import

regress/crash_tb.py

@@ -0,0 +1,32 @@
+#!/usr/bin/python
+
+from unicorn import *
+from unicorn.x86_const import *
+
+
+CODE_ADDR = 0x0
+
+
+binary1 = b'\xb8\x02\x00\x00\x00'
+binary2 = b'\xb8\x01\x00\x00\x00'
+
+mu = Uc(UC_ARCH_X86, UC_MODE_64)
+
+mu.mem_map(CODE_ADDR, 2 * 1024 * 1024)
+
+# write machine code to be emulated to memory
+mu.mem_write(CODE_ADDR, binary1)
+
+# emu for maximum 1 sec.
+mu.emu_start(CODE_ADDR, len(binary1), UC_SECOND_SCALE)
+
+print("RAX = %x" %mu.reg_read(X86_REG_RAX))
+
+# write machine code to be emulated to memory
+mu.mem_write(CODE_ADDR, binary2)
+
+# emu for maximum 1 sec.
+mu.emu_start(CODE_ADDR, len(binary2), UC_SECOND_SCALE)
+
+print("RAX = %x" %mu.reg_read(X86_REG_RAX))
+

regress/hang.py

@@ -0,0 +1,53 @@
+#!/usr/bin/python
+
+from __future__ import print_function
+from unicorn import *
+from unicorn.x86_const import *
+
+
+# callback for tracing instructions
+def hook_code(uc, address, size, user_data):
+    tmp = uc.mem_read(address, size)
+    print("[0x%x] =" %(address), end="")
+    for i in tmp:
+        print(" %02x" %i, end="")
+    print("")
+
+
+# callback for tracing Linux interrupt
+def hook_intr(uc, intno, user_data):
+    # only handle Linux syscall
+    rip = uc.reg_read(X86_REG_RIP)
+    if intno != 0x80:
+        print("=== 0x%x: got interrupt %x, quit" %(rip, intno));
+        uc.emu_stop()
+        return
+
+    eax = uc.reg_read(X86_REG_EAX)
+    print(">>> 0x%x: interrupt 0x%x, EAX = 0x%x" %(rip, intno, eax))
+
+
+binary1 = b'\xeb\x1c\x5a\x89\xd6\x8b\x02\x66\x3d\xca\x7d\x75\x06\x66\x05\x03\x03\x89\x02\xfe\xc2\x3d\x41\x41\x41\x41\x75\xe9\xff\xe6\xe8\xdf\xff\xff\xff\x31\xd2\x6a\x0b\x58\x99\x52\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x52\x53\x89\xe1\xca\x7d\x41\x41\x41\x41\x41\x41\x41\x41'
+
+mu = Uc(UC_ARCH_X86, UC_MODE_64)
+
+mu.mem_map(0, 2 * 1024 * 1024)
+
+# tracing all instructions with customized callback
+mu.hook_add(UC_HOOK_CODE, hook_code)
+
+# handle interrupt ourself
+mu.hook_add(UC_HOOK_INTR, hook_intr)
+
+# setup stack
+mu.reg_write(X86_REG_RSP, 1024 * 1024)
+
+# fill in memory with 0xCC (software breakpoint int 3)
+for i in xrange(1 * 1024):
+    mu.mem_write(0 + i, b'\xcc')
+
+# write machine code to be emulated to memory
+mu.mem_write(0, binary1)
+
+mu.emu_start(0, len(binary1))
+

regress/wrong_rip.py

@@ -0,0 +1,32 @@
+#!/usr/bin/python
+
+from unicorn import *
+from unicorn.x86_const import *
+
+binary1 = b'\xb8\x02\x00\x00\x00'    # mov eax, 2
+binary2 = b'\xb8\x01\x00\x00\x00'    # mov eax, 1
+
+mu = Uc(UC_ARCH_X86, UC_MODE_64)
+
+mu.mem_map(0, 2 * 1024 * 1024)
+
+# write machine code to be emulated to memory
+mu.mem_write(0, binary1 + binary2)
+
+# emu for maximum 1 instruction.
+mu.emu_start(0, 5, 0, 1)
+
+print("RAX = %u" %mu.reg_read(X86_REG_RAX))
+
+pos = mu.reg_read(X86_REG_RIP)
+
+print("RIP = %x" %pos)
+
+mu.emu_start(5, 10, 0, 1)
+
+pos = mu.reg_read(X86_REG_RIP)
+
+print("RIP = %x" %pos)
+
+print("RAX = %u" %mu.reg_read(X86_REG_RAX))
+

regress/wrong_rip2.py

@@ -0,0 +1,32 @@
+#!/usr/bin/python
+
+from unicorn import *
+from unicorn.x86_const import *
+
+binary1 = b'\xb8\x02\x00\x00\x00'    # mov eax, 2
+binary2 = b'\xb8\x01\x00\x00\x00'    # mov eax, 1
+
+mu = Uc(UC_ARCH_X86, UC_MODE_64)
+
+mu.mem_map(0, 2 * 1024 * 1024)
+
+# write machine code to be emulated to memory
+mu.mem_write(0, binary1 + binary2)
+
+# emu for maximum 1 instruction.
+mu.emu_start(0, 10, 0, 1)
+
+print("RAX = %u" %mu.reg_read(X86_REG_RAX))
+
+pos = mu.reg_read(X86_REG_RIP)
+
+print("RIP = %x" %pos)
+
+mu.emu_start(5, 10, 0, 1)
+
+pos = mu.reg_read(X86_REG_RIP)
+
+print("RIP = %x" %pos)
+
+print("RAX = %u" %mu.reg_read(X86_REG_RAX))
+

regress/wrong_rip3.py

@@ -0,0 +1,23 @@
+#!/usr/bin/python
+
+from unicorn import *
+from unicorn.x86_const import *
+
+binary1 = b'\x40\x01\xc1\x31\xf6' # inc eax; add ecx, eax; xor esi, esi
+
+mu = Uc(UC_ARCH_X86, UC_MODE_32)
+
+mu.mem_map(0, 2 * 1024 * 1024)
+
+# write machine code to be emulated to memory
+mu.mem_write(0, binary1)
+
+# emu for maximum 1 instruction.
+mu.emu_start(0, 10, 0, 1)
+
+print("EAX = %u" %mu.reg_read(X86_REG_EAX))
+
+pos = mu.reg_read(X86_REG_EIP)
+
+print("EIP = %x" %pos)
+

regress/wrong_rip4.py

@@ -0,0 +1,32 @@
+#!/usr/bin/python
+
+from unicorn import *
+from unicorn.x86_const import *
+
+binary1 = b'\x40\x01\xc1\x31\xf6\x90\x90\x90' # inc eax; add ecx, eax; xor esi, esi
+
+mu = Uc(UC_ARCH_X86, UC_MODE_32)
+
+mu.mem_map(0, 2 * 1024 * 1024)
+
+# write machine code to be emulated to memory
+mu.mem_write(0, binary1)
+
+pos = 0
+# emu for maximum 1 instruction.
+mu.emu_start(pos, len(binary1), 0, 1)
+
+print("EAX = %u" %mu.reg_read(X86_REG_EAX))
+
+pos = mu.reg_read(X86_REG_EIP)
+
+print("EIP = %x" %pos)
+
+# emu to the end
+mu.emu_start(pos, len(binary1))
+
+print("EAX = %u" %mu.reg_read(X86_REG_EAX))
+
+pos = mu.reg_read(X86_REG_EIP)
+
+print("EIP = %x" %pos)

regress/wrong_rip_arm.py

@@ -0,0 +1,39 @@
+#!/usr/bin/python
+
+from unicorn import *
+from unicorn.x86_const import *
+from unicorn.arm_const import *
+
+# adds  r1, #0x48
+# ldrsb r7, [r7, r7]
+# ldrsh r7, [r2, r1]
+# ldr   r0, [pc, #0x168]
+# cmp   r7, #0xbf
+# str   r7, [r5, #0x20]
+# ldr   r1, [r5, #0x64]
+# strb  r7, [r5, #0xc]
+# ldr   r0, [pc, #0x1a0]
+binary1 = b'\x48\x31\xff\x57\x57\x5e\x5a\x48\xbf\x2f\x2f\x62\x69\x6e\x2f\x73\x68\x48\xc1\xef\x08\x57\x54\x5f\x6a\x3b\x58\x0f\x05'
+binary1 = b'\x48\x31\xff\x57'
+#adds r1, #0x48
+#ldrsb  r7, [r7, r7]
+
+mu = Uc(UC_ARCH_ARM, UC_MODE_THUMB)
+
+mu.mem_map(0, 2 * 1024 * 1024)
+
+# write machine code to be emulated to memory
+mu.mem_write(0, binary1)
+
+mu.reg_write(ARM_REG_R13, 1*1024*1024)
+
+pos = 0
+
+# emu for maximum 1 instruction.
+mu.emu_start(pos, len(binary1), 0, 1)
+
+print("R1 = %x" % mu.reg_read(ARM_REG_R1))
+
+pos = mu.reg_read(ARM_REG_R15)
+
+print("RIP = %x" %pos)