18
18
* mov rax, 60
19
19
* syscall
20
20
*/
21
- char code [] = "\xB8\x39\x00\x00\x00\x0F\x05\x48\x85\xC0\x74\x0F\xB8\x3C\x00\x00\x00\x48\x89\x04\x25\x00\x40\x00\x00\x0F\x05\xB9\x2A\x00\x00\x00\x48\x89\x0C\x25\x00\x40\x00\x00\xB8\x3C\x00\x00\x00\x0F\x05" ;
21
+ char code [] = "\xB8\x39\x00\x00\x00\x0F\x05\x48\x85\xC0\x74\x0F\xB8\x3C\x00\x00"
22
+ "\x00\x48\x89\x04\x25\x00\x40\x00\x00\x0F\x05\xB9\x2A\x00\x00\x00"
23
+ "\x48\x89\x0C\x25\x00\x40\x00\x00\xB8\x3C\x00\x00\x00\x0F\x05" ;
22
24
23
- static void mmu_write_callback (uc_engine * uc , uc_mem_type type , uint64_t address , int size , int64_t value , void * user_data )
25
+ static void mmu_write_callback (uc_engine * uc , uc_mem_type type ,
26
+ uint64_t address , int size , int64_t value ,
27
+ void * user_data )
24
28
{
25
29
printf ("write at 0x%lx: 0x%lx\n" , address , value );
26
30
}
27
31
28
- static void x86_mmu_prepare_tlb (uc_engine * uc , uint64_t vaddr , uint64_t tlb_base )
32
+ static void x86_mmu_prepare_tlb (uc_engine * uc , uint64_t vaddr ,
33
+ uint64_t tlb_base )
29
34
{
30
35
uc_err err ;
31
36
uint64_t cr0 ;
32
37
uint64_t cr4 ;
33
38
uc_x86_msr msr = {.rid = 0xC0000080 , .value = 0 };
34
- uint64_t pml4o = ((vaddr & 0x00ff8000000000 ) >> 39 )* 8 ;
35
- uint64_t pdpo = ((vaddr & 0x00007fc0000000 ) >> 30 )* 8 ;
36
- uint64_t pdo = ((vaddr & 0x0000003fe00000 ) >> 21 )* 8 ;
39
+ uint64_t pml4o = ((vaddr & 0x00ff8000000000 ) >> 39 ) * 8 ;
40
+ uint64_t pdpo = ((vaddr & 0x00007fc0000000 ) >> 30 ) * 8 ;
41
+ uint64_t pdo = ((vaddr & 0x0000003fe00000 ) >> 21 ) * 8 ;
37
42
uint64_t pml4e = (tlb_base + 0x1000 ) | 1 | (1 << 2 );
38
- uint64_t pdpe = (tlb_base + 0x2000 ) | 1 | (1 << 2 );
39
- uint64_t pde = (tlb_base + 0x3000 ) | 1 | (1 << 2 );
43
+ uint64_t pdpe = (tlb_base + 0x2000 ) | 1 | (1 << 2 );
44
+ uint64_t pde = (tlb_base + 0x3000 ) | 1 | (1 << 2 );
40
45
err = uc_mem_write (uc , tlb_base + pml4o , & pml4e , sizeof (pml4o ));
41
46
if (err ) {
42
47
printf ("failed to write pml4e\n" );
@@ -73,10 +78,10 @@ static void x86_mmu_prepare_tlb(uc_engine *uc, uint64_t vaddr, uint64_t tlb_base
73
78
exit (1 );
74
79
}
75
80
76
- cr0 |= 1 ; // enable protected mode
77
- cr0 |= 1l << 31 ; // enable paging
78
- cr4 |= 1l << 5 ; // enable physical address extension
79
- msr .value |= 1l << 8 ; // enable long mode
81
+ cr0 |= 1 ; // enable protected mode
82
+ cr0 |= 1l << 31 ; // enable paging
83
+ cr4 |= 1l << 5 ; // enable physical address extension
84
+ msr .value |= 1l << 8 ; // enable long mode
80
85
81
86
err = uc_reg_write (uc , UC_X86_REG_CR0 , & cr0 );
82
87
if (err ) {
@@ -95,10 +100,11 @@ static void x86_mmu_prepare_tlb(uc_engine *uc, uint64_t vaddr, uint64_t tlb_base
95
100
}
96
101
}
97
102
98
- static void x86_mmu_pt_set (uc_engine * uc , uint64_t vaddr , uint64_t paddr , uint64_t tlb_base )
103
+ static void x86_mmu_pt_set (uc_engine * uc , uint64_t vaddr , uint64_t paddr ,
104
+ uint64_t tlb_base )
99
105
{
100
- uint64_t pto = ((vaddr & 0x000000001ff000 ) >> 12 )* 8 ;
101
- uint32_t pte = (paddr ) | 1 | (1 << 2 );
106
+ uint64_t pto = ((vaddr & 0x000000001ff000 ) >> 12 ) * 8 ;
107
+ uint32_t pte = (paddr ) | 1 | (1 << 2 );
102
108
uc_mem_write (uc , tlb_base + 0x3000 + pto , & pte , sizeof (pte ));
103
109
}
104
110
@@ -162,20 +168,23 @@ void cpu_tlb(void)
162
168
exit (1 );
163
169
}
164
170
165
- err = uc_hook_add (uc , & h1 , UC_HOOK_INSN , & x86_mmu_syscall_callback , & parrent_done , 1 , 0 , UC_X86_INS_SYSCALL );
171
+ err = uc_hook_add (uc , & h1 , UC_HOOK_INSN , & x86_mmu_syscall_callback ,
172
+ & parrent_done , 1 , 0 , UC_X86_INS_SYSCALL );
166
173
if (err ) {
167
174
printf ("Failed on uc_hook_add() with error returned: %u\n" , err );
168
175
exit (1 );
169
176
}
170
177
171
- // Memory hooks are called after the mmu translation, so hook the physicall addresses
172
- err = uc_hook_add (uc , & h2 , UC_HOOK_MEM_WRITE , & mmu_write_callback , NULL , 0x1000 , 0x3000 );
178
+ // Memory hooks are called after the mmu translation, so hook the physicall
179
+ // addresses
180
+ err = uc_hook_add (uc , & h2 , UC_HOOK_MEM_WRITE , & mmu_write_callback , NULL ,
181
+ 0x1000 , 0x3000 );
173
182
if (err ) {
174
183
printf ("Faled on uc_hook_add() with error returned: %u\n" , err );
175
184
}
176
185
177
186
printf ("map code\n" );
178
- err = uc_mem_map (uc , 0x0 , 0x1000 , UC_PROT_ALL ); //Code
187
+ err = uc_mem_map (uc , 0x0 , 0x1000 , UC_PROT_ALL ); // Code
179
188
if (err ) {
180
189
printf ("Failed on uc_mem_map() with error return: %u\n" , err );
181
190
exit (1 );
@@ -186,25 +195,24 @@ void cpu_tlb(void)
186
195
exit (1 );
187
196
}
188
197
printf ("map parrent memory\n" );
189
- err = uc_mem_map (uc , 0x1000 , 0x1000 , UC_PROT_ALL ); //Parrent
198
+ err = uc_mem_map (uc , 0x1000 , 0x1000 , UC_PROT_ALL ); // Parrent
190
199
if (err ) {
191
200
printf ("Failed on uc_mem_map() with error return: %u\n" , err );
192
201
exit (1 );
193
202
}
194
203
printf ("map child memory\n" );
195
- err = uc_mem_map (uc , 0x2000 , 0x1000 , UC_PROT_ALL ); //Child
204
+ err = uc_mem_map (uc , 0x2000 , 0x1000 , UC_PROT_ALL ); // Child
196
205
if (err ) {
197
206
printf ("failed to map child memory\n" );
198
207
exit (1 );
199
208
}
200
209
printf ("map tlb memory\n" );
201
- err = uc_mem_map (uc , tlb_base , 0x4000 , UC_PROT_ALL ); //TLB
210
+ err = uc_mem_map (uc , tlb_base , 0x4000 , UC_PROT_ALL ); // TLB
202
211
if (err ) {
203
212
printf ("failed to map memory for tlb\n" );
204
213
exit (1 );
205
214
}
206
215
207
-
208
216
printf ("set up the tlb\n" );
209
217
x86_mmu_prepare_tlb (uc , 0x0 , tlb_base );
210
218
x86_mmu_pt_set (uc , 0x2000 , 0x0 , tlb_base );
@@ -277,7 +285,8 @@ void cpu_tlb(void)
277
285
uc_close (uc );
278
286
}
279
287
280
- static bool virtual_tlb_callback (uc_engine * uc , uint64_t addr , uc_mem_type type , uc_tlb_entry * result , void * user_data )
288
+ static bool virtual_tlb_callback (uc_engine * uc , uint64_t addr , uc_mem_type type ,
289
+ uc_tlb_entry * result , void * user_data )
281
290
{
282
291
bool * parrent_done = user_data ;
283
292
printf ("tlb lookup for address: 0x%lX\n" , addr );
@@ -324,20 +333,23 @@ void virtual_tlb(void)
324
333
exit (1 );
325
334
}
326
335
327
- err = uc_hook_add (uc , & h1 , UC_HOOK_INSN , & x86_mmu_syscall_callback , & parrent_done , 1 , 0 , UC_X86_INS_SYSCALL );
336
+ err = uc_hook_add (uc , & h1 , UC_HOOK_INSN , & x86_mmu_syscall_callback ,
337
+ & parrent_done , 1 , 0 , UC_X86_INS_SYSCALL );
328
338
if (err ) {
329
339
printf ("Failed on uc_hook_add() with error returned: %u\n" , err );
330
340
exit (1 );
331
341
}
332
342
333
- // Memory hooks are called after the mmu translation, so hook the physicall addresses
334
- err = uc_hook_add (uc , & h2 , UC_HOOK_MEM_WRITE , & mmu_write_callback , NULL , 0x1000 , 0x3000 );
343
+ // Memory hooks are called after the mmu translation, so hook the physicall
344
+ // addresses
345
+ err = uc_hook_add (uc , & h2 , UC_HOOK_MEM_WRITE , & mmu_write_callback , NULL ,
346
+ 0x1000 , 0x3000 );
335
347
if (err ) {
336
348
printf ("Faled on uc_hook_add() with error returned: %u\n" , err );
337
349
}
338
350
339
351
printf ("map code\n" );
340
- err = uc_mem_map (uc , 0x0 , 0x1000 , UC_PROT_ALL ); //Code
352
+ err = uc_mem_map (uc , 0x0 , 0x1000 , UC_PROT_ALL ); // Code
341
353
if (err ) {
342
354
printf ("Failed on uc_mem_map() with error return: %u\n" , err );
343
355
exit (1 );
@@ -348,19 +360,20 @@ void virtual_tlb(void)
348
360
exit (1 );
349
361
}
350
362
printf ("map parrent memory\n" );
351
- err = uc_mem_map (uc , 0x1000 , 0x1000 , UC_PROT_ALL ); //Parrent
363
+ err = uc_mem_map (uc , 0x1000 , 0x1000 , UC_PROT_ALL ); // Parrent
352
364
if (err ) {
353
365
printf ("Failed on uc_mem_map() with error return: %u\n" , err );
354
366
exit (1 );
355
367
}
356
368
printf ("map child memory\n" );
357
- err = uc_mem_map (uc , 0x2000 , 0x1000 , UC_PROT_ALL ); //Child
369
+ err = uc_mem_map (uc , 0x2000 , 0x1000 , UC_PROT_ALL ); // Child
358
370
if (err ) {
359
371
printf ("failed to map child memory\n" );
360
372
exit (1 );
361
373
}
362
374
363
- err = uc_hook_add (uc , & h3 , UC_HOOK_TLB_FILL , virtual_tlb_callback , & parrent_done , 1 , 0 );
375
+ err = uc_hook_add (uc , & h3 , UC_HOOK_TLB_FILL , virtual_tlb_callback ,
376
+ & parrent_done , 1 , 0 );
364
377
365
378
printf ("run the parrent\n" );
366
379
err = uc_emu_start (uc , 0x2000 , 0x0 , 0 , 0 );
0 commit comments