自学教程：C++ uc_open函数代码示例

int main(){    int size;    uint8_t *buf;    uc_engine *uc;    uc_hook uh_trap;    uc_err err = uc_open (UC_ARCH_X86, UC_MODE_64, &uc);    if (err) {        fprintf (stderr, "Cannot initialize unicorn/n");        return 1;    }    size = UC_BUG_WRITE_SIZE;    buf = malloc (size);    if (!buf) {        fprintf (stderr, "Cannot allocate/n");        return 1;    }    memset (buf, 0, size);    if (!uc_mem_map(uc, UC_BUG_WRITE_ADDR, size, UC_PROT_ALL)) {        uc_mem_write(uc, UC_BUG_WRITE_ADDR,                (const uint8_t*)"/xff/xff/xff/xff/xff/xff/xff/xff", 8);    }    uc_hook_add(uc, &uh_trap, UC_HOOK_INTR, _interrupt, NULL, 1, 0);    uc_emu_start(uc, UC_BUG_WRITE_ADDR, UC_BUG_WRITE_ADDR+8, 0, 1);    uc_close(uc);    printf ("Correct: %s/n", got_sigill? "YES": "NO");    return got_sigill? 0: 1;}

int main(int argc, char **argv, char **envp){    uc_engine *uc;    uc_err err;    if(argc<2){      printf("usage: mem_fuzz $seed/n");      return 1;    }    int seed = atoi(argv[1]);     int i = 0;    //don't really care about quality of randomness    srand(seed);    printf("running with seed %d/n",seed);    // Initialize emulator in X86-32bit mode    err = uc_open(UC_ARCH_X86, UC_MODE_64, &uc);    if (err) {        printf("Failed on uc_open() with error returned: %u/n", err);        return 1;    }     for(i = 0; i < 2048; i++){      step++;      perform_fuzz_step(uc);    }    // fill in sections that shouldn't get touched    if (uc_close(uc) != UC_ERR_OK) {        printf("Failed on uc_close/n");        return 1;    }    return 0;}

// emulate code that jumps to invalid memorystatic void test_i386_jump_invalid(void **state){    uc_engine *uc;    uc_err err;    static const uint64_t address = 0x1000000;    static const uint8_t code[] = {        0xE9, 0xE9, 0xEE, 0xEE, 0xEE,   // jmp 0xEEEEEEEE    };    // Initialize emulator in X86-32bit mode    err = uc_open(UC_ARCH_X86, UC_MODE_32, &uc);    uc_assert_success(err);    // map 2MB memory for this emulation    err = uc_mem_map(uc, address, 2 * 1024 * 1024, UC_PROT_ALL);    uc_assert_success(err);    // write machine code to be emulated to memory    err = uc_mem_write(uc, address, code, sizeof(code));    uc_assert_success(err);    // emulate machine code in infinite time    err = uc_emu_start(uc, address, address+sizeof(code), 0, 0);    uc_assert_err(UC_ERR_FETCH_UNMAPPED, err);    uc_assert_success(uc_close(uc));}

/* Called before every test to set up a new instance */static int setup(void **state){    uc_engine *uc;    uc_assert_success(uc_open(UC_ARCH_X86, UC_MODE_64, &uc));    *state = uc;    return 0;}

/* Called before every test to set up a new instance */static int setup32(void **state){    uc_engine *uc;    OK(uc_open(UC_ARCH_X86, UC_MODE_32, &uc));    *state = uc;    return 0;}

int main(int argc, char **argv, char **envp){    uc_engine *uc;    uc_hook trace1, trace2;    uc_err err;    uint32_t eax, ebx;        printf("Memory protections test/n");    // Initialize emulator in X86-32bit mode    err = uc_open(UC_ARCH_X86, UC_MODE_32, &uc);    if (err) {        printf("Failed on uc_open() with error returned: %u/n", err);        return 1;    }    uc_mem_map(uc, 0x100000, 0x1000, UC_PROT_READ);    uc_mem_map(uc, 0x300000, 0x1000, UC_PROT_READ | UC_PROT_WRITE);    uc_mem_map(uc, 0x400000, 0x1000, UC_PROT_WRITE);        // write machine code to be emulated to memory    if (uc_mem_write(uc, 0x100000, PROGRAM, sizeof(PROGRAM))) {        printf("Failed to write emulation code to memory, quit!/n");        return 2;    } else {        printf("Allowed to write to read only memory via uc_mem_write/n");    }    uc_mem_write(uc, 0x300000, (const uint8_t*)"/x41/x41/x41/x41", 4);    uc_mem_write(uc, 0x400000, (const uint8_t*)"/x42/x42/x42/x42", 4);    //uc_hook_add(uc, &trace2, UC_HOOK_CODE, hook_code, NULL, (uint64_t)0x400000, (uint64_t)0x400fff);    // intercept invalid memory events    uc_hook_add(uc, &trace1, UC_MEM_READ_PROT, hook_mem_invalid, NULL);    // emulate machine code in infinite time    printf("BEGIN execution/n");    err = uc_emu_start(uc, 0x100000, 0x100000 + sizeof(PROGRAM), 0, 2);    if (err) {        printf("Expected failure on uc_emu_start() with error returned %u: %s/n",                err, uc_strerror(err));    } else {        printf("UNEXPECTED uc_emu_start returned UC_ERR_OK/n");    }    printf("END execution/n");    uc_reg_read(uc, UC_X86_REG_EAX, &eax);    printf("Final eax = 0x%x/n", eax);    uc_reg_read(uc, UC_X86_REG_EBX, &ebx);    printf("Final ebx = 0x%x/n", ebx);    uc_close(uc);        return 0;}

// emulate code that jump to invalid memorystatic void test_i386_jump_invalid(void){    uc_engine *uc;    uc_err err;    uc_hook trace1, trace2;    int r_ecx = 0x1234;     // ECX register    int r_edx = 0x7890;     // EDX register    printf("===================================/n");    printf("Emulate i386 code that jumps to invalid memory/n");    // Initialize emulator in X86-32bit mode    err = uc_open(UC_ARCH_X86, UC_MODE_32, &uc);    if (err) {        printf("Failed on uc_open() with error returned: %u/n", err);        return;    }    // map 2MB memory for this emulation    uc_mem_map(uc, ADDRESS, 2 * 1024 * 1024, UC_PROT_ALL);    // write machine code to be emulated to memory    if (uc_mem_write(uc, ADDRESS, X86_CODE32_JMP_INVALID, sizeof(X86_CODE32_JMP_INVALID) - 1)) {        printf("Failed to write emulation code to memory, quit!/n");        return;    }    // initialize machine registers    uc_reg_write(uc, UC_X86_REG_ECX, &r_ecx);    uc_reg_write(uc, UC_X86_REG_EDX, &r_edx);    // tracing all basic blocks with customized callback    uc_hook_add(uc, &trace1, UC_HOOK_BLOCK, hook_block, NULL, 1, 0);    // tracing all instructions by having @begin > @end    uc_hook_add(uc, &trace2, UC_HOOK_CODE, hook_code, NULL, 1, 0);    // emulate machine code in infinite time    err = uc_emu_start(uc, ADDRESS, ADDRESS + sizeof(X86_CODE32_JMP_INVALID) - 1, 0, 0);    if (err) {        printf("Failed on uc_emu_start() with error returned %u: %s/n",                err, uc_strerror(err));    }    // now print out some registers    printf(">>> Emulation done. Below is the CPU context/n");    uc_reg_read(uc, UC_X86_REG_ECX, &r_ecx);    uc_reg_read(uc, UC_X86_REG_EDX, &r_edx);    printf(">>> ECX = 0x%x/n", r_ecx);    printf(">>> EDX = 0x%x/n", r_edx);    uc_close(uc);}

static void test_arm(void){    uc_engine *uc;    uc_err err;    uc_hook trace1, trace2;    int r0 = 0x1234;     // R0 register    int r2 = 0x6789;     // R1 register    int r3 = 0x3333;     // R2 register    int r1;     // R1 register    printf("Emulate ARM code/n");    // Initialize emulator in ARM mode    err = uc_open(UC_ARCH_ARM, UC_MODE_ARM, &uc);    if (err) {        printf("Failed on uc_open() with error returned: %u (%s)/n",                err, uc_strerror(err));        return;    }    // map 2MB memory for this emulation    uc_mem_map(uc, ADDRESS, 2 * 1024 * 1024, UC_PROT_ALL);    // write machine code to be emulated to memory    uc_mem_write(uc, ADDRESS, ARM_CODE, sizeof(ARM_CODE) - 1);    // initialize machine registers    uc_reg_write(uc, UC_ARM_REG_R0, &r0);    uc_reg_write(uc, UC_ARM_REG_R2, &r2);    uc_reg_write(uc, UC_ARM_REG_R3, &r3);    // tracing all basic blocks with customized callback    uc_hook_add(uc, &trace1, UC_HOOK_BLOCK, hook_block, NULL, 1, 0);    // tracing one instruction at ADDRESS with customized callback    uc_hook_add(uc, &trace2, UC_HOOK_CODE, hook_code, NULL, ADDRESS, ADDRESS);    // emulate machine code in infinite time (last param = 0), or when    // finishing all the code.    err = uc_emu_start(uc, ADDRESS, ADDRESS + sizeof(ARM_CODE) -1, UC_SECOND_SCALE * TIMEOUT, 0);    if (err) {        printf("Failed on uc_emu_start() with error returned: %u/n", err);    }    // now print out some registers    printf(">>> Emulation done. Below is the CPU context/n");    uc_reg_read(uc, UC_ARM_REG_R0, &r0);    uc_reg_read(uc, UC_ARM_REG_R1, &r1);    printf(">>> R0 = 0x%x/n", r0);    printf(">>> R1 = 0x%x/n", r1);    uc_close(uc);}

static void VM_exec(){    int c;    uc_engine *uc;    uc_err err;    // Initialize emulator in X86-64bit mode    err = uc_open(UC_ARCH_X86, UC_MODE_32, &uc);    if(err)    {        printf("Failed on uc_open() with error returned: %s/n", uc_strerror(err));        return;    }repeat:    err = uc_mem_map(uc, ADDRESS1, SIZE, UC_PROT_ALL);    if(err != UC_ERR_OK)    {        printf("Failed to map memory %s/n", uc_strerror(err));        goto err;    }    err = uc_mem_map(uc, ADDRESS2, SIZE, UC_PROT_ALL);    if(err != UC_ERR_OK)    {        printf("Failed to map memory %s/n", uc_strerror(err));        goto err;    }    err = uc_mem_unmap(uc, ADDRESS1, SIZE);    if(err != UC_ERR_OK)    {        printf("Failed to unmap memory %s/n", uc_strerror(err));        goto err;    }    err = uc_mem_unmap(uc, ADDRESS2, SIZE);    if(err != UC_ERR_OK)    {        printf("Failed to unmap memory %s/n", uc_strerror(err));        goto err;    }    for(;;)    {        c = getchar(); //pause here and analyse memory usage before exiting with a program like VMMap;        if(c != 'e')            goto repeat;        else            break;    }err:    uc_close(uc);}

int main(int argc, char **argv){    uc_engine *uc;    uc_hook trace;    uc_err err;    uint8_t memory[MEM_SIZE];    if (argc == 1) {        usage(argv[0]);        return -1;    }    const char *fname = argv[1];    err = uc_open (UC_ARCH_X86, UC_MODE_16, &uc);    if (err) {        fprintf(stderr, "Cannot initialize unicorn/n");        return 1;    }    // map 64KB in    if (uc_mem_map (uc, 0, MEM_SIZE, UC_PROT_ALL)) {        fprintf(stderr, "Failed to write emulation code to memory, quit!/n");        uc_close(uc);        return 0;    }    // initialize internal settings    int21_init();    //load executable    size_t fsize = load_com(uc, memory, fname);    // setup PSP    setup_psp(0, memory, argc, argv);    // write machine code to be emulated in, including the prefix PSP    uc_mem_write(uc, 0, memory, DOS_ADDR + fsize);    // handle interrupt ourself    uc_hook_add(uc, &trace, UC_HOOK_INTR, hook_intr, NULL);    err = uc_emu_start(uc, DOS_ADDR, DOS_ADDR + 0x10000, 0, 0);    if (err) {        fprintf(stderr, "Failed on uc_emu_start() with error returned %u: %s/n",                err, uc_strerror(err));    }    uc_close(uc);    return 0;}

static void test_sparc(void){    uc_engine *uc;    uc_err err;    uc_hook trace1, trace2;    int g1 = 0x1230;     // G1 register    int g2 = 0x6789;     // G2 register    int g3 = 0x5555;     // G3 register    printf("Emulate SPARC code/n");    // Initialize emulator in Sparc mode    err = uc_open(UC_ARCH_SPARC, UC_MODE_32, &uc);    if (err) {        printf("Failed on uc_open() with error returned: %u (%s)/n",                err, uc_strerror(err));        return;    }    // map 2MB memory for this emulation    uc_mem_map(uc, ADDRESS, 2 * 1024 * 1024, UC_PROT_ALL);    // write machine code to be emulated to memory    uc_mem_write(uc, ADDRESS, SPARC_CODE, sizeof(SPARC_CODE) - 1);    // initialize machine registers    uc_reg_write(uc, UC_SPARC_REG_G1, &g1);    uc_reg_write(uc, UC_SPARC_REG_G2, &g2);    uc_reg_write(uc, UC_SPARC_REG_G3, &g3);    // tracing all basic blocks with customized callback    uc_hook_add(uc, &trace1, UC_HOOK_BLOCK, hook_block, NULL, (uint64_t)1, (uint64_t)0);    // tracing all instructions with customized callback    uc_hook_add(uc, &trace2, UC_HOOK_CODE, hook_code, NULL, (uint64_t)1, (uint64_t)0);    // emulate machine code in infinite time (last param = 0), or when    // finishing all the code.    err = uc_emu_start(uc, ADDRESS, ADDRESS + sizeof(SPARC_CODE) - 1, 0, 0);    if (err) {        printf("Failed on uc_emu_start() with error returned: %u (%s)/n",                err, uc_strerror(err));    }    // now print out some registers    printf(">>> Emulation done. Below is the CPU context/n");    uc_reg_read(uc, UC_SPARC_REG_G3, &g3);    printf(">>> G3 = 0x%x/n", g3);    uc_close(uc);}

static void test_x86_16(void){    uc_engine *uc;    uc_err err;    uint8_t tmp;    int32_t eax = 7;    int32_t ebx = 5;    int32_t esi = 6;    printf("Emulate x86 16-bit code/n");    // Initialize emulator in X86-16bit mode    err = uc_open(UC_ARCH_X86, UC_MODE_16, &uc);    if (err) {        printf("Failed on uc_open() with error returned: %u/n", err);        return;    }    // map 8KB memory for this emulation    uc_mem_map(uc, 0, 8 * 1024, UC_PROT_ALL);    // write machine code to be emulated to memory    if (uc_mem_write(uc, 0, X86_CODE16, sizeof(X86_CODE16) - 1)) {        printf("Failed to write emulation code to memory, quit!/n");        return;    }    // initialize machine registers    uc_reg_write(uc, UC_X86_REG_EAX, &eax);    uc_reg_write(uc, UC_X86_REG_EBX, &ebx);    uc_reg_write(uc, UC_X86_REG_ESI, &esi);    // emulate machine code in infinite time (last param = 0), or when    // finishing all the code.    err = uc_emu_start(uc, 0, sizeof(X86_CODE16) - 1, 0, 0);    if (err) {        printf("Failed on uc_emu_start() with error returned %u: %s/n",                err, uc_strerror(err));    }    // now print out some registers    printf(">>> Emulation done. Below is the CPU context/n");    // read from memory    if (!uc_mem_read(uc, 11, &tmp, 1))        printf(">>> Read 1 bytes from [0x%x] = 0x%x/n", 11, tmp);    else        printf(">>> Failed to read 1 bytes from [0x%x]/n", 11);    uc_close(uc);}

static void test_arm64(void){    uc_engine *uc;    uc_err err;    uc_hook trace1, trace2;    int64_t x11 = 0x1234;     // X11 register    int64_t x13 = 0x6789;     // X13 register    int64_t x15 = 0x3333;     // X15 register    printf("Emulate ARM64 code/n");    // Initialize emulator in ARM mode    err = uc_open(UC_ARCH_ARM64, UC_MODE_ARM, &uc);    if (err) {        printf("Failed on uc_open() with error returned: %u (%s)/n",                err, uc_strerror(err));        return;    }    // map 2MB memory for this emulation    uc_mem_map(uc, ADDRESS, 2 * 1024 * 1024, UC_PROT_ALL);    // write machine code to be emulated to memory    uc_mem_write(uc, ADDRESS, ARM_CODE, sizeof(ARM_CODE) - 1);    // initialize machine registers    uc_reg_write(uc, UC_ARM64_REG_X11, &x11);    uc_reg_write(uc, UC_ARM64_REG_X13, &x13);    uc_reg_write(uc, UC_ARM64_REG_X15, &x15);    // tracing all basic blocks with customized callback    uc_hook_add(uc, &trace1, UC_HOOK_BLOCK, hook_block, NULL, (uint64_t)1, (uint64_t)0);    // tracing one instruction at ADDRESS with customized callback    uc_hook_add(uc, &trace2, UC_HOOK_CODE, hook_code, NULL, (uint64_t)ADDRESS, (uint64_t)ADDRESS);    // emulate machine code in infinite time (last param = 0), or when    // finishing all the code.    err = uc_emu_start(uc, ADDRESS, ADDRESS + sizeof(ARM_CODE) -1, 0, 0);    if (err) {        printf("Failed on uc_emu_start() with error returned: %u/n", err);    }    // now print out some registers    printf(">>> Emulation done. Below is the CPU context/n");    uc_reg_read(uc, UC_ARM64_REG_X11, &x11);    printf(">>> X11 = 0x%" PRIx64 "/n", x11);    uc_close(uc);}

static void test_x86_64_syscall(void){    uc_engine *uc;    uc_hook trace1;    uc_err err;    int64_t rax = 0x100;    printf("===================================/n");    printf("Emulate x86_64 code with 'syscall' instruction/n");    // Initialize emulator in X86-64bit mode    err = uc_open(UC_ARCH_X86, UC_MODE_64, &uc);    if (err) {        printf("Failed on uc_open() with error returned: %u/n", err);        return;    }    // map 2MB memory for this emulation    uc_mem_map(uc, ADDRESS, 2 * 1024 * 1024, UC_PROT_ALL);    // write machine code to be emulated to memory    if (uc_mem_write(uc, ADDRESS, X86_CODE64_SYSCALL, sizeof(X86_CODE64_SYSCALL) - 1)) {        printf("Failed to write emulation code to memory, quit!/n");        return;    }    // hook interrupts for syscall    uc_hook_add(uc, &trace1, UC_HOOK_INSN, hook_syscall, NULL, 1, 0, UC_X86_INS_SYSCALL);    // initialize machine registers    uc_reg_write(uc, UC_X86_REG_RAX, &rax);    // emulate machine code in infinite time (last param = 0), or when    // finishing all the code.    err = uc_emu_start(uc, ADDRESS, ADDRESS + sizeof(X86_CODE64_SYSCALL) - 1, 0, 0);    if (err) {        printf("Failed on uc_emu_start() with error returned %u: %s/n",                err, uc_strerror(err));    }    // now print out some registers    printf(">>> Emulation done. Below is the CPU context/n");    uc_reg_read(uc, UC_X86_REG_RAX, &rax);    printf(">>> RAX = 0x%" PRIx64 "/n", rax);    uc_close(uc);}

static void test_mips_el(void){    uc_engine *uc;    uc_err err;    uc_hook trace1, trace2;    int r1 = 0x6789;     // R1 register    printf("===========================/n");    printf("Emulate MIPS code (little-endian)/n");    // Initialize emulator in MIPS mode    err = uc_open(UC_ARCH_MIPS, UC_MODE_MIPS32, &uc);    if (err) {        printf("Failed on uc_open() with error returned: %u (%s)/n",                err, uc_strerror(err));        return;    }    // map 2MB memory for this emulation    uc_mem_map(uc, ADDRESS, 2 * 1024 * 1024, UC_PROT_ALL);    // write machine code to be emulated to memory    uc_mem_write(uc, ADDRESS, MIPS_CODE_EL, sizeof(MIPS_CODE_EL) - 1);    // initialize machine registers    uc_reg_write(uc, UC_MIPS_REG_1, &r1);    // tracing all basic blocks with customized callback    uc_hook_add(uc, &trace1, UC_HOOK_BLOCK, hook_block, NULL, (uint64_t)1, (uint64_t)0);    // tracing one instruction at ADDRESS with customized callback    uc_hook_add(uc, &trace2, UC_HOOK_CODE, hook_code, NULL, (uint64_t)ADDRESS, (uint64_t)ADDRESS);    // emulate machine code in infinite time (last param = 0), or when    // finishing all the code.    err = uc_emu_start(uc, ADDRESS, ADDRESS + sizeof(MIPS_CODE_EL) - 1, 0, 0);    if (err) {        printf("Failed on uc_emu_start() with error returned: %u (%s)/n", err, uc_strerror(err));    }    // now print out some registers    printf(">>> Emulation done. Below is the CPU context/n");    uc_reg_read(uc, UC_MIPS_REG_1, &r1);    printf(">>> R1 = 0x%x/n", r1);    uc_close(uc);}

// emulate code that loop foreverstatic void test_i386_loop(void){    uc_engine *uc;    uc_err err;    int r_ecx = 0x1234;     // ECX register    int r_edx = 0x7890;     // EDX register    printf("===================================/n");    printf("Emulate i386 code that loop forever/n");    // Initialize emulator in X86-32bit mode    err = uc_open(UC_ARCH_X86, UC_MODE_32, &uc);    if (err) {        printf("Failed on uc_open() with error returned: %u/n", err);        return;    }    // map 2MB memory for this emulation    uc_mem_map(uc, ADDRESS, 2 * 1024 * 1024, UC_PROT_ALL);    // write machine code to be emulated to memory    if (uc_mem_write(uc, ADDRESS, X86_CODE32_LOOP, sizeof(X86_CODE32_LOOP) - 1)) {        printf("Failed to write emulation code to memory, quit!/n");        return;    }    // initialize machine registers    uc_reg_write(uc, UC_X86_REG_ECX, &r_ecx);    uc_reg_write(uc, UC_X86_REG_EDX, &r_edx);    // emulate machine code in 2 seconds, so we can quit even    // if the code loops    err = uc_emu_start(uc, ADDRESS, ADDRESS + sizeof(X86_CODE32_LOOP) - 1, 2 * UC_SECOND_SCALE, 0);    if (err) {        printf("Failed on uc_emu_start() with error returned %u: %s/n",                err, uc_strerror(err));    }    // now print out some registers    printf(">>> Emulation done. Below is the CPU context/n");    uc_reg_read(uc, UC_X86_REG_ECX, &r_ecx);    uc_reg_read(uc, UC_X86_REG_EDX, &r_edx);    printf(">>> ECX = 0x%x/n", r_ecx);    printf(">>> EDX = 0x%x/n", r_edx);    uc_close(uc);}

static void test_thumb(void){    uc_engine *uc;    uc_err err;    uc_hook trace1, trace2;    int sp = 0x1234;     // R0 register    printf("Emulate THUMB code/n");    // Initialize emulator in ARM mode    err = uc_open(UC_ARCH_ARM, UC_MODE_THUMB, &uc);    if (err) {        printf("Failed on uc_open() with error returned: %u (%s)/n",                err, uc_strerror(err));        return;    }    // map 2MB memory for this emulation    uc_mem_map(uc, ADDRESS, 2 * 1024 * 1024, UC_PROT_ALL);    // write machine code to be emulated to memory    uc_mem_write(uc, ADDRESS, THUMB_CODE, sizeof(THUMB_CODE) - 1);    // initialize machine registers    uc_reg_write(uc, UC_ARM_REG_SP, &sp);    // tracing all basic blocks with customized callback    uc_hook_add(uc, &trace1, UC_HOOK_BLOCK, hook_block, NULL, 1, 0);    // tracing one instruction at ADDRESS with customized callback    uc_hook_add(uc, &trace2, UC_HOOK_CODE, hook_code, NULL, ADDRESS, ADDRESS);    // emulate machine code in infinite time (last param = 0), or when    // finishing all the code.    // Note we start at ADDRESS | 1 to indicate THUMB mode.    err = uc_emu_start(uc, ADDRESS | 1, ADDRESS + sizeof(THUMB_CODE) -1, 0, 0);    if (err) {        printf("Failed on uc_emu_start() with error returned: %u/n", err);    }    // now print out some registers    printf(">>> Emulation done. Below is the CPU context/n");    uc_reg_read(uc, UC_ARM_REG_SP, &sp);    printf(">>> SP = 0x%x/n", sp);    uc_close(uc);}

int main(int argc, char **argv, char **envp) {  uc_engine *uc;  if (uc_open(UC_ARCH_X86, UC_MODE_64, &uc)) {    printf("uc_open(…) failed/n");    return 1;  }  uc_mem_map(uc, STARTING_ADDRESS, MEMORY_SIZE, UC_PROT_ALL);  if (uc_mem_write(uc, STARTING_ADDRESS, BINARY, sizeof(BINARY) - 1)) {    printf("uc_mem_write(…) failed/n");    return 1;  }  printf("uc_emu_start(…)/n");  uc_emu_start(uc, STARTING_ADDRESS, STARTING_ADDRESS + sizeof(BINARY) - 1, 0, 20);  printf("done/n");  return 0;}

int main(int argc, char **argv, char **envp) {  uc_engine *uc;  if (uc_open(HARDWARE_ARCHITECTURE, HARDWARE_MODE, &uc)) {    printf("uc_open(…) failed/n");    return 1;  }  uc_mem_map(uc, MEMORY_STARTING_ADDRESS, MEMORY_SIZE, MEMORY_PERMISSIONS);  if (uc_mem_write(uc, MEMORY_STARTING_ADDRESS, BINARY_CODE, sizeof(BINARY_CODE) - 1)) {    printf("uc_mem_write(…) failed/n");    return 1;  }  printf("uc_emu_start(…)/n");  uc_emu_start(uc, MEMORY_STARTING_ADDRESS, MEMORY_STARTING_ADDRESS + sizeof(BINARY_CODE) - 1, 0, 20);  printf("done/n");  return 0;}

// emulate code that loop foreverstatic void test_i386_loop(void **state){    uc_engine *uc;    uc_err err;    int r_ecx = 0x1234;     // ECX register    int r_edx = 0x7890;     // EDX register    static const uint64_t address = 0x1000000;    static const uint8_t code[] = {        0x41,           // inc ecx        0x4a,           // dec edx        0xEB, 0xFE,     // jmp $    };    // Initialize emulator in X86-32bit mode    err = uc_open(UC_ARCH_X86, UC_MODE_32, &uc);    uc_assert_success(err);    // map 2MB memory for this emulation    err = uc_mem_map(uc, address, 2 * 1024 * 1024, UC_PROT_ALL);    uc_assert_success(err);    // write machine code to be emulated to memory    err = uc_mem_write(uc, address, code, sizeof(code));    uc_assert_success(err);    // initialize machine registers    err = uc_reg_write(uc, UC_X86_REG_ECX, &r_ecx);    uc_assert_success(err);    err = uc_reg_write(uc, UC_X86_REG_EDX, &r_edx);    uc_assert_success(err);    // emulate machine code in 2 seconds, so we can quit even    // if the code loops    err = uc_emu_start(uc, address, address+sizeof(code), 2*UC_SECOND_SCALE, 0);    uc_assert_success(err);    // verify register values    uc_assert_success(uc_reg_read(uc, UC_X86_REG_ECX, &r_ecx));    uc_assert_success(uc_reg_read(uc, UC_X86_REG_EDX, &r_edx));    assert_int_equal(r_ecx, 0x1235);    assert_int_equal(r_edx, 0x788F);    uc_assert_success(uc_close(uc));}

int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {    uc_err err;    if (initialized == 0) {        if (outfile == NULL) {            // we compute the output            outfile = fopen("/dev/null", "w");            if (outfile == NULL) {                printf("failed opening /dev/null/n");                abort();                return 0;            }        }        initialized = 1;    }    // Not global as we must reset this structure    // Initialize emulator in supplied mode    err = uc_open(UC_ARCH_X86, UC_MODE_64, &uc);    if (err != UC_ERR_OK) {        printf("Failed on uc_open() with error returned: %u/n", err);        abort();    }    // map 4MB memory for this emulation    uc_mem_map(uc, ADDRESS, 4 * 1024 * 1024, UC_PROT_ALL);    // write machine code to be emulated to memory    if (uc_mem_write(uc, ADDRESS, Data, Size)) {        printf("Failed to write emulation code to memory, quit!/n");        abort();    }    // emulate code in infinite time & 4096 instructions    // avoid timeouts with infinite loops    err=uc_emu_start(uc, ADDRESS, ADDRESS + Size, 0, 0x1000);    if (err) {        fprintf(outfile, "Failed on uc_emu_start() with error returned %u: %s/n", err, uc_strerror(err));    }    uc_close(uc);    return 0;}

int main(int argc, char **argv, char **envp) {  uc_engine *uc;  if (uc_open(HARDWARE_ARCHITECTURE, HARDWARE_MODE, &uc)) {    printf("uc_open(…) failed/n");    return 1;  }  uc_mem_map(uc, MEMORY_STARTING_ADDRESS, MEMORY_SIZE, MEMORY_PERMISSIONS);  if (uc_mem_write(uc, MEMORY_STARTING_ADDRESS, BINARY_CODE, sizeof(BINARY_CODE) - 1)) {    printf("uc_mem_write(…) failed/n");    return 1;  }  uc_hook trace;  uc_hook_add(uc, &trace, UC_HOOK_CODE, hook_code, NULL, (uint64_t)MEMORY_STARTING_ADDRESS, (uint64_t)(MEMORY_STARTING_ADDRESS + 1));  printf("uc_emu_start(…)/n");  uc_emu_start(uc, MEMORY_STARTING_ADDRESS, MEMORY_STARTING_ADDRESS + sizeof(BINARY_CODE) - 1, 0, 0);  printf("done/n");  return 0;}

static void test_x86_64_syscall(void **state){    uc_engine *uc;    uc_hook trace1;    uc_err err;    static const uint64_t address = 0x1000000;    static const uint8_t code[] = {        0x0F, 0x05,     // SYSCALL    };    int64_t rax = 0x100;    // Initialize emulator in X86-64bit mode    err = uc_open(UC_ARCH_X86, UC_MODE_64, &uc);    uc_assert_success(err);    // map 2MB memory for this emulation    err = uc_mem_map(uc, address, 2 * 1024 * 1024, UC_PROT_ALL);    uc_assert_success(err);    // write machine code to be emulated to memory    err = uc_mem_write(uc, address, code, sizeof(code));    uc_assert_success(err);    // hook interrupts for syscall    err = uc_hook_add(uc, &trace1, UC_HOOK_INSN, hook_syscall, NULL, 1, 0, UC_X86_INS_SYSCALL);    uc_assert_success(err);    // initialize machine registers    err = uc_reg_write(uc, UC_X86_REG_RAX, &rax);    uc_assert_success(err);    // emulate machine code in infinite time (last param = 0), or when    // finishing all the code.    err = uc_emu_start(uc, address, address + sizeof(code), 0, 0);    uc_assert_success(err);    // verify register values    uc_assert_success(uc_reg_read(uc, UC_X86_REG_RAX, &rax));    assert_int_equal(0x200, rax);    uc_assert_success(uc_close(uc));}

static void test_i386_jump(void){    uc_engine *uc;    uc_err err;    uc_hook trace1, trace2;    printf("===================================/n");    printf("Emulate i386 code with jump/n");    // Initialize emulator in X86-32bit mode    err = uc_open(UC_ARCH_X86, UC_MODE_32, &uc);    if (err) {        printf("Failed on uc_open() with error returned: %u/n", err);        return;    }    // map 2MB memory for this emulation    uc_mem_map(uc, ADDRESS, 2 * 1024 * 1024, UC_PROT_ALL);    // write machine code to be emulated to memory    if (uc_mem_write(uc, ADDRESS, X86_CODE32_JUMP,          sizeof(X86_CODE32_JUMP) - 1)) {        printf("Failed to write emulation code to memory, quit!/n");        return;    }    // tracing 1 basic block with customized callback    uc_hook_add(uc, &trace1, UC_HOOK_BLOCK, hook_block, NULL, ADDRESS, ADDRESS);    // tracing 1 instruction at ADDRESS    uc_hook_add(uc, &trace2, UC_HOOK_CODE, hook_code, NULL, ADDRESS, ADDRESS);    // emulate machine code in infinite time    err = uc_emu_start(uc, ADDRESS, ADDRESS + sizeof(X86_CODE32_JUMP) - 1, 0, 0);    if (err) {        printf("Failed on uc_emu_start() with error returned %u: %s/n",                err, uc_strerror(err));    }    printf(">>> Emulation done. Below is the CPU context/n");    uc_close(uc);}

static void test_x86_16(void **state){    uc_engine *uc;    uc_err err;    uint8_t tmp;    static const uint64_t address = 0;    static const uint8_t code[] = {        0x00, 0x00,         // add   byte ptr [bx + si], al    };    int32_t eax = 7;    int32_t ebx = 5;    int32_t esi = 6;    // Initialize emulator in X86-16bit mode    err = uc_open(UC_ARCH_X86, UC_MODE_16, &uc);    uc_assert_success(err);    // map 8KB memory for this emulation    err = uc_mem_map(uc, address, 8 * 1024, UC_PROT_ALL);    uc_assert_success(err);    // write machine code to be emulated to memory    err = uc_mem_write(uc, address, code, sizeof(code));    uc_assert_success(err);    // initialize machine registers    uc_assert_success(uc_reg_write(uc, UC_X86_REG_EAX, &eax));    uc_assert_success(uc_reg_write(uc, UC_X86_REG_EBX, &ebx));    uc_assert_success(uc_reg_write(uc, UC_X86_REG_ESI, &esi));    // emulate machine code in infinite time (last param = 0), or when    // finishing all the code.    err = uc_emu_start(uc, address, address+sizeof(code), 0, 0);    uc_assert_success(err);    // read from memory    uc_assert_success(uc_mem_read(uc, 11, &tmp, 1));    assert_int_equal(7, tmp);    uc_assert_success(uc_close(uc));}

int main(int argc, char **argv, char **envp){    uc_engine *uc;    uc_hook trace1, trace2;    uc_err err;    // Initialize emulator in X86-32bit mode    err = uc_open(UC_ARCH_X86, UC_MODE_32, &uc);    if (err) {        printf("not ok - Failed on uc_open() with error returned: %u/n", err);        return -1;    }    uc_mem_map(uc, 0x1000, 0x1000, UC_PROT_ALL);    if (err) {        printf("not ok - Failed on uc_mem_map() with error returned: %u/n", err);        return -1;    }    uc_mem_map(uc, 0x4000, 0x1000, UC_PROT_ALL);    if (err) {        printf("not ok - Failed on uc_mem_map() with error returned: %u/n", err);        return -1;    }    err = uc_mem_unmap(uc, 0x4000, 0x1000);    if (err) {        printf("not ok - Failed on uc_mem_unmap() with error returned: %u/n", err);        return -1;    }    err = uc_mem_unmap(uc, 0x4000, 0x1000);    if (!err) {        printf("not ok - second unmap succeeded/n");        return -1;    }    printf("Tests OK/n");    uc_close(uc);    return 0;}

static void test_i386_jump(void **state){    uc_engine *uc;    uc_err err;    uc_hook trace1, trace2;    const uint8_t code[] = "/xeb/x02/x90/x90/x90/x90/x90/x90"; // jmp 4; nop; nop; nop; nop; nop; nop    const uint64_t address = 0x1000000;    // Initialize emulator in X86-32bit mode    err = uc_open(UC_ARCH_X86, UC_MODE_32, &uc);    uc_assert_success(err);    // map 2MB memory for this emulation    err = uc_mem_map(uc, address, 2 * 1024 * 1024, UC_PROT_ALL);    uc_assert_success(err);    // write machine code to be emulated to memory    err = uc_mem_write(uc, address, code, sizeof(code)-1);    uc_assert_success(err);    // tracing 1 basic block with customized callback    err = uc_hook_add(uc, &trace1, UC_HOOK_BLOCK, hook_block, NULL, address, address);    uc_assert_success(err);    // tracing 1 instruction at address    err = uc_hook_add(uc, &trace2, UC_HOOK_CODE, hook_code, NULL, address, address);    uc_assert_success(err);    // emulate machine code in infinite time    err = uc_emu_start(uc, address, address+sizeof(code)-1, 0, 0);    uc_assert_success(err);    err = uc_close(uc);    uc_assert_success(err);}

static void test_m68k(void){    uc_engine *uc;    uc_hook trace1, trace2;    uc_err err;    int d0 = 0x0000;     // d0 data register    int d1 = 0x0000;     // d1 data register    int d2 = 0x0000;     // d2 data register    int d3 = 0x0000;     // d3 data register    int d4 = 0x0000;     // d4 data register    int d5 = 0x0000;     // d5 data register    int d6 = 0x0000;     // d6 data register    int d7 = 0x0000;     // d7 data register    int a0 = 0x0000;     // a0 address register    int a1 = 0x0000;     // a1 address register    int a2 = 0x0000;     // a2 address register    int a3 = 0x0000;     // a3 address register    int a4 = 0x0000;     // a4 address register    int a5 = 0x0000;     // a5 address register    int a6 = 0x0000;     // a6 address register    int a7 = 0x0000;     // a6 address register    int pc = 0x0000;     // program counter    int sr = 0x0000;     // status register    printf("Emulate M68K code/n");    // Initialize emulator in M68K mode    err = uc_open(UC_ARCH_M68K, UC_MODE_BIG_ENDIAN, &uc);    if (err) {        printf("Failed on uc_open() with error returned: %u (%s)/n",                err, uc_strerror(err));        return;    }    // map 2MB memory for this emulation    uc_mem_map(uc, ADDRESS, 2 * 1024 * 1024, UC_PROT_ALL);    // write machine code to be emulated to memory    uc_mem_write(uc, ADDRESS, M68K_CODE, sizeof(M68K_CODE) - 1);    // initialize machine registers    uc_reg_write(uc, UC_M68K_REG_D0, &d0);    uc_reg_write(uc, UC_M68K_REG_D1, &d1);    uc_reg_write(uc, UC_M68K_REG_D2, &d2);    uc_reg_write(uc, UC_M68K_REG_D3, &d3);    uc_reg_write(uc, UC_M68K_REG_D4, &d4);    uc_reg_write(uc, UC_M68K_REG_D5, &d5);    uc_reg_write(uc, UC_M68K_REG_D6, &d6);    uc_reg_write(uc, UC_M68K_REG_D7, &d7);    uc_reg_write(uc, UC_M68K_REG_A0, &a0);    uc_reg_write(uc, UC_M68K_REG_A1, &a1);    uc_reg_write(uc, UC_M68K_REG_A2, &a2);    uc_reg_write(uc, UC_M68K_REG_A3, &a3);    uc_reg_write(uc, UC_M68K_REG_A4, &a4);    uc_reg_write(uc, UC_M68K_REG_A5, &a5);    uc_reg_write(uc, UC_M68K_REG_A6, &a6);    uc_reg_write(uc, UC_M68K_REG_A7, &a7);    uc_reg_write(uc, UC_M68K_REG_PC, &pc);    uc_reg_write(uc, UC_M68K_REG_SR, &sr);    // tracing all basic blocks with customized callback    uc_hook_add(uc, &trace1, UC_HOOK_BLOCK, hook_block, NULL, 1, 0);    // tracing all instruction    uc_hook_add(uc, &trace2, UC_HOOK_CODE, hook_code, NULL, 1, 0);    // emulate machine code in infinite time (last param = 0), or when    // finishing all the code.    err = uc_emu_start(uc, ADDRESS, ADDRESS + sizeof(M68K_CODE)-1, 0, 0);    if (err) {        printf("Failed on uc_emu_start() with error returned: %u/n", err);    }    // now print out some registers    printf(">>> Emulation done. Below is the CPU context/n");    uc_reg_read(uc, UC_M68K_REG_D0, &d0);    uc_reg_read(uc, UC_M68K_REG_D1, &d1);    uc_reg_read(uc, UC_M68K_REG_D2, &d2);    uc_reg_read(uc, UC_M68K_REG_D3, &d3);    uc_reg_read(uc, UC_M68K_REG_D4, &d4);    uc_reg_read(uc, UC_M68K_REG_D5, &d5);    uc_reg_read(uc, UC_M68K_REG_D6, &d6);    uc_reg_read(uc, UC_M68K_REG_D7, &d7);    uc_reg_read(uc, UC_M68K_REG_A0, &a0);    uc_reg_read(uc, UC_M68K_REG_A1, &a1);    uc_reg_read(uc, UC_M68K_REG_A2, &a2);    uc_reg_read(uc, UC_M68K_REG_A3, &a3);    uc_reg_read(uc, UC_M68K_REG_A4, &a4);    uc_reg_read(uc, UC_M68K_REG_A5, &a5);    uc_reg_read(uc, UC_M68K_REG_A6, &a6);    uc_reg_read(uc, UC_M68K_REG_A7, &a7);    uc_reg_read(uc, UC_M68K_REG_PC, &pc);//.........这里部分代码省略.........

static void test_tb_x86_64_32_imul_Gv_Ev_Ib(void **state){    uc_engine *uc = *state;    uc_hook trace1, trace2;    void *mem;#ifdef RIP_NEXT_TO_THE_SELFMODIFY_OPCODE    // These values assumes just before PC = 0x60000021    int64_t eax = 0x00000041;    int64_t ecx = 0x5ffffff8;    int64_t edx = 0x5ffffff8;    int64_t ebx = 0x034a129b;    int64_t esp = 0x6010229a;    int64_t ebp = 0x60000002;    int64_t esi = 0x1f350211;    int64_t edi = 0x488ac239;#else    //  These values assumes PC == 0x6000000    int64_t eax = 0x73952c43;    int64_t ecx = 0x6010229a;    int64_t edx = 0x2a500e50;    int64_t ebx = 0x034a1295;    int64_t esp = 0x6010229a;    int64_t ebp = 0x60000000;    int64_t esi = 0x1f350211;    int64_t edi = 0x488ac239;#endif    mem = calloc(1, CODE_SPACE);    assert_int_not_equal(0, mem);    uc_assert_success(uc_open(UC_ARCH_X86,                               UC_MODE_32,                               &uc));    uc_assert_success(uc_mem_map(uc,                                  PHY_STACK_REGION,                                  CODE_SPACE,                                  UC_PROT_ALL));    uc_assert_success(uc_mem_write(uc,                                   PHY_STACK_REGION,                                   X86_CODE32_ALPHA_MIXED,                                   sizeof(X86_CODE32_ALPHA_MIXED) - 1));    uc_assert_success(uc_reg_write(uc, UC_X86_REG_EAX, &eax));    uc_assert_success(uc_reg_write(uc, UC_X86_REG_ECX, &ecx));    uc_assert_success(uc_reg_write(uc, UC_X86_REG_EDX, &edx));    uc_assert_success(uc_reg_write(uc, UC_X86_REG_EBX, &ebx));    uc_assert_success(uc_reg_write(uc, UC_X86_REG_ESP, &esp));    uc_assert_success(uc_reg_write(uc, UC_X86_REG_EBP, &ebp));    uc_assert_success(uc_reg_write(uc, UC_X86_REG_ESI, &esi));    uc_assert_success(uc_reg_write(uc, UC_X86_REG_EDI, &edi));    uc_assert_success(uc_hook_add(uc,                &trace1,                UC_HOOK_CODE,                hook_code32,                NULL,                (uint64_t)1,                (uint64_t)0));    uc_assert_success(uc_hook_add(uc,                &trace2,                UC_HOOK_MEM_VALID,                hook_mem32,                NULL,                (uint64_t)1,                (uint64_t)0));    uc_assert_success(uc_emu_start(uc,#ifdef RIP_NEXT_TO_THE_SELFMODIFY_OPCODE    //  Register set (before self-modifying IMUL opcode)    //  Start at "0x00000021: xorb   %al, 0x30(%ecx)    //  Start at "0x00000021: xor    byte ptr [ecx + 0x30], al                       PHY_STACK_REGION+0x0021,   //  0x0024 didn't work#else                       PHY_STACK_REGION+0x0000,#endif                       PHY_STACK_REGION+sizeof(X86_CODE32_ALPHA_MIXED) - 1,                       0, 0));    uc_assert_success(uc_close(uc));}

static void VM_exec(){    uc_engine *uc;    uc_err err;    uc_hook trace;    unsigned int r_eax, eflags, r_esp, r_edi, r_ecx;    r_eax = 0xbaadbabe;    r_esp = ADDRESS+0x20;    r_edi = ADDRESS+0x300; //some safe distance from main code.    eflags = 0x00000206;    r_ecx = ECX_OPS;    // Initialize emulator in X86-32bit mode    err = uc_open(UC_ARCH_X86, UC_MODE_32, &uc);    if(err)    {        printf("Failed on uc_open() with error returned: %s/n", uc_strerror(err));        return;    }    err = uc_mem_map(uc, ADDRESS, (2 * 1024 * 1024), UC_PROT_ALL);    if(err != UC_ERR_OK)    {        printf("Failed to map memory %s/n", uc_strerror(err));        return;    }    // write machine code to be emulated to memory    err = uc_mem_write(uc, ADDRESS, X86_CODE32, sizeof(X86_CODE32) - 1);    if(err != UC_ERR_OK)    {        printf("Failed to write emulation code to memory, quit!: %s(len %lu)/n", uc_strerror(err), (unsigned long)sizeof(X86_CODE32) - 1);        return;    }    // initialize machine registers    uc_reg_write(uc, UC_X86_REG_EAX, &r_eax);    uc_reg_write(uc, UC_X86_REG_EDI, &r_edi);    uc_reg_write(uc, UC_X86_REG_ECX, &r_ecx);    uc_reg_write(uc, UC_X86_REG_ESP, &r_esp); //make stack pointer point to already mapped memory so we don't need to hook.    uc_reg_write(uc, UC_X86_REG_EFLAGS, &eflags);    uc_hook_add(uc, &trace, UC_HOOK_CODE, (void *)hook_ins, NULL, 1, 0);    // emulate machine code in infinite time    err = uc_emu_start(uc, ADDRESS, ADDRESS + (sizeof(X86_CODE32) - 1), 0, 0);    if(err)    {        printf("Failed on uc_emu_start() with error returned %u: %s/n", err, uc_strerror(err));        uc_close(uc);        return;    }    uc_reg_read(uc, UC_X86_REG_EAX, &r_eax);    uc_reg_read(uc, UC_X86_REG_ECX, &r_ecx);    uc_reg_read(uc, UC_X86_REG_EDI, &r_edi);    uc_reg_read(uc, UC_X86_REG_EFLAGS, &eflags);    uc_close(uc);    printf("/n>>> Emulation done. Below is the CPU context/n");    printf(">>> EAX = 0x%08X/n", r_eax);    printf(">>> ECX = 0x%08X/n", r_ecx);    printf(">>> EDI = 0x%08X/n", r_edi);    printf(">>> EFLAGS = 0x%08X/n", eflags);    printf("/nHook called %lu times. Test %s/n", hook_called, (hook_called == ECX_OPS ? "PASSED!!" : "FAILED!!!"));}