alexhude / uemu Goto Github PK
View Code? Open in Web Editor NEWTiny cute emulator plugin for IDA based on unicorn.
Tiny cute emulator plugin for IDA based on unicorn.
Awesome plugin! Wish i knew how to use it. I placed the plugin in my ida pro plugin directory, but i dont see it appear either in the right click menu, or in the plugins menu. Using latest IDA7 for mac. Trying to run the script directly does throw a NameError is_code
is not defined, but this could be due to me not setting it up properly.
Any suggestions on how to set it up besides what i am already trying?
Thanks!
Some features are needed
Hi,
when I load the plugin in IDA Pro, it alerts that there is no modular named ida_hexrays, ida_kernwin and ida_allins. uEmu.py locates in ida's /plugins directory.
Would you please give me a clue how to fix this problem? thanks.
The code for step
starts a new thread to do the step, probably to keep the simulation asynchronous, which is fair enough and useful. But the step
function is only capable of executing one instruction at a time. The run
functionality also uses step
, just with a special constant kStepCount_Run
which means "keep going". The issue is that step_thread_main
will call step
recursively, which will spawn a brand new thread.. on every instruction. Unicorn is slower than hardware, but not that slow, so this control flow makes emulation orders of magnitude slower than it needs to be. Proposed fix: call emu_start
with an indefinite count in the step_thread_main
thread and use Unicorn hooks (UC_HOOK_CODE) to do the tracing, breakpoint handling and IDAAPI_MakeCode
.
https://github.com/alexhude/uEmu/blob/master/uEmu.py#L1444 provious previous
I have to emulate armle, thumb mode in ida 7.3
now i used this plugin, i have a error
Traceback (most recent call last):
File "C:/Users/JaeHong/Downloads/uEmu-master (1)/uEmu-master/uEmu.py", line 111, in activate
self.action_handler.handle_menu_action(self.action_type)
File "C:/Users/JaeHong/Downloads/uEmu-master (1)/uEmu-master/uEmu.py", line 1739, in handle_menu_action
[x.handler() for x in self.MENU_ITEMS if x.action == action]
File "C:/Users/JaeHong/Downloads/uEmu-master (1)/uEmu-master/uEmu.py", line 1855, in emu_start
self.unicornEngine.run_from(IDAAPI_ScreenEA())
File "C:/Users/JaeHong/Downloads/uEmu-master (1)/uEmu-master/uEmu.py", line 1429, in run_from
if self.init_cpu_context(address) == False:
File "C:/Users/JaeHong/Downloads/uEmu-master (1)/uEmu-master/uEmu.py", line 1385, in init_cpu_context
if self.owner.ext_hooks.init_context is not None:
AttributeError: 'NoneType' object has no attribute 'init_context'
I couldn't create pull request on the other side so I request code fix here.
This fixes the convert to code automatically error for 7.6.
https://hex-rays.com/products/ida/support/ida74_idapython_no_bc695_porting_guide.shtml
I was using the emulator successfully for a while, and now have managed to achieve a state where every time I try to step, I instead get an error:
File "uEmu/uEmu.py", line 111, in activate
self.action_handler.handle_menu_action(self.action_type)
File "uEmu/uEmu.py", line 1742, in handle_menu_action
[x.handler() for x in self.MENU_ITEMS if x.action == action]
File "uEmu/uEmu.py", line 1742, in <listcomp>
[x.handler() for x in self.MENU_ITEMS if x.action == action]
File "uEmu/uEmu.py", line 1881, in emu_step
if UEMU_HELPERS.is_alt_pressed():
File "uEmu/uEmu.py", line 491, in is_alt_pressed
if QtWidgets.QApplication.keyboardModifiers() & QtCore.Qt.AltModifier:
NameError: name 'QtWidgets' is not defined
The controls window also stopped rendering altogether:
If I recall, things started going downhill after attempting to access the Settings menu via Edit > Plugins > uEmu > Settings.
This is on Ida version 7.7.220218.
I have of course tried closing and re-opening idapro fully, without success.
Any ideas?
No menu shows up for me, i've added qt path and no error either
I got some random error while executing code:
[uEmu]: Memory breakpoint [*****] reached from ******* : LDRB W5, [X4]
Exception in thread Thread-2646:
Traceback (most recent call last):
File "/System/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/threading.py", line 810, in __bootstrap_inner
self.run()
File "/System/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/threading.py", line 763, in run
self.__target(*self.__args, **self.__kwargs)
File "/Users/admin/dev/tools/uEmu/uEmu.py", line 1032, in step_thread_main
self.mu.context_restore(self.fix_context)
File "/Library/Python/2.7/site-packages/unicorn/unicorn.py", line 563, in context_restore
status = _uc.uc_context_restore(self._uch, context.po
Let's see what's happened on line 1032:
https://github.com/alexhude/uEmu/blob/master/uEmu.py#L1032
# vvv Workaround to fix issue when register are still updated even if emu_stop is called
if self.fix_context is not None:
self.mu.context_restore(self.fix_context)
self.fix_context = None
# ^^^
And single place where fix_context is not equal to None:
# vvv Workaround to fix issue when register are still updated even if emu_stop is called
self.fix_context = self.get_context()
# ^^^
The problem here is that self.fix_context is 'dict' with 'cpu' and 'mem' fields, so I guess instead of mu.context_restore you want self.set_context. Because context_restore use another type:
def context_restore(self, context):
status = _uc.uc_context_restore(self._uch, context.pointer)
if status != uc.UC_ERR_OK:
raise UcError(status)
What do you think?
return res == 1
How about extending this emulation capability to IDAPython console? Like:
print hex(Appcall['some_hash']('hey!!'))
>> 0x12345678
It would be pretty cool
Is there a way to use the uEmu plugin in Windows version of IDA?
IDA changed from PySide to PyQt in 6.9. Perhaps it's worth adding a min version to the readme (or support for PySide ๐).
Hi, Nice plugin worked well with previous IDA but with latest IDA 7.4
when I try to show the CPU context (ARM32) I get an error:
WARNING: The method "ida_kernwin.UI_Hooks::finish_populating_tform_popup" won't be called (it has been replaced with "ida_kernwin.UI_Hooks::finish_populating_widget_popup")
[uEmu]: Init plugin uEmu
File "C:/Program Files/IDA74/plugins/uEmu.py", line 1949, in show_cpu_context
self.cpuContextView.SetContent(self.unicornEngine.pc, self.unicornEngine.mu)
File "C:/Program Files/IDA74/plugins/uEmu.py", line 628, in SetContent
for i in range(lines):
TypeError: 'float' object cannot be interpreted as an integer
I used this tool to emulate the source of a MIPS bootloader a few months ago, I didn't have any issue, it was working fine. Now I had to setup the environment again in IDA 7.7 and I'm getting problems when trying to emulate any instruction:
The output log won't show anything else. Just that weird message that won't let me emulate anything. I have tried to re-setup the entire project again, restarting IDA with the same result
find_inited = IDAAPI_IsLoaded(start)
Allow a reverse engineer to map and emulate metal code separately from IDA memory ranges.
I added additional useful feature - skip instruction. I also found out that IDAAPI_NextHead() uses 2 parameters (IDA Pro 7.6).
If you will add this feature in main branch it would be great!
Thanks
Issue
When running uEmu as a plugin in IDA 7.2 and stepping over code I occasionally get the error:
Traceback (most recent call last):
File "_ctypes/callbacks.c", line 315, in 'calling callback function'
File "C:\python27-x64\lib\site-packages\unicorn\unicorn.py", line 448, in _hook_mem_access_cb
cb(self, access, address, size, value, data)
File "C:/Program Files/IDA 7.2/plugins/uEmu.py", line 1169, in hook_mem_access
if self.is_breakpoint_reached(address):
File "C:/Program Files/IDA 7.2/plugins/uEmu.py", line 1422, in is_breakpoint_reached
for idx in range(IDAAPI_GetBptQty()):
File "C:\Program Files\IDA 7.2\python\idc.py", line 5796, in get_bpt_qty
return ida_dbg.get_bpt_qty()
File "C:\Program Files\IDA 7.2\python\ida_dbg.py", line 1907, in get_bpt_qty
return _ida_dbg.get_bpt_qty(*args)
RuntimeError: Function can be called from the main thread only
Cause
I think it's because IDA 7.2 introduced checks for IDA API functions to make sure they can only be called from the main thread.
IDAPython: all functions not marked as THREAD_SAFE in the C++ SDK, will now check that they are being called from the main thread, avoiding possible corruption or crashes
I wanna automated execute the script, is there any APIs?
IDA PRO 7.4.191112
Python 3.7.6 x64
Win10
When I try to display memory I've this error :
Traceback (most recent call last):
File "C:/Program Files/IDA Pro 7.4/plugins/uEmu.py", line 111, in activate
self.action_handler.handle_menu_action(self.action_type)
File "C:/Program Files/IDA Pro 7.4/plugins/uEmu.py", line 1737, in handle_menu_action
[x.handler() for x in self.MENU_ITEMS if x.action == action]
File "C:/Program Files/IDA Pro 7.4/plugins/uEmu.py", line 1737, in <listcomp>
[x.handler() for x in self.MENU_ITEMS if x.action == action]
File "C:/Program Files/IDA Pro 7.4/plugins/uEmu.py", line 1993, in show_memory
self.memoryViews[mem_addr].Create("uEmu Memory [ " + mem_cmnt.encode('utf8') + " ]")
TypeError: can only concatenate str (not "bytes") to str
Full context :
BinDiff 6 (@297836223, Feb 28 2020), (c)2004-2011 zynamics GmbH, (c)2011-2020 Google LLC.
BinExport 11 (@297836223, Feb 28 2020), (c)2004-2011 zynamics GmbH, (c)2011-2020 Google LLC.
bytes pages size description
--------- ----- ---- --------------------------------------------
942080 115 8192 allocating memory for b-tree...
548864 67 8192 allocating memory for virtual array...
262144 32 8192 allocating memory for name pointers...
-----------------------------------------------------------------
1753088 total memory allocated
Loading processor module C:\Program Files\IDA Pro 7.4\procs\pc.dll for metapc...OK
Loading type libraries...
Autoanalysis subsystem has been initialized.
WARNING: The method "ida_kernwin.UI_Hooks::finish_populating_tform_popup" won't be called (it has been replaced with "ida_kernwin.UI_Hooks::finish_populating_widget_popup")
[uEmu]: Init plugin uEmu
Database for file 'XXXXX.exe' has been loaded.
Hex-Rays Decompiler plugin has been loaded (v7.4.0.191112)
License: XXXXXXXXXXXXXXXXX (1 user)
The hotkeys are F5: decompile, Ctrl-F5: decompile all.
Please check the Edit/Plugins menu for more informaton.
IDAPython Hex-Rays bindings initialized.
================================================================================
WARNING: The method "ida_kernwin.UI_Hooks::finish_populating_tform_popup" won't be called (it has been replaced with "ida_kernwin.UI_Hooks::finish_populating_widget_popup")
[uEmu]: Init plugin uEmu
40BD7A: restored microcode from idb
40D92D: using guessed type int __thiscall WinMain(_DWORD);
420BB0: using guessed type void *off_420BB0;
[uEmu]: UI ready. Run plugin
[uEmu]: Unicorn version [ 1.0.1 ]
[uEmu]: CPU arch set to [ x86 ]
------------------------------------------------------------------------------------------
Python 3.7.6 (tags/v3.7.6:43364a7ae0, Dec 19 2019, 00:42:30) [MSC v.1916 64 bit (AMD64)]
IDAPython v7.4.0 final (serial 0) (c) The IDAPython Team <[email protected]>
------------------------------------------------------------------------------------------
[uEmu]: Mapping segments...
[uEmu]: * seg [401000:414000]
[uEmu]: map [401000:413FFF] -> [401000:413FFF]
[uEmu]: cpy [401000:413FFF]
[uEmu]: * seg [414000:414408]
[uEmu]: map [414000:414FFF] -> [414000:414FFF]
[uEmu]: skp [414000:41400F]
[uEmu]: cpy [414010:414013]
[uEmu]: skp [414010:414017]
[uEmu]: cpy [414018:41401B]
[uEmu]: skp [414018:41409B]
[uEmu]: cpy [41409C:41409F]
[uEmu]: skp [41409C:414207]
[uEmu]: cpy [414208:41420B]
[uEmu]: skp [414208:4143CF]
[uEmu]: cpy [4143D0:4143D3]
[uEmu]: skp [4143D0:4143F3]
[uEmu]: cpy [4143F4:4143F7]
[uEmu]: skp [4143F4:414403]
[uEmu]: cpy [414404:414407]
[uEmu]: * seg [414408:419000]
[uEmu]: map [415000:418FFF] -> [415000:418FFF]
[uEmu]: cpy [414408:418FFF]
[uEmu]: * seg [419000:426000]
[uEmu]: map [419000:425FFF] -> [419000:425FFF]
[uEmu]: cpy [419000:42364F]
[uEmu]: Emulation started
[uEmu]: ! <M> Missing memory at 0xfffffffc, data size = 4, data value = 0xf
[uEmu]: ! <C> execute_sync(<function uEmuUnicornEngine.hook_mem_invalid.<locals>.result_handler at 0x000001F0973BF8B8>) failed
[uEmu]: ! <M> Missing memory at 0xfffffffc, data size = 4, data value = 0xf
[uEmu]: map [FFFFFFFC:FFFFFFFF] -> [FFFFF000:FFFFFFFF]
[uEmu]: unmap [401000:413FFF]
[uEmu]: unmap [414000:414FFF]
[uEmu]: unmap [415000:418FFF]
[uEmu]: unmap [419000:425FFF]
[uEmu]: unmap [FFFFF000:FFFFFFFF]
[uEmu]: Emulation reset
[uEmu]: Mapping segments...
[uEmu]: * seg [401000:414000]
[uEmu]: map [401000:413FFF] -> [401000:413FFF]
[uEmu]: cpy [401000:413FFF]
[uEmu]: * seg [414000:414408]
[uEmu]: map [414000:414FFF] -> [414000:414FFF]
[uEmu]: skp [414000:41400F]
[uEmu]: cpy [414010:414013]
[uEmu]: skp [414010:414017]
[uEmu]: cpy [414018:41401B]
[uEmu]: skp [414018:41409B]
[uEmu]: cpy [41409C:41409F]
[uEmu]: skp [41409C:414207]
[uEmu]: cpy [414208:41420B]
[uEmu]: skp [414208:4143CF]
[uEmu]: cpy [4143D0:4143D3]
[uEmu]: skp [4143D0:4143F3]
[uEmu]: cpy [4143F4:4143F7]
[uEmu]: skp [4143F4:414403]
[uEmu]: cpy [414404:414407]
[uEmu]: * seg [414408:419000]
[uEmu]: map [415000:418FFF] -> [415000:418FFF]
[uEmu]: cpy [414408:418FFF]
[uEmu]: * seg [419000:426000]
[uEmu]: map [419000:425FFF] -> [419000:425FFF]
[uEmu]: cpy [419000:42364F]
[uEmu]: Emulation started
[uEmu]: Emulator is already active
[uEmu]: ! <M> Missing memory at 0xfffffffc, data size = 4, data value = 0xf
Traceback (most recent call last):
File "_ctypes/callbacks.c", line 232, in 'calling callback function'
File "C:\Program Files\IDA Pro 7.4\python\3\ida_kernwin.py", line 6849, in helper_cb
r = self.handler(fid)
File "C:/Program Files/IDA Pro 7.4/plugins/uEmu.py", line 1000, in OnFormChange
self.SetControlValue(self.total_label, "Total: %d (0x%X)" % (size, size))
File "C:\Program Files\IDA Pro 7.4\python\3\ida_kernwin.py", line 7532, in SetControlValue
tid, _ = self.ControlToFieldTypeIdAndSize(ctrl)
File "C:\Program Files\IDA Pro 7.4\python\3\ida_kernwin.py", line 7559, in ControlToFieldTypeIdAndSize
return (3, min(_ida_kernwin.MAXSTR, ctrl.size))
AttributeError: module '_ida_kernwin' has no attribute 'MAXSTR'
Traceback (most recent call last):
File "_ctypes/callbacks.c", line 232, in 'calling callback function'
File "C:\Program Files\IDA Pro 7.4\python\3\ida_kernwin.py", line 6849, in helper_cb
r = self.handler(fid)
File "C:/Program Files/IDA Pro 7.4/plugins/uEmu.py", line 1000, in OnFormChange
self.SetControlValue(self.total_label, "Total: %d (0x%X)" % (size, size))
File "C:\Program Files\IDA Pro 7.4\python\3\ida_kernwin.py", line 7532, in SetControlValue
tid, _ = self.ControlToFieldTypeIdAndSize(ctrl)
File "C:\Program Files\IDA Pro 7.4\python\3\ida_kernwin.py", line 7559, in ControlToFieldTypeIdAndSize
return (3, min(_ida_kernwin.MAXSTR, ctrl.size))
AttributeError: module '_ida_kernwin' has no attribute 'MAXSTR'
Traceback (most recent call last):
File "_ctypes/callbacks.c", line 232, in 'calling callback function'
File "C:\Program Files\IDA Pro 7.4\python\3\ida_kernwin.py", line 6849, in helper_cb
r = self.handler(fid)
File "C:/Program Files/IDA Pro 7.4/plugins/uEmu.py", line 1000, in OnFormChange
self.SetControlValue(self.total_label, "Total: %d (0x%X)" % (size, size))
File "C:\Program Files\IDA Pro 7.4\python\3\ida_kernwin.py", line 7532, in SetControlValue
tid, _ = self.ControlToFieldTypeIdAndSize(ctrl)
File "C:\Program Files\IDA Pro 7.4\python\3\ida_kernwin.py", line 7559, in ControlToFieldTypeIdAndSize
return (3, min(_ida_kernwin.MAXSTR, ctrl.size))
AttributeError: module '_ida_kernwin' has no attribute 'MAXSTR'
[uEmu]: map [FFFFFFFC:FFFFFFFF] -> [FFFFF000:FFFFFFFF]
[uEmu]: Breakpoint reached at 0x4012F6 : push ebp; bRevert
Traceback (most recent call last):
File "C:/Program Files/IDA Pro 7.4/plugins/uEmu.py", line 111, in activate
self.action_handler.handle_menu_action(self.action_type)
File "C:/Program Files/IDA Pro 7.4/plugins/uEmu.py", line 1737, in handle_menu_action
[x.handler() for x in self.MENU_ITEMS if x.action == action]
File "C:/Program Files/IDA Pro 7.4/plugins/uEmu.py", line 1737, in <listcomp>
[x.handler() for x in self.MENU_ITEMS if x.action == action]
File "C:/Program Files/IDA Pro 7.4/plugins/uEmu.py", line 1993, in show_memory
self.memoryViews[mem_addr].Create("uEmu Memory [ " + mem_cmnt.encode('utf8') + " ]")
TypeError: can only concatenate str (not "bytes") to str
return QtWidgets.QApplication.keyboardModifiers() & QtCore.Qt.AltModifier
Use this tool with IDA7.7_pro + python3.11.3 under win10_64bit ,Simulate any function ,Encounter the following Err:
Propagating type information...
Function argument information has been propagated
The initial autoanalysis has been finished.
File "E:/IDA_Pro_7.7/plugins/uEmu.py", line 110, in activate
if ctx.form_type == BWN_DISASM:
Please use "widget_type" instead of "form_type" ("form_type" is kept for backward-compatibility, and will be removed soon.)
[uEmu]: VFP enabled
[uEmu]: Mapping segments...
[uEmu]: * seg [0:174]
[uEmu]: map [0:FFF] -> [0:FFF]
[uEmu]: cpy [0:173]
[uEmu]: * seg [174:4EEE4C]
[uEmu]: map [1000:4EEFFF] -> [1000:4EEFFF]
[uEmu]: cpy [174:4EEE4B]
[uEmu]: * seg [4EEE4C:51557C]
[uEmu]: map [4EF000:515FFF] -> [4EF000:515FFF]
[uEmu]: cpy [4EEE4C:51557B]
[uEmu]: * seg [51557C:531A3C]
[uEmu]: map [516000:531FFF] -> [516000:531FFF]
[uEmu]: cpy [51557C:531A3B]
[uEmu]: * seg [531A3C:5BC000]
[uEmu]: map [532000:5BBFFF] -> [532000:5BBFFF]
[uEmu]: cpy [531A3C:5BBFFF]
[uEmu]: * seg [5BC000:63A000]
[uEmu]: map [5BC000:639FFF] -> [5BC000:639FFF]
[uEmu]: * seg [63A000:63A008]
[uEmu]: map [63A000:63AFFF] -> [63A000:63AFFF]
[uEmu]: cpy [63A000:63A007]
[uEmu]: * seg [63A008:63A01C]
[uEmu]: cpy [63A008:63A01B]
[uEmu]: * seg [63A01C:63A02C]
[uEmu]: cpy [63A01C:63A02B]
[uEmu]: * seg [63A02C:6487F8]
[uEmu]: map [63B000:648FFF] -> [63B000:648FFF]
[uEmu]: cpy [63A02C:6487F7]
[uEmu]: * seg [649D9C:64B77C]
[uEmu]: map [649D9C:64BFFF] -> [649000:64BFFF]
[uEmu]: cpy [649D9C:64B77B]
[uEmu]: * seg [64B77C:7A2578]
[uEmu]: map [64C000:7A2FFF] -> [64C000:7A2FFF]
[uEmu]: cpy [64B77C:7A2577]
[uEmu]: * seg [7A2578:80FF54]
[uEmu]: map [7A3000:80FFFF] -> [7A3000:80FFFF]
[uEmu]: cpy [7A2578:80FF53]
[uEmu]: * seg [80FF54:810098]
[uEmu]: map [810000:810FFF] -> [810000:810FFF]
[uEmu]: cpy [80FF54:810097]
[uEmu]: Emulation started
Exception in thread Thread-1 (step_thread_main):
Traceback (most recent call last):
File "C:\Users\Administrator\AppData\Local\Programs\Python\Python311\Lib\threading.py", line 1038, in _bootstrap_inner
self.run()
File "C:\Users\Administrator\AppData\Local\Programs\Python\Python311\Lib\threading.py", line 975, in run
self._target(*self._args, **self._kwargs)
File "E:/IDA_Pro_7.7/plugins/uEmu.py", line 1508, in step_thread_main
self.mu.emu_start(self.pc | 1 if UEMU_HELPERS.is_thumb_ea(self.pc) else self.pc, -1, count=1)
File "C:\Users\Administrator\AppData\Local\Programs\Python\Python311\Lib\site-packages\unicorn\unicorn.py", line 545, in emu_start
status = _uc.uc_emu_start(self._uch, begin, until, timeout, count)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
OSError: [WinError -1073741795] Windows Error 0xc000001d
Have tested on win7_64bit, different version of python,Same issue.
Hello,
do you plan to support mips ?
Thanks for you plugin.
Hi,
Thanks for your great plugin, it's very useful. However, it does not properly emulate ARM in thumb mode. In order to fix this, the following line should be added to the start of step_thread_main()
if get_arch()[0:3] == "arm" and GetReg(self.pc, "T"):
self.pc |= 1
Possibly, it would be a good idea to store get_arch() in a class variable, as it is now frequently computed while it is a constant value. This negatively impacts emulation speed.
Kind regards,
Wouter
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.