Skip to content

Commit 88491a8

Browse files
author
RTOSploit
committed
fix: Unicorn memory mapping for ELFs with address gaps, fix constant names
- Skip firmware sections in SRAM/peripheral/system register ranges to avoid double-mapping in Unicorn - Check for page overlap before mapping to prevent UC_ERR_MAP - Fix _PERIPHERAL_START/_END constant names to match existing _PERIPH_* - Fix detection.engine import path in CI pipeline - Verified: vuln-firmware.elf and Particle Argon both fuzz at ~700 exec/sec
1 parent 4ae3cd0 commit 88491a8

1 file changed

Lines changed: 28 additions & 4 deletions

File tree

rtosploit/peripherals/unicorn_engine.py

Lines changed: 28 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -127,16 +127,41 @@ def setup(self) -> None:
127127
self._mapped_pages.clear()
128128

129129
# Map memory regions from firmware sections
130+
# Skip sections in ranges we map explicitly (SRAM, peripheral, system regs)
131+
_SKIP_RANGES = [
132+
(0x20000000, 0x20000000 + self._sram_size), # SRAM (mapped below)
133+
(_PERIPH_START, _PERIPH_END), # Peripheral MMIO (unmapped for PIP)
134+
(_SYSTEM_REG_START, _SYSTEM_REG_END), # System registers (mapped below)
135+
]
136+
130137
if self._firmware.sections:
131138
for section in self._firmware.sections:
132-
if not section.data:
139+
if not section.data or len(section.data) == 0:
140+
continue
141+
142+
# Skip sections in explicitly managed ranges
143+
skip = False
144+
for range_start, range_end in _SKIP_RANGES:
145+
if section.address >= range_start and section.address < range_end:
146+
skip = True
147+
break
148+
if skip:
133149
continue
150+
134151
# Align to 4KB page boundary
135152
base = section.address & ~0xFFF
136-
end = section.address + section.size
153+
end = section.address + len(section.data)
137154
size = ((end - base) + 0xFFF) & ~0xFFF
138155
size = max(size, 0x1000)
139156

157+
# Check for overlap with already-mapped pages
158+
overlap = any(
159+
page in self._mapped_pages
160+
for page in range(base, base + size, 0x1000)
161+
)
162+
if overlap:
163+
continue
164+
140165
# Determine permissions
141166
perms = section.permissions if hasattr(section, 'permissions') else "rx"
142167
uc_perms = 0
@@ -150,11 +175,10 @@ def setup(self) -> None:
150175
try:
151176
uc.mem_map(base, size, uc_perms or 7)
152177
uc.mem_write(section.address, section.data)
153-
# Track mapped pages
154178
for page in range(base, base + size, 0x1000):
155179
self._mapped_pages.add(page)
156180
except Exception:
157-
pass # Region may overlap, skip
181+
pass # Skip on any mapping error
158182
else:
159183
# Raw binary: map at base address with R+X
160184
base = self._firmware.base_address & ~0xFFF

0 commit comments

Comments
 (0)