Log file access events. This will include things like handles being opened, data reads, and data writes.

Read value from a register args: reg: name of the register to read from return: value contained in t

Remove a vectored exception handler

Reset stack to the supplied base address args: base: stack base address return: base, ptr

Set the current process that is emulating

Set the current thread

Set the current pointer size used in the emulator

Set the current address of the stack pointer

Setup the shared user data section that is often used to share data between user mode and kernel mode

Stop the runtime clock to include in the report

Update the size of the image within the optional header

BOOL CreateProcess( LPTSTR lpApplicationName, LPTSTR lpCommandLine, LPSECURITY_ATTRIBUTES

HANDLE FindFirstFileA( LPCSTR lpFileName, LPWIN32_FIND_DATAA lpFindFileData );

DWORD GetModuleFileName( HMODULE hModule, LPSTR lpFilename, DWORD nSize );

HMODULE GetModuleHandle( LPCSTR lpModuleName );

BOOL GetStringTypeW( DWORD dwInfoType, _In_NLS_string_(cchSrc)LPCWCH lpSrcStr, int

UINT GetSystemDirectory( LPSTR lpBuffer, UINT uSize );

void GetSystemTime( LPSYSTEMTIME lpSystemTime );

int MessageBox( HWND hWnd, LPCTSTR lpText, LPCTSTR lpCaption, UINT uType );

LSTATUS RegEnumKeyEx( HKEY hKey, DWORD dwIndex, LPSTR lpName, LPDWORD lpcchNam

SERVICE_STATUS_HANDLE RegisterServiceCtrlHandlerA( LPCSTR lpServiceName, LPHANDLER_FUNCTION lpHandlerProc

HINSTANCE ShellExecuteA( HWND hwnd, LPCSTR lpOperation, LPCSTR lpFile, LPCSTR lpParameters,

BOOL StartService( SC_HANDLE hService, DWORD dwNumServiceArgs, LPCSTR *lpServiceArgVectors );

LPVOID VirtualAllocEx( HANDLE hProcess, LPVOID lpAddress, SIZE_T dwSize, DWORD flAllocationType,

BOOL WINAPI VirtualProtect( _In_ LPVOID lpAddress, _In_ SIZE_T dwSize, _In_ DWORD flNewProtect, _Out_ PDWO

Factory used to generate ctypes structures using the ctypes metaclass

Command line global CRT variable

Mount direct-child files in the target's host directory into the emulated current directory. This makes sibling files (e.g. data files the sa

Build a human-readable one-line triage summary. Examples:: read of unmapped 0x12345678 from sample.exe+0x8d14; nearest: heap [0x

Capture current memory layout and loaded modules for the run report.

Get the next exception handler while processing SEH

Disassemble bytes using capstone

Get the initial SEH handler when dispatching a CPU exception that occurs during emulation

Return up to `count` nearest memory regions to an unmapped address.

Called when an attempt to emulate an instruction from an invalid address

Hook each invalid memory read event that occurs.

Called when non-writable address is written to

Called when non-executable code is emulated

Init the emulator config args: config: The configuration data to set up the emulator environment If n

Test whether the object has a ctype base

Link the ctypes structures together in the case of nesting. This will allow the buffer API to convert it to bytes easily

Remove an entire memory region that may not have blocks allocated within it

Parse the emulation config file

Check if a port is in use without consuming any connection.

Return a RegionInfo for the region containing addr, or None if unmapped.

Unicorn expects timeouts to be supplied in microsecond granularity

Set up emulator hooks. Subclasses must implement.

int _vsnprintf( char *buffer, size_t count, const char *format, va_list argptr );

Wait until port is listening, or the subprocess dies.

Add a hook that will fire for every CPU instruction

Set a callback to fire when dynamically generated/copied code is executed args: cb: Callable python function to execute

Register an existing file already included in the emulation space (with data)