UnicornTemplate

from __future__ import print_function
from keystone import *
from unicorn import *
from unicorn.x86_const import *
from capstone import *
#separate assembly instructions by;
CODEADDRESS = 0x08048000
STACKADDRESS= 0x7FFc0000
CODE = b'''
mov eax,0
mov ebx,1

mov ecx,2
mov edx,3
loop:
DEC ECX
TEST ECX,ECX
int3
jne loop
mov eax,0
syscall
'''
#Break interupt with interupt number intno
def hook_int(mu, intno,user_data):

    if (intno==0x3):
        r_eip = mu.reg_read(UC_X86_REG_EIP)
        r_ecx = mu.reg_read(UC_X86_REG_ECX)
        print(">>> ECX = 0x%x" % r_ecx)
        print(">>> Breakpoint hit at 0x%x " % r_eip)

#hook every instruction
def hook_code(uc, address, size, user_data):
    global X86_CODE32
    #print(">>> Tracing instruction at 0x%x, instruction size = 0x%x" %(address, size))
    # read this instruction code from memory
    #print(">>> Instruction code at [0x%x] =" %(address), end="")
    tmp = X86_CODE32[address-CODEADDRESS:address-CODEADDRESS+size]
    print(repr(tmp))
    ins=cs.disasm(tmp, address)
    for i in cs.disasm(X86_CODE32, CODEADDRESS):
        if (i.address==address):
            print("0x%x:\t%s\t%s" % (i.address, i.mnemonic, i.op_str))

#hook instruction (eg: syscall)
def hook_syscall(uc, user_data):
    r_eax = mu.reg_read(UC_X86_REG_EAX)
    print("Syscall with eax=0x%x" % r_eax)

def unicornInit():
    # map 2 MB memory for this emulation
    mu = Uc(UC_ARCH_X86, UC_MODE_32)
    mu.mem_map(CODEADDRESS, 2 * 1024 * 1024)
    # init stack
    mu.mem_map(STACKADDRESS,0x1000*3)
    # write machine code to be emulated to memory
    mu.mem_write(CODEADDRESS, X86_CODE32)

    # initialize machine registers
    mu.reg_write(UC_X86_REG_ECX, 0x1234)
    mu.reg_write(UC_X86_REG_EDX, 0x7890)
    mu.reg_write(UC_X86_REG_ESP, 0x7FFd0000)
    mu.reg_write(UC_X86_REG_EBP, 0x7FFd0000)
    # initialize machine hook
    mu.hook_add(UC_HOOK_INTR, hook_int)  # hook interupt
    mu.hook_add(UC_HOOK_CODE, hook_code)  # hook code
    mu.hook_add(UC_HOOK_INSN, hook_syscall,None,1,0,UC_X86_INS_SYSCALL)  # hook instruction
    return mu
def capstoneInit():
    cs = Cs(CS_ARCH_X86, CS_MODE_32)
    return cs


def keystoneInit():
    ks = Ks(KS_ARCH_X86, KS_MODE_32)
    return ks

def listToByteString(a):
    s=b""
    for i in a:
       s+=chr(i)
    return s


cs=capstoneInit()
try: #Initialize engine in X86 - 32 bit mode
    ks=keystoneInit()
    encoding, count = ks.asm(CODE)
    print("%s = %s (number of statements: %u)" % (CODE, encoding, count))
except KsError as e:
  print("ERROR: %s" % e)

X86_CODE32=listToByteString(encoding)
print("Emulate i386 code")



try: #Initialize emulator in X86 - 32 bit mode

    mu=unicornInit()

    mu.emu_start(CODEADDRESS, CODEADDRESS + len(X86_CODE32))

    # now print out some registers
    print("Emulation done. Below is the CPU context")
    r_eax = mu.reg_read(UC_X86_REG_EAX)
    r_ebx = mu.reg_read(UC_X86_REG_EBX)
    r_ecx = mu.reg_read(UC_X86_REG_ECX)
    r_edx = mu.reg_read(UC_X86_REG_EDX)
    print(">>> EAX = 0x%x" % r_eax)
    print(">>> EBX = 0x%x" % r_ebx)
    print(">>> ECX = 0x%x" % r_ecx)
    print(">>> EDX = 0x%x" % r_edx)

except UcError as e:
    print("ERROR: %s" % e)