$ show chenxvb/Unicorn-Trace
This repository provides an ARM64 tracing and emulation workflow based on the Unicorn engine, designed to work as an IDA Pro plugin and with standalone replay capabilities. The system allows users to trace ARM64 code execution within IDA, dump memory segments, generate Tenet-compatible logs for analysis, and replay traces offline. Key features include dynamic code simulation, memory dumping, register state tracking, instruction-level logging, and special handling for ARM64-specific instructions like MRS TPIDR_EL0 and AUTIASP. The architecture separates IDA integration (dyn_trace_ida.py) from core emulation logic (unicorn_trace/unicorn_class.py), enabling both interactive tracing within IDA and offline replay of captured traces.
The LLM identified 1 files worth highlighting for reuse:
This file contains the Arm64Emulator class which provides core ARM64 emulation functionality with sophisticated tracing capabilities. It demonstrates non-obvious skill in: 1) Memory access analysis that correctly handles various ARM64 addressing modes with proper scale/index/base/displacement calculations, 2) Efficient register change tracking that logs only modified registers rather than all registers on every instruction, 3) Tenet-compatible log generation that follows the expected format for downstream analysis tools, 4) Proper error handling and recovery mechanisms that delegate control back to IDA's debugger when encountering out-of-range execution or exceptions, 5) Clean separation of concerns with modular methods for memory management, hook handling, and instruction analysis. The component is reasonably self-contained (depending only on Unicorn and Capstone) and could be extracted for use in other ARM64 emulation/tracing projects with minimal adaptation.