How to use the unicorn.UC_MODE_THUMB function in unicorn

To help you get started, we’ve selected a few unicorn examples, based on popular ways it is used in public projects.

Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.

github iGio90 / Dwarf / lib / emulator.py View on Github external
def setup_arm(self):
        self.thumb = self.context.pc.thumb
        if self.thumb:
            self._current_cpu_mode = unicorn.UC_MODE_THUMB
            self.cs = Cs(CS_ARCH_ARM, CS_MODE_THUMB)
            self.uc = unicorn.Uc(unicorn.UC_ARCH_ARM, unicorn.UC_MODE_THUMB)
            # Enable VFP instr
            self.uc.mem_map(0x1000, 1024)
            self.uc.mem_write(0x1000, binascii.unhexlify(VFP))
            self.uc.emu_start(0x1000 | 1, 0x1000 + len(VFP))
            self.uc.mem_unmap(0x1000, 1024)
        else:
            self.cs = Cs(CS_ARCH_ARM, CS_MODE_ARM)
            self.uc = unicorn.Uc(unicorn.UC_ARCH_ARM, unicorn.UC_MODE_ARM)
            self._current_cpu_mode = unicorn.UC_MODE_ARM
github hugsy / cemu / cemu / utils.py View on Github external
else:                   arch, mode, endian = unicorn.UC_ARCH_X86, unicorn.UC_MODE_32, unicorn.UC_MODE_LITTLE_ENDIAN

    elif is_x86_64(a):
        if lib=="keystone":     arch, mode, endian = keystone.KS_ARCH_X86, keystone.KS_MODE_64, keystone.KS_MODE_LITTLE_ENDIAN
        elif lib=="capstone":   arch, mode, endian = capstone.CS_ARCH_X86, capstone.CS_MODE_64, capstone.CS_MODE_LITTLE_ENDIAN
        else:                   arch, mode, endian = unicorn.UC_ARCH_X86, unicorn.UC_MODE_64, unicorn.UC_MODE_LITTLE_ENDIAN

    # arm
    elif is_arm(a):
        if lib=="keystone":     arch, mode, endian = keystone.KS_ARCH_ARM, keystone.KS_MODE_ARM, keystone.KS_MODE_LITTLE_ENDIAN
        elif lib=="capstone":   arch, mode, endian = capstone.CS_ARCH_ARM, capstone.CS_MODE_ARM, capstone.CS_MODE_LITTLE_ENDIAN
        else:                   arch, mode, endian = unicorn.UC_ARCH_ARM, unicorn.UC_MODE_ARM, unicorn.UC_MODE_LITTLE_ENDIAN
    elif is_arm_thumb(a):
        if lib=="keystone":     arch, mode, endian = keystone.KS_ARCH_ARM, keystone.KS_MODE_THUMB, keystone.KS_MODE_LITTLE_ENDIAN
        elif lib=="capstone":   arch, mode, endian = capstone.CS_ARCH_ARM, capstone.CS_MODE_THUMB, capstone.CS_MODE_LITTLE_ENDIAN
        else:                   arch, mode, endian = unicorn.UC_ARCH_ARM, unicorn.UC_MODE_THUMB, unicorn.UC_MODE_LITTLE_ENDIAN

    # aarch64
    elif is_aarch64(a):
        if lib=="keystone":     arch, mode, endian = keystone.KS_ARCH_ARM64, 0, keystone.KS_MODE_LITTLE_ENDIAN
        elif lib=="capstone":   arch, mode, endian = capstone.CS_ARCH_ARM64, capstone.CS_MODE_ARM, capstone.CS_MODE_LITTLE_ENDIAN
        else:                   arch, mode, endian = unicorn.UC_ARCH_ARM64, unicorn.UC_MODE_ARM, unicorn.UC_MODE_LITTLE_ENDIAN

    # powerpc (uncomment when unicorn supports ppc)
    # elif is_ppc(m):
    #     if lib=="keystone":     arch, mode, endian = keystone.KS_ARCH_PPC, keystone.KS_MODE_PPC32, keystone.KS_MODE_BIG_ENDIAN
    #     elif lib=="capstone":   arch, mode, endian = capstone.CS_ARCH_PPC, 0, capstone.CS_MODE_BIG_ENDIAN
    #     else:                   arch, mode, endian = unicorn.UC_ARCH_PPC, unicorn.UC_MODE_PPC32, unicorn.UC_MODE_BIG_ENDIAN

    # mips/mips64
    elif is_mips(a):
        if a.endianness==Endianness.LITTLE:
github Ledger-Donjon / rainbow / rainbow / generics / cortexm.py View on Github external
def __init__(self, trace=True, sca_mode=False, local_vars={}):
        super().__init__(trace, sca_mode)
        self.emu = uc.Uc(uc.UC_ARCH_ARM, uc.UC_MODE_THUMB | uc.UC_MODE_MCLASS)
        self.disasm = cs.Cs(cs.CS_ARCH_ARM, cs.CS_MODE_THUMB | cs.CS_MODE_MCLASS)
        self.disasm.detail = True
        self.word_size = 4
        self.endianness = "little"
        self.page_size = self.emu.query(uc.UC_QUERY_PAGE_SIZE)
        self.page_shift = self.page_size.bit_length() - 1
        self.pc = uc.arm_const.UC_ARM_REG_PC

        known_regs = [i[len('UC_ARM_REG_'):] for i in dir(uc.arm_const) if '_REG' in i]
        self.reg_map = {r.lower(): getattr(uc.arm_const, 'UC_ARM_REG_'+r) for r in known_regs}

        self.stubbed_functions = local_vars
        self.setup(sca_mode)

        self.reset_stack()
        # Force mapping of those addresses so that
github iGio90 / Dwarf / lib / emulator.py View on Github external
def setup_arm(self):
        self.thumb = self.context.pc.thumb
        if self.thumb:
            self._current_cpu_mode = unicorn.UC_MODE_THUMB
            self.cs = Cs(CS_ARCH_ARM, CS_MODE_THUMB)
            self.uc = unicorn.Uc(unicorn.UC_ARCH_ARM, unicorn.UC_MODE_THUMB)
            # Enable VFP instr
            self.uc.mem_map(0x1000, 1024)
            self.uc.mem_write(0x1000, binascii.unhexlify(VFP))
            self.uc.emu_start(0x1000 | 1, 0x1000 + len(VFP))
            self.uc.mem_unmap(0x1000, 1024)
        else:
            self.cs = Cs(CS_ARCH_ARM, CS_MODE_ARM)
            self.uc = unicorn.Uc(unicorn.UC_ARCH_ARM, unicorn.UC_MODE_ARM)
            self._current_cpu_mode = unicorn.UC_MODE_ARM
github iGio90 / frick / main.py View on Github external
def hook_mem_unmapped(self, uc, access, address, size, value, user_data):
        if self.report:
            self.write_to_session('%sreading to an unmapped memory region at '
                                  '<span style="color: #C36969">0x%x</span>' % (self.apix, address))
        uc.emu_stop()
        map_len = self.map_region_by_addr(address)
        if map_len &gt; 0:
            start_addr = self.current_address
            if self.cli.context_manager.get_arch().get_unicorn_mode() == unicorn.UC_MODE_THUMB:
                start_addr += 1
            uc.emu_start(start_addr, start_addr + self.cli.context_manager.get_pointer_size())
github pwndbg / pwndbg / pwndbg / emu / emulator.py View on Github external
def get_uc_mode(self):
        """
        Retrieve the mode used by Unicorn for the current architecture.
        """
        arch = pwndbg.arch.current
        mode = 0

        if arch == 'armcm':
            mode |= (U.UC_MODE_MCLASS | U.UC_MODE_THUMB) if (pwndbg.regs.xpsr &amp; (1&lt;&lt;24)) else U.UC_MODE_MCLASS

        elif arch in ('arm', 'aarch64'):
            mode |= U.UC_MODE_THUMB if (pwndbg.regs.cpsr &amp; (1&lt;&lt;5)) else U.UC_MODE_ARM

        else:
            mode |= {4:U.UC_MODE_32, 8:U.UC_MODE_64}[pwndbg.arch.ptrsize]

        if pwndbg.arch.endian == 'little':
            mode |= U.UC_MODE_LITTLE_ENDIAN
        else:
            mode |= U.UC_MODE_BIG_ENDIAN

        return mode
github smuniz / pimp_my_ride / pimp_my_ride.py View on Github external
"r24"   : UC_ARM64_REG_W24, #= 223
                    "r25"   : UC_ARM64_REG_W25, #= 224
                    "r26"   : UC_ARM64_REG_W26, #= 225
                    "r27"   : UC_ARM64_REG_W27, #= 226
                    "r28"   : UC_ARM64_REG_W28, #= 227

                    "r29"   : UC_ARM64_REG_W29, #= 1
                    "r30"   : UC_ARM64_REG_W30, #= 2

                    "r31"    : UC_ARM64_REG_SP, #= 4
                    "sp"    : UC_ARM64_REG_SP, #= 4
                    #"xzr"   : UC_ARM64_REG_XZR, #= 7

                    "pc"    : UC_ARM64_REG_PC, #= 260
                    }
            elif self.mode == uc.UC_MODE_THUMB:
                raise Exception("Register map for ARM thumb-mode not implemented")

        else:
            raise Exception("Register map not implemented")

        return reg_map.get(reg_name, 0x11223344)