Unicorn.Net
Slightly fancier WIP .NET binding/wrapper for the Unicorn engine.
NOTE
The API is very prone to changes at the moment.
Examples
Here is an example of how to use it. This is also the same example as the official documentation available here but in C# and using Unicorn.Net.
using (var emulator = new X86Emulator(X86Mode.b32))
{
ulong addr = 0x1000000;
byte[] x86code =
{
0x41, // INC ECX
0x4a // DEC EDX
};
var ecx = 0x1234;
var edx = 0x7890;
// Map 2mb of memory.
emulator.Memory.Map(addr, 2 * 1024 * 1024, MemoryPermissions.All);
emulator.Registers.ECX = ecx;
emulator.Registers.EDX = edx;
emulator.Memory.Write(addr, x86code, x86code.Length);
emulator.Start(addr, addr + (ulong)x86code.Length);
Console.WriteLine(emulator.Registers.ECX);
Console.WriteLine(emulator.Registers.EDX);
}Registers
Reading and writing to registers.
NOTE
Currently there is no way to write to registers using register IDs, but this may change.
// Assume emulator is an instance of the X86Emulator type.
// Reading from registers.
var val = emulator.Registers.ECX;
// Writing to registers.
emulator.Registers.ECX = 0x10;Memory
Mapping, unmapping, reading, writing and changing memory permissions.
var addr = 0x100000;
// Getting memory regions.
var regions = emulator.Memory.Regions;
// Getting memory page size.
var pageSize = emulator.Memory.PageSize;
// Mapping memory.
emulator.Memory.Map(addr, 2 * 1024, 2 * 1024, MemoryPermissions.All);
// Unmapping memory.
emulator.Memory.Unmap(addr + (4 * 1024), 4 * 1024);
// Changing memory permissions.
emulator.Memory.Protect(addr + (4 * 1024), 4 * 1024, MemoryPermissions.Read);
// Code to write to memory.
var code = new byte[]
{
0x41, // INC ECX
0x4a // DEC EDX
}
// Buffer thats going to be the storage for data read from memory.
var buffer = new byte[2];
// Writing to memory.
emulator.Memory.Write(code, 0, code.Length);
// Reading to memory.
emulator.Memory.Read(buffer, 0, buffer.Length);Hooking
Currently hooking is still under the works and may change.
// Adding a memory read hook.
emulator.Hooks.Memory.Add(MemoryHookType.Read, (emu, type, address, size, val, userData) => {
Console.WriteLine(" stuff was read from memory.");
}, addr, addr + (ulong)code.Length, null);Contexts
Capturing and restoring contexts.
// emulator.Context will create a new Context object
// which you will to dispose afterwards. Hence the `using` statement.
// Capturing the context.
using (var ctx = emulator.Context)
{
...
// To restore the context simply do this.
emulator.Context = ctx;
}Raw Bindings
Unicorn.Net also provide some raw bindings through the Bindings class.
var bindings = new Bindings();
bindings.Open(...);
bindings.MemMap(...);
...TODO
List of stuff thats needs to be implemented or that has been implemented.
-
Emulator
- uc_emu_start
- uc_emu_stop
- uc_query
-
Context
- uc_context_alloc
- uc_context_save
- uc_context_restore
-
Registers
- uc_reg_read
- uc_reg_write
-
Memory
- uc_mem_write
- uc_mem_read
- uc_mem_protect
- uc_mem_regions
- uc_mem_map
- uc_mem_unmap
-
Hooking
- uc_hook_add
- uc_hook_del
-
Arches
- x86
- arm
- arm64
- m68k
- mips
- sparc
-
Actual bindings
Licensing
Unicorn.Net is licensed under the permissive MIT License.