Rev Unicorn Debug

rev-unicorn-debug - Unicorn Emulation Debugger

Debug and emulate specific code fragments or functions using the Unicorn engine. Analyze context dependencies (JNI, syscalls, library functions) and simulate them through hook mechanisms to complete the user's debugging goal.

Source: P4nda0s/reverse-skills (MIT).

Prerequisites

pip install unicorn

Unicorn is the CPU emulation engine (Python binding, Windows wheel available — no JDK or Android toolchain needed). It emulates instructions only: loading the .so, resolving relocations, and simulating libc/JNI/syscalls are done by the Python harness you write (see below).

Harness kit (tools/uniharness.py)

Import it instead of rewriting boilerplate:

from uniharness import Harness, asm, JNI_SLOTS

h = Harness(trace=False)                    # trace=True prints every instruction
h.map_raw("lib.so", 0, 0x10000)             # vaddr==file offset; else h.map_elf("lib.so")
h.setup_stack()
h.setup_tls()                               # TPIDR_EL0 + canary at TLS+40

env = h.jni_env(slots={JNI_SLOTS["NewByteArray"]: cb})   # fake JNIEnv: stub + hook per slot
r = h.call(0x196C, args=[env, 0])           # run until ret; r.x0, r.insns

Helpers: map / map_raw / map_elf / alloc / setup_stack / setup_tls / stub (accepts code= from asm()) / hook / jni_env / call / run / fault. Self-test: python3 uniharness.py.

Recon before writing a harness (raw-map check / deps / exports / relocs): tools/so.py info. Dependencies: see repo root requirements.txt (unicorn, capstone, keystone-engine, pyelftools).

CLI runner (tools/emu_run.py)

One-shot emulation without writing a harness:

python3 tools/emu_run.py libfoo.so --sym Java_pkg_Cls_method --jni --args "env,0,'text'" --poke 0x1300c:1=1 --read 0x1000:32

Options: --off 0x.. (address instead of symbol), --imp (extra import stubs), --trace, --timeout, --raw, --setup hooks.py (full Harness access), --stub name=val (override an import stub's return, e.g. getpid=1234), --log-jni (log every JNI call: [jni] name(args) -> ret, string/array args decoded), --dump-jni-out FILE (append NewStringUTF / SetByteArrayRegion payloads), --trace-stubs (log every stub hit: [stub] name(args) -> ret; both logs aggregate beyond --watch-max).

Observability layer (white-box / VM / algorithm work): --watch-code PC --watch-regs x0,x1 --watch-buf "x19+0x61f0:16", --watch-read/--watch-write lo-hi (auto-aggregated beyond --watch-max), --scan hex[,hex] [--scan-at PC]. Pair with tools/trace_recon.py (event log -> buffer state sequence) and tools/cipher_lab.py (layer/table/schedule adjudication).

Core Principles

1. Load file raw first — do NOT parse ELF/PE/Mach-O headers. Read the file as raw bytes and map directly into Unicorn memory. We only need to emulate specific functions, not the entire binary. If raw loading fails (code references segments at specific addresses), then parse minimally — only map the segments needed.
2. Identify context dependencies — analyze the target code for external calls (JNI, syscalls, libc, imports) and hook them to provide simulated responses.
3. Use callbacks extensively — leverage Unicorn's hook system for debugging, tracing, error recovery, and environment simulation.
4. Iterative fix — when emulation crashes, use the callback info to diagnose and fix (map missing memory, hook unhandled calls, fix register state).
5. Minimal trace output — prefer block-level tracing over instruction-level. Only enable instruction trace on small targeted ranges. Use counters and summaries instead of per-step logging.

Environment Simulation Strategy

Before emulating, read the target function and identify what it calls. Hook external dependencies by address and simulate in Python:

JNIEnv slot math: table entries are 8 bytes each, in jni.h declaration order — e.g. slot 176 = NewByteArray, 184 = GetByteArrayElements, 208 = SetByteArrayRegion. Derive the slot from the disassembly (ldr x8, [x8, #1408] → 1408 / 8 = 176).

Hook pattern: Register a UC_HOOK_CODE callback. When PC hits a known import address, execute the Python simulation, then set PC = LR to skip the original function.