idaemu

by 36hours

36hours / idaemu

idaemu is an IDA Pro Plugin - use for emulating code in IDA Pro.

419 Stars 100 Forks Last release: Not found GNU General Public License v2.0 27 Commits 0 Releases

Available items

No Items, yet!

The developer of this repository has not created any items for sale yet. Need a bug fixed? Help with integration? A different license? Create a request here:

idaemu

idaemu is an IDA Pro Plugin - use for emulating code in IDA Pro. It is based on unicorn-engine.

Support architecture: - X86 (16, 32, 64-bit) - ARM - ARM64 (ARMv8) - MIPS (developing)

Install

If you want to use idaemu, you have to install unicorn-engine and unicorn's python binding first. Then use the

idaemu.py
as the idapython script.

License

This project is released under the GPL license.

Example1

This is easy function for add.

.text:000000000040052D                 public myadd
.text:000000000040052D myadd           proc near               ; CODE XREF: main+1Bp
.text:000000000040052D
.text:000000000040052D var_4           = dword ptr -4
.text:000000000040052D
.text:000000000040052D                 push    rbp
.text:000000000040052E                 mov     rbp, rsp
.text:0000000000400531                 mov     [rbp+var_4], edi
.text:0000000000400534                 mov     edx, cs:magic    ; magic dd 64h 
.text:000000000040053A                 mov     eax, [rbp+var_4]
.text:000000000040053D                 add     eax, edx
.text:000000000040053F                 pop     rbp
.text:0000000000400540                 retn
.text:0000000000400540 myadd           endp

Running the idapython scritp:

python
from idaemu import *
a = Emu(UC_ARCH_X86, UC_MODE_64)
print a.eFunc(0x040052D, None, [7])

Get the function result:

107

Example2

If there is a library function call inner the function, we couldn't call it directly. We should use

alt
to hook the library function first.
.text:0000000000400560                 public myadd
.text:0000000000400560 myadd           proc near               ; CODE XREF: main+27p
.text:0000000000400560
.text:0000000000400560 var_8           = dword ptr -8
.text:0000000000400560 var_4           = dword ptr -4
.text:0000000000400560
.text:0000000000400560                 push    rbp
.text:0000000000400561                 mov     rbp, rsp
.text:0000000000400564                 sub     rsp, 10h
.text:0000000000400568                 mov     [rbp+var_4], edi
.text:000000000040056B                 mov     [rbp+var_8], esi
.text:000000000040056E                 mov     eax, [rbp+var_8]
.text:0000000000400571                 mov     edx, [rbp+var_4]
.text:0000000000400574                 add     eax, edx
.text:0000000000400576                 mov     esi, eax
.text:0000000000400578                 mov     edi, offset format ; "a+b=%d\n"
.text:000000000040057D                 mov     eax, 0
.text:0000000000400582                 call    _printf
.text:0000000000400587                 leave
.text:0000000000400588                 retn
.text:0000000000400588 myadd           endp

Running the idapython scritp: ``` python from idaemu import *

a = Emu(UCARCHX86, UCMODE64)

def myprint(uc, out, args): out.append("this is hook output: %d" % args[1]) return 0

myaddaddr = 0x00400560 printfaddr = 0x00400410 a.alt(printfaddr, myprint, 2, False) a.eFunc(myaddaddr, None, [1, 7]) print "---- below is the trace ----" a.showTrace() ```

Get the result:

---- below is the trace ----
this is hook output: 8
Well Done. We can alter every function in this way.

Example3

Sometimes it emulates fail with some abort: ``` Python>from idaemu import * Python>a = Emu(UCARCHARM, UCMODETHUMB) Python>print a.eFunc(here(), 0xbeae, [4])

ERROR: Invalid instruction (UCERRINSN_INVALID)

1048576 ```

Then we can use

setTrace
and
showTrace
for debugging.
Python>from idaemu import *
Python>a = Emu(UC_ARCH_ARM, UC_MODE_THUMB)
Python>a.setTrace(TRACE_CODE)
Python>a.eFunc(here(), 0xbeae, [4])
#ERROR: Invalid instruction (UC_ERR_INSN_INVALID)
1048576
Python>a.showTrace()
### Trace Instruction at 0x13dc, size = 2
### Trace Instruction at 0x13de, size = 2
### Trace Instruction at 0x13e0, size = 2
......
### Trace Instruction at 0x19c6, size = 2
### Trace Instruction at 0x19c8, size = 2
### Trace Instruction at 0x19ca, size = 2
### Trace Instruction at 0xbeae, size = 2

So we found the abort reason (the RA is wrong)

We use cookies. If you continue to browse the site, you agree to the use of cookies. For more information on our use of cookies please see our Privacy Policy.