{"action":"created","issue":{"url":"https://api.github.com/repos/unicorn-engine/unicorn/issues/337","labels_url":"https://api.github.com/repos/unicorn-engine/unicorn/issues/337/labels{/name}","comments_url":"https://api.github.com/repos/unicorn-engine/unicorn/issues/337/comments","events_url":"https://api.github.com/repos/unicorn-engine/unicorn/issues/337/events","html_url":"https://github.com/unicorn-engine/unicorn/issues/337","id":123549762,"number":337,"title":"hook_del UC_HOOK_INSN does not delete","user":{"login":"michalmalik","id":1903285,"avatar_url":"https://avatars.githubusercontent.com/u/1903285?v=3","gravatar_id":"","url":"https://api.github.com/users/michalmalik","html_url":"https://github.com/michalmalik","followers_url":"https://api.github.com/users/michalmalik/followers","following_url":"https://api.github.com/users/michalmalik/following{/other_user}","gists_url":"https://api.github.com/users/michalmalik/gists{/gist_id}","starred_url":"https://api.github.com/users/michalmalik/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/michalmalik/subscriptions","organizations_url":"https://api.github.com/users/michalmalik/orgs","repos_url":"https://api.github.com/users/michalmalik/repos","events_url":"https://api.github.com/users/michalmalik/events{/privacy}","received_events_url":"https://api.github.com/users/michalmalik/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-12-22T20:21:53Z","updated_at":"2015-12-22T23:09:59Z","closed_at":null,"body":"Hello,\r\n\r\n```python\r\nfrom __future__ import print_function\r\n\r\nfrom unicorn import *\r\nfrom unicorn.x86_const import *\r\n\r\nemu = Uc(UC_ARCH_X86, UC_MODE_32)\r\n\r\ndef hook_syscall(mu, user_data):\r\n        pass\r\n        \r\ndef hook_intr(mu, intno, user_data):\r\n        pass\r\n       \r\ntry:\r\n        i = emu.hook_add(UC_HOOK_INSN, hook_syscall, None, UC_X86_INS_SYSCALL)\r\n        emu.hook_del(i)\r\n        i = emu.hook_add(UC_HOOK_INSN, hook_syscall, None, UC_X86_INS_SYSCALL)\r\nexcept UcError as e:\r\n        print(\"hook_del UC_HOOK_INSN is broken: \" + str(e))\r\n        \r\ntry:\r\n        i = emu.hook_add(UC_HOOK_INTR, hook_intr, None)\r\n        emu.hook_del(i)\r\n        i = emu.hook_add(UC_HOOK_INTR, hook_intr, None)\r\nexcept UcError as e:\r\n        print(\"hook_del UC_HOOK_INTR is broken: \" + str(e))\r\n```\r\nOutputs:\r\n\r\n```\r\nhook_del UC_HOOK_INSN is broken: Hook for this type event already exists (UC_ERR_HOOK_EXIST)\r\n```\r\n\r\nThat part with UC_HOOK_INTR is just for demonstration.\r\n\r\nShould I submit a regress test for this?"},"comment":{"url":"https://api.github.com/repos/unicorn-engine/unicorn/issues/comments/166759074","html_url":"https://github.com/unicorn-engine/unicorn/issues/337#issuecomment-166759074","issue_url":"https://api.github.com/repos/unicorn-engine/unicorn/issues/337","id":166759074,"user":{"login":"michalmalik","id":1903285,"avatar_url":"https://avatars.githubusercontent.com/u/1903285?v=3","gravatar_id":"","url":"https://api.github.com/users/michalmalik","html_url":"https://github.com/michalmalik","followers_url":"https://api.github.com/users/michalmalik/followers","following_url":"https://api.github.com/users/michalmalik/following{/other_user}","gists_url":"https://api.github.com/users/michalmalik/gists{/gist_id}","starred_url":"https://api.github.com/users/michalmalik/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/michalmalik/subscriptions","organizations_url":"https://api.github.com/users/michalmalik/orgs","repos_url":"https://api.github.com/users/michalmalik/repos","events_url":"https://api.github.com/users/michalmalik/events{/privacy}","received_events_url":"https://api.github.com/users/michalmalik/received_events","type":"User","site_admin":false},"created_at":"2015-12-22T23:09:59Z","updated_at":"2015-12-22T23:09:59Z","body":"I think I found the bug.\r\n\r\nIn this function: https://github.com/unicorn-engine/unicorn/blob/master/uc.c#L938\r\n\r\nThis block https://github.com/unicorn-engine/unicorn/blob/master/uc.c#L976\r\n```python\r\ncase UC_X86_INS_SYSCALL:\r\ncase UC_X86_INS_SYSENTER:\r\n\t// only one event handler at the same time\r\n\tif (uc->hook_syscall_idx)\r\n\t\treturn UC_ERR_HOOK_EXIST;\r\n\r\n\ti = hook_find_new(uc);\r\n\tif (i) {\r\n\t\tuc->hook_callbacks[i].callback = callback;\r\n\t\tuc->hook_callbacks[i].user_data = user_data;\r\n\t\t*evh = i;\r\n\t\tuc->hook_syscall_idx = i;\r\n\t\treturn UC_ERR_OK;\r\n\t} else\r\n\t\treturn UC_ERR_NOMEM;\r\n```\r\n\r\nIt checks and sets the **uc->hook_syscall_idx** variable.\r\n\r\nWhen you look at the hook_del function https://github.com/unicorn-engine/unicorn/blob/master/hook.c#L93\r\n\r\nIt properly addresses **UC_X86_INS_OUT** by checking **uc->hook_out_idx** https://github.com/unicorn-engine/unicorn/blob/master/hook.c#L139 and **UC_X86_INS_IN** by checking **uc->hook_in_idx** https://github.com/unicorn-engine/unicorn/blob/master/hook.c#L143.\r\n\r\nHowever, instead of checking **uc->hook_syscall_idx**, it checks for **uc->hook_insn_idx** https://github.com/unicorn-engine/unicorn/blob/master/hook.c#L99."}}