test: add emulator hook tests (and fix related bugs)

Author: msm-code

ghidralib.py

@@ -698,6 +698,9 @@ def name(self):
 class Varnode(GhidraWrapper):
     @property
     def has_value(self):  # type: () -> bool
+        """Return true if this varnode can be converted to a integer value.
+
+        In particuler, this will return true for Address and Constant varnodes"""
         return self.is_address or self.is_constant
 
     @property
@@ -799,11 +802,15 @@ def simple(self):  # type: () -> int|str
         if self.has_value:
             return self.value
         elif self.is_register:
-            return self.as_register
+            if self.is_named_register:
+                return self.as_register
+            return "reg:{:x}:{:x}".format(self.offset, self.size)
         elif self.is_unique:
-            return "uniq:{:x}".format(self.offset)
+            return "uniq:{:x}:{:x}".format(self.offset, self.size)
         elif self.is_hash:
-            return "hash:{:x}".format(self.offset)
+            return "hash:{:x}:{:x}".format(self.offset, self.size)
+        elif self.is_stack:
+            return "stack:{:x}:{:x}".format(self.offset, self.size)
         raise RuntimeError("Unknown varnode type")
 
     @property
@@ -2552,10 +2559,22 @@ class Symbol(GhidraWrapper):
     """Wraps a Ghidra Symbol object."""
 
     @staticmethod
-    def __get_thunk_if_it_exists(external_symbol):  # type: (JavaObject) -> JavaObject
+    def resolve_thunk_if_exists(external_symbol):  # type: (JavaObject) -> JavaObject
         """Returns a function thunk leading to a passed external symbol, if it exists.
 
-        If there is no function thunk, original symbol is returned."""
+        If there is no function thunk, original symbol is returned.
+
+        Why is this ugly thing here? Well, we want to support external symbols,
+        especially external functions. Thunks are much more useful for us when
+        thinking in context of the analysed program - when Linux program calls
+        `printf` it jumps to the appropriate `printf` thunk, not to libc
+        directly. So this is the location that we want to patch/hook/trace/etc when
+        thinking about printf. But the thing is that Ghidra SymbolTable API will
+        not even return thunks! So we trace the external function references, and
+        return the first (almost certainly only) Thunk reference.
+
+        :param external_symbol: Symbol to find thunk for (if it exists).
+        """
         xrefs = list(external_symbol.getReferences())
         for xref in xrefs:
             if xref.getReferenceType() == GhRefType.THUNK:
@@ -2565,6 +2584,27 @@ def __get_thunk_if_it_exists(external_symbol):  # type: (JavaObject) -> JavaObje
                     return thunk
         return external_symbol
 
+    @staticmethod
+    def resolve_external(external_symbol):  # type: (JavaObject) -> int
+        """Resolves an external address to a RAM location, if possible.
+
+        If the symbol has no RAM location, just return its offset.
+
+        Why is this ugly thing here? Again, we want to support external symbols, and
+        we are interested in their RAM address in the program address space. In some
+        cases, Ghidra will give an external address a "location" in the RAM space.
+        So, for example, if current program jumps to that external function (or read
+        that external variable etc), it will read that location as far as Ghidra is
+        concerned (for example, Emulator will use it for calls). This is important
+        for emulating Windows binaries, that use address tables for imports.
+
+        :param external_symbol: External symbol to resolve."""
+        external_manager = Program.current().getExternalManager()
+        ram_addr = external_manager.getExternalLocation(external_symbol).getAddress()
+        if ram_addr:
+            return ram_addr.getOffset()
+        return external_symbol.getAddress().getOffset()
+
     @staticmethod
     def get(raw_or_name):  # type: (JavaObject|str|Addr) -> Symbol|None
         """Get a symbol with the provided name or at the provided address.
@@ -2582,7 +2622,7 @@ def get(raw_or_name):  # type: (JavaObject|str|Addr) -> Symbol|None
                 return None
             raw = symbols[0]
             if raw.isExternal():
-                raw = Symbol.__get_thunk_if_it_exists(raw)
+                raw = Symbol.resolve_thunk_if_exists(raw)
         elif can_resolve(raw_or_name):
             raw = (
                 Program.current()
@@ -2625,6 +2665,8 @@ def remove(address, name):  # type: (Addr, str) -> None
     @property
     def address(self):  # type: () -> int
         """Get the address of this symbol."""
+        if self.is_external:
+            return Symbol.resolve_external(self.raw)
         return self.raw.getAddress().getOffset()
 
     @property
@@ -2812,11 +2854,11 @@ def add_hook(
         self._hooks[addr] = hook
 
     def has_hook_at(self, address):  # type: (Addr) -> bool
-        addr = resolve(address)
+        addr = resolve(address).getOffset()
         return addr in self._hooks
 
     def delete_hook_at(self, address):  # type: (Addr) -> None
-        addr = resolve(address)
+        addr = resolve(address).getOffset()
         del self._hooks[addr]
 
     @property

tests/ghidralib_test.py

@@ -382,13 +382,13 @@ def test_function():
     assert func.repeatable_comment == ""
 
     assert len(func.parameters) == 0
-    assert len(func.local_variables) > 3
+    assert len(func.local_variables) >= 3
     assert func.local_variables[0].raw
-    assert len(func.variables) > 3
+    assert len(func.variables) >= 3
     assert func.variables[0].raw
-    assert len(func.varnodes) > 3
+    assert len(func.varnodes) >= 3
     assert func.varnodes[0].raw
-    assert len(func.high_variables) > 3
+    assert len(func.high_variables) >= 3
     assert func.high_variables[0].raw
     assert len(func.stack) > 1
     assert func.stack[0].raw
@@ -472,6 +472,8 @@ def test_symbol():
     assert Symbol.get("bar") is None
     assert Symbol.get(0x00403CDE) is None
 
+    assert Symbol("wsprintfA").address == 0xB8AA  # Resolve external address
+
 
 ###############################################################
 # Test DataType
@@ -548,6 +550,20 @@ def test_emulator():
     emu.emulate_while(fnc.entrypoint, lambda e: e.pc in fnc.body)
     assert emu.read_unicode(emu["eax"]) == "HKEY_CLASSES_ROOT"
 
+    mock_executed = [False]
+
+    def nullsub(emu):
+        mock_executed[0] = True
+        emu.pc = emu.read_u64(emu.sp)
+        emu.sp += 8
+        return True
+
+    fun = Function(0x406035)
+    emu = Emulator()
+    emu.add_hook("lstrcpynW", nullsub)
+    emu.emulate(fun.entrypoint, fun.exitpoints)
+    assert mock_executed[0]
+
 
 ###############################################################
 # Test Program