Unicorn is a lightweight, multi-platform, multi-architecture CPU emulator framework based on QEMU. It provides a clean and simple API for emulating various CPU architectures, including x86, ARM, MIPS, and more. Unicorn is designed for use in reverse engineering, malware analysis, and security research.

Pros

• Supports multiple CPU architectures and platforms
• Easy-to-use API with bindings for various programming languages
• High performance and lightweight design
• Actively maintained and well-documented

Cons

• Limited to CPU emulation, doesn't emulate full system or peripherals
• May have a learning curve for users unfamiliar with low-level CPU operations
• Some advanced features may require in-depth knowledge of CPU architecture

Code Examples

1. Basic x86 code emulation:

from unicorn import *
from unicorn.x86_const import *

# X86 code to emulate
X86_CODE32 = b"\x41\x4a" # INC ecx; DEC edx

# Initialize emulator in X86-32bit mode
mu = Uc(UC_ARCH_X86, UC_MODE_32)

# Map 2MB memory for this emulation
mu.mem_map(0x1000000, 2 * 1024 * 1024)

# Write machine code to be emulated to memory
mu.mem_write(0x1000000, X86_CODE32)

# Initialize registers
mu.reg_write(UC_X86_REG_ECX, 0x1234)
mu.reg_write(UC_X86_REG_EDX, 0x7890)

# Emulate code
mu.emu_start(0x1000000, 0x1000000 + len(X86_CODE32))

# Read results
print("ECX = 0x%x" % mu.reg_read(UC_X86_REG_ECX))
print("EDX = 0x%x" % mu.reg_read(UC_X86_REG_EDX))

2. ARM code emulation with hooks:

from unicorn import *
from unicorn.arm_const import *

def hook_code(uc, address, size, user_data):
    print(">>> Tracing instruction at 0x%x, instruction size = 0x%x" %(address, size))

# ARM code to emulate
ARM_CODE = b"\x37\x00\xa0\xe3\x03\x10\x42\xe0" # mov r0, #0x37; sub r1, r2, r3

# Initialize emulator in ARM mode
mu = Uc(UC_ARCH_ARM, UC_MODE_ARM)

# Map 2MB memory for this emulation
mu.mem_map(0x10000, 2 * 1024 * 1024)

# Write machine code to be emulated to memory
mu.mem_write(0x10000, ARM_CODE)

# Add hook
mu.hook_add(UC_HOOK_CODE, hook_code)

# Emulate code
mu.emu_start(0x10000, 0x10000 + len(ARM_CODE))

3. Memory access tracking:

from unicorn import *
from unicorn.x86_const import *

def hook_mem_access(uc, access, address, size, value, user_data):
    if access == UC_MEM_WRITE:
        print(">>> Memory is being WRITTEN at 0x%x, data size = %u, data value = 0x%x" \
                %(address, size, value))
    else:   # READ
        print(">>> Memory is being READ at 0x%x, data size = %u" \
                %(address, size))

# X86 code to emulate
X86_CODE32 = b"\x89\x0D\x12\x00\x00\x00" # mov [0x12], ecx

# Initialize emulator in X86-32bit mode
mu = Uc(UC_ARCH_X86, UC_MODE_32)