安装

安装模拟器: unicorn

https://github.com/unicorn-engine/unicorn
一般通过pip安装:

  1. pip install unicorn

安装 flareEmu

从FireEye的Git下载 : https://github.com/fireeye/flare-emu
下载 flare_emu.py 就好, 是FireEye针对unicorn模拟器开发的一个帮助类

使用Emu

在使用时, 可不关心解密函数的算法, 然后直接模拟参数传递, 和结果的读取就好

decodeStr

  1. from __future__ import print_function
  2. import idc
  3. import idaapi
  4. import idautils
  5. import flare_emu
  7. def decrypt(address, argv):
  8.     print("%08X" % address, argv)
  9.     myEH = flare_emu.EmuHelper()
  10.     stack = []
  11.     dwRet = idc.next_head(address)
  12.     stack.append(dwRet) # RetAddr
  13.     stack.append(argv[0])
  14.     print(stack)
  16.     # 用于设置栈, 栈的0号元素为返回地址 为 [EBP+4], 1号为第一个Arg [EBP+8]
  17.     myEH.emulateRange(idc.get_name_ea_simple("sub_401667"), stack=stack)
  18.     dwEAX = myEH.getRegVal("eax")   # 从虚拟机中获得eax的值
  19.     print ("EAX:%08X" % dwEAX)
  20.     return myEH.getEmuString(dwEAX) # 从虚拟机中获得字符串, 地址是EAX的值
  22. def decrypt1(argv):
  23.     myEH = flare_emu.EmuHelper()
  25.     # 用于设置寄存器
  26.     myEH.emulateRange(idc.get_name_ea_simple("q_decodeStr"), registers={'eax': argv[0]})
  27.     dwEAX = myEH.getRegVal("eax")
  28.     print ("EAX:%08X" % dwEAX)
  29.     return myEH.getEmuString(dwEAX)
  31. g_bIsNotIter = False
  32. # 迭代地址
  33. def iterateCallback(eh, address, argv, userData):
  34.     global g_bIsNotIter
  35.     if g_bIsNotIter:
  36.         return
  38.     g_bIsNotIter = True
  39.     print("=" * 80)
  40.     print("%08X" % address)
  41.     print(argv)
  42.     # print(userData)
  43.     print("%08X" % argv[0])
  44.     #return
  46.     s = decrypt(address, argv)
  48.     #s = decrypt(argv)
  49.     print("%016X: %s" % (address, s))
  50.     idc.set_cmt(address, s, 0)
  51.     idc.set_cmt(argv[0], s, 0)
  54. if __name__ == '__main__':
  55.     eh = flare_emu.EmuHelper()
  57.     # 启动一个虚拟机 模拟器
  58.     #eh.iterate(idc.get_name_ea_simple("q_decodeStr"), iterateCallback) 
  59.     eh.iterate(idc.get_name_ea_simple("sub_401667"), iterateCallback)

官方示例: rename_dynamic_imports.py

  1. ############################################
  2. # Copyright (C) 2018 FireEye, Inc.
  3. #
  4. # Licensed under the Apache License, Version 2.0, <LICENSE-APACHE or
  5. # http://apache.org/licenses/LICENSE-2.0> or the MIT license <LICENSE-BSD-3-CLAUSE or
  6. # https://opensource.org/licenses/BSD-3-Clause>, at your option. This file may not be
  7. # copied, modified, or distributed except according to those terms.
  8. #
  9. # Author: James T. Bennett
  10. #
  11. # IDApython script that names global variables after their import names when dynamically resolved using GetProcAddress
  12. # Point it to a target function (or somewhere within the function) to begin emulation from
  13. #
  14. # Dependencies:
  15. # https://github.com/fireeye/flare-emu
  16. ############################################
  18. import flare_emu
  19. import struct
  20. import idc
  21. import idautils
  22. import logging
  25. def makeName(addr, name):
  26.     names = list(map(lambda x: x[1], list(idautils.Names())))
  27.     i = 0
  28.     myname = name
  29.     while myname in names:
  30.         myname = name + "_%d" % i
  31.         i += 1
  33.     idc.set_name(addr, myname, idc.SN_CHECK)
  36. def instructionHook(uc, address, size, userData):
  37.     try:
  38.         eh = userData["EmuHelper"]
  39.         if (idc.print_insn_mnem(address) == "mov" and
  40.                 idc.get_operand_type(address, 0) == 2 and
  41.                 idc.get_name(idc.get_operand_value(address, 0))[:6] == "dword_"):
  42.             if "imp" in userData:
  43.                 makeName(idc.get_operand_value(address, 0), userData["imp"])
  44.                 del(userData["imp"])
  46.     except Exception as err:
  47.         print "Error in instructionHook: %s" % str(err)
  48.         eh.stopEmulation(userData)
  51. def callHook(address, argv, funcName, userData):
  52.     try:
  53.         eh = userData["EmuHelper"]
  54.         # save last import string passed to a call to GetProcAddress
  55.         if funcName == "GetProcAddress":
  56.             arg = eh.getEmuString(argv[1])
  57.             if len(arg) > 2:
  58.                 userData["imp"] = arg
  59.             # for code that checks for a return value
  60.             eh.uc.reg_write(eh.regs["ret"], 1)
  62.     except Exception as err:
  63.         print "Error in callHook: %s" % str(err)
  64.         eh.stopEmulation(userData)
  67. if __name__ == '__main__':
  68.     eh = flare_emu.EmuHelper()
  69.     sVa = idc.ida_kernwin.ask_str("0", 0, "Enter the start address (hex)")
  70.     sVa = int(sVa, 16)
  71.     eVa = idc.ida_kernwin.ask_str("0", 0, "Enter the end address (hex), specify 0 to emulate to end of function")
  72.     eVa = int(eVa, 16)
  73.     if (sVa >= idc.get_inf_attr(idc.INF_MIN_EA) and sVa <= idc.get_inf_attr(idc.INF_MAX_EA) and
  74.             (eVa == 0 or (eVa >= idc.get_inf_attr(idc.INF_MIN_EA) and eVa <= idc.get_inf_attr(idc.INF_MAX_EA)))):
  75.         if eVa == 0:
  76.             eVa = None
  77.         mu = eh.emulateRange(sVa, eVa, instructionHook=instructionHook, callHook=callHook)
  79.     else:
  80.         print "Error: supplied addresses not within IDB address range"