{"action":"created","issue":{"url":"https://api.github.com/repos/unicorn-engine/unicorn/issues/247","labels_url":"https://api.github.com/repos/unicorn-engine/unicorn/issues/247/labels{/name}","comments_url":"https://api.github.com/repos/unicorn-engine/unicorn/issues/247/comments","events_url":"https://api.github.com/repos/unicorn-engine/unicorn/issues/247/events","html_url":"https://github.com/unicorn-engine/unicorn/issues/247","id":115179909,"number":247,"title":"Executing a conditional branch that leads to \"nowhere\" crashes Unicorn.","user":{"login":"farmdve","id":7746376,"avatar_url":"https://avatars.githubusercontent.com/u/7746376?v=3","gravatar_id":"","url":"https://api.github.com/users/farmdve","html_url":"https://github.com/farmdve","followers_url":"https://api.github.com/users/farmdve/followers","following_url":"https://api.github.com/users/farmdve/following{/other_user}","gists_url":"https://api.github.com/users/farmdve/gists{/gist_id}","starred_url":"https://api.github.com/users/farmdve/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/farmdve/subscriptions","organizations_url":"https://api.github.com/users/farmdve/orgs","repos_url":"https://api.github.com/users/farmdve/repos","events_url":"https://api.github.com/users/farmdve/events{/privacy}","received_events_url":"https://api.github.com/users/farmdve/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/unicorn-engine/unicorn/labels/bug","name":"bug","color":"fc2929"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2015-11-05T00:14:07Z","updated_at":"2015-11-06T17:05:02Z","closed_at":null,"body":"I am talking about a conditional jump like JNZ or JZ that leads to memory that contains no other instruction, like \\x75\\x01. The problem seems to stem from this function in qemu/translate-all.c\r\n\r\n    static void page_flush_tb_1(int level, void **lp)\r\n    {\r\n    int i;\r\n\r\n    if (*lp == NULL) {\r\n        return;\r\n    }\r\n    if (level == 0) {\r\n        PageDesc *pd = *lp;\r\n\r\n        for (i = 0; i < V_L2_SIZE; ++i) {\r\n            pd[i].first_tb = NULL;\r\n            invalidate_page_bitmap(pd + i);\r\n        }\r\n    } else {\r\n        void **pp = *lp;\r\n\r\n        for (i = 0; i < V_L2_SIZE; ++i) {\r\n            page_flush_tb_1(level - 1, pp + i);\r\n        }\r\n    }\r\n    }\r\n\r\nMore specifically `pd[i].first_tb = NULL;`, the `'i'`th element points to nothing. \r\n\r\nThe behaviour I was expecting was that the jump would lead to a section of code that is either 00 and would get executed as `add byte ptr ds:[eax],al` or an error would be raised of type UC_ERR_FETCH_UNMAPPED or some sort."},"comment":{"url":"https://api.github.com/repos/unicorn-engine/unicorn/issues/comments/154473910","html_url":"https://github.com/unicorn-engine/unicorn/issues/247#issuecomment-154473910","issue_url":"https://api.github.com/repos/unicorn-engine/unicorn/issues/247","id":154473910,"user":{"login":"aquynh","id":5965536,"avatar_url":"https://avatars.githubusercontent.com/u/5965536?v=3","gravatar_id":"","url":"https://api.github.com/users/aquynh","html_url":"https://github.com/aquynh","followers_url":"https://api.github.com/users/aquynh/followers","following_url":"https://api.github.com/users/aquynh/following{/other_user}","gists_url":"https://api.github.com/users/aquynh/gists{/gist_id}","starred_url":"https://api.github.com/users/aquynh/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/aquynh/subscriptions","organizations_url":"https://api.github.com/users/aquynh/orgs","repos_url":"https://api.github.com/users/aquynh/repos","events_url":"https://api.github.com/users/aquynh/events{/privacy}","received_events_url":"https://api.github.com/users/aquynh/received_events","type":"User","site_admin":false},"created_at":"2015-11-06T17:05:02Z","updated_at":"2015-11-06T17:05:02Z","body":"this should be fixed now, please confirm."}}