Beta release of libemu qemu extension

30 Aug 2011 Florian Schmitt libemu qemu shellcode
As part of this year’s Summer of Code, I programmed an extension for the shellcode detection and analysis library libemu. The main goal of the project was to increase the performance when executing shellcode, with the help of a virtualizer. Prior to this extension, libemu made use of a custom emulator, which supported only instructions mostly used in shellcode. With this extension, libemu utilizes a full-blown, completely functioning virtualizer, which executes code presumably the same way a real CPU does.

Another possible way to intercept function calls in QEMU

02 Dec 2010 Chengyu Song qemu hook
I’m developing a syscall interception tool for Android as a course’s project. While it is relatively simple to intercept calling into the system services (introduced at the end), it is harder to get the syscall return. The reason is, the latest Android emulator is build upon QEMU 0.10.50, meaning it’s TCG based. So we cannot use the same way Qebek or TEMU uses to intercept the syscall return. Therefore I looked into the new code to find if I could find a way to solve this problem.

Precall and Postcall

14 Jun 2009 Chengyu Song qebek sebek qemu windows
When using hooking technology to intercept system calls, there are two different places to collect information: before the original function is called (precall) and after the original function returns (postcall). For example, in Sebek Win32 client, when callback function OnZwReadFile is called, it first calls the original function s_fnZwReadFile, after the original function returns, it checks whether the original call succeeds, if does, it then calls the data collection function LogIfStdHandle:

Is Handle Std

11 Jun 2009 Chengyu Song qebek qemu sebek windows
Sebek Windows client has two keystroke sources, one is read or write std stream, the other is csrss port. In the callback function of NtReadFile and NtWriteFile, Sebek will check if the given file handle match one of the three standard stream handles. if matches, it then logs the given data of keystrokes: __asm { mov EAX, FS:[18h] mov [pTIB], EAX } if(FileHandle == pTIB->pPEB->ProcessParameters->StandardOutput || FileHandle == pTIB->pPEB->ProcessParameters->StandardInput ||