From c09a52e80384cdd1f7218307474771dd7e4bea53 Mon Sep 17 00:00:00 2001 From: bulaza Date: Wed, 26 Apr 2017 21:29:01 -0400 Subject: [PATCH] Update comments on UC_MEM_*_UNMAPPED (#811) Updated the comment on UC_MEM_*_UNMAPPED to clarify what happens if "true" is returned --- include/unicorn/unicorn.h | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/include/unicorn/unicorn.h b/include/unicorn/unicorn.h index 925eeb42..784fd999 100644 --- a/include/unicorn/unicorn.h +++ b/include/unicorn/unicorn.h @@ -273,6 +273,14 @@ typedef void (*uc_cb_hookmem_t)(uc_engine *uc, uc_mem_type type, @user_data: user data passed to tracing APIs @return: return true to continue, or false to stop program (due to invalid memory). + NOTE: returning true to continue execution will only work if if the accessed + memory is made accessible with the correct permissions during the hook. + In the event of a UC_MEM_READ_UNMAPPED or UC_MEM_WRITE_UNMAPPED callback, + the memory should be uc_mem_map()-ed with the correct permissions, and the + instruction will then read or write to the address as it was supposed to. + In the event of a UC_MEM_FETCH_UNMAPPED callback, the memory can be mapped + in as executable, in which case execution will resume from the fetched address, + or the instruction pointer can be written to in order to resume execution elsewhere. */ typedef bool (*uc_cb_eventmem_t)(uc_engine *uc, uc_mem_type type, uint64_t address, int size, int64_t value, void *user_data);