Skip to content

Instantly share code, notes, and snippets.

@gdraperi
Forked from tahaconfiant/bundlore_emulation.py
Created December 11, 2019 12:13
Show Gist options
  • Save gdraperi/ee244e7ffff2f560e9399864b1eea33e to your computer and use it in GitHub Desktop.
Save gdraperi/ee244e7ffff2f560e9399864b1eea33e to your computer and use it in GitHub Desktop.
bundlore_emulation
from unicorn import *
from unicorn.x86_const import *
from abc import ABC, abstractmethod
class bundlore_emulation(ABC):
def __init__(self):
self.mu = Uc(UC_ARCH_X86, UC_MODE_64)
self.BASE = 0x100000000
self.HEAP_SIZE = 64*1024
self.STACK_SIZE= 32*1024
self.STACK_ADDR = 0x0
self.CODE = 0x90 # code
self.mu.mem_map(self.BASE, self.HEAP_SIZE)
self.mu.mem_map(self.STACK_ADDR, self.STACK_SIZE)
self.mu.hook_add(UC_HOOK_CODE, self.hook_code)
self.load_binary()
super().__init__()
@abstractmethod
def load_binary(self):
pass
@abstractmethod
def hook_code(self, mu, address, size, user_data):
pass
def _start_unicorn(self, startaddr, endaddr):
try:
#self.mu.emu_start(startaddr, 0)
self.mu.emu_start(startaddr, endaddr)
except Exception as e:
if self.mu.reg_read(UC_X86_REG_EIP) == 1:
return
else:
raise e
def run(self):
self.mu.reg_write(UC_X86_REG_RSP, self.STACK_ADDR + self.STACK_SIZE - 1)
self.mu.mem_write(self.BASE, self.CODE)
self._start_unicorn(0x100001c26, 0x100002a40)
return self.mu.reg_read(UC_X86_REG_EAX)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment