diff --git a/bindings/dotnet/Unicorn/Const/UcError.fs b/bindings/dotnet/Unicorn/Const/UcError.fs deleted file mode 100644 index af1d5eba..00000000 --- a/bindings/dotnet/Unicorn/Const/UcError.fs +++ /dev/null @@ -1,51 +0,0 @@ -(* - -.NET bindings for the UnicornEngine Emulator Engine - -Copyright(c) 2015 Antonio Parata - -This program is free software; you can redistribute it and/or -modify it under the terms of the GNU General Public License -version 2 as published by the Free Software Foundation. - -This program is distributed in the hope that it will be useful, -but WITHOUT ANY WARRANTY; without even the implied warranty of -MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -GNU General Public License for more details. - -You should have received a copy of the GNU General Public License -along with this program; if not, write to the Free Software -Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. - -*) - -namespace UnicornEngine.Const - -open System - -module UcError = - - let toErrorDesc(err: Int32) = - match err with - | 0 -> "UC_ERR_OK" - | 1 -> "UC_ERR_NOMEM" - | 2 -> "UC_ERR_ARCH" - | 3 -> "UC_ERR_HANDLE" - | 4 -> "UC_ERR_MODE" - | 5 -> "UC_ERR_VERSION" - | 6 -> "UC_ERR_READ_INVALID" - | 7 -> "UC_ERR_WRITE_INVALID" - | 8 -> "UC_ERR_FETCH_INVALID" - | 9 -> "UC_ERR_CODE_INVALID" - | 10 -> "UC_ERR_HOOK" - | 11 -> "UC_ERR_INSN_INVALID" - | 12 -> "UC_ERR_MAP" - | 13 -> "UC_ERR_WRITE_PROT" - | 14 -> "UC_ERR_READ_PROT" - | 15 -> "UC_ERR_FETCH_PROT" - | 16 -> "UC_ERR_ARG" - | 17 -> "UC_ERR_READ_UNALIGNED" - | 18 -> "UC_ERR_WRITE_UNALIGNED" - | 19 -> "UC_ERR_FETCH_UNALIGNED" - | _ -> String.Empty - diff --git a/bindings/dotnet/Unicorn/NativeUnicorn.fs b/bindings/dotnet/Unicorn/NativeUnicorn.fs index e8bb6a1c..930309ea 100644 --- a/bindings/dotnet/Unicorn/NativeUnicorn.fs +++ b/bindings/dotnet/Unicorn/NativeUnicorn.fs @@ -64,6 +64,9 @@ module NativeUnicornEngine = [] extern Int32 uc_errno(UIntPtr eng) + [] + extern IntPtr uc_strerror(Int32 err) + [] extern Int32 uc_hook_add_noarg(UIntPtr eng, UIntPtr hh, Int32 callbackType, UIntPtr callback, IntPtr userData) @@ -86,6 +89,7 @@ module NativeUnicornEngine = let mutable emu_stop = fun(eng) -> Imported.uc_emu_stop(eng) let mutable arch_supported = fun(arch) -> Imported.uc_arch_supported(arch) let mutable errno = fun(eng) -> Imported.uc_errno(eng) + let mutable strerror = fun(err) -> Imported.uc_strerror(err) let mutable hook_add_noarg = fun(eng, hh, callbackType, callback, userData) -> Imported.uc_hook_add_noarg(eng, hh, callbackType, callback, userData) let mutable hook_add_arg0 = fun(eng, hh, callbackType, callback, userData, arg0) -> Imported.uc_hook_add_arg0(eng, hh, callbackType, callback, userData, arg0) let mutable hook_add_arg0_arg1 = fun(eng, hh, callbackType, callback, userData, arg0, arg1) -> Imported.uc_hook_add_arg0_arg1(eng, hh, callbackType, callback, userData, arg0, arg1) \ No newline at end of file diff --git a/bindings/dotnet/Unicorn/Unicorn.fs b/bindings/dotnet/Unicorn/Unicorn.fs index 2bddbede..7e4e34bd 100644 --- a/bindings/dotnet/Unicorn/Unicorn.fs +++ b/bindings/dotnet/Unicorn/Unicorn.fs @@ -55,7 +55,7 @@ and Unicorn(arch: Int32, mode: Int32) = let mutable _eng = [|UIntPtr.Zero|] let checkResult(errCode: Int32, errMsg: String) = - if errCode <> Common.UC_ERR_OK then raise(ApplicationException(errMsg + ". Error: " + UcError.toErrorDesc(errCode))) + if errCode <> Common.UC_ERR_OK then raise(ApplicationException(String.Format("{0}. Error: {1}", errMsg, errCode))) let getId = let counter = ref 0 @@ -103,9 +103,9 @@ and Unicorn(arch: Int32, mode: Int32) = member this.ErrNo() = NativeUnicornEngine.errno(_eng.[0]) - member this.StrError() = - // TODO: to be implemented - raise(NotImplementedException()) + member this.StrError(errorNo: Int32) = + let errorStringPointer = NativeUnicornEngine.strerror(errorNo) + Marshal.PtrToStringAnsi(errorStringPointer) member this.AddCodeHook(callback: CodeHook, userData: Object, beginAdd: UInt64, endAddr: UInt64) = let trampoline(u: IntPtr) (addr: UInt64) (size: Int32) (user: IntPtr) = diff --git a/bindings/dotnet/UnicornTests/Program.cs b/bindings/dotnet/UnicornTests/Program.cs index 191e4e78..dde8d1e8 100644 --- a/bindings/dotnet/UnicornTests/Program.cs +++ b/bindings/dotnet/UnicornTests/Program.cs @@ -29,149 +29,11 @@ namespace UnicornTests { class Program { - private const UInt64 ADDRESS = 0x1000000; - - private static Byte[] X86_CODE32_SELF = - { - 0xeb, 0x19, 0x31, 0xc0, 0x31, 0xdb, 0x31, 0xd2, 0x31, 0xc9, 0xb0, 0x04, 0xb3, 0x01, 0x59, 0xb2, 0x05, 0xcd, - 0x80, 0x31, 0xc0, 0xb0, 0x01, 0x31, 0xdb, 0xcd, 0x80, 0xe8, 0xe2, 0xff, 0xff, 0xff, 0x68, 0x65, 0x6c, 0x6c, - 0x6f - }; - - private static UInt64 ToInt(Byte[] val) - { - UInt64 res = 0; - for (var i = 0; i < val.Length; i++) - { - var v = val[i] & 0xFF; - res += (UInt64)(v << (i * 8)); - } - return res; - } - - private static void CheckError(Int32 err) - { - if (err != Common.UC_ERR_OK) - { - throw new ApplicationException("Operation failed, error: " + UcError.toErrorDesc(err)); - } - } - - private static Byte[] Int64ToBytes(UInt64 intVal) - { - var res = new Byte[8]; - for (var i = 0; i < res.Length; i++) - { - res[i] = (Byte)(intVal & 0xff); - intVal = intVal >> 8; - } - return res; - } - - private static void CodeHookCallback(Unicorn u, UInt64 addr, Int32 size, Object userData) - { - Console.Write("Tracing >>> 0x{0} ", addr.ToString("X")); - - var eipBuffer = new Byte[4]; - CheckError(u.RegRead(X86.UC_X86_REG_EIP, eipBuffer)); - - var effectiveSize = Math.Min(16, size); - var tmp = new Byte[effectiveSize]; - CheckError(u.MemRead(addr, tmp)); - - foreach (var t in tmp) - { - Console.Write("{0} ", (0xFF & t).ToString("X")); - } - - Console.WriteLine(); - } - - private static void InterruptHookCallback(Unicorn u, Int32 intNumber, Object userData) - { - // only handle Linux syscall - if (intNumber != 0x80) - { - return; - } - - var eaxBuffer = new Byte[4]; - var eipBuffer = new Byte[4]; - - CheckError(u.RegRead(X86.UC_X86_REG_EAX, eaxBuffer)); - CheckError(u.RegRead(X86.UC_X86_REG_EIP, eipBuffer)); - - var eax = ToInt(eaxBuffer); - var eip = ToInt(eipBuffer); - - switch (eax) - { - default: - Console.WriteLine("Interrupt >>> 0x{0} num {1}, EAX=0x{2}", eip.ToString("X"), intNumber.ToString("X"), eax.ToString("X")); - break; - case 1: // sys_exit - Console.WriteLine("Interrupt >>> 0x{0} num {1}, SYS_EXIT", eip.ToString("X"), intNumber.ToString("X")); - u.EmuStop(); - break; - case 4: // sys_write - - // ECX = buffer address - var ecxBuffer = new Byte[4]; - - // EDX = buffer size - var edxBuffer = new Byte[4]; - - CheckError(u.RegRead(X86.UC_X86_REG_ECX, ecxBuffer)); - CheckError(u.RegRead(X86.UC_X86_REG_EDX, edxBuffer)); - - var ecx = ToInt(ecxBuffer); - var edx = ToInt(edxBuffer); - - // read the buffer in - var size = Math.Min(256, edx); - var buffer = new Byte[size]; - CheckError(u.MemRead(ecx, buffer)); - var content = Encoding.Default.GetString(buffer); - - Console.WriteLine( - "Interrupt >>> 0x{0}: num {1}, SYS_WRITE. buffer = 0x{2}, size = , content = '{3}'", - eip.ToString("X"), - ecx.ToString("X"), - edx.ToString("X"), - content); - - break; - } - } - static void Main(String[] args) { - var u = new Unicorn(Common.UC_ARCH_X86, Common.UC_MODE_32); - Console.WriteLine("Unicorn version: {0}", u.Version()); - - // map 2MB of memory for this emulation - CheckError(u.MemMap(ADDRESS, new UIntPtr(2 * 1024 * 1024), Common.UC_PROT_ALL)); - - // write machine code to be emulated to memory - CheckError(u.MemWrite(ADDRESS, X86_CODE32_SELF)); - - // initialize machine registers - CheckError(u.RegWrite(X86.UC_X86_REG_ESP, Int64ToBytes(ADDRESS + 0x200000))); - - // tracing all instructions by having @begin > @end - CheckError(u.AddCodeHook(CodeHookCallback, null, 1, 0).Item1); - - // handle interrupt ourself - CheckError(u.AddInterruptHook(InterruptHookCallback, null).Item1); - - Console.WriteLine(); - Console.WriteLine(">>> Start tracing linux code"); - - // emulate machine code in infinite time - u.EmuStart(ADDRESS, ADDRESS + (UInt64)X86_CODE32_SELF.Length, 0u, new UIntPtr(0)); - - Console.WriteLine(); - Console.WriteLine(">>> Emulation Done!"); + // Run all shellcode tests + ShellcodeTest.TestX86Code32Self(); + ShellcodeTest.TestX86Code32(); } } } diff --git a/bindings/dotnet/UnicornTests/ShellcodeTest.cs b/bindings/dotnet/UnicornTests/ShellcodeTest.cs new file mode 100644 index 00000000..bba47f29 --- /dev/null +++ b/bindings/dotnet/UnicornTests/ShellcodeTest.cs @@ -0,0 +1,168 @@ +using System; +using System.Collections.Generic; +using System.Linq; +using System.Reflection; +using System.Text; +using System.Threading.Tasks; +using UnicornEngine; +using UnicornEngine.Const; + +namespace UnicornTests +{ + internal class ShellcodeTest + { + private const UInt64 ADDRESS = 0x1000000; + + public static void TestX86Code32Self() + { + Byte[] X86_CODE32_SELF = + { + 0xeb, 0x1c, 0x5a, 0x89, 0xd6, 0x8b, 0x02, 0x66, 0x3d, 0xca, 0x7d, 0x75, 0x06, 0x66, 0x05, 0x03, 0x03, + 0x89, 0x02, 0xfe, 0xc2, 0x3d, 0x41, 0x41, 0x41, 0x41, 0x75, 0xe9, 0xff, 0xe6, 0xe8, 0xdf, 0xff, 0xff, + 0xff, 0x31, 0xd2, 0x6a, 0x0b, 0x58, 0x99, 0x52, 0x68, 0x2f, 0x2f, 0x73, 0x68, 0x68, 0x2f, 0x62, 0x69, + 0x6e, 0x89, 0xe3, 0x52, 0x53, 0x89, 0xe1, 0xca, 0x7d, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41 + }; + + Console.WriteLine(); + Console.WriteLine("*** Start Shellcode: " + MethodInfo.GetCurrentMethod().Name); + RunTest(X86_CODE32_SELF, ADDRESS); + Console.WriteLine("End Shellcode: " + MethodInfo.GetCurrentMethod().Name); + Console.WriteLine(); + } + + public static void TestX86Code32() + { + Byte[] X86_CODE32 = + { + 0xeb, 0x19, 0x31, 0xc0, 0x31, 0xdb, 0x31, 0xd2, 0x31, 0xc9, 0xb0, 0x04, 0xb3, 0x01, 0x59, 0xb2, 0x05, + 0xcd, 0x80, 0x31, 0xc0, 0xb0, 0x01, 0x31, 0xdb, 0xcd, 0x80, 0xe8, 0xe2, 0xff, 0xff, 0xff, 0x68, 0x65, + 0x6c, 0x6c, 0x6f + }; + + Console.WriteLine(); + Console.WriteLine("*** Start Shellcode: " + MethodInfo.GetCurrentMethod().Name); + RunTest(X86_CODE32, ADDRESS); + Console.WriteLine("End Shellcode: " + MethodInfo.GetCurrentMethod().Name); + Console.WriteLine(); + } + + + public static void RunTest(Byte[] code, UInt64 address) + { + var u = new Unicorn(Common.UC_ARCH_X86, Common.UC_MODE_32); + Console.WriteLine("Unicorn version: {0}", u.Version()); + + // map 2MB of memory for this emulation + Utils.CheckError(u.MemMap(address, new UIntPtr(2 * 1024 * 1024), Common.UC_PROT_ALL)); + + // write machine code to be emulated to memory + Utils.CheckError(u.MemWrite(address, code)); + + // initialize machine registers + Utils.CheckError(u.RegWrite(X86.UC_X86_REG_ESP, Utils.Int64ToBytes(address + 0x200000))); + + // tracing all instructions by having @begin > @end + Utils.CheckError(u.AddCodeHook(CodeHookCallback, null, 1, 0).Item1); + + // handle interrupt ourself + Utils.CheckError(u.AddInterruptHook(InterruptHookCallback, null).Item1); + + // handle SYSCALL + Utils.CheckError(u.AddSyscallHook(SyscallHookCallback, null).Item1); + + Console.WriteLine(">>> Start tracing linux code"); + + // emulate machine code in infinite time + u.EmuStart(address, address + (UInt64)code.Length, 0u, new UIntPtr(0)); + + Console.WriteLine(">>> Emulation Done!"); + } + + private static void CodeHookCallback(Unicorn u, UInt64 addr, Int32 size, Object userData) + { + Console.Write("Tracing >>> 0x{0} ", addr.ToString("X")); + + var eipBuffer = new Byte[4]; + Utils.CheckError(u.RegRead(X86.UC_X86_REG_EIP, eipBuffer)); + + var effectiveSize = Math.Min(16, size); + var tmp = new Byte[effectiveSize]; + Utils.CheckError(u.MemRead(addr, tmp)); + + foreach (var t in tmp) + { + Console.Write("{0} ", (0xFF & t).ToString("X")); + } + + Console.WriteLine(); + } + + private static void SyscallHookCallback(Unicorn u, Object userData) + { + var eaxBuffer = new Byte[4]; + Utils.CheckError(u.RegRead(X86.UC_X86_REG_EAX, eaxBuffer)); + var eax = Utils.ToInt(eaxBuffer); + + Console.WriteLine("Syscall >>> EAX = 0x{0}", eax.ToString("X")); + + u.EmuStop(); + } + + private static void InterruptHookCallback(Unicorn u, Int32 intNumber, Object userData) + { + // only handle Linux syscall + if (intNumber != 0x80) + { + return; + } + + var eaxBuffer = new Byte[4]; + var eipBuffer = new Byte[4]; + + Utils.CheckError(u.RegRead(X86.UC_X86_REG_EAX, eaxBuffer)); + Utils.CheckError(u.RegRead(X86.UC_X86_REG_EIP, eipBuffer)); + + var eax = Utils.ToInt(eaxBuffer); + var eip = Utils.ToInt(eipBuffer); + + switch (eax) + { + default: + Console.WriteLine("Interrupt >>> 0x{0} num {1}, EAX=0x{2}", eip.ToString("X"), intNumber.ToString("X"), eax.ToString("X")); + break; + case 1: // sys_exit + Console.WriteLine("Interrupt >>> 0x{0} num {1}, SYS_EXIT", eip.ToString("X"), intNumber.ToString("X")); + u.EmuStop(); + break; + case 4: // sys_write + + // ECX = buffer address + var ecxBuffer = new Byte[4]; + + // EDX = buffer size + var edxBuffer = new Byte[4]; + + Utils.CheckError(u.RegRead(X86.UC_X86_REG_ECX, ecxBuffer)); + Utils.CheckError(u.RegRead(X86.UC_X86_REG_EDX, edxBuffer)); + + var ecx = Utils.ToInt(ecxBuffer); + var edx = Utils.ToInt(edxBuffer); + + // read the buffer in + var size = Math.Min(256, edx); + var buffer = new Byte[size]; + Utils.CheckError(u.MemRead(ecx, buffer)); + var content = Encoding.Default.GetString(buffer); + + Console.WriteLine( + "Interrupt >>> 0x{0}: num {1}, SYS_WRITE. buffer = 0x{2}, size = , content = '{3}'", + eip.ToString("X"), + ecx.ToString("X"), + edx.ToString("X"), + content); + + break; + } + } + } +} diff --git a/bindings/dotnet/UnicornTests/UnicornTests.csproj b/bindings/dotnet/UnicornTests/UnicornTests.csproj index 1d17dd61..dfb6bdf1 100644 --- a/bindings/dotnet/UnicornTests/UnicornTests.csproj +++ b/bindings/dotnet/UnicornTests/UnicornTests.csproj @@ -45,6 +45,8 @@ + + diff --git a/bindings/dotnet/UnicornTests/Utils.cs b/bindings/dotnet/UnicornTests/Utils.cs new file mode 100644 index 00000000..882e8ded --- /dev/null +++ b/bindings/dotnet/UnicornTests/Utils.cs @@ -0,0 +1,42 @@ +using System; +using System.Collections.Generic; +using System.Linq; +using System.Text; +using System.Threading.Tasks; +using UnicornEngine.Const; + +namespace UnicornTests +{ + internal static class Utils + { + public static UInt64 ToInt(Byte[] val) + { + UInt64 res = 0; + for (var i = 0; i < val.Length; i++) + { + var v = val[i] & 0xFF; + res += (UInt64)(v << (i * 8)); + } + return res; + } + + public static void CheckError(Int32 err) + { + if (err != Common.UC_ERR_OK) + { + throw new ApplicationException("Operation failed, error: " + err); + } + } + + public static Byte[] Int64ToBytes(UInt64 intVal) + { + var res = new Byte[8]; + for (var i = 0; i < res.Length; i++) + { + res[i] = (Byte)(intVal & 0xff); + intVal = intVal >> 8; + } + return res; + } + } +}