uc_ctl_remove_cache() causes memory leak

[yakamoz423]

Original title: Failed to uc_emu_start: Unhandled CPU exception (UC_ERR_EXCEPTION)

To reproduce:

1. open unicorn as AArch64 target
2. mem_map 0xC3053000[4096]
3. write instr opcode 0xd100071b(SUB) to address 0xc3053bfc
4. uc_emu_start to single step
5. get PC reg value, it is 0xc3053bfc+4
6. write the same instr opcode to address 0xc3053bfc+4
7. uc_emu_start again, but it reports UC_ERR_EXCEPTION

I'm confused if there was anything wrong, and how to obtian the detials of inner engine exception?

My code:

    uc_engine* uc;
    uc_err err;
    uint32_t data1;
    uint64_t data2;

    err = uc_open(UC_ARCH_ARM64, 0, &uc);
    if (err) {
        printf("Failed to open: %s\n", uc_strerror(err));
    }

    err = uc_mem_map(uc, 0xc3053bfc >> 12 << 12, 4 * 1024, UC_PROT_ALL);
    if (err) {
        printf("Failed to mem_map: %s\n", uc_strerror(err));
    }

    data1 = 0xd100071b;  // sub    x27, x24, #1
    err = uc_mem_write(uc, 0xc3053bfc, &data1, sizeof(data1));
    if (err) {
        printf("Failed to mem_write: %s\n", uc_strerror(err));
    }

    err = uc_emu_start(uc, 0xc3053bfc, -1, 0, 1);
    if (err) {
        printf("Failed to emu_start1: %s\n", uc_strerror(err));
    }

    err = uc_reg_read(uc, UC_ARM64_REG_PC, &data2);
    if (err) {
        printf("Failed to reg_read: %s\n", uc_strerror(err));
    }
    printf("%llx\n", data2);

    data1 = 0xd100071b; 
    err = uc_mem_write(uc, 0xc3053c00, &data1, sizeof(data1));
    if (err) {
        printf("Failed to mem_write: %s\n", uc_strerror(err));
    }

    err = uc_emu_start(uc, 0xc3053c00, -1, 0, 1);
    if (err) {
        printf("Failed to emu_start2: %s\n", uc_strerror(err));
    }

    err = uc_reg_read(uc, UC_ARM64_REG_PC, &data2);
    if (err) {
        printf("Failed to reg_read: %s\n", uc_strerror(err));
    }
    printf("%llx\n", data2);

Output:

c3053c00
Failed to emu_start2: Unhandled CPU exception (UC_ERR_EXCEPTION)
c3053c00

[yakamoz423]

I noticed https://github.com/unicorn-engine/unicorn/wiki/FAQ#editing-an-instruction-doesnt-take-effecthooks-added-during-emulation-are-not-called
After doing this, it is resolved.

[yakamoz423]

Now my new code is:

    uc_engine* uc;
    uc_err err;
    uint32_t data1;
    uint64_t data2;

do {

    err = uc_open(UC_ARCH_ARM64, 0, &uc);
    if (err) {
        printf("Failed to open: %s\n", uc_strerror(err));
    }

    err = uc_mem_map(uc, 0xc3053bfc >> 12 << 12, 4 * 1024, UC_PROT_ALL);
    if (err) {
        printf("Failed to mem_map: %s\n", uc_strerror(err));
    }

    data1 = 0xd100071b;  // sub    x27, x24, #1
    err = uc_mem_write(uc, 0xc3053bfc, &data1, sizeof(data1));
    if (err) {
        printf("Failed to mem_write: %s\n", uc_strerror(err));
    }

    err = uc_emu_start(uc, 0xc3053bfc, -1, 0, 1);
    if (err) {
        printf("Failed to emu_start1: %s\n", uc_strerror(err));
    }

    err = uc_reg_read(uc, UC_ARM64_REG_PC, &data2);
    if (err) {
        printf("Failed to reg_read: %s\n", uc_strerror(err));
    }
    // printf("%llx\n", data2);

    data1 = 0xd100071b;
    err = uc_mem_write(uc, 0xc3053c00, &data1, sizeof(data1));
    if (err) {
        printf("Failed to mem_write: %s\n", uc_strerror(err));
    }

    uc_ctl_remove_cache(uc, 0xc3053c00, 0xc3053c04);

    err = uc_emu_start(uc, 0xc3053c00, -1, 0, 1);
    if (err) {
        printf("Failed to emu_start2: %s\n", uc_strerror(err));
    }

    err = uc_reg_read(uc, UC_ARM64_REG_PC, &data2);
    if (err) {
        printf("Failed to reg_read: %s\n", uc_strerror(err));
    }
    // printf("%llx\n", data2);

    usleep(1000);

} while (1);

Build and run, the process memory alloc are continuously increasing, and crashed soon.

If replaced uc_ctl_remove_cache with uc_ctl_flush_tb, It will work. But the simulation speed has significantly decreased.

[yakamoz423]

my fault