shellcode模拟运行工具之unicorn安装与使用
2022-11-15 09:34:37 Author: 安全狗的自我修养(查看原文) 阅读量:36 收藏

下载最新2.1版本源码 

git clone https://github.com/unicorn-engine/unicorn.git

编译

mkdir buildcd buildcmake  -G "Unix Makefiles" ..cmake  -G "Xcode" ..make -j6

模拟运行shellcode例子代码

/* Unicorn Emulator Engine *//* By Nguyen Anh Quynh & Dang Hoang Vu, 2015 */
/* Sample code to trace code with Linux code with syscall */
#include <unicorn/unicorn.h>#include <string.h>
// code to be emulated#define X86_CODE32 \ "\xeb\x19\x31\xc0\x31\xdb\x31\xd2\x31\xc9\xb0\x04\xb3\x01\x59\xb2\x05\xcd" \ "\x80\x31\xc0\xb0\x01\x31\xdb\xcd\x80\xe8\xe2\xff\xff\xff\x68\x65\x6c\x6c" \ "\x6f"
#define X86_CODE32_SELF \ "\xeb\x1c\x5a\x89\xd6\x8b\x02\x66\x3d\xca\x7d\x75\x06\x66\x05\x03\x03\x89" \ "\x02\xfe\xc2\x3d\x41\x41\x41\x41\x75\xe9\xff\xe6\xe8\xdf\xff\xff\xff\x31" \ "\xd2\x6a\x0b\x58\x99\x52\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3" \ "\x52\x53\x89\xe1\xca\x7d\x41\x41\x41\x41\x41\x41\x41\x41"
// memory address where emulation starts#define ADDRESS 0x1000000
#define MIN(a, b) (a < b ? a : b)// callback for tracing instructionstatic void hook_code(uc_engine *uc, uint64_t address, uint32_t size, void *user_data){ int r_eip; uint8_t tmp[16];
printf("Tracing instruction at 0x%" PRIx64 ", instruction size = 0x%x\n", address, size);
uc_reg_read(uc, UC_X86_REG_EIP, &r_eip); printf("*** EIP = %x ***: ", r_eip);
size = MIN(sizeof(tmp), size); if (!uc_mem_read(uc, address, tmp, size)) { uint32_t i; for (i = 0; i < size; i++) { printf("%x ", tmp[i]); } printf("\n"); }}
// callback for handling interrupt// ref: http://syscalls.kernelgrok.com/static void hook_intr(uc_engine *uc, uint32_t intno, void *user_data){ int32_t r_eax, r_ecx, r_eip; uint32_t r_edx, size; unsigned char buffer[256];
// only handle Linux syscall if (intno != 0x80) return;
uc_reg_read(uc, UC_X86_REG_EAX, &r_eax); uc_reg_read(uc, UC_X86_REG_EIP, &r_eip);
switch (r_eax) { default: printf(">>> 0x%x: interrupt 0x%x, EAX = 0x%x\n", r_eip, intno, r_eax); break; case 1: // sys_exit printf(">>> 0x%x: interrupt 0x%x, SYS_EXIT. quit!\n\n", r_eip, intno); uc_emu_stop(uc); break; case 4: // sys_write // ECX = buffer address uc_reg_read(uc, UC_X86_REG_ECX, &r_ecx);
// EDX = buffer size uc_reg_read(uc, UC_X86_REG_EDX, &r_edx);
// read the buffer in size = MIN(sizeof(buffer) - 1, r_edx);
if (!uc_mem_read(uc, r_ecx, buffer, size)) { buffer[size] = '\0'; printf(">>> 0x%x: interrupt 0x%x, SYS_WRITE. buffer = 0x%x, size = " "%u, content = '%s'\n", r_eip, intno, r_ecx, r_edx, buffer); } else { printf(">>> 0x%x: interrupt 0x%x, SYS_WRITE. buffer = 0x%x, size = " "%u (cannot get content)\n", r_eip, intno, r_ecx, r_edx); } break; }}
static void test_i386(void){ uc_engine *uc; uc_err err; uc_hook trace1, trace2;
int r_esp = ADDRESS + 0x200000; // ESP register
printf("Emulate i386 code\n");
// Initialize emulator in X86-32bit mode err = uc_open(UC_ARCH_X86, UC_MODE_32, &uc); if (err) { printf("Failed on uc_open() with error returned: %u\n", err); return; }
// map 2MB memory for this emulation uc_mem_map(uc, ADDRESS, 2 * 1024 * 1024, UC_PROT_ALL);
// write machine code to be emulated to memory if (uc_mem_write(uc, ADDRESS, X86_CODE32_SELF, sizeof(X86_CODE32_SELF) - 1)) { printf("Failed to write emulation code to memory, quit!\n"); return; }
// initialize machine registers uc_reg_write(uc, UC_X86_REG_ESP, &r_esp);
// tracing all instructions by having @begin > @end uc_hook_add(uc, &trace1, UC_HOOK_CODE, hook_code, NULL, 1, 0);
// handle interrupt ourself uc_hook_add(uc, &trace2, UC_HOOK_INTR, hook_intr, NULL, 1, 0);
printf("\n>>> Start tracing this Linux code\n");
// emulate machine code in infinite time // err = uc_emu_start(uc, ADDRESS, ADDRESS + sizeof(X86_CODE32_SELF), 0, // 12); <--- emulate only 12 instructions err = uc_emu_start(uc, ADDRESS, ADDRESS + sizeof(X86_CODE32_SELF) - 1, 0, 0); if (err) { printf("Failed on uc_emu_start() with error returned %u: %s\n", err, uc_strerror(err)); }
printf("\n>>> Emulation done.\n");
uc_close(uc);}
int main(int argc, char **argv, char **envp){ if (argc == 2) { if (!strcmp(argv[1], "-32")) { test_i386(); } else if (!strcmp(argv[1], "-h")) { printf("Syntax: %s <-32|-64>\n", argv[0]); } } else { test_i386(); }
return 0;}

更多其它详细教程可以联系作者。

目录

# unicorn源码分析与使用视频教程  ## 基础
* 1.课程介绍* 2.unicorn源码编译* 3.unicorn简单使用与调试* 4.unicorn 源码框架了解* 5.实现一个最简单的my_qemu(kvm)* 6.shellcode 指令追踪使用* 7.shellcode 指令追踪源码分析* 8.使用中断事件hook源码分析 (syscall)* 9.使用中断事件hook源码分析(arm syscall)* 10.内存操作事件hook(读写执行)* 11.内存操作事件hook源码分析* 12.异常事件使用与源码分析* 13.再谈unicorn(框架定位与缺陷)
## x86架构中使用
* 14.模拟单个参数函数与获取返回值(x86_64构架)* 15.模拟多个参数函数(x86_64构架)* 16.模拟获取全局变量函数(x86_64构架)* 17.外部符合libc库函数调用模拟(x86_64构架)* 18.模拟多个函数调用链(x86_64构架)
### 常用算法模拟* 19.模拟base64编码(x86_64构架)* 20.aes算法模拟(x86_64构架)* 21.des算法模拟(x86_64构架)* 22.rc4算法模拟(x86_64构架)* 23.其它算法模拟思路(x86_64构架)
## arm架构中使用* 24.模拟单个参数函数与获取返回值(arm64构架)* 25.模拟多个参数函数(arm64构架)* 26.模拟获取全局变量函数(arm64构架)* 27.arm构架中的算法模拟(arm64构架)* 28.android中模拟与JNI交互(arm64构架)* 29.JNI模拟call java函数(arm64构架)

## 完善unicorn * 30.unicorn ELF文件模拟* 31.unicorn 其它可执行文件* 32.unicorn调试器介绍
## ollvm混淆* 33.unicorn结合capstone使用* 34.生成CFG(控制流程图)* 35.ollvm反混淆思路

其它学习教程。


文章来源: http://mp.weixin.qq.com/s?__biz=MzkwOTE5MDY5NA==&mid=2247486518&idx=1&sn=4e0b5ae72b4a4b59092ebf8bbccd4f32&chksm=c13f3f7ff648b6699aef62ce245c5a0107b2e869f0da603755c531bbbc32fc4604f4ce6a0b9a#rd
如有侵权请联系:admin#unsafe.sh