36hours / idaemu

idaemu is an IDA Pro Plugin - use for emulating code in IDA Pro.

idaemu

idaemu is an IDA Pro Plugin - use for emulating code in IDA Pro. It is based on unicorn-engine.

Support architecture:

• X86 (16, 32, 64-bit)
• ARM
• ARM64 (ARMv8)
• MIPS (developing)

Install

If you want to use idaemu, you have to install unicorn-engine and unicorn's python binding first. Then use the idaemu.py as the idapython script.

License

This project is released under the GPL license.

Example1

This is easy function for add.

.text:000000000040052D                 public myadd
.text:000000000040052D myadd           proc near               ; CODE XREF: main+1B�p
.text:000000000040052D
.text:000000000040052D var_4           = dword ptr -4
.text:000000000040052D
.text:000000000040052D                 push    rbp
.text:000000000040052E                 mov     rbp, rsp
.text:0000000000400531                 mov     [rbp+var_4], edi
.text:0000000000400534                 mov     edx, cs:magic	; magic dd 64h 
.text:000000000040053A                 mov     eax, [rbp+var_4]
.text:000000000040053D                 add     eax, edx
.text:000000000040053F                 pop     rbp
.text:0000000000400540                 retn
.text:0000000000400540 myadd           endp

Running the idapython scritp:

from idaemu import *
a = Emu(UC_ARCH_X86, UC_MODE_64)
print a.eFunc(0x040052D, None, [7])

Get the function result:

107

Example2

If there is a library function call inner the function, we couldn't call it directly. We should use alt to hook the library function first.

.text:0000000000400560                 public myadd
.text:0000000000400560 myadd           proc near               ; CODE XREF: main+27�p
.text:0000000000400560
.text:0000000000400560 var_8           = dword ptr -8
.text:0000000000400560 var_4           = dword ptr -4
.text:0000000000400560
.text:0000000000400560                 push    rbp
.text:0000000000400561                 mov     rbp, rsp
.text:0000000000400564                 sub     rsp, 10h
.text:0000000000400568                 mov     [rbp+var_4], edi
.text:000000000040056B                 mov     [rbp+var_8], esi
.text:000000000040056E                 mov     eax, [rbp+var_8]
.text:0000000000400571                 mov     edx, [rbp+var_4]
.text:0000000000400574                 add     eax, edx
.text:0000000000400576                 mov     esi, eax
.text:0000000000400578                 mov     edi, offset format ; "a+b=%d\n"
.text:000000000040057D                 mov     eax, 0
.text:0000000000400582                 call    _printf
.text:0000000000400587                 leave
.text:0000000000400588                 retn
.text:0000000000400588 myadd           endp

Running the idapython scritp:

from idaemu import *

a = Emu(UC_ARCH_X86, UC_MODE_64)

def myprint(uc, out, args):
    out.append("this is hook output: %d" % args[1])
    return 0

myadd_addr = 0x00400560
printf_addr = 0x00400410 
a.alt(printf_addr, myprint, 2, False)
a.eFunc(myadd_addr, None, [1, 7])
print "---- below is the trace ----"
a.showTrace()

Get the result:

---- below is the trace ----
this is hook output: 8

Well Done. We can alter every function in this way.

Example3

Sometimes it emulates fail with some abort:

Python>from idaemu import *
Python>a = Emu(UC_ARCH_ARM, UC_MODE_THUMB)
Python>print a.eFunc(here(), 0xbeae, [4])
#ERROR: Invalid instruction (UC_ERR_INSN_INVALID)
1048576

Then we can use setTrace and showTrace for debugging.

Python>from idaemu import *
Python>a = Emu(UC_ARCH_ARM, UC_MODE_THUMB)
Python>a.setTrace(TRACE_CODE)
Python>a.eFunc(here(), 0xbeae, [4])
#ERROR: Invalid instruction (UC_ERR_INSN_INVALID)
1048576
Python>a.showTrace()
### Trace Instruction at 0x13dc, size = 2
### Trace Instruction at 0x13de, size = 2
### Trace Instruction at 0x13e0, size = 2
......
### Trace Instruction at 0x19c6, size = 2
### Trace Instruction at 0x19c8, size = 2
### Trace Instruction at 0x19ca, size = 2
### Trace Instruction at 0xbeae, size = 2

So we found the abort reason (the RA is wrong)

idaemu's Issues

Forget print data

in method "showData" , there will no actually data be printed out.

请问支持SMC吗

如图所示，

我想要模拟执行一段解密代码，最终会替换掉内存中的数据，不知道能否支持？

_initData overwrites data if it lies within the same page

Injecting data at multiple addresses that lie within the same memory page causes any data but the last to be discarded.

Consider the following IDAPython demo code:

from idaemu import *
import binascii

e = Emu(UC_ARCH_X86, UC_MODE_32)

# write two bytes into the same page

e.setData(0x0FFFFF, b"\xAA") # new page
e.setData(0x100000, b"\xAA") # new page
e.setData(0x100010, b"\xAA") # same page as above, will overwrite data at 0x10000

e.eUntilAddress(0x401000, 0x401000) # run the emulator once to init data

print "0x0FFFFF:", binascii.hexlify(e.curUC.mem_read(0x0FFFFF, 1))
print "0x100000:", binascii.hexlify(e.curUC.mem_read(0x100000, 1)) # this results in 0x00, not 0xAA as expected
print "0x100010:", binascii.hexlify(e.curUC.mem_read(0x100010, 1))

This seems to be occurring because the loop that injects the data into the emulator memory calls uc.mem_map for every data element in the list. If the memory region that is mapped already contains data from a previous call, this data will now be disregarded.

Quick workaround:

    def _initData(self, uc):
        # DIRTY FIX: first loop maps memory
        for address, data, init in self.data:
            addr = self._alignAddr(address)
            size = PAGE_ALIGN
            while addr + size < len(data): size += PAGE_ALIGN
            uc.mem_map(addr, size)
            
        # second loop actually writes
        for address, data, init in self.data:
            addr = self._alignAddr(address)
            size = PAGE_ALIGN
            if init: 
                uc.mem_write(addr, self._getOriginData(addr, size))
            uc.mem_write(address, data)

Passing a string to a char* argument

I'm trying to emulate a function call
int __cdecl sub_46F8B0(int a1, char *a2)
The function I want to invoke is a wrapper over sprintf (a2, template, ... ).

In IDA 6.6, I call this:

from idaemu import  * 
a = Emu ( UC_ARCH_X86 , UC_MODE_32 )
print a.eFunc(0x0046F8B0, None, [0x4105C0, ?])

How to pass the second argument? The most reasonable would be to use ctypes.create_string_buffer(%) (because the return type is ctypes.c_char_Array_%). But an integer argument is required.

Python>s2=ctypes.create_string_buffer(50)
Python>print a.eFunc(0x454AB0, None, [0x4105C0, s2])
Traceback (most recent call last):
  File "<string>", line 1, in <module>
  File "C:/Program Files (x86)/IDA 6.6/plugins\idaemu.py", line 371, in eFunc
    self._emulate(func.startEA, retAddr, args)
  File "C:/Program Files (x86)/IDA 6.6/plugins\idaemu.py", line 285, in _emulate
    self._initStackAndArgs(uc, stopAddr, args)
  File "C:/Program Files (x86)/IDA 6.6/plugins\idaemu.py", line 177, in _initStackAndArgs
    uc.mem_write(sp, pack(self.pack_fmt, args[i]))
struct.error: cannot convert argument to integer

I'm not strong at python and ctypes. How to be in this situation?

weird behaviour during UC emulation

I have a function without epilogue nor prologue as a consequence of static inline. The IDA disassmebling of my function is :

Address Opcode Bytes Nnemonic
0xF80145C4 14 28 CMP R0, #0x14
0xF80145C6 01 DA BGE loc_F80145CC
0xF80145C8 05 48 LDR R0, =0x5A827999
0xF80145CA 70 47 BX LR
loc_F80145CC
0xF80145CC 28 28 CMP R0, #0x28
etc....

when I try to emulate with
a = Emu(UC_ARCH_ARM, UC_MODE_THUMB)
a.setTrace(TRACE_CODE)
a.eFunc(0xF80145C4 | 1, 0xF000000, [2])

the a.showTrace() show me:

Trace Instruction at 0xf80145c4, size = 4

Trace Instruction at 0xf805e61c, size = 4

Meaning that the instruction at 0xF80145C4 is interpreted as 4 bytes not 2 bytes.

Do you know why?

thx in advance

congrats!

wow, congrats on the release of this tool! this is what everybody is longing for, but you are the first to make it!

we linked to this repo from our website at http://www.unicorn-engine.org/showcase/ just now.

keep it up, cheers!

_showRegs throws an exception when the arch is UC_ARCH_ARM or UC_ARCH_ARM32

when the arch is UC_ARCH_ARM or UC_ARCH_ARM32, the eflags is not initialized and python raises an exception.

Using your plugin on IDA under linux

Hi,

How did you install unicorn engine ? I'm on arch linux and IDA use only python in 32bit. So How do you manage to make it works ?
Thanks