4 ms·

I've had no trouble using angr on real binaries, including self-modifying binaries. > [Qiling] is an extra layer on top of Unicorn (a library that can emulate

I've had no trouble using angr on real binaries, including self-modifying binaries. > [Qiling] is an extra layer on top of Unicorn (a library that can emulate CPU instructions using QEMU). This is what is mostly confusing me -- angr has support for unicorn, so how is it different from angr's support of Unicorn?

philibuster 7y ago
Unicorn is a scriptable CPU emulator. What happens though when a program uses a system call? Qiling tries to fully emulate what the host (windows, linux, etc) should do. Emulating the systems an OS provides is not trivial. An OS provides networking, filesystem, loading a binary(ELF, PE, MachO) into memory, etc. Using QEMU with full system emulation can do some of this, but you don't get the scriptable control and deep analysis capabilities of Unicorn. angr, from what I gather, can be useful for targeting specific sections of code. If you've reversed a binary enough to know where to target, this is useful. For example, code such as as parsers which are typically complex and vulnerable or finding a specific input to reach a desired location (i.e. ctf challenges). The problem qiling solves is that applications don't run in a vacuum, they are highly dependent on the OS they run on. Emulating each OS allows for dynamic analysis not possible with other frameworks. Some tools like Corellium provide great system emulation, but qiling has much better potential for analysis purposes. The slides in the 'News' section of the page do good job of explaining in detail. https://www.qiling.io/docs/Qiling-NullCon2020.pdf https://www.qiling.io/docs/Qiling-NullCon2020.pdf
zznop 7y ago
Certainly, angr is a very good framework. My previous understanding is that angr uses unicorn for instruction emulation for symbolic execution. Although, I see they also have what they call a "simulation engine" that provides a similar interface to Qiling's and allows for setting breakpoints and poking around in memory. To your point, there is definitely overlap. Qiling is much more narrowly scoped, but I think Qiling has a better understanding of the OS. It can do syscall and I/O handling for Windows, Linux, and Mac binaries regardless of what host OS you are running.

philibuster 7y ago

Unicorn is a scriptable CPU emulator. What happens though when a program uses a system call? Qiling tries to fully emulate what the host (windows, linux, etc) should do. Emulating the systems an OS provides is not trivial. An OS provides networking, filesystem, loading a binary(ELF, PE, MachO) into memory, etc. Using QEMU with full system emulation can do some of this, but you don't get the scriptable control and deep analysis capabilities of Unicorn. angr, from what I gather, can be useful for targeting specific sections of code. If you've reversed a binary enough to know where to target, this is useful. For example, code such as as parsers which are typically complex and vulnerable or finding a specific input to reach a desired location (i.e. ctf challenges). The problem qiling solves is that applications don't run in a vacuum, they are highly dependent on the OS they run on. Emulating each OS allows for dynamic analysis not possible with other frameworks. Some tools like Corellium provide great system emulation, but qiling has much better potential for analysis purposes. The slides in the 'News' section of the page do good job of explaining in detail. https://www.qiling.io/docs/Qiling-NullCon2020.pdf https://www.qiling.io/docs/Qiling-NullCon2020.pdf

zznop 7y ago

Certainly, angr is a very good framework. My previous understanding is that angr uses unicorn for instruction emulation for symbolic execution. Although, I see they also have what they call a "simulation engine" that provides a similar interface to Qiling's and allows for setting breakpoints and poking around in memory. To your point, there is definitely overlap. Qiling is much more narrowly scoped, but I think Qiling has a better understanding of the OS. It can do syscall and I/O handling for Windows, Linux, and Mac binaries regardless of what host OS you are running.