View Code? Open in Web Editor NEW

Unicorn PE is an unicorn based instrumentation project designed to emulate code execution for windows PE files.

License: MIT License

Shell 0.04% Ruby 0.24% C++ 4.14% Python 2.21% C 86.94% Objective-C 0.07% Java 1.91% OCaml 0.75% Haskell 0.27% Smalltalk 1.73% Tcl 0.01% Go 0.19% C# 0.52% Assembly 0.01% F# 0.27% PowerShell 0.05% Pascal 0.31% Makefile 0.21% CMake 0.08% Batchfile 0.04%

unicorn_pe-1's Introduction

Unicorn PE

Unicorn PE is an unicorn based instrumentation project/framework designed to emulate code execution for windows PE files, especially packed ones.

Feature

Dump PE image from emu-memory into file, fix import table, especially packed ones.

Partial support for exception. (only #DB and #BP)

Show disasm for all instructions that is being executed.

Update BlackBone to latest ver (2020.4.5).

TODO

Feature: x86 (low priority) -- 0%

Build

Visual Studio 2019 are required.

Open unicorn_pe.sln with Visual Studio 2019

Build project "unicorn_pe" as x64/Release or x64/Debug. (No x86 support for now)

Usage

unicorn_pe (filename or filepath) [-k for kernel mode driver emulation] [-disasm for displaying disasm]

Programming

...to be documented

Snapshots

original driver

vmprotect packed driver

vmprotect is fixing encrypted IAT

vmprotect goes back to original entry point

vmprotect packed DLL, full user-mode emulation.

License

This software is released under the MIT License, see LICENSE.

Dependencies

A modification of https://github.com/DarthTon/Blackbone is done for PE manual-mapping.

https://github.com/unicorn-engine/unicorn for emulation.

https://github.com/aquynh/capstone for disasm.

Recommend Projects

ykankaya / unicorn_pe-1 Goto Github PK