Debug and emulate specific code fragments or functions using the Unicorn engine. Activate when the user wants to emulate a function with Unicorn, trace binary execution without running the full program, decrypt or decode data by emulating the algorithm, or bypass environment dependencies (JNI, sysca

rev unicorn debug Unicorn Emulation Debugger Debug and emulate specific code fragments or functions using the Unicorn engine. Analyze context dependencies (JNI, syscalls, library functions) and simulate them through hook mechanisms to complete the user's debugging goal. Core Principles 1. Load file raw first — do NOT parse ELF/PE/Mach O headers. Read the file as raw bytes and map directly into Unicorn memory. We only need to emulate specific functions, not the entire binary. If raw loading fails (code references segments at specific addresses), then parse minimally — only map the segments needed. 2. Identify context dependencies — analyze the target code for external calls (JNI, syscalls, libc, imports) and hook them to provide simulated responses. 3. Use callbacks extensively — leverage Unicorn's hook system for debugging, tracing, error recovery, and environment simulation. 4. Iterative fix — when emulation crashes, use the callback info to diagnose and fix (map missing memory, hook unhandled calls, fix register state). 5. Minimal trace output — prefer block level tracing over instruction level. Only enable instruction trace on small targeted ranges. Use counters and summaries instead of per step logging. Environment Simulation Strategy Before emulating, read the target function and identify what it calls. Hook external dependencies by address and simulate in Python: Category Examples Simulation Strategy libc malloc , free , memcpy , strlen , printf Hook address, implement logic in Python (bump allocator for malloc) JNI GetStringUTFChars , FindClass , GetMethodID Build fake JNIEnv function table in UC memory, write RET stubs at each entry, hook stub addresses Syscalls read , write , mmap , ioctl Hook UC HOOK INTR , dispatch by syscall number C++ runtime operator new , cxa throw Hook and simulate Library calls pthread mutex lock , dlopen Hook and return success/stub Hook pattern: Register a UC HOOK CODE callback. When PC hits a known import address, execute the Python simulation, then set PC = LR to skip the original function. Callback Types to Use Callback Purpose UC HOOK CODE Intercept import calls by address; instruction level trace (use sparingly, narrow range only) UC HOOK BLOCK Block level trace (preferred over instruction trace) UC HOOK MEM UNMAPPED Auto map missing pages to recover from unmapped access errors UC HOOK MEM READ \ UC HOOK MEM WRITE Trace memory access on targeted data ranges only UC HOOK INTR Intercept SVC/INT for syscall simulation Iterative Debugging Workflow When emulation fails, follow this loop: 1. Run — start emulation, let it crash 2. Read callback output — which address faulted? What type (read/write/fetch)? 3. Diagnose : Unmapped memory fetch → missing code page, map it Unmapped memory read/write → missing data section or uninitialized pointer, map or hook Hitting an import stub → identify the function, add a simulation hook Infinite loop → add a code hook with execution counter, stop after threshold 4. Fix — add the hook / map the memory / adjust registers 5. Re run — repeat until the target function completes Architecture Quick Reference Arch Uc Const Mode SP LR Args Return Syscall ARM64 UC ARCH ARM64 UC MODE LITTLE ENDIAN SP X30 X0 X7 X0 X8 + SVC 0 ARM32 UC ARCH ARM UC MODE THUMB / UC MODE ARM SP LR R0 R3 R0 R7 + SVC 0 x86 64 UC ARCH X86 UC MODE 64 RSP (stack) RDI,RSI,RDX,RCX,R8,R9 RAX RAX + syscall x86 32 UC ARCH X86 UC MODE 32 ESP (stack) (stack) EAX EAX + int 0x80 MIPS32 UC ARCH MIPS UC MODE MIPS32 + UC MODE BIG ENDIAN $sp $ra $a0 $a3 $v0 $v0 + syscall

rev-unicorn-debug