36hours / idaemu Goto Github PK

I'm trying to emulate a function call
int __cdecl sub_46F8B0(int a1, char *a2)
The function I want to invoke is a wrapper over sprintf (a2, template, ... ).

In IDA 6.6, I call this:

from idaemu import  * 
a = Emu ( UC_ARCH_X86 , UC_MODE_32 )
print a.eFunc(0x0046F8B0, None, [0x4105C0, ?])

How to pass the second argument? The most reasonable would be to use ctypes.create_string_buffer(%) (because the return type is ctypes.c_char_Array_%). But an integer argument is required.

Python>s2=ctypes.create_string_buffer(50)
Python>print a.eFunc(0x454AB0, None, [0x4105C0, s2])
Traceback (most recent call last):
  File "<string>", line 1, in <module>
  File "C:/Program Files (x86)/IDA 6.6/plugins\idaemu.py", line 371, in eFunc
    self._emulate(func.startEA, retAddr, args)
  File "C:/Program Files (x86)/IDA 6.6/plugins\idaemu.py", line 285, in _emulate
    self._initStackAndArgs(uc, stopAddr, args)
  File "C:/Program Files (x86)/IDA 6.6/plugins\idaemu.py", line 177, in _initStackAndArgs
    uc.mem_write(sp, pack(self.pack_fmt, args[i]))
struct.error: cannot convert argument to integer

I'm not strong at python and ctypes. How to be in this situation?

I have a function without epilogue nor prologue as a consequence of static inline. The IDA disassmebling of my function is :

Address Opcode Bytes Nnemonic
0xF80145C4 14 28 CMP R0, #0x14
0xF80145C6 01 DA BGE loc_F80145CC
0xF80145C8 05 48 LDR R0, =0x5A827999
0xF80145CA 70 47 BX LR
loc_F80145CC
0xF80145CC 28 28 CMP R0, #0x28
etc....

when I try to emulate with
a = Emu(UC_ARCH_ARM, UC_MODE_THUMB)
a.setTrace(TRACE_CODE)
a.eFunc(0xF80145C4 | 1, 0xF000000, [2])

the a.showTrace() show me:

Trace Instruction at 0xf80145c4, size = 4

Trace Instruction at 0xf805e61c, size = 4

Meaning that the instruction at 0xF80145C4 is interpreted as 4 bytes not 2 bytes.

Do you know why?

thx in advance

when the arch is UC_ARCH_ARM or UC_ARCH_ARM32, the eflags is not initialized and python raises an exception.

如图所示，

我想要模拟执行一段解密代码，最终会替换掉内存中的数据，不知道能否支持？

wow, congrats on the release of this tool! this is what everybody is longing for, but you are the first to make it!

we linked to this repo from our website at http://www.unicorn-engine.org/showcase/ just now.

keep it up, cheers!

Hi,

How did you install unicorn engine ? I'm on arch linux and IDA use only python in 32bit. So How do you manage to make it works ?
Thanks

Injecting data at multiple addresses that lie within the same memory page causes any data but the last to be discarded.

Consider the following IDAPython demo code:

from idaemu import *
import binascii

e = Emu(UC_ARCH_X86, UC_MODE_32)

# write two bytes into the same page

e.setData(0x0FFFFF, b"\xAA") # new page
e.setData(0x100000, b"\xAA") # new page
e.setData(0x100010, b"\xAA") # same page as above, will overwrite data at 0x10000

e.eUntilAddress(0x401000, 0x401000) # run the emulator once to init data

print "0x0FFFFF:", binascii.hexlify(e.curUC.mem_read(0x0FFFFF, 1))
print "0x100000:", binascii.hexlify(e.curUC.mem_read(0x100000, 1)) # this results in 0x00, not 0xAA as expected
print "0x100010:", binascii.hexlify(e.curUC.mem_read(0x100010, 1))

This seems to be occurring because the loop that injects the data into the emulator memory calls uc.mem_map for every data element in the list. If the memory region that is mapped already contains data from a previous call, this data will now be disregarded.

Quick workaround:

    def _initData(self, uc):
        # DIRTY FIX: first loop maps memory
        for address, data, init in self.data:
            addr = self._alignAddr(address)
            size = PAGE_ALIGN
            while addr + size < len(data): size += PAGE_ALIGN
            uc.mem_map(addr, size)
            
        # second loop actually writes
        for address, data, init in self.data:
            addr = self._alignAddr(address)
            size = PAGE_ALIGN
            if init: 
                uc.mem_write(addr, self._getOriginData(addr, size))
            uc.mem_write(address, data)

in method "showData" , there will no actually data be printed out.