git clone https://github.com/unicorn-engine/unicorn.git

mkdir buildcd buildcmake  -G "Unix Makefiles" ..cmake  -G "Xcode" ..make -j6

/* Unicorn Emulator Engine *//* By Nguyen Anh Quynh & Dang Hoang Vu, 2015 */
/* Sample code to trace code with Linux code with syscall */
#include <unicorn/unicorn.h>#include <string.h>
// code to be emulated#define X86_CODE32                                                             \    "\xeb\x19\x31\xc0\x31\xdb\x31\xd2\x31\xc9\xb0\x04\xb3\x01\x59\xb2\x05\xcd" \    "\x80\x31\xc0\xb0\x01\x31\xdb\xcd\x80\xe8\xe2\xff\xff\xff\x68\x65\x6c\x6c" \    "\x6f"
#define X86_CODE32_SELF                                                        \    "\xeb\x1c\x5a\x89\xd6\x8b\x02\x66\x3d\xca\x7d\x75\x06\x66\x05\x03\x03\x89" \    "\x02\xfe\xc2\x3d\x41\x41\x41\x41\x75\xe9\xff\xe6\xe8\xdf\xff\xff\xff\x31" \    "\xd2\x6a\x0b\x58\x99\x52\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3" \    "\x52\x53\x89\xe1\xca\x7d\x41\x41\x41\x41\x41\x41\x41\x41"
// memory address where emulation starts#define ADDRESS 0x1000000
#define MIN(a, b) (a < b ? a : b)// callback for tracing instructionstatic void hook_code(uc_engine *uc, uint64_t address, uint32_t size,                      void *user_data){    int r_eip;    uint8_t tmp[16];
    printf("Tracing instruction at 0x%" PRIx64 ", instruction size = 0x%x\n",           address, size);
    uc_reg_read(uc, UC_X86_REG_EIP, &r_eip);    printf("*** EIP = %x ***: ", r_eip);
    size = MIN(sizeof(tmp), size);    if (!uc_mem_read(uc, address, tmp, size)) {        uint32_t i;        for (i = 0; i < size; i++) {            printf("%x ", tmp[i]);        }        printf("\n");    }}
// callback for handling interrupt// ref: http://syscalls.kernelgrok.com/static void hook_intr(uc_engine *uc, uint32_t intno, void *user_data){    int32_t r_eax, r_ecx, r_eip;    uint32_t r_edx, size;    unsigned char buffer[256];
    // only handle Linux syscall    if (intno != 0x80)        return;
    uc_reg_read(uc, UC_X86_REG_EAX, &r_eax);    uc_reg_read(uc, UC_X86_REG_EIP, &r_eip);
    switch (r_eax) {    default:        printf(">>> 0x%x: interrupt 0x%x, EAX = 0x%x\n", r_eip, intno, r_eax);        break;    case 1: // sys_exit        printf(">>> 0x%x: interrupt 0x%x, SYS_EXIT. quit!\n\n", r_eip, intno);        uc_emu_stop(uc);        break;    case 4: // sys_write        // ECX = buffer address        uc_reg_read(uc, UC_X86_REG_ECX, &r_ecx);
        // EDX = buffer size        uc_reg_read(uc, UC_X86_REG_EDX, &r_edx);
        // read the buffer in        size = MIN(sizeof(buffer) - 1, r_edx);
        if (!uc_mem_read(uc, r_ecx, buffer, size)) {            buffer[size] = '\0';            printf(">>> 0x%x: interrupt 0x%x, SYS_WRITE. buffer = 0x%x, size = "                   "%u, content = '%s'\n",                   r_eip, intno, r_ecx, r_edx, buffer);        } else {            printf(">>> 0x%x: interrupt 0x%x, SYS_WRITE. buffer = 0x%x, size = "                   "%u (cannot get content)\n",                   r_eip, intno, r_ecx, r_edx);        }        break;    }}
static void test_i386(void){    uc_engine *uc;    uc_err err;    uc_hook trace1, trace2;
    int r_esp = ADDRESS + 0x200000; // ESP register
    printf("Emulate i386 code\n");
    // Initialize emulator in X86-32bit mode    err = uc_open(UC_ARCH_X86, UC_MODE_32, &uc);    if (err) {        printf("Failed on uc_open() with error returned: %u\n", err);        return;    }
    // map 2MB memory for this emulation    uc_mem_map(uc, ADDRESS, 2 * 1024 * 1024, UC_PROT_ALL);
    // write machine code to be emulated to memory    if (uc_mem_write(uc, ADDRESS, X86_CODE32_SELF,                     sizeof(X86_CODE32_SELF) - 1)) {        printf("Failed to write emulation code to memory, quit!\n");        return;    }
    // initialize machine registers    uc_reg_write(uc, UC_X86_REG_ESP, &r_esp);
    // tracing all instructions by having @begin > @end    uc_hook_add(uc, &trace1, UC_HOOK_CODE, hook_code, NULL, 1, 0);
    // handle interrupt ourself    uc_hook_add(uc, &trace2, UC_HOOK_INTR, hook_intr, NULL, 1, 0);
    printf("\n>>> Start tracing this Linux code\n");
    // emulate machine code in infinite time    // err = uc_emu_start(uc, ADDRESS, ADDRESS + sizeof(X86_CODE32_SELF), 0,    // 12); <--- emulate only 12 instructions    err =        uc_emu_start(uc, ADDRESS, ADDRESS + sizeof(X86_CODE32_SELF) - 1, 0, 0);    if (err) {        printf("Failed on uc_emu_start() with error returned %u: %s\n", err,               uc_strerror(err));    }
    printf("\n>>> Emulation done.\n");
    uc_close(uc);}
int main(int argc, char **argv, char **envp){    if (argc == 2) {        if (!strcmp(argv[1], "-32")) {            test_i386();        } else if (!strcmp(argv[1], "-h")) {            printf("Syntax: %s <-32|-64>\n", argv[0]);        }    } else {        test_i386();    }
    return 0;}

# unicorn源码分析与使用视频教程  ## 基础
* 1.课程介绍* 2.unicorn源码编译* 3.unicorn简单使用与调试* 4.unicorn 源码框架了解* 5.实现一个最简单的my_qemu(kvm)* 6.shellcode 指令追踪使用* 7.shellcode 指令追踪源码分析* 8.使用中断事件hook源码分析 (syscall)* 9.使用中断事件hook源码分析(arm syscall)* 10.内存操作事件hook(读写执行)* 11.内存操作事件hook源码分析* 12.异常事件使用与源码分析* 13.再谈unicorn(框架定位与缺陷)
## x86架构中使用
* 14.模拟单个参数函数与获取返回值(x86_64构架)* 15.模拟多个参数函数(x86_64构架)* 16.模拟获取全局变量函数(x86_64构架)* 17.外部符合libc库函数调用模拟(x86_64构架)* 18.模拟多个函数调用链(x86_64构架)
### 常用算法模拟* 19.模拟base64编码(x86_64构架)* 20.aes算法模拟(x86_64构架)* 21.des算法模拟(x86_64构架)* 22.rc4算法模拟(x86_64构架)* 23.其它算法模拟思路(x86_64构架)
## arm架构中使用* 24.模拟单个参数函数与获取返回值(arm64构架)* 25.模拟多个参数函数(arm64构架)* 26.模拟获取全局变量函数(arm64构架)* 27.arm构架中的算法模拟(arm64构架)* 28.android中模拟与JNI交互(arm64构架)* 29.JNI模拟call java函数(arm64构架)

## 完善unicorn   * 30.unicorn ELF文件模拟* 31.unicorn 其它可执行文件* 32.unicorn调试器介绍
## ollvm混淆* 33.unicorn结合capstone使用* 34.生成CFG(控制流程图)* 35.ollvm反混淆思路