search

pgarba / UniPE

UNIPE - A small framwork to execute PE files with UniCorn
44 stars 14 forks source link

Still working on this? #2

Open 0xhellord opened 4 years ago

0xhellord commented 4 years ago

Anybody still working on this?

pgarba commented 4 years ago

Yes, but only made the proof of concept public.

I think https://github.com/qilingframework/qiling goes into the same direction but never tried it.

0xhellord commented 4 years ago

It's very hard to run windows binaries under qilin framework. Because qilin is trying to full simulate all of windows APIs, just like wine does, and the devlopment progress is very slow. Qilin is suitable for code/func pieces, but not for running a real exe.

By the way , have you implement multithread , user mode apc and exception dispatch emulation in your private version?

pgarba commented 4 years ago

Oh, I didn't know that ... that really sucks.

Yes, I have multithreading support and I think user mode apc works. For exceptions I never really tried but I think hooking the exception handler should be enough. Maybe it also works out of the box ...