Code emulation ... radare2's ESIL
summary
Shows how radare2's ESIL actually executes code snippets as a reverse‑polish stack machine on steroids, mapping CPU registers and virtual memory so emulation produces real register and memory values. Demonstrates extracting a program password by initializing ESIL, emulating from scanf to the comparison, and reading the computed memory cell; automates brute force via the r2 pipe and Python; and decrypts an obfuscated Windows PE in-place using IO cache and emulation — all without running the binary.
AI-written summary · about
chapters (20)
- 0:00Introduction
- 1:23Outline of the talk
- 3:28Documentation
- 5:11Radare2 tools
- 12:18Visual Modes
- 16:56What is emulation
- 26:06Visual explanation
- 26:55Initial expression
- 28:44Expression
- 29:19Expansion
- 30:19Storage
- 31:14Comments
- 32:54operands
- 33:58flags
- 35:24practice
- 41:27brute force
- 41:49magic number
- 49:52obfuscation
- 50:48function
- 58:25conclusion
related talks
02h 05mOvercoming Fear: Reversing With Radare2
51mFull System Emulation: Achieving Successful Automated Dynamic Analysis of Evasive Malware
31mBypassing Anti-Debugging: A Hybrid Real-Simulated Approach to Rootkit Analysis
45m"Advanced Malware Threat: handling obfuscated code using..."
36mExploiting Buffer Overflows on RISC-V
41mAPTs Way: Evading Your EBNIDS
01h 09mDeobfuscate UEFI/BIOS Malware And Virtualized Packers
34mRISC-V-Based Sandboxing for Secure and Efficient Software Execution