AMD64 PE Emulator in Python.
Switch branches/tags
Nothing to show
Clone or download
Latest commit be0fe05 Apr 16, 2017
Permalink
Failed to load latest commit information.
.gitignore initial commit Feb 22, 2017
README.rst add trace (exp.) Mar 4, 2017
disp.py disp: cleanup Mar 11, 2017
runpe.py minor improvements Apr 16, 2017
trace.py minor improvements Apr 16, 2017

README.rst

x86-64-pe-emu

http://i.imgur.com/IRFe6Zd.png

This is a simple x86-64 emulator for AMD64 PE files (Windows binaries). This was originally designed to run device drivers for analysis, but it will be extended to be much more.

Notes

  1. This was mainly done for analysis of Windows kernel device drivers (packed ones mostly.)
  2. This is very experiemental, and it relies heavily on the underlying libraries.
  3. Some stuff are ultimately broken.
  4. It can run under any system that unicorn/capstone engines support (Linux, Windows, Mac OS, etc.)

Requirements

  • Unicorn engine
  • Capstone engine
  • pefile
  • numpy
  • Python 2.7

This looks silly, why?

Personal reasons, fun experience, etc. This can greatly aid somehow in reverse engineering tasks.

This will definitely be extended to be much more, but for now, it's just a silly PE runner, it "fake-resolves" imports as dummy functions. As noted before, this was originally written for device driver analysis, so not much stuff is done, it's kept minimal (for now).

Disclaimer

Don't look at this yet, this is pretty much in an alpha stage, and will most likely take time to improve.