Applied Emulation - Module 1
Added 2023-08-29 21:42:04 +0000 UTCEmulator Fundamentals
This is the first part in our five-part tutorial series on emulation. In this module we begin by learning how an emulator works under the hood. The module is accompanied by a live demo and a lab that builds on the concepts we discuss.
References
- Windows Stack Overview
https://en.wikipedia.org/wiki/Windows_NT - Unicorn Overview
https://www.unicorn-engine.org/BHUSA2015-unicorn.pdf - Ghidra Emulator
https://github.com/Nalen98/GhidraEmu - Speakeasy Emulator
https://github.com/mandiant/speakeasy - Binee Emulator
https://github.com/carbonblack/binee - Bochs Emulator
https://bochs.sourceforge.io/VirtNoJit.pdf - Online Disassembler
https://disasm.pro/ - Capstone Disassembler
https://www.capstone-engine.org/
Lab Setup
To complete the labs you must have a lab setup that meets the requirements listed in the Lab Setup.pdf document found in setup.zip. Download the setup.zip file, unzip, and follow the instructions in the PDF.
Lab Exercise
The lab for this module is contained in the lab1_zip file. Download lab1_zip, unzip, and run jupyter-lab from the root of the unzipped directory. Once Jupyter Labs is launched in your browser open the lab notebook and follow the instructions.
Comments
Oh thanks! You're right, I feel quite dumb because I forgot about dir() and help() 😓 However I'll give a try to VS code! Thanks a lot for your reply and your awesome content!
Al
2023-10-27 22:03:26 +0000 UTCHey thanks glad you enjoyed it : ) As for Capstone I don't know of any good documentation but enabling type hints in your editor will help a lot, a fast way to get this to work is to open the notebook in VS code and install the recommended python plugins. There is also the trusty help() and dir() functions in a python shell... sorry I don't have something better though.
OALABS
2023-10-27 21:44:58 +0000 UTCProbably one of the best resources on emulation. Suddenly emulation seems to be an easy task xD! I would rename the series as "Emulation's bible". Anyway, I really enjoyed doing the exercise, however, looking at capstone docs was a nightmare, even looking for X86_OP_MEM members has been really hard. Is there any resource that in somehow, sum up classes/type/variables/etc..?
Al
2023-10-27 16:09:39 +0000 UTCQuite a bit more detail on here than the youtube videos. Love it!
Michael Walker
2023-08-31 21:19:05 +0000 UTCHey nice!! That's exactly the response I was hoping for : ))
OALABS
2023-08-30 19:38:55 +0000 UTCI'm the one who wanted this on youtube comment! I watched the first one and im super satisfied that you use capstone and jupiter-notebook during the tutorial. besides that, after watched it emulator looks more friendly thing than i thought before, thanks! i'll do the exercise and keep watching through all 5 lessons!
vxcall
2023-08-30 16:58:58 +0000 UTC
