shellcode模拟运行工具之unicorn安装与使用

git clone https://github.com/unicorn-engine/unicorn.git

mkdir buildcd buildcmake  -G "Unix Makefiles" ..cmake  -G "Xcode" ..make -j6

/* Unicorn Emulator Engine *//* By Nguyen Anh Quynh & Dang Hoang Vu, 2015 */
/* Sample code to trace code with Linux code with syscall */
#include <unicorn/unicorn.h>#include <string.h>
// code to be emulated#define X86_CODE32                                                                 "xebx19x31xc0x31xdbx31xd2x31xc9xb0x04xb3x01x59xb2x05xcd"     "x80x31xc0xb0x01x31xdbxcdx80xe8xe2xffxffxffx68x65x6cx6c"     "x6f"
#define X86_CODE32_SELF                                                            "xebx1cx5ax89xd6x8bx02x66x3dxcax7dx75x06x66x05x03x03x89"     "x02xfexc2x3dx41x41x41x41x75xe9xffxe6xe8xdfxffxffxffx31"     "xd2x6ax0bx58x99x52x68x2fx2fx73x68x68x2fx62x69x6ex89xe3"     "x52x53x89xe1xcax7dx41x41x41x41x41x41x41x41"
// memory address where emulation starts#define ADDRESS 0x1000000
#define MIN(a, b) (a < b ? a : b)// callback for tracing instructionstatic void hook_code(uc_engine *uc, uint64_t address, uint32_t size,                      void *user_data){    int r_eip;    uint8_t tmp[16];
    printf("Tracing instruction at 0x%" PRIx64 ", instruction size = 0x%xn",           address, size);
    uc_reg_read(uc, UC_X86_REG_EIP, &r_eip);    printf("*** EIP = %x ***: ", r_eip);
    size = MIN(sizeof(tmp), size);    if (!uc_mem_read(uc, address, tmp, size)) {        uint32_t i;        for (i = 0; i < size; i++) {            printf("%x ", tmp[i]);        }        printf("n");    }}
// callback for handling interrupt// ref: http://syscalls.kernelgrok.com/static void hook_intr(uc_engine *uc, uint32_t intno, void *user_data){    int32_t r_eax, r_ecx, r_eip;    uint32_t r_edx, size;    unsigned char buffer[256];
    // only handle Linux syscall    if (intno != 0x80)        return;
    uc_reg_read(uc, UC_X86_REG_EAX, &r_eax);    uc_reg_read(uc, UC_X86_REG_EIP, &r_eip);
    switch (r_eax) {    default:        printf(">>> 0x%x: interrupt 0x%x, EAX = 0x%xn", r_eip, intno, r_eax);        break;    case 1: // sys_exit        printf(">>> 0x%x: interrupt 0x%x, SYS_EXIT. quit!nn", r_eip, intno);        uc_emu_stop(uc);        break;    case 4: // sys_write        // ECX = buffer address        uc_reg_read(uc, UC_X86_REG_ECX, &r_ecx);
        // EDX = buffer size        uc_reg_read(uc, UC_X86_REG_EDX, &r_edx);
        // read the buffer in        size = MIN(sizeof(buffer) - 1, r_edx);
        if (!uc_mem_read(uc, r_ecx, buffer, size)) {            buffer[size] = '';            printf(">>> 0x%x: interrupt 0x%x, SYS_WRITE. buffer = 0x%x, size = "                   "%u, content = '%s'n",                   r_eip, intno, r_ecx, r_edx, buffer);        } else {            printf(">>> 0x%x: interrupt 0x%x, SYS_WRITE. buffer = 0x%x, size = "                   "%u (cannot get content)n",                   r_eip, intno, r_ecx, r_edx);        }        break;    }}
static void test_i386(void){    uc_engine *uc;    uc_err err;    uc_hook trace1, trace2;
    int r_esp = ADDRESS + 0x200000; // ESP register
    printf("Emulate i386 coden");
    // Initialize emulator in X86-32bit mode    err = uc_open(UC_ARCH_X86, UC_MODE_32, &uc);    if (err) {        printf("Failed on uc_open() with error returned: %un", err);        return;    }
    // map 2MB memory for this emulation    uc_mem_map(uc, ADDRESS, 2 * 1024 * 1024, UC_PROT_ALL);
    // write machine code to be emulated to memory    if (uc_mem_write(uc, ADDRESS, X86_CODE32_SELF,                     sizeof(X86_CODE32_SELF) - 1)) {        printf("Failed to write emulation code to memory, quit!n");        return;    }
    // initialize machine registers    uc_reg_write(uc, UC_X86_REG_ESP, &r_esp);
    // tracing all instructions by having @begin > @end    uc_hook_add(uc, &trace1, UC_HOOK_CODE, hook_code, NULL, 1, 0);
    // handle interrupt ourself    uc_hook_add(uc, &trace2, UC_HOOK_INTR, hook_intr, NULL, 1, 0);
    printf("n>>> Start tracing this Linux coden");
    // emulate machine code in infinite time    // err = uc_emu_start(uc, ADDRESS, ADDRESS + sizeof(X86_CODE32_SELF), 0,    // 12); <--- emulate only 12 instructions    err =        uc_emu_start(uc, ADDRESS, ADDRESS + sizeof(X86_CODE32_SELF) - 1, 0, 0);    if (err) {        printf("Failed on uc_emu_start() with error returned %u: %sn", err,               uc_strerror(err));    }
    printf("n>>> Emulation done.n");
    uc_close(uc);}
int main(int argc, char **argv, char **envp){    if (argc == 2) {        if (!strcmp(argv[1], "-32")) {            test_i386();        } else if (!strcmp(argv[1], "-h")) {            printf("Syntax: %s <-32|-64>n", argv[0]);        }    } else {        test_i386();    }
    return 0;}

# unicorn源码分析与使用视频教程  ## 基础
* 1.课程介绍* 2.unicorn源码编译* 3.unicorn简单使用与调试* 4.unicorn 源码框架了解* 5.实现一个最简单的my_qemu(kvm)* 6.shellcode 指令追踪使用* 7.shellcode 指令追踪源码分析* 8.使用中断事件hook源码分析 (syscall)* 9.使用中断事件hook源码分析(arm syscall)* 10.内存操作事件hook(读写执行)* 11.内存操作事件hook源码分析* 12.异常事件使用与源码分析* 13.再谈unicorn(框架定位与缺陷)
## x86架构中使用
* 14.模拟单个参数函数与获取返回值(x86_64构架)* 15.模拟多个参数函数(x86_64构架)* 16.模拟获取全局变量函数(x86_64构架)* 17.外部符合libc库函数调用模拟(x86_64构架)* 18.模拟多个函数调用链(x86_64构架)
### 常用算法模拟* 19.模拟base64编码(x86_64构架)* 20.aes算法模拟(x86_64构架)* 21.des算法模拟(x86_64构架)* 22.rc4算法模拟(x86_64构架)* 23.其它算法模拟思路(x86_64构架)
## arm架构中使用* 24.模拟单个参数函数与获取返回值(arm64构架)* 25.模拟多个参数函数(arm64构架)* 26.模拟获取全局变量函数(arm64构架)* 27.arm构架中的算法模拟(arm64构架)* 28.android中模拟与JNI交互(arm64构架)* 29.JNI模拟call java函数(arm64构架)

## 完善unicorn   * 30.unicorn ELF文件模拟* 31.unicorn 其它可执行文件* 32.unicorn调试器介绍
## ollvm混淆* 33.unicorn结合capstone使用* 34.生成CFG(控制流程图)* 35.ollvm反混淆思路