[unicorn-engine] IP wonky after UC_ERR_READ_UNMAPPED

  • From: Manduca <manduca@xxxxxxxxxxx>
  • To: unicorn-engine@xxxxxxxxxxxxx
  • Date: Tue, 23 Jan 2018 11:33:27 +0100

Hi guys,

I use unicorn to emulate x86 code.

It encounters problematic instruction

mov eax, dword ptr fs:[0]

and throws UC_ERR_READ_UNMAPPED.

Not surprising, that selector probably points nowhere.

But when I do reg_read(EIP), it gives me the address of a harmless
instruction 0xF bytes back.

When I do UC_HOOK_CODE I get correct IPs until the end.

But once the exception hits, I'm 0xF bytes back, why?


Thanks!

M.


Other related posts: