Memory access rights ignored unless mem hook is set
Author: boborjan2Created Jul 22, 2026Updated Aug 11, 2026
UC_PROT_READ disregarded in some cases when there is no mem hook attached. (tested on x86) Please consider the following scenario:
static void test_mem_prot_callback(uc_engine *uc, uc_mem_type type, uint64_t address, int size, int64_t value, void *user_data)
{
/* this is only a dummy callback */
}
static void test_mem_prot(void)
{
uc_engine *uc;
uint64_t r_rsp;
char code_main[] =
"\xC6\x05\xff\x20\x00\x00\x55" // mov byte ptr [0x20ff],0x55
"\xA0\x00\x20\x00\x00" // mov al,[0x2000]
;
r_rsp = 0x5000;
printf("\n");
OK(uc_open(UC_ARCH_X86, UC_MODE_32, &uc));
OK(uc_reg_write(uc, UC_X86_REG_ESP, &r_rsp));
OK(uc_mem_map (uc, 0x0, 0x1000, UC_PROT_ALL)); // text
OK(uc_mem_map (uc, 0x4000, 0x1000, UC_PROT_READ|UC_PROT_WRITE)); // stack
OK(uc_mem_map (uc, 0x2000,0x1000, UC_PROT_WRITE|UC_PROT_EXEC)); // another text
//installing dummy mem read hook anywhere makes protection work
//uc_hook hk;
//OK(uc_hook_add(uc, &hk, UC_HOOK_MEM_WRITE, test_mem_prot_callback, NULL, 0xfffffe, 0xffffff));
OK(uc_mem_write(uc, 0x0, code_main, sizeof(code_main)-1));
uc_assert_err(UC_ERR_READ_PROT, uc_emu_start(uc, 0x0, sizeof(code_main)-1, 0, 0));
OK(uc_close(uc));
}My guess is that it is connected to the fast path/slow path conditional in tcg_out_tlb_load():
// Unicorn: fast path if hookmem is not enable
if (!tcg_uc_has_hookmem(s))
tcg_out_opc(s, OPC_JCC_long + JCC_JNE, 0, 0, 0);
else
/* slow_path, so data access will go via load_helper() */
tcg_out_opc(s, OPC_JMP_long, 0, 0, 0);Source: unicorn-engine/unicorn