This is a simple x86-64 emulator for AMD64 PE files (Windows binaries). This was originally designed to run device drivers for analysis, but it will be extended to be much more.
- This was mainly done for analysis of Windows kernel device drivers (packed ones mostly.)
- This is very experiemental, and it relies heavily on the underlying libraries.
- Some stuff are ultimately broken.
- It can run under any system that unicorn/capstone engines support (Linux, Windows, Mac OS, etc.)
- Unicorn engine
- Capstone engine
- pefile
- numpy
- Python 2.7
Personal reasons, fun experience, etc. This can greatly aid somehow in reverse engineering tasks.
This will definitely be extended to be much more, but for now, it's just a silly PE runner, it "fake-resolves" imports as dummy functions. As noted before, this was originally written for device driver analysis, so not much stuff is done, it's kept minimal (for now).
Don't look at this yet, this is pretty much in an alpha stage, and will most likely take time to improve.