bundlore_emulation

bundlore_emulation.py

from unicorn import *
from unicorn.x86_const import *
from abc import ABC, abstractmethod

class bundlore_emulation(ABC):
	def __init__(self):
		self.mu = Uc(UC_ARCH_X86, UC_MODE_64)
		self.BASE = 0x100000000
		self.HEAP_SIZE = 64*1024
		self.STACK_SIZE= 32*1024
		self.STACK_ADDR = 0x0
		self.CODE = 0x90 # code 
		self.mu.mem_map(self.BASE, self.HEAP_SIZE)
		self.mu.mem_map(self.STACK_ADDR, self.STACK_SIZE)
		self.mu.hook_add(UC_HOOK_CODE, self.hook_code)
		self.load_binary()
		super().__init__()

	@abstractmethod
	def load_binary(self):
		pass

	@abstractmethod
	def hook_code(self, mu, address, size, user_data):
   		pass
	
	def _start_unicorn(self, startaddr, endaddr):
		try:
			#self.mu.emu_start(startaddr, 0)
			self.mu.emu_start(startaddr, endaddr)
		except Exception as e:
			if self.mu.reg_read(UC_X86_REG_EIP) == 1:
				return
			else:
				raise e

	def run(self):
		self.mu.reg_write(UC_X86_REG_RSP, self.STACK_ADDR + self.STACK_SIZE - 1)
		self.mu.mem_write(self.BASE, self.CODE)
		self._start_unicorn(0x100001c26, 0x100002a40)
		return self.mu.reg_read(UC_X86_REG_EAX)