#2369·unicorn

Memory access rights ignored unless mem hook is set

Author: boborjan2Created Jul 22, 2026Updated Aug 11, 2026

UC_PROT_READ disregarded in some cases when there is no mem hook attached. (tested on x86) Please consider the following scenario:

static void test_mem_prot_callback(uc_engine *uc, uc_mem_type type, uint64_t address, int size, int64_t value, void *user_data)
{
    /* this is only a dummy callback */
}

static void test_mem_prot(void)
{
    uc_engine *uc;
    uint64_t r_rsp;

    char code_main[] = 
        "\xC6\x05\xff\x20\x00\x00\x55"      // mov byte ptr [0x20ff],0x55
        "\xA0\x00\x20\x00\x00"              // mov al,[0x2000]
        ;
    r_rsp = 0x5000;
    printf("\n");
    OK(uc_open(UC_ARCH_X86, UC_MODE_32, &uc));
    OK(uc_reg_write(uc, UC_X86_REG_ESP, &r_rsp));
    OK(uc_mem_map  (uc, 0x0,    0x1000, UC_PROT_ALL));                // text
    OK(uc_mem_map  (uc, 0x4000, 0x1000, UC_PROT_READ|UC_PROT_WRITE)); // stack
    OK(uc_mem_map  (uc, 0x2000,0x1000, UC_PROT_WRITE|UC_PROT_EXEC)); // another text

    //installing dummy mem read hook anywhere makes protection work
    //uc_hook hk;
    //OK(uc_hook_add(uc, &hk, UC_HOOK_MEM_WRITE, test_mem_prot_callback, NULL, 0xfffffe, 0xffffff));

    OK(uc_mem_write(uc, 0x0,        code_main,   sizeof(code_main)-1));
    uc_assert_err(UC_ERR_READ_PROT, uc_emu_start(uc, 0x0, sizeof(code_main)-1, 0, 0));

    OK(uc_close(uc));
}

My guess is that it is connected to the fast path/slow path conditional in tcg_out_tlb_load():

    // Unicorn: fast path if hookmem is not enable
    if (!tcg_uc_has_hookmem(s))
        tcg_out_opc(s, OPC_JCC_long + JCC_JNE, 0, 0, 0);
    else
        /* slow_path, so data access will go via load_helper() */
        tcg_out_opc(s, OPC_JMP_long, 0, 0, 0);