Tapping into the potential of Memory Dump Emulation

[hugsy]

This post summarizes some of the work I've been doing for the past few months during my (few) off times. Nothing new, mostly just a structured reminder for my later self. Introduction What-The-Fuzz is one of my favorite tools, and beyond the tool...

Link

[sha0coder]

Nice post, I really liked it, I usually do windows memory dump emulation from linux/mac with pyscemu python module, It was developed in pure rust. It's not perfect it doesn't implement the full winapi, but don't get stuck with fs/gs peb access, ldr crawling etc.
regards.

[hugsy]

Hi @sha0coder

I didn't know this Scemu, those are very cool projects I wish I knew earlier, It could have been useful on some former projects. Impressive work
TBH I wasn't trying to bring anything new, I realize there are other (better!) alternatives: probably can do something similar with Qiling (based on unicorn - based on qemu 😓 ) which would be more feature-rich. I just really like bochs (and bochscpu) because you actually control everything, where others libs I've used in the past tend to abstract too much, not letting users the possibility to go deep down

Thanks for the feedback and sharing the libs!

[msuiche]

This is pretty cool. Just wanted to say that

[hugsy]

Thanks! That means a lot coming from you!