mirror of
https://github.com/momo5502/emulator.git
synced 2026-01-20 20:23:57 +00:00
4c81c6355d
Bumps [deps/unicorn](https://github.com/momo5502/unicorn) from `79f4f7a` to `65f12b1`. <details> <summary>Commits</summary> <ul> <li><a href="65f12b11ee"><code>65f12b1</code></a> Merge remote-tracking branch 'gh/dev' into dev</li> <li><a href="fd2e0e6980"><code>fd2e0e6</code></a> Add support for clangarm64 (<a href="https://redirect.github.com/momo5502/unicorn/issues/2228">#2228</a>)</li> <li><a href="94847a96d8"><code>94847a9</code></a> Fix cmake deprecation warning (<a href="https://redirect.github.com/momo5502/unicorn/issues/2226">#2226</a>)</li> <li><a href="79f910ea73"><code>79f910e</code></a> Fix <code>read_sprr_perm</code> for Apple real CPUs and GitHub Actions; enable Apple ARM...</li> <li><a href="1cb2c67054"><code>1cb2c67</code></a> Remove ninja installation from macos runners (<a href="https://redirect.github.com/momo5502/unicorn/issues/2225">#2225</a>)</li> <li><a href="3d2febe82d"><code>3d2febe</code></a> Enable install for rust bindings (<a href="https://redirect.github.com/momo5502/unicorn/issues/2224">#2224</a>)</li> <li><a href="c8bc9eb9b0"><code>c8bc9eb</code></a> glib_compat/glib_compact: Clear the buffer in g_hash_table_resize (<a href="https://redirect.github.com/momo5502/unicorn/issues/2219">#2219</a>)</li> <li>See full diff in <a href="79f4f7a51e...65f12b11ee">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details>
Sogen is a high-performance Windows user space emulator that operates at syscall level, providing full control over process execution through comprehensive hooking capabilities.
Perfect for security research, malware analysis, and DRM research where fine-grained control over process execution is required.
Built in C++ and powered by the Unicorn Engine (or the icicle-emu 🆕).
Try it out: sogen.dev
Key Features
- 🔄 Syscall-Level Emulation
- Instead of reimplementing Windows APIs, the emulator operates at the syscall level, allowing it to leverage existing system DLLs
- 📝 Advanced Memory Management
- Supports Windows-specific memory types including reserved, committed, built on top of Unicorn's memory management
- 📦 Complete PE Loading
- Handles executable and DLL loading with proper memory mapping, relocations, and TLS
- ⚡ Exception Handling
- Implements Windows structured exception handling (SEH) with proper exception dispatcher and unwinding support
- 🧵 Threading Support
- Provides a scheduled (round-robin) threading model
- 💾 State Management
- Supports both full state serialization and
fast in-memory snapshots(currently broken 😕)
- Supports both full state serialization and
- 💻 Debugging Interface
- Implements GDB serial protocol for integration with common debugging tools (IDA Pro, GDB, LLDB, VS Code, ...)
Preview
YouTube Overview
Click here for the slides.
Quick Start (Windows + Visual Studio)
Tip
Checkout the Wiki for more details on how to build & run the emulator on Windows, Linux, macOS, ...
1. Checkout the code:
git clone --recurse-submodules https://github.com/momo5502/sogen.git
2. Run the following command in an x64 Development Command Prompt in the cloned directory:
cmake --preset=vs2022
3. Build the solution that was generated at build/vs2022/emulator.sln
4. Create a registry dump by running the grab-registry.bat as administrator and place it in the artifacts folder next to the analyzer.exe
5. Run the program of your choice:
analyzer.exe C:\example.exe