unicorn-engine / unicorn

Unicorn CPU emulator framework (ARM, AArch64, M68K, Mips, Sparc, PowerPC, RiscV, S390x, TriCore, X86)
http://www.unicorn-engine.org
GNU General Public License v2.0
7.33k stars 1.31k forks source link

Invalid instruction (vpxorq) #1913

Open Jorgecmartins opened 6 months ago

Jorgecmartins commented 6 months ago

Hello,

I'm trying to emulate the following piece of code:

   0x7ffff7db2220 <__strlen_evex>:  endbr64 
   0x7ffff7db2224 <__strlen_evex+4>:    mov    eax,edi
   0x7ffff7db2226 <__strlen_evex+6>:    vpxorq xmm16,xmm16,xmm16 (buggy)

When I try to emulate the instruction vpxorq xmm16,xmm16,xmm16 I get the following error - Invalid instruction (UC_ERR_INSN_INVALID).

I've added a hook to this instruction:

def code_hook(mu, address, size, user_data):
    print (hex(address), hex(size))

and I get a weird output (instruction size):

0x7ffff7db2220 0x4
0x7ffff7db2224 0x2
0x7ffff7db2226 0xf1f1f1f1
ERROR: Invalid instruction (UC_ERR_INSN_INVALID)

The instruction size should be 6 but is outputting 0xf1f1f1f1

wtdcode commented 6 months ago

https://github.com/unicorn-engine/unicorn/wiki/FAQ#emulating-some-instructions-gives-an-error-like-invalid-instruction-what-should-i-do

Did you try switching models?

Jorgecmartins commented 6 months ago

Thanks for the pointer. I'm emulating x64, therefore I used Uc(UC_ARCH_X86, UC_MODE_64). Maybe this instruction is not implemented?

ntqbit commented 6 months ago

I encounter the same issue. Emulation of a valid x86-64 instruction triggers UC_ERR_INSN_INVALID. The code:

from unicorn import *
from unicorn.x86_const import *

uc = Uc(UC_ARCH_X86, UC_MODE_64)

# STACK
STACK_BASE = 0x5000
STACK_SIZE = 0x1000

uc.mem_map(STACK_BASE, STACK_SIZE, UC_PROT_ALL)
uc.reg_write(UC_X86_REG_RSP, STACK_BASE + STACK_SIZE - 0x8)

# PROGRAM
PROGRAM_BASE = 0x10000

# vmovdqu ymmword ptr ds:[rax], ymm0
PROGRAM = b"\xC5\xFE\x7F\x00"

uc.mem_map(PROGRAM_BASE, 0x1000, UC_PROT_ALL)
uc.mem_write(PROGRAM_BASE, PROGRAM)

uc.emu_start(PROGRAM_BASE, PROGRAM_BASE + len(PROGRAM))
emc2314 commented 5 months ago

You should set CPU model according to #1880.

mu.ctl_set_cpu_model(UC_CPU_X86_EPYC_ROME)

But the example code in #1880 just doesn't work on my computer even after I've set CPU model and I have no idea why...

ntqbit commented 5 months ago

You should set CPU model according to #1880.

mu.ctl_set_cpu_model(UC_CPU_X86_EPYC_ROME)

But the example code in #1880 just doesn't work on my computer even after I've set CPU model and I have no idea why...

Unfortunately, this does not work for me as well. I tried different model values for in ctl_set_cpu_model, neither of them worked. I tried on the example code I provided above.

Nuxar1 commented 5 months ago

Hi, same issue here for me trying to emulate

c5 fe 6f 02             vmovdqu ymm0,YMMWORD PTR [rdx]

I've tried multiple cpu models, none of which worked.