Questions tagged [emulation]
The emulation tag has no usage guidance.
33
questions
0
votes
0
answers
34
views
Understanding emulation & tracking IP within a process
I'm working on an end-of-year project for my studies and I was thinking of writing some sort of process emulation debugging tool. What I mean by this is, I want to write a debugger without actually ...
2
votes
0
answers
205
views
How to decrypt data during runtime before executing and then encrypting it back
I was doing some research and came across the term protectors. From my understanding is they encrypt a file to be protected but run it without an issue. During its execution it is able to decrypt the ...
- 21
1
vote
0
answers
209
views
Sentinel C-Plus B emulator help
I find your post.
I need an emulator for the Sentinel C-Plus B dongle.
I was able to find the dumper.
In this post I found the SC_Emulator.zip which seems to work:
http://www.reteam.org/board/...
- 11
1
vote
1
answer
456
views
Visual Arm64 Emulator
I have an arm64 binary that I've been reversing and I've reached a point where it would be immensely useful to visually emulate / debug a section of code. I have the full binary and I can also find a ...
- 223
1
vote
0
answers
351
views
UC_ERR_WRITE_UNMAPPED when emulation starts on binary
Whenever I try to emulate my obfuscated driver it fails at uc_emu_start with UC_ERR_WRITE_UNMAPPED. I get all success return codes on: uc_mem_map and uc_mem_write but when I call uc_emu_start ; I get ...
- 41
1
vote
0
answers
108
views
Implementing syscalls under Miasm
I'd like to use Miasm's DSE on a binary. This binary makes use of 2 syscalls: exit and ptrace. Miasm provides an implementation of some syscalls, but unfortunately, not of those two.
So I tried to ...
- 11
1
vote
0
answers
136
views
Why Qiling doesn't recognize the right EntryPoint?
I'm trying to emulate an EFI driver. Luckily, I found a nice emulator called Qiling and try to debug it with GDB but it doesn't recognize the right Entry-Point.
Here is the Entry-Point in IDA and in ...
- 163
5
votes
0
answers
445
views
Using angr as a pure concrete emulator
I am able to successfully run my target binary under Qiling, an emulator that supplements Unicorn with hooks for system libraries. I would like to do the same thing under angr. I don't need any ...
- 267
0
votes
0
answers
128
views
Emulator that emulates arm hardware
I want to hook arm instructions as they executes but most of the emulators are based on VirtualBox that uses houdini to translate arm instructions to x86, and i really can't hook a native JNI lib, ...
- 73
1
vote
1
answer
182
views
Is `movq rax, xmm0` buggy in Radare2?
Why doesn't rax get loaded from xmm0 here? radare2 bug?
GitHub issue `movq rax, xmm0` doesn't work in native debugger filed.
[0x0003b0e0]> drr
role reg value ref
―――――――――――――――――――...
- 121
4
votes
0
answers
171
views
QEMU Translation block
I'm studying how QEMU translates native basic blocks and runs them. As far as I understand, it reads native basic blocks then retranslates them, but I wonder how it can deal with exceptions inside, so ...
- 1,410
0
votes
0
answers
904
views
How to change the manufacturer property in the Android emulator?
I already asked this question on StackOverflow, but it is not getting attention; maybe here is a better place
I am running the Android emulator that comes with the Android Studio software. I created ...
2
votes
2
answers
179
views
Malware Samples that defeats emulators by using uncommon API calls [closed]
I am looking for a few malware samples that detects sandboxes using uncommon API calls. I understand that one of the drawbacks of OS emulated sandboxes is that the malware can use uncommon API calls ...
- 21
1
vote
0
answers
185
views
How can I emulate Huawei routers HG5xx firmware?
i want to pentest some HG routers in a way that i can try every thing without worrying if it would damage the router or not .... and a better view of debugging the actions .
- 180
0
votes
1
answer
237
views
Finding the correct emulator for programming a renesas sh7722 processor
I have a question about reverse engineering a Roland gr-55 guitar synthesizer. I'm 90% sure the device uses a Renesas sh7722 processor as the main CPU, or at least one of the CPU's in the SH family. I ...
- 103
1
vote
2
answers
736
views
QEMU fpu mode error when attempting to run MIPS binary
I have unpacked a firmware binary using binwalk and have identified the architecture as MIPS by running file bin/busybox . When I try to run the binary with the proper static version of qemu, i get an ...
- 123
2
votes
1
answer
2k
views
Cannot load a Floppy Disk image with Bochs emulator
I have a floppy disk image which I am trying to load with Bochs Emulator.
It is from a CTF challenge and can be downloaded from here: http://squarectf.com/2017/floppy.img
I am using Bochs version 2....
- 765
9
votes
1
answer
10k
views
Emulating Routers and other Embedded Devices with QEMU
I'm thinking about reverse engineering a few router models and trying to get them running with QEMU. In particular I'm trying to get the web server running. The current issue I'm thinking might be a ...
- 115
2
votes
0
answers
362
views
How should I got about working out the format for this psp game?
I have been attempting to reverse engineer a format for a visual novel psp game ('Mirai Nikki RE: WRITE - 13 Ninme No Nikki Shoyuusha') and I have come to the understanding that the format works as a ...
- 21
1
vote
0
answers
94
views
Can Radare2 emulate null pointer exceptions and others?
I'm wondering if anyone has had any luck with Radare2's configuration variables, esil.exectrap, esil.iotrap, and esil.nonull while emulating?
xor eax, eax
mov eax, dword [eax] <-
From what I can ...
- 133
1
vote
1
answer
2k
views
*.abs (sfw) emulation in Qemu - MIPS (abs = Amiko,Skybox,OpenBox, Cryptobox,... file firmware)
I have some questions well today I tried to emulate with (Qemu) a STB firmware (.abs extension file) in Qemu. So I tried to unpack the .abs file I got many files.
Example for: Amiko HD8150 2.4.43 emu ...
2
votes
1
answer
202
views
Windows x86 compability on x64 operating system
I know some about wow64 system, in x64 windows version, and i looked up into this wow64* dlls, to see how the actual syscall transition happen, but something i can't find, and this is probably done by ...
0
votes
1
answer
83
views
Where Is device specific information kept on smart devices
I am doing a project for school on Emulation of device using its firmware. Using firmadyne, I can start up the smart device unfortunately because it is not a real device, information fields like ...
- 123
3
votes
2
answers
466
views
Unicorn emulator: find out if register is undefined
Maybe I am stupid, but I really dont see anything in their documentation.
Say I emulate this code
mov eax, 1
mov ecx, 2
Then I can get the result like so:
int rr;
uc_reg_read(uc, UC_X86_REG_ECX, &...
- 463
1
vote
1
answer
407
views
library issue when running mips binary in a chrooted environment
Background
In my endeavor to RE my router, I'm trying to emulate a router's firmware inside a QEMU MIPS system. I have debian-mips installed to a virtual disk that runs just fine. Its a MIPS32 Big ...
- 301
1
vote
1
answer
720
views
Network support when emulating firmware with QEMU
Continuing from this question:
Firmware analysis and file system extraction?
I am trying to run the QNap firmware using QEmu. I have basically the same
firmware as is used in the question above.
My ...
3
votes
0
answers
1k
views
When to use qemu user mode versus system mode?
This seems to be a pretty basic question but I can't seem to find a good answer.
I am currently just following https://w00tsec.blogspot.ca/2013/09/analyzing-and-running-binaries-from.html to learn ...
- 111
3
votes
1
answer
15k
views
Invalid ELF image for this architecture
I'm trying to load a Busybox binary with qemu-ppc-static with this command:
sudo chroot . ./qemu-ppc-static ./bin/busybox
And I get this error:
/lib/ld.so.1: Invalid ELF image for this ...
- 131
6
votes
1
answer
5k
views
Unicorn and QEMU: Example use cases to understand the differences
The Unicorn website lists some differences between Unicorn and QEMU, especially those differences "where Unicorn shines".
They furthermore write:
A notable difference between Unicorn and ...
- 1,560
3
votes
1
answer
2k
views
Emulate juan DVR R7816 in Qemu
I Want to emulate cctv dvr in qemu.this dvr is from juan cctv and the model is R7816.it is an 16ch dvr.I Have firmware upgrade file in .rom format which i can extract with binwalk.But i dont know what ...
- 31
5
votes
0
answers
2k
views
Emulate TP-Link WR841N using Qemu
I have downloaded a few different versions of the firmware from the TP-Link website. I've been piecing together details on how to achieve this but I'm missing some key points.
Following instructions ...
- 51
7
votes
4
answers
2k
views
Disassemble using an emulator
I learned the disassembly challenges from this link. The following six challenges are listed in that article:
Data embedded in the code regions
Variable instruction size
Indirect branch instructions
...
- 173
5
votes
1
answer
724
views
Why is true emulation not possible?
Antiviruses and similar analysis engines often face the problem of identifying whether the file is harmful. They often do so with the use of (partial)emulation and as a result often fall prey to the ...
- 784