search

unicorn-engine / unicorn

Unicorn CPU emulator framework (ARM, AArch64, M68K, Mips, Sparc, PowerPC, RiscV, S390x, TriCore, X86)
http://www.unicorn-engine.org
GNU General Public License v2.0
7.33k stars 1.31k forks source link

Changing x86 32 bit execution to x86 64 bit and vice versa #1941

Closed OptionalAssistant closed 2 months ago

OptionalAssistant commented 2 months ago

Is it possible to change mode from 32 bit to 64 bit x86 and vice versa?The need for this is for example I face push0x33 ret far which will lead me to 64 bit segment code(for example to perform shellcode syscall within 32 bit application).I can use uc_open in 64 bit mode but it will create new uc_context and i will need to setup my hooks and mem regions again.I found uc_ctl but it seems only can read current mode but not set.

wtdcode commented 2 months ago

I can't see why it's essential to switch modes.

OptionalAssistant commented 2 months ago

I can't see why it's essential to switch modes.

In my opinion it is essential cause that both 32 bit assembly and 32 bit assembly can be present in the same x86 application. For example when someone codes inline syscalls.And he changes from 32 bit to 64 bit code segment through instructions sequence push 0x33 retfar.

wtdcode commented 2 months ago

You are talking about code segments, which has nothing to do with CPU emulation. Just check how ld handles this. But afaik, most x86 code shall be compatible with x64.

From: OptionalAssistant @.> Sent: Friday, April 19, 2024 4:31:42 PM To: unicorn-engine/unicorn @.> Cc: lazymio @.>; Comment @.> Subject: Re: [unicorn-engine/unicorn] Changing x86 32 bit execution to x86 64 bit and vice versa (Issue #1941)

I can't see why it's essential to switch modes.

In my opinion cause it is essential that both 32 bit assembly and 32 bit assembly can be present in the same x86 application. For example when someone codes inline syscalls.And he changes from 32 bit to 64 bit code segment through instructions sequence push 0x33 retfar.

― Reply to this email directly, view it on GitHubhttps://github.com/unicorn-engine/unicorn/issues/1941#issuecomment-2066092877, or unsubscribehttps://github.com/notifications/unsubscribe-auth/AHJULO4PISMJT6YK4I6RJDDY6DI65AVCNFSM6AAAAABGL55YGCVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDANRWGA4TEOBXG4. You are receiving this because you commented.Message ID: @.***>