讀書會-Unicorn.pdf

Transcript

1. Unicorn 2025/12/26 Study by Fox
2. Outline • What is Unicorn • Unicorn usage • Hook • Challenge • hxp CTF 2017 Fibonacci • Pre-Exam 2025 babyUnicorn • 2025 AIS3 CTF5 HAHA, It's Me Again. Unicorn~
3. What is Unicorn • Unicorn is a lightweight, multi-platform, multi-architecture CPU emulator framework, based on QEMU. • GOAL: https://www.unicorn-engine.org/BHUSA2015-unicorn.pdf
4. QEMU https://www.unicorn-engine.org/BHUSA2015-unicorn.pdf
5. Where is Unicorn • 本項目被用於 Qiling 虛擬框架、Radare2 逆向分析框架、GEF (gdb 的 pwn 分析插件)、Pwndbg、Angr 符號執行框架等多個 著名項目。 https://github.com/kabeor/Unicorn-EngineDocumentation/blob/master/UnicornEngine%20Documentation.md
6. Angr with Unicorn • https://api.angr.io/en/v9.2.97/_modules/angr/engines/unico rn.html • Angr 內部有一個特殊的引擎 angr.engines.unicorn。當 Angr 發 現當前的狀態（State）中的數據主要是「具體數值」 （Concrete）而非「符號」（Symbolic）時，它會啟動 Unicorn 進行加速。
7. Pwndbg with Unicorn • https://github.com/pwndbg/pwndbg/blob/dev/pwndbg/e mu/emulator.py • Pwndbg 會透過 Unicorn 先嘗試執行後面的指令，並預覽執行後 結果。
8. How to use Unicorn • Implemented in pure C language, with bindings for Crystal, Clojure, Visual Basic, Perl, Rust, Ruby, Python, Java, .NET, Go, Delphi/Free Pascal, Haskell, Pharo, and Lua. • Later will focus on C and Python.
9. How to use Unicorn
10. How to use Unicorn • 科普一下 C 的
11. Hook • 算是 Unicorn 最常用功能 • Hook type
12. Hook
13. Challenge1: Fibonacci • Unicorn is not the best solution!!! • Recurcive Fibonacci will too slow • Need to think how can speed up • Reconstruct with iterator version • Patch with another Fibonacci method • scripting gdb • Unicorn
14. Challenge1: Fibonacci • First Problem: Unicorn doesn’t load glibc into virtual memory
15. Challenge1: Fibonacci • First Problem: Unicorn doesn’t load glibc into virtual memory
16. Challenge1: Fibonacci • Second Problem: how to improve speed. • Recording computed values 1. Hook the code 2. If call Fibonacci, check if it is computed, set eax, eip
17. Challenge1: Fibonacci
18. Challenge2: babyUnicorn • 我沒載到題目 lol • 給 python unicorn script 用 hook syscall 去改變 eip 值 • 我忘了細節
19. Challenge3: HAHA, It's Me Again. Unicorn~ • 架構參考 babyUnicorn，but implement in C++
20. HAHA It's Me Again: Unicorn 出題動機 • 在 Pre-Exam 中遇到 ShadowFeather 出的 Unicorn，有趣 • 思考如何變化時看到 Unicorn 支援 C++ • 為何出成 remote？因為規定要出 remote 20
21. HAHA It's Me Again: Unicorn Datetime 出題流程 • 生成 Key Key Flag • 加密 Flag Encrypt Logic • Hook Hook Unicorn Engine Encrypt Flag Challenge 21
22. HAHA It's Me Again: Unicorn Datetime 出題流程 Datetime: 2025/08/03 14:50:13 Key Flag Encrypt Logic %S%Y%d%m%M%H%S%M%H%Y%d%m Hook Unicorn Engine Key: “132025031413501420250308” Encrypt Flag Challenge 22
23. HAHA It's Me Again: Unicorn Datetime 出題流程 • Unicorn Engine Key Flag • 將 machine code 透過 Unicorn 執行 Encrypt Logic Hook Unicorn Engine Encrypt Flag Challenge 23
24. HAHA It's Me Again: Unicorn Datetime 出題流程 • 程式邏輯中遇到特定指令會被 Unicorn Key Flag Engine 截斷並執行特定函式 Encrypt Logic Hook Unicorn Engine Encrypt Flag Challenge 24
25. HAHA It's Me Again: Unicorn Datetime 出題流程 • 加密邏輯 Key Flag Encrypt Logic Hook Unicorn Engine Encrypt Flag Challenge 25
26. HAHA It's Me Again: Unicorn 出題流程 Block 1 Block 3 Block 2 ecx == 1 key End ecx == 3 ecx == 2 syscall Block 4 syscall syscall HOOK 26
27. HAHA It's Me Again: Unicorn 解題流程 Flag[n1] Flag Flag[n2] Encrypt Flag[n3] Flag[n4] xor add sub value Block 27
28. HAHA It's Me Again: Unicorn Datetime 解題流程 • 給予挑戰者 Datetime 和 Encrypt Flag Key Flag • 透過逆向加密邏輯反推 Flag Encrypt Logic Hook Unicorn Engine Encrypt Flag Challenge 28
29. Ref • BlackHat 2015: https://www.unicornengine.org/BHUSA2015-unicorn.pdf • Unicorn Github: https://github.com/unicorn-engine/unicorn • Unicorn API Github: https://github.com/kabeor/UnicornEngine-Documentation/blob/master/UnicornEngine%20Documentation.md • Unicorn Challenge WP: https://eternal.red/2018/unicornengine-tutorial