unicorn learning (1) - "" "know the unicorn

At home, bored, brush to brush the question of dizziness, intend to learn new knowledge. .

unicorn this thing can be considered a simulation execution 

Before instructions can simulate arm x86 mips platforms running for some time, and so was also seen hair unicorn write a debugger

I am going to learn about themselves.

Here is mainly used python. . Now tell us about the basic functions as well as members of the

uc a mode register  

uc（uc_arch,mode）

Examples Uc (UC_ARCH_ARM, UC_MODE_THUMB)

Members are as follows

// Architecture type
typedef enum uc_arch {
    UC_ARCH_ARM = 1,    // ARM architecture (including Thumb, Thumb-2)
    UC_ARCH_ARM64,      // ARM-64, also called AArch64
    UC_ARCH_MIPS,       // Mips architecture
    UC_ARCH_X86,        // X86 architecture (including x86 & x86-64)
    UC_ARCH_PPC,        // PowerPC architecture (currently unsupported)
    UC_ARCH_SPARC,      // Sparc architecture
    UC_ARCH_M68K,       // M68K architecture
    UC_ARCH_MAX,
} uc_arch;

// Mode type
typedef enum uc_mode {
    UC_MODE_LITTLE_ENDIAN = 0,    // little-endian mode (default mode)
    UC_MODE_BIG_ENDIAN = 1 << 30, // big-endian mode

    // arm / arm64
    UC_MODE_ARM = 0,              // ARM mode
    UC_MODE_THUMB = 1 << 4,       // THUMB mode (including Thumb-2)
    UC_MODE_MCLASS = 1 << 5,      // ARM's Cortex-M series (currently unsupported)
    UC_MODE_V8 = 1 << 6,          // ARMv8 A32 encodings for ARM (currently unsupported)

    // arm (32bit) cpu types
    UC_MODE_ARM926 = 1 << 7,	  // ARM926 CPU type
    UC_MODE_ARM946 = 1 << 8,	  // ARM946 CPU type
    UC_MODE_ARM1176 = 1 << 9,	  // ARM1176 CPU type

    // mips
    UC_MODE_MICRO = 1 << 4,       // MicroMips mode (currently unsupported)
    UC_MODE_MIPS3 = 1 << 5,       // Mips III ISA (currently unsupported)
    UC_MODE_MIPS32R6 = 1 << 6,    // Mips32r6 ISA (currently unsupported)
    UC_MODE_MIPS32 = 1 << 2,      // Mips32 ISA
    UC_MODE_MIPS64 = 1 << 3,      // Mips64 ISA

    // x86 / x64
    UC_MODE_16 = 1 << 1,          // 16-bit mode
    UC_MODE_32 = 1 << 2,          // 32-bit mode
    UC_MODE_64 = 1 << 3,          // 64-bit mode

    // ppc 
    UC_MODE_PPC32 = 1 << 2,       // 32-bit mode (currently unsupported)
    UC_MODE_PPC64 = 1 << 3,       // 64-bit mode (currently unsupported)
    UC_MODE_QPX = 1 << 4,         // Quad Processing eXtensions mode (currently unsupported)

    // sparc
    UC_MODE_SPARC32 = 1 << 2,     // 32-bit mode
    UC_MODE_SPARC64 = 1 << 3,     // 64-bit mode
    UC_MODE_V9 = 1 << 4,          // SparcV9 mode (currently unsupported)

    // m68k
} uc_mode;

uc_reg_read uc_reg_write register read 

uc_mem_write uc_mem_read address space for reading and writing

emu_start start the simulation

uc_emu_start(uc_engine *uc, uint64_t begin, uint64_t until, uint64_t timeout, size_t count);
 

uc_emu_stop stop simulation  

uc_hook_add register a callback event of a hook

uc_hook_del remove a hook event

mapping space simulation uc_mem_map

uc_mem_unmap unmap space

 

hook type

typedef enum uc_hook_type {
    // Hook all interrupt/syscall events
    UC_HOOK_INTR = 1 << 0,
    // Hook a particular instruction - only a very small subset of instructions supported here
    UC_HOOK_INSN = 1 << 1,
    // Hook a range of code
    UC_HOOK_CODE = 1 << 2,
    // Hook basic blocks
    UC_HOOK_BLOCK = 1 << 3,
    // Hook for memory read on unmapped memory
    UC_HOOK_MEM_READ_UNMAPPED = 1 << 4,
    // Hook for invalid memory write events
    UC_HOOK_MEM_WRITE_UNMAPPED = 1 << 5,
    // Hook for invalid memory fetch for execution events
    UC_HOOK_MEM_FETCH_UNMAPPED = 1 << 6,
    // Hook for memory read on read-protected memory
    UC_HOOK_MEM_READ_PROT = 1 << 7,
    // Hook for memory write on write-protected memory
    UC_HOOK_MEM_WRITE_PROT = 1 << 8,
    // Hook for memory fetch on non-executable memory
    UC_HOOK_MEM_FETCH_PROT = 1 << 9,
    // Hook memory read events.
    UC_HOOK_MEM_READ = 1 << 10,
    // Hook memory write events.
    UC_HOOK_MEM_WRITE = 1 << 11,
    // Hook memory fetch for execution events
    UC_HOOK_MEM_FETCH = 1 << 12,
    // Hook memory read events, but only successful access.
    // The callback will be triggered after successful read.
    UC_HOOK_MEM_READ_AFTER = 1 << 13,
    // Hook invalid instructions exceptions.
    UC_HOOK_INSN_INVALID = 1 << 14,
} uc_hook_type;

You can now write a demo to familiarize yourself

from unicorn import *
from unicorn.x86_const import *
code = b"\x41" #INC ecx;
 
# callback for tracing instructions
def call_back(uc, address, size, user_data):
    print("[*]  addr %x size %x user_data %x") %(address,size,user_data)

def demo_x86():
    try:
        # Initialize emulator in ARM mode
        mu = Uc(UC_ARCH_X86, UC_MODE_32)
 
        # map 2MB memory for this emulation
        ADDRESS = 0x10000
        mu.mem_map(ADDRESS, 2 * 0x10000)
        mu.mem_write(ADDRESS, code)
 
        mu.reg_write(UC_X86_REG_ECX, 0x201f)
 
        mu.hook_add(UC_HOOK_CODE, call_back,0x2020,begin=ADDRESS, end=ADDRESS)
        # emulate machine code in infinite time
        mu.emu_start(ADDRESS, ADDRESS + len(code))
        ecx_value = mu.reg_read(UC_X86_REG_ECX)
        print("[*] ecx_value: %x") %(ecx_value)
    except UcError as e:
        print("UcError %x") %(e)



demo_x86()

For more examples see on the official github