import sys
sys.path.append(r'D:\reverse\IDA\python\pyemu')
sys.path.append(r'D:\reverse\IDA\python\pyemu\lib')
from PyEmu import *
emu = IDAPyEmu()
#debug=0,1,2,>2
emu.debug(0)
vlizer_start = SegByName(".reloc")
vlizer_end = SegEnd( vlizer_start )
#load vlizer section
for i in range(vlizer_start,vlizer_end,4):
emu.set_memory(i,Dword(i))
print "[*] Finished loading vlizer section into memory,Start at %x,End at %x,size:%x"%(vlizer_start,vlizer_end,vlizer_end-vlizer_start)
flag=1
instack=0
#eip=fetchcode
emu.set_register("eip",0x10013bd6)
#ebx=key
emu.set_register("ebx",0x10018cca)
#esi=ebx+delta
emu.set_register("esi",0x10018cca)
#edi=vmctx=0x10013880+delta
emu.set_register("edi",0x10013880)
while True:
eip=emu.get_register("eip")
mnemonic=GetMnem(eip)
op1=GetOpnd(eip,0)
op2=GetOpnd(eip,1)
#push eax,ax
if mnemonic=="push":
if GetOpType(eip,0)==1 and GetOperandValue(eip,0)==0:
instack=1
#pop eax,ax
elif mnemonic=="pop":
if GetOpType(eip,0)==1 and GetOperandValue(eip,0)==0:
instack=0
#push eax,ax
#pop eax,ax
elif mnemonic=="mov":
if op1=="[esp]":
if GetOpType(eip,1)==1 and GetOperandValue(eip,1)==0:
instack=1
elif op2=="[esp]":
if GetOpType(eip,0)==1 and GetOperandValue(eip,0)==0:
instack=0
elif mnemonic=="add" or mnemonic=="sub" or mnemonic=="xor":
if GetOpType(eip,0)==1 and (GetOperandValue(eip,0)==0 or GetOperandValue(eip,0)==0x10):
#operand eax/ax/al ebx/bx/bl
if GetOpType(eip,1)==1 and (GetOperandValue(eip,1)==3 or GetOperandValue(eip,1)==0x13) and flag:
print "%s %s,%s"%(mnemonic,op1,op2)
flag=0
#operand eax/ax/al imm32/imm16/imm8
else:
if not instack:
if GetOpType(eip,1)==1:
print "%s %s,%x"%(mnemonic,op1,emu.get_register(op2))
elif GetOpType(eip,1)==5:
print "%s %s,%x"%(mnemonic,op1,GetOperandValue(eip,1))
#operand ebx/bx/bl eax/ax/al
if (GetOpType(eip,0)==1 and (GetOperandValue(eip,0)==3 or GetOperandValue(eip,0)==0x13)) and (GetOpType(eip,1)==1 and (GetOperandValue(eip,1)==0 or GetOperandValue(eip,1)==0x10)):
print "%s %s,%s"%(mnemonic,op1,op2)
print "handleindex:%x"%emu.get_register("eax")
break
emu.execute()