shellcode模拟运行工具之unicorn安装与使用

admin 2022年11月15日12:02:17安全工具评论8 views4374字阅读14分34秒阅读模式

shellcode模拟运行工具之unicorn安装与使用

下载最新2.1版本源码 

git clone https://github.com/unicorn-engine/unicorn.git

编译

mkdir buildcd buildcmake  -G "Unix Makefiles" ..cmake  -G "Xcode" ..make -j6

shellcode模拟运行工具之unicorn安装与使用

shellcode模拟运行工具之unicorn安装与使用

shellcode模拟运行工具之unicorn安装与使用

模拟运行shellcode例子代码

/* Unicorn Emulator Engine *//* By Nguyen Anh Quynh & Dang Hoang Vu, 2015 */
/* Sample code to trace code with Linux code with syscall */
#include <unicorn/unicorn.h>#include <string.h>
// code to be emulated#define X86_CODE32 "xebx19x31xc0x31xdbx31xd2x31xc9xb0x04xb3x01x59xb2x05xcd" "x80x31xc0xb0x01x31xdbxcdx80xe8xe2xffxffxffx68x65x6cx6c" "x6f"
#define X86_CODE32_SELF "xebx1cx5ax89xd6x8bx02x66x3dxcax7dx75x06x66x05x03x03x89" "x02xfexc2x3dx41x41x41x41x75xe9xffxe6xe8xdfxffxffxffx31" "xd2x6ax0bx58x99x52x68x2fx2fx73x68x68x2fx62x69x6ex89xe3" "x52x53x89xe1xcax7dx41x41x41x41x41x41x41x41"
// memory address where emulation starts#define ADDRESS 0x1000000
#define MIN(a, b) (a < b ? a : b)// callback for tracing instructionstatic void hook_code(uc_engine *uc, uint64_t address, uint32_t size, void *user_data){ int r_eip; uint8_t tmp[16];
printf("Tracing instruction at 0x%" PRIx64 ", instruction size = 0x%xn", address, size);
uc_reg_read(uc, UC_X86_REG_EIP, &r_eip); printf("*** EIP = %x ***: ", r_eip);
size = MIN(sizeof(tmp), size); if (!uc_mem_read(uc, address, tmp, size)) { uint32_t i; for (i = 0; i < size; i++) { printf("%x ", tmp[i]); } printf("n"); }}
// callback for handling interrupt// ref: http://syscalls.kernelgrok.com/static void hook_intr(uc_engine *uc, uint32_t intno, void *user_data){ int32_t r_eax, r_ecx, r_eip; uint32_t r_edx, size; unsigned char buffer[256];
// only handle Linux syscall if (intno != 0x80) return;
uc_reg_read(uc, UC_X86_REG_EAX, &r_eax); uc_reg_read(uc, UC_X86_REG_EIP, &r_eip);
switch (r_eax) { default: printf(">>> 0x%x: interrupt 0x%x, EAX = 0x%xn", r_eip, intno, r_eax); break; case 1: // sys_exit printf(">>> 0x%x: interrupt 0x%x, SYS_EXIT. quit!nn", r_eip, intno); uc_emu_stop(uc); break; case 4: // sys_write // ECX = buffer address uc_reg_read(uc, UC_X86_REG_ECX, &r_ecx);
// EDX = buffer size uc_reg_read(uc, UC_X86_REG_EDX, &r_edx);
// read the buffer in size = MIN(sizeof(buffer) - 1, r_edx);
if (!uc_mem_read(uc, r_ecx, buffer, size)) { buffer[size] = ''; printf(">>> 0x%x: interrupt 0x%x, SYS_WRITE. buffer = 0x%x, size = " "%u, content = '%s'n", r_eip, intno, r_ecx, r_edx, buffer); } else { printf(">>> 0x%x: interrupt 0x%x, SYS_WRITE. buffer = 0x%x, size = " "%u (cannot get content)n", r_eip, intno, r_ecx, r_edx); } break; }}
static void test_i386(void){ uc_engine *uc; uc_err err; uc_hook trace1, trace2;
int r_esp = ADDRESS + 0x200000; // ESP register
printf("Emulate i386 coden");
// Initialize emulator in X86-32bit mode err = uc_open(UC_ARCH_X86, UC_MODE_32, &uc); if (err) { printf("Failed on uc_open() with error returned: %un", err); return; }
// map 2MB memory for this emulation uc_mem_map(uc, ADDRESS, 2 * 1024 * 1024, UC_PROT_ALL);
// write machine code to be emulated to memory if (uc_mem_write(uc, ADDRESS, X86_CODE32_SELF, sizeof(X86_CODE32_SELF) - 1)) { printf("Failed to write emulation code to memory, quit!n"); return; }
// initialize machine registers uc_reg_write(uc, UC_X86_REG_ESP, &r_esp);
// tracing all instructions by having @begin > @end uc_hook_add(uc, &trace1, UC_HOOK_CODE, hook_code, NULL, 1, 0);
// handle interrupt ourself uc_hook_add(uc, &trace2, UC_HOOK_INTR, hook_intr, NULL, 1, 0);
printf("n>>> Start tracing this Linux coden");
// emulate machine code in infinite time // err = uc_emu_start(uc, ADDRESS, ADDRESS + sizeof(X86_CODE32_SELF), 0, // 12); <--- emulate only 12 instructions err = uc_emu_start(uc, ADDRESS, ADDRESS + sizeof(X86_CODE32_SELF) - 1, 0, 0); if (err) { printf("Failed on uc_emu_start() with error returned %u: %sn", err, uc_strerror(err)); }
printf("n>>> Emulation done.n");
uc_close(uc);}
int main(int argc, char **argv, char **envp){ if (argc == 2) { if (!strcmp(argv[1], "-32")) { test_i386(); } else if (!strcmp(argv[1], "-h")) { printf("Syntax: %s <-32|-64>n", argv[0]); } } else { test_i386(); }
return 0;}

shellcode模拟运行工具之unicorn安装与使用

更多其它详细教程可以联系作者。

目录

# unicorn源码分析与使用视频教程  ## 基础
* 1.课程介绍* 2.unicorn源码编译* 3.unicorn简单使用与调试* 4.unicorn 源码框架了解* 5.实现一个最简单的my_qemu(kvm)* 6.shellcode 指令追踪使用* 7.shellcode 指令追踪源码分析* 8.使用中断事件hook源码分析 (syscall)* 9.使用中断事件hook源码分析(arm syscall)* 10.内存操作事件hook(读写执行)* 11.内存操作事件hook源码分析* 12.异常事件使用与源码分析* 13.再谈unicorn(框架定位与缺陷)
## x86架构中使用
* 14.模拟单个参数函数与获取返回值(x86_64构架)* 15.模拟多个参数函数(x86_64构架)* 16.模拟获取全局变量函数(x86_64构架)* 17.外部符合libc库函数调用模拟(x86_64构架)* 18.模拟多个函数调用链(x86_64构架)
### 常用算法模拟* 19.模拟base64编码(x86_64构架)* 20.aes算法模拟(x86_64构架)* 21.des算法模拟(x86_64构架)* 22.rc4算法模拟(x86_64构架)* 23.其它算法模拟思路(x86_64构架)
## arm架构中使用* 24.模拟单个参数函数与获取返回值(arm64构架)* 25.模拟多个参数函数(arm64构架)* 26.模拟获取全局变量函数(arm64构架)* 27.arm构架中的算法模拟(arm64构架)* 28.android中模拟与JNI交互(arm64构架)* 29.JNI模拟call java函数(arm64构架)

## 完善unicorn * 30.unicorn ELF文件模拟* 31.unicorn 其它可执行文件* 32.unicorn调试器介绍
## ollvm混淆* 33.unicorn结合capstone使用* 34.生成CFG(控制流程图)* 35.ollvm反混淆思路

其它学习教程。

shellcode模拟运行工具之unicorn安装与使用shellcode模拟运行工具之unicorn安装与使用



shellcode模拟运行工具之unicorn安装与使用




原文始发于微信公众号(安全狗的自我修养):shellcode模拟运行工具之unicorn安装与使用

特别标注: 本站(CN-SEC.COM)所有文章仅供技术研究,若将其信息做其他用途,由用户承担全部法律及连带责任,本站不承担任何法律及连带责任,请遵守中华人民共和国安全法.
  • 我的微信
  • 微信扫一扫
  • weinxin
  • 我的微信公众号
  • 微信扫一扫
  • weinxin
admin
  • 本文由 发表于 2022年11月15日12:02:17
  • 转载请保留本文链接(CN-SEC中文网:感谢原作者辛苦付出):
                  shellcode模拟运行工具之unicorn安装与使用 http://cn-sec.com/archives/1410451.html

发表评论

匿名网友 填写信息

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen: