Anderson buzzer-re

Unicorn-Engine API Documentation

Version	2.0.0

Official API document by kabeor

PDF File

Unicorn Engine is a lightweight, multi-platform, multi-architecture CPU simulator framework, the current version is based on [Qemu](https://www.qemu. org/) 5.0.1 development, it can replace the execution of CPU simulation code, commonly used in program virtualization, malicious code analysis, Fuzzing, etc. This project is used in [Qiling Virtual Framework] (https://github.com/qilingframework/ qiling), Radare2 Reverse Analysis Framework, GEF (pwn analysis plugin for gdb), [Pwndbg] (https://github.com/pwndbg/pwndbg), Angr Symbol Execution Framework and many other famous projects.

	# Minimal Go pclntab function recovery for IDA.
	#
	# Run from IDA with File > Script file..., or copy to IDA/plugins and invoke
	# Edit > Plugins > Go pclntab recover.

	import re
	import struct

	import ida_auto
	import ida_bytes

	#!/usr/bin/env python3

	# Exactly what is already public https://github.com/HexRaysSA/ida-hcli/blob/main/src/hcli/lib/ida/__init__.py#L316

	from __future__ import annotations

	import os
	import sys
	from pathlib import Path

	# A Python script using LIEF to search a specific exported function name in a directories
	# This is useful when you don't know the DLL name but (somehow) knows the exported function name
	import sys
	import lief
	import os
	import logging

	lief.logging.set_level(lief.logging.LOGGING_LEVEL.CRITICAL)

	DLL_CHAR = 0x2000

	# Clean PE files that have a lot of junk after its end to avoid AV scanners and slow down analysis tools

	import pefile
	import sys
	import os

	TRESHOLD = 100

	if __name__ == '__main__':
	if len(sys.argv) < 2:

	0 AUE_NULL ALL { int nosys(void); } { indirect syscall }
	1 AUE_EXIT ALL { void exit(int rval) NO_SYSCALL_STUB; }
	2 AUE_FORK ALL { int fork(void) NO_SYSCALL_STUB; }
	3 AUE_NULL ALL { user_ssize_t read(int fd, user_addr_t cbuf, user_size_t nbyte); }
	4 AUE_NULL ALL { user_ssize_t write(int fd, user_addr_t cbuf, user_size_t nbyte); }
	5 AUE_OPEN_RWTC ALL { int open(user_addr_t path, int flags, int mode) NO_SYSCALL_STUB; }
	6 AUE_CLOSE ALL { int sys_close(int fd); }
	7 AUE_WAIT4 ALL { int wait4(int pid, user_addr_t status, int options, user_addr_t rusage) NO_SYSCALL_STUB; }
	8 AUE_NULL ALL { int enosys(void); } { old creat }
	9 AUE_LINK ALL { int link(user_addr_t path, user_addr_t link); }

	import os
	import json
	import requests

	class VirusTotal:
	VT_API = 'https://www.virustotal.com/api/v3'

	def __init__(self, key = None, query = None, limit_query=5):
	self.valid = True
	self.last_err = ''

	#!/bin/bash

	# This will organize a whole directory with each folder containing the filetype name

	path=$1


	if [ -z $path ]
	then
	echo "Usage $0 <path>"