Reverse Engineering With Unicorn Emulation

In this OALABS Patreon tutorial we will learn how to use the Unicorn Emulator to assist with reverse engineering! This is the second part in a five-part tutorial series that can be found on our Patreon here...
www.patreon.co...
Lab Notes
gist.github.co...
-----
OALABS DISCORD
/ discord
OALABS PATREON
/ oalabs
Twitch
/ oalabslive
OALABS GITHUB
github.com/OALabs
UNPACME - AUTOMATED MALWARE UNPACKING
www.unpac.me/#/
-----

[@leftspace89]

my experience with unicorn was good, just take a note you need to have aligned memory address with it. unicorn was forcing 4k alignment on map.
address & size parameters must be 4KB aligned with uc_mem_map

[@OALABS]

You get the pin : )

[@musicstudio7832]

Like 255👍🏻
Thank you for sharing a very great video. I will always be with my lovely and wonderful friends. Good luck 🌹

[@ahwbjsjianwekem8311]

Really sick content lately I absolutely love emulation stuff! Explained so well too

[@OALABS]

Thanks : ))

[@ReverseSec]

The goat 🐐

[@yongokpark5692]

Hello 😘😘
My friends😄😄
Thank you so very much 🎁🎁🙆🙆
Like friends🙆🙆😍
Happy days ❤❤❤🎉🎉🎉🎉

[@bske-h6j]

May I ask if you have tried to compile unicorn from source? I tried to compile unicorn static libraries for arm64 architecture and failed.

[@OALABS]

i.imgur.com/IhWEb3a.png

[@bske-h6j]

@@OALABS wow,I didn't expect you to really answer my question. Thank you very much.

[@bske-h6j]

@@OALABS 🤣man,It turned out to be a picture

[@OALABS]

hahahah!! sry, yes I have compiled it, only pain awaits you...

[@TheLoneAlpaca]

bruh I gotta get me into this Patreon

[@kwinzman]

TH-cam really wanted me to watch this video. This has been on the top of my recommended feed on the home page for 2 weeks until I finally gave in.
Seems like part of a larger tutorial series.

[@OALABS]

What kind of wizardry is this? The video has only been out for a day... TH-cam time machine!

[@yongokpark5692]

Good Night 😍😘🎁🎁
Like friends🥰🥰🙆🙆
Video very good 🎉🎉🎉❤❤❤

[@masqmp3]

👍

[@SuperBotschaft]

can you explain an example of malware that has a VM-based obfuscation and how to analysis it ?

[@OALABS]

Not in a TH-cam comment lol... I guess I could give you super unhelpful generic advice like locate the instruction handlers, identify their behaviour, create a lifter, lift and transform to something readable... or maybe if you just need a dirty trace hook all of the instruction handlers and print a trace... but I have a feeling you meant something more like plz generic unpack vmprotect in TH-cam comments... at some point a plan to do a series on this but not sure when...

[@FranciscoL-m7o]

@@OALABS Yes please I would love a deobfuscation videos

[@717Fang]

I wonder if it can emulate NXP MPC microcontroller / which based PowerPC architecture/ ?

[@OALABS]

Supported targets github.com/unicorn-engine/unicorn/tree/master/qemu/target

[@spacewolfjr]

Huzzah!

[@Geeky-Boy]

Can you stop this strange sound at the beginning of the video because it causes disturbance when I put on headphones?

[@OALABS]

DO 👏 IT 👏 LIVE