Jonas Zaddach

Luca Bruno

http://www.s3.eurecom.fr/tools/avatar/

S²E

Avatar is an event-based arbitration framework that orchestrates the communication between an emulator and a target physical device. Avatar's goal is to enable complex dynamic analysis of embedded firmware in order to assist in a wide range of security-related activities including (but not limited to) reverse engineering, malware analysis, vulnerability discovery, vulnerability assessment, backtrace acquisition and root-cause analysis of known test cases.

???

???

Ero Carrera (@erocarrera)

https://github.com/zynamics/bochs-python-instrumentation

Bochs (2.4.5 and 2.4.6)

This patch for Bochs provides a Python interpreter instead of Bochs' own debugger, yet still providing the debugger functionality. It also allows to interact with the instrumentation interface on-demand, by dynamically associating Python methods to handle instrumentation events.

???

wiki
presentation

Simon Free

https://github.com/sipefree/d00ks

An ARM Assembler and Simulator/Debugger.

???

???

Serpilliere (serpilliere@droids-corp.org)

https://github.com/cea-sec/miasm

Miasm is a a free and open source reverse engineering framework. Miasm aims at analyzing/modifying/generating binary programs. Miasm embed its own disassembler, intermediate language and instruction semantic. To emulate code, it uses libtcc to jit C code generate from intermediate representation. It can emulate shellcodes, parts of binaries. Python callback can be executed to emulate library functions.

smiasm
depgraph
symbol_exec
Sibyl

Miasm (incomprehensible documentation)
Rebuilding a cleaned & working binary (Re150 part 2)
Dynamic shellcode analysis

Cody Pierce (@codypierce)

http://code.google.com/p/pyemu/

PyEmu tries to provide a fully scriptable IA-32 emulator in python. The aim is for security researchers and malware analysis. By having a flexible community driven emulator in a high level language one can roll their own purpose driven scripts to solve common problems.

???

whitepaper from BH USA 07
video from BH USA 07
entry in blog about usage PyEMU

Angelo Dell'Aera (buffer@antifork.org, @angelodellaera)

https://github.com/buffer/pylibemu

Libemu

Pylibemu is a wrapper for the Libemu library.

Dionaea
Thug

Shellcode Detection Using Python
Detecting shellcode over the network with scapy and libemu

Georg Wicherski (@ochsff): http://code.mwcollect.org/projects/pylibscizzle

http://code.mwcollect.org/projects/pylibscizzle

libscizzle

Identification of possible getpc sequences, bruteforce possible starting location around sequence, use efficient sandbox. Disassemble guest code, execute one basic blocks, emulate all other instructions, exception.

???

Efficient Bytecode Analysis: Linespeed Shellcode Detection
Shellcode Detection Using Python

AmrThabet

https://github.com/AmrThabet/pySRDF

The Security Research and Development Framework

This Project is a the python implementation for The Security Research and Development Framework
This Project includes:
1. PE Parser
2. Process analyzer, DLL Injector
3. Debugger
4. x86 Emulator for binary files and shellcodes

???

Examples

Felipe Manzano ‏(@feliam)

https://github.com/feliam/pysymemu

A small symbolic execution engine for Intel64 in python.

???

Documentation

NGUYEN Anh Quynh

http://www.unicorn-engine.org/

QEMU

Unicorn is a lightweight multi-platform, multi-architecture CPU emulator framework.

Highlight features:
- Multi-architectures: Arm, Arm64 (Armv8), M68K, Mips, PowerPC, Sparc, & X86 (include X86_64).
- Clean/simple/lightweight/intuitive architecture-neutral API.
- Implemented in pure C language, with bindings for Python, Java, Go & .NET available.
- Native support for Windows & *nix (with Mac OSX, Linux, *BSD & Solaris confirmed).
- High performance by using Just-In-Time compiler technique.
- Support fine-grained instrumentation at various levels.
- Thread-safe by design.

Usercorn
unicorn-decoder
Eli.Decode
PyAna

UNICORN VS. MALWARE

invisigoth kenshoto (@invisig0th)

http://visi.kenshoto.com/viki/MainPage

https://github.com/vivisect/vivisect

Vivisect is programatic binary analysis framework.
Features:
* Simple/fast python API for trying out crazy analysis ideas
* Complete emulation pass with annotation
* Import emulation to allow emu state tracking
* Analysis of Elf/PE/binaryblob formats (Mach-O to come soon)
* Support for easy to implement and batch run analysis module interface
* Support for more than one binary file loaded in one workspace
* Colaborative real-time client/server mode
* Reasonably decent GUI (mostly for viewing) results
* Support for running on windows/linux/mac
* Windows symbol server support (when run on win32)
* Bulk analysis mode which goes nice and fast (w/o GUI)

SocketSniff
Nightmare
FLOSS
flare-dbg

Visipedia
Examples