting from instruction
:param instruction: Where to start
:param chunksize: max number of instructions to execute. Defaults to infinite.
"""
try:
pc = self._cpu.PC
m = self._cpu.memory.map_containing(pc)
if self._stop_at:
logger.info(f"Emulating from {pc:#x} to {self._stop_at:#x}")
self._emu.emu_start(pc,
m.end if not self._stop_at else self._stop_at,
count=chunksize)
except UcError:
# We request re-execution by signaling error; if we we didn't set
# _should_try_again, it was likely an actual error
if not self._should_try_again:
raise
if self._should_try_again:
return
# self.sync_unicorn_to_manticore()
self._cpu.PC = self.get_unicorn_pc()
if self._cpu.PC == self._stop_at:
logger.info(
"Reached emulation target, switching to Manticore mode")
self.sync_unicorn_to_manticore()
self._stop_at = None
self.write_backs_disabled = True
# Raise the exception from a hook that Unicorn would have eaten
if self._to_raise:
from ..native.cpu.abstractcpu import Syscall
if type(self._to_raise) is Syscall:
# NOTE: raises Syscall within sem_SYSCALL
# NOTE: Need to call syscall semantic function due to
# @instruction around SYSCALL
self._cpu.sem_SYSCALL()
logger.info(f"Raising {self._to_raise}")
raise self._to_raise
logger.info(f"Exiting Unicorn Mode at {self._cpu.PC:#x}")
return
def sync_unicorn_to_manticore(self):
"""
Copy registers and written memory back into Manticore
"""
self.write_backs_disabled = True
for reg in self.registers:
val = self._emu.reg_read(self._to_unicorn_id(reg))
self._cpu.write_register(reg, val)
if len(self._mem_delta) > 0:
logger.debug(
f"Syncing {len(self._mem_delta)} writes back into Manticore")
for location in self._mem_delta:
value, size = self._mem_delta[location]
self._cpu.write_int(location, value, size * 8)
self.write_backs_disabled = False
self._mem_delta = {}
def write_back_memory(self, where, expr, size):
""" Copy memory writes from Manticore back into Unicorn in real-time """
if self.write_backs_disabled:
return
if type(expr) is bytes:
self._emu.mem_write(where, expr)
else:
if issymbolic(expr):
data = [
Operators.CHR(Operators.EXTRACT(expr, offset, 8))
for offset in range(0, size, 8)
]
concrete_data = []
for c in data:
if issymbolic(c):
c = chr(SelectedSolver.instance().get_value(
self._cpu.memory.constraints, c))
concrete_data.append(c)
data = concrete_data
else:
data = [
Operators.CHR(Operators.EXTRACT(expr, offset, 8))
for offset in range(0, size, 8)
]
logger.debug(
f"Writing back {hr_size(size // 8)} to {hex(where)}: {data}")
# TODO - the extra encoding is to handle null bytes output as strings when we concretize. That's probably a bug.
self._emu.mem_write(
where, b"".join(
b.encode("utf-8") if type(b) is str else b for b in data))
def write_back_register(self, reg, val):
""" Sync register state from Manticore -> Unicorn"""
if self.write_backs_disabled:
return
if issymbolic(val):
logger.warning("Skipping Symbolic write-back")
return
if reg in self.flag_registers:
self._emu.reg_write(self._to_unicorn_id("EFLAGS"),
self._cpu.read_register("EFLAGS"))
return
self._emu.reg_write(self._to_unicorn_id(reg), val)
def update_segment(self, selector, base, size, perms):
""" Only useful for setting FS right now. """
logger.debug("Updating selector %s to 0x%02x (%s bytes) (%s)",
selector, base, size, perms)
self.write_back_register("FS", selector)
self.write_back_register("FS_BASE", base)
self.msr_write("FS", base)
def msr_write(self, reg, data):
"""
set the hidden descriptor-register fields to the given address.
This enables referencing the fs segment on x86-64.
https://wiki.osdev.org/SWAPGS
"""
magic = {"FS": 0xC0000100, "GS": 0xC0000101}
return self._emu.msr_write(magic[reg], data)
