36hours / idaemu Goto Github PK
View Code? Open in Web Editor NEWidaemu is an IDA Pro Plugin - use for emulating code in IDA Pro.
License: GNU General Public License v2.0
idaemu is an IDA Pro Plugin - use for emulating code in IDA Pro.
License: GNU General Public License v2.0
I'm trying to emulate a function call
int __cdecl sub_46F8B0(int a1, char *a2)
The function I want to invoke is a wrapper over sprintf (a2, template, ... )
.
In IDA 6.6, I call this:
from idaemu import *
a = Emu ( UC_ARCH_X86 , UC_MODE_32 )
print a.eFunc(0x0046F8B0, None, [0x4105C0, ?])
How to pass the second argument? The most reasonable would be to use ctypes.create_string_buffer(%)
(because the return type is ctypes.c_char_Array_%
). But an integer argument is required.
Python>s2=ctypes.create_string_buffer(50)
Python>print a.eFunc(0x454AB0, None, [0x4105C0, s2])
Traceback (most recent call last):
File "<string>", line 1, in <module>
File "C:/Program Files (x86)/IDA 6.6/plugins\idaemu.py", line 371, in eFunc
self._emulate(func.startEA, retAddr, args)
File "C:/Program Files (x86)/IDA 6.6/plugins\idaemu.py", line 285, in _emulate
self._initStackAndArgs(uc, stopAddr, args)
File "C:/Program Files (x86)/IDA 6.6/plugins\idaemu.py", line 177, in _initStackAndArgs
uc.mem_write(sp, pack(self.pack_fmt, args[i]))
struct.error: cannot convert argument to integer
I'm not strong at python and ctypes. How to be in this situation?
Hi,
How did you install unicorn engine ? I'm on arch linux and IDA use only python in 32bit. So How do you manage to make it works ?
Thanks
I have a function without epilogue nor prologue as a consequence of static inline. The IDA disassmebling of my function is :
Address Opcode Bytes Nnemonic
0xF80145C4 14 28 CMP R0, #0x14
0xF80145C6 01 DA BGE loc_F80145CC
0xF80145C8 05 48 LDR R0, =0x5A827999
0xF80145CA 70 47 BX LR
loc_F80145CC
0xF80145CC 28 28 CMP R0, #0x28
etc....
when I try to emulate with
a = Emu(UC_ARCH_ARM, UC_MODE_THUMB)
a.setTrace(TRACE_CODE)
a.eFunc(0xF80145C4 | 1, 0xF000000, [2])
the a.showTrace() show me:
Meaning that the instruction at 0xF80145C4 is interpreted as 4 bytes not 2 bytes.
Do you know why?
thx in advance
in method "showData" , there will no actually data be printed out.
Injecting data at multiple addresses that lie within the same memory page causes any data but the last to be discarded.
Consider the following IDAPython demo code:
from idaemu import * import binascii e = Emu(UC_ARCH_X86, UC_MODE_32) # write two bytes into the same page e.setData(0x0FFFFF, b"\xAA") # new page e.setData(0x100000, b"\xAA") # new page e.setData(0x100010, b"\xAA") # same page as above, will overwrite data at 0x10000 e.eUntilAddress(0x401000, 0x401000) # run the emulator once to init data print "0x0FFFFF:", binascii.hexlify(e.curUC.mem_read(0x0FFFFF, 1)) print "0x100000:", binascii.hexlify(e.curUC.mem_read(0x100000, 1)) # this results in 0x00, not 0xAA as expected print "0x100010:", binascii.hexlify(e.curUC.mem_read(0x100010, 1))
This seems to be occurring because the loop that injects the data into the emulator memory calls uc.mem_map for every data element in the list. If the memory region that is mapped already contains data from a previous call, this data will now be disregarded.
Quick workaround:
def _initData(self, uc): # DIRTY FIX: first loop maps memory for address, data, init in self.data: addr = self._alignAddr(address) size = PAGE_ALIGN while addr + size < len(data): size += PAGE_ALIGN uc.mem_map(addr, size) # second loop actually writes for address, data, init in self.data: addr = self._alignAddr(address) size = PAGE_ALIGN if init: uc.mem_write(addr, self._getOriginData(addr, size)) uc.mem_write(address, data)
wow, congrats on the release of this tool! this is what everybody is longing for, but you are the first to make it!
we linked to this repo from our website at http://www.unicorn-engine.org/showcase/ just now.
keep it up, cheers!
when the arch is UC_ARCH_ARM or UC_ARCH_ARM32, the eflags is not initialized and python raises an exception.
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google ❤️ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.