unicorn

As one who helped improved Capstone and its even more wonderful partner, Unicorn, I actually found an exploit in QEMU using Capstone/Unicorn. Unicorn is a nearly-true software-based CPU emulator for ARM, AArch64, M68K, Mips, Sparc, PowerPC, RiscV, S390x, TriCore, X86 CPU (and memory) architecture. This pair-up is arguably the best set of software tools out there. QEMU? No worry, that's way back in QEMU v1.4 days (emulation of Intel IMUL lb/DWORD OPC_IMUL_GvEvlb opcode getting tripped up by XOR opcode doing self-modified operand and TLB cache didn't flush, resulting in a double XOR; ROT13x2 anyone?) Fabrice fixed it then and is still blazing at QEMU 10.0 now. Ain't he awesome? Yeah, I actually ran portion of TLB of QEMU thru unicorn back then. https://github.com/unicorn-engine/unicorn/issues/364

And us machine emulators too, like Fabrice Bellard (QEMU) and me (and my OP post detailed the failing of emulated TLB in QEMU as discovered by Unicorn emulator). Unicorn emulator - https://github.com/unicorn-engine/unicorn

Within QEMU amd64/x86 emulation (not KVM) mode, the IMUL opcode still fails its IMUL opcode emulation after an XOR opcode (also within the same TLB cached page) modified its neighbor IMUL operand(s). TLB got double-invalidated yet some say never invalidated. The crux is a glitch within a singlr entire TLB invalidation operation thereby negating XOR opcode's ability to self-modify the neighboring IMUL operand. (Double ROT13, anyone?). I assert double-invalidation because within the same TLB invalidation stroke, XOR operation got performed ... twice, as opposed to retrieving and restoring original IMUL operand value after such invalidation thereby negating XOR computed result EITHER WAY. A failure of self-modifying code within QEMU amd64/x86 emulation mode could be a useful test to determine if one is under QEMU emulation mode, of course i

If you find Capstone interesting, check out the Unicorn Engine. https://github.com/unicorn-engine/unicorn Also, if anyone is interested in an example of using capstone for basic disassembly and analysis, here is a link to my capstool project. https://github.com/alexander-hanel/capstool

see also https://github.com/unicorn-engine/unicorn

Yep. Nine months to change a single buggy line of cache line invalidation in the translation look-aside table handling IMUL opcode in QEMU 4.0. imul eax, [ecx+0x41], 0x10 Entails hundreds of hours of single-stepping through that opcode in Linux kernel using an indirect operand pointing toward its own opcode (self-modifying code). Even the extraordinaire Fabrice Bellard (author of QEMU) admitted that it is broke and did a total rewrite, which fixed tons of other issues. https://github.com/unicorn-engine/unicorn/issues/364

This is how I found out a snippet of assembly code that can actually distinguished between a KVM hypervisor and most of today’s emulator. https://github.com/unicorn-engine/unicorn/issues/364

My only lamentation of QEMU is their rapid development. (I did say “only”). We had an open source CPU emulator (of many CPU arch) called “Unicorn” that was a heavy test instrumentation points inserted widely throughout and into QEMU 4.0. I spent 2 solid years on these dynamic API bindings of Unicorn into QEMU. It was an awesome piece of SW that allowed us to recreate the behavior of malware. Asking the QEMU team to insert some 50-odd test points into the QEMU code was proved to be a maintenance nightmare. Even if it just an #ifdef of C language, it was too “cluttery”, it was still an awesome automated detection of code generation of just the affected malware portion. I still believe this approach to be a significant tangential vector of prime investing for a startup. https://github.com/unicorn-engine/unicorn

Unicorn is missing from that list. The python CPU emulator with full program counter (PC) and general (and other CPU-specific) register set controls. I use it to catch fileless malware in the second fastest dynamic manner. Also good for detecting Rowhammer/SPECTRE behaviors. Disclaimer: one of the contributors and a contractor that frequently deploy this. https://github.com/unicorn-engine/unicorn

This was a few years back but I had token generation working with something much simpler than Corellium using https://github.com/unicorn-engine/unicorn emulator [You will need to set up CommPage, handle system and mach traps, load dyld, etc]. They've probably added more security since then but back when I looked at it some of the data that was encrypted in the token off the top of my head was: - Request Path - Timestamp - Snapchat Binary Size - Bit Flags for various hack checks such as jailbreak, checks for various tweaks, etc. - Device Type - iOS Version - A pair of counters, I believe these were being used to detect real devices being used as signature proxies. - A unique device ID generated at startup I can't remember which one of the tokens this was for. There is a X-Snapchat-Client-Token used at login if I remember correctly and X-Sn

I don't know about switch emulation, but I know there was an Xbox emulation project that wanted to use it, and gave up. The reason was that Unicorn doesn't have paging working properly on x86. In refactoring Unicorn out of Qemu, it somehow got messed up, and as a result Unicorn isn't useful for full system 32 bit x86 yet. The Github issue is here: https://github.com/unicorn-engine/unicorn/issues/947 Perhaps it is better for other guest processors, but for x86 Unicorn still needs time to mature and get some critical problems fixed.

Github link was kinda hard to find: https://github.com/unicorn-engine/unicorn

found another that is QEMU-specific. https://github.com/unicorn-engine/unicorn/issues/364