dncil : CIL Emulation

[akhilguruprasad22]

Hello team @mandiant/flare-gsoc (@mike-hunhoff @williballenthin),

With prior experience with .NET in C#(I'd love to deep dive into it's workings) and python, I'd like to express my interest in extending dncil to support a CIL instruction emulator. While I'm in the process of figuring things out, I wanted to know if, as an initial contribution to this project, I could take up work on the following issues:
#16 (mandiant/dncil#16)
#8 (mandiant/dncil#8)
#2022 (mandiant/capa#2022)
#724 (mandiant/flare-floss#724)

Regarding the addition of CIL emulation, I intend to finish due research and discuss/propose actionable ideas here, as soon as possible, while trying my best to adhere to the following deadline:

If you choose, we can provide one review of your application submitted to us via a shared Google document at least 10 days prior to the application deadline.

The provided starting points look real good but please do feel free to share any additional material, if you do come across any.

Looking forward to a great first gsoc experience with both of you as my mentors. All the best to us all.

[mike-hunhoff]

Thanks for reaching out @akhilguruprasad22 - it's great to read your excitement about contributing to this project. Please grab an issue that you feel comfortable working on and ask any questions 🚀

[akhilguruprasad22]

Hello again team @mike-hunhoff , @williballenthin,
Here with a few more questions/requests:

According to my research and understanding, to achieve this with Unicorn emulator, the majority of the work in emulating CIL would be towards mapping/parsing CIL instructions to appropriate native instructions, all while staying semantically correct. I believe the ECMA-335 doc will come in handy here. If i'm not wrong, this will have to be done for each architecture based on their instruction set.
Something like this but with actual parsing and added emulation to mimic the variable array and stack manipulations.
Do you think this would be a viable direction to take to achieve our goal?

If we choose to go with the above approach, I'd really like some help to come up with checkpoints to outline the pace and results we expect to see.
If we choose to approach this another way, I'd be grateful to be pointed in the right direction in order to be able to research and propose another solution, accordingly.

[symbolicvoid]

I don't think we need to compile CIL to native code and use a CPU emulator to run it. We could just interpret these instructions and perform their actions on the stack and local variables. I suppose its kind of like how Unicorn or any emulator would run assembly instructions, but instead of assembly we run CIL instructions. We cannot fully run a program start-to-end this way but it should still serve for what the project aims to do, such as being helpful in malware analysis. Please correct me if I got it wrong :)

[akhilguruprasad22]

Hello @symbolicvoid,
I did consider interpreting each instruction and emulating them as and when we interpret them. I personally felt this would not enable us to make the most of the JIT compiler that Unicorn provides. I was thinking we could provide this(stepping through instructions) as an added functionality (Unicorn's demo shows this being achieved through CEnigma-Unicorn, although I haven't dove into this) while still maintaining the ability to emulate end-to-end. Keeping in mind that the hooks provided by Unicorn will anyway enable us to monitor different accesses and individual instructions, I believe the ability to run end-to-end programs/functions will help us capture more context as well.

[mike-hunhoff]

@symbolicvoid is spot on with the intention of this project - We could just interpret these instructions and perform their actions on the stack and local variables. Our goal is not to run programs end-to-end but instead enable users to emulate groupings of CIL instructions towards solving common problems seen in malware analysis e.g. string obfuscation. @akhilguruprasad22 the project that you linked above is an example written in C# of our intended approach.

[akhilguruprasad22]

Noted @mike-hunhoff @symbolicvoid. Thank you for clearing this up for me.