Recentry I’ve started work on a cross platform x86 emulator in C for the open source anti-virus program ClamAV. Actually it is not a fully functional emulator, but a emulator for viruses. I am targeting the polymorphic and metamorphic viruses, as well as a generic unpacker for exe packers like UPX, FSG, MEW, AsPack, etc. I hope one day it will be able to emulate protectors too, but I might have a *little* problem with emulating threads and all these protectors which do self-debugging :(. Anyway I managed to finalize in some way the Intel instruction decoder ( it decodes the ModRM and SiB even 😛 ) and the memory manager. I also have a basic PE file loader, but it is really just for testing purposes. For example it is assuming the ImageBase is always 0x00400000 and some more little things must be fixed too. I call this the “kernel”, because I am trying to make the emulator layer based and each part should be separated from the others. I’ve put it on my svn – http://www.wush.net/trac/i-nZ/browser/i-Emulator/ . The problem is that if don’t have time to work on it, because I’ve got some courseworks to do :). I hope I won’t get raped for using GTK# and Mono;s C# compiler for my ACW in Programming :P. I will write a small article soon on how to write a MasterMind game using GTK#.
read