Unicorn strange raise a UC_ERR_FETCH_UNMAPPED error

[kawaiinonian]

Hi I'm just learning to use unicorn to emulate firmware execution. This is a strange question I just met.

    addr_config = {
        "load_address": 0x8000_0400,
        "stack_address": 0xfffe_0000,
        "stack_size": 0x10000,
        "data_address": 0x8027_5000,
        "data_size": 0x100000
    }
    emulator = unicorn.Uc(unicorn.UC_ARCH_MIPS, unicorn.UC_MODE_MIPS32+unicorn.UC_MODE_BIG_ENDIAN)
    addr, size = align(addr_config["load_address"], len(firmware), True)
    print("mem_map text segment from {}, size {}".format(hex(addr), hex(size)))
    emulator.mem_map(addr, size, unicorn.UC_PROT_ALL)
    emulator.mem_map(addr_config["stack_address"], addr_config["stack_size"], unicorn.UC_PROT_ALL)
    emulator.mem_map(addr_config["data_address"], addr_config["data_size"], unicorn.UC_PROT_ALL)
    emulator.mem_write(addr_config["load_address"], firmware)
    entry_address = 0x8013_e0fc
    stop_stub_addr = 0x30000
    emulator.mem_map(stop_stub_addr, 0x10000, unicorn.UC_PROT_ALL)
    print(emulator.mem_read(entry_address, 4).hex())
    emulator.reg_write(mips_const.UC_MIPS_REG_SP, 0xfffe_0000)  # Set stack pointer
    emulator.reg_write(mips_const.UC_MIPS_REG_RA, stop_stub_addr) 
    emulator.reg_write(mips_const.UC_MIPS_REG_A0, 0x8000_0400)  # Example register setup
    emulator.reg_write(mips_const.UC_MIPS_REG_A1, 0x8000_0500)
    logging.info("Execution expected from 0x%x to 0x%x", entry_address, stop_stub_addr)
    emulator.emu_start(entry_address, stop_stub_addr)

While the mem_read goes correctly, emulator.emu_start raise this error:

Traceback (most recent call last):
File "/home/noisyfood/Dlink/anyexe/./anyexe.py", line 54, in start_execution
emulator.emu_start(entry_address, stop_stub_addr)
File "/home/noisyfood/miniconda3/lib/python3.12/site-packages/unicorn/unicorn_py3/unicorn.py", line 768, in emu_start
raise UcError(status)
unicorn.unicorn_py3.unicorn.UcError: Invalid memory fetch (UC_ERR_FETCH_UNMAPPED)

Can anybody help? Appreciate a lot!

[PhilippTakacs]

You missed that the MIPS MMU special handles the kseg sections. This means the virtual address 0x8000_0400 is located add 0x400. See https://training.mips.com/basic_mips/PDF/Memory_Map.pdf for details.

The mem_map call works on emulated physical addresses. So you need to map the 0x0 page.

Alternative you can use the UC_TLB_VIRTUAL, which does a 1:1 mapping and adds a tlb callback. This might not work when your firmware expects to manage the MMU on it's own.

[kawaiinonian]

It's VERY NICE of you to reply my silly question. I fixed my code, but still something wrong.
The code now look like this:

import unicorn
import unicorn.mips_const as mips_const

file_path = "firmware.bin"
with open(file_path, "rb") as f:
    firmware =  f.read()
emulator = unicorn.Uc(unicorn.UC_ARCH_MIPS, unicorn.UC_MODE_MIPS32+unicorn.UC_MODE_BIG_ENDIAN)
emulator.mem_map(0x0, 0x2000_0000, unicorn.UC_PROT_ALL)
emulator.mem_write(0x8000_0400-0x8000_0000, firmware)
emulator.reg_write(mips_const.UC_MIPS_REG_SP, 0xfffe_0000)
entry_address = 0x8013_e0fc
stop_stub_addr = 0x8013_e104
print(emulator.mem_read(entry_address-0x8000_0000, 4).hex())
emulator.emu_start(entry_address-0x8000_0000, stop_stub_addr - 0x8000_0000)

But there's still an Invalid memory read error

Traceback (most recent call last):
File "/home/noisyfood/Dlink/anyexe/./test.py", line 16, in
emulator.emu_start(entry_address-0x8000_0000, stop_stub_addr - 0x8000_0000)
File "/home/noisyfood/miniconda3/lib/python3.12/site-packages/unicorn/unicorn_py3/unicorn.py", line 768, in emu_start
raise UcError(status)
unicorn.unicorn_py3.unicorn.UcError: Invalid memory read (UC_ERR_READ_UNMAPPED)

Can you give me some points? Thanks very much.

[PhilippTakacs]

The emu_start function works with virtual addresses. So changing this back to emulator.emu_start(entry_address, stop_stub_addr) and it should work as expected.