unicorn-libemu-shim
unicorn-libemu-shim copied to clipboard
mandiant
libemu shim layer and win32 environment for Unicorn Engine
/* libemu / Unicorn compatibility shim layer Contributed by FireEye FLARE team Author: David Zimmer [email protected] [email protected] License: GPL
Files: emu_cpu.h, emu_shim.h, emu_shim.cpp */
This is a sample of using the libemu win32 environment with Unicorn engine.
Project also includes a shim layer so that you can easily port existing libemu code over to run on Unicorn.
Please see the following article for more details:
https://www.fireeye.com/blog/threat-research/2017/04/libemu-unicorn-compatability-layer.html
Notes:
The libemu environment was taken from scdbg and includes support for 15 dlls.
kernel32, ntdll, ws2_32, iphlpapi, user32, shell32, msvcrt, urlmon, wininet, shlwapi, advapi32, shdocvw, psapi, imagehlp, winhttp
The sample.exe contains a hardcoded shellcode buffer. A compiled binary is available in the /bin folder.
Project files were built with VS2008. If you compiler does not come with stdint.h and inttypes.h compatible versions can be found here:
https://github.com/dzzie/VS_LIBEMU/tree/master/libemu/include
Credits:
Libemu Copyright (C) Paul Baecher & Markus Koetter
License: GPL
Unicorn Copyright (C) Nguyen Anh Quynh and Dang Hoang Vu
Site: http://www.unicorn-engine.org/
License: GPL
QEMU
Site: http://qemu.org
License: GPL
scdbg Copyright (C) David Zimmer
Site: http://sandsprite.com
License: GPL
mandiant