binee - Binee: binary emulation environment

项目说明

binee (Binary Emulation En)

Binee is a complete binary emulation en that focuses on introspection
of all IO operations. Primary goals for this project are to provide a flexible
en for determining a binaries side effects on the system.

The goals Binee tries to solve are the following:

1. Realistic loading of a PE file and its required dependencies. The userland
memory should look as close to a real execution as possible.
2. Easy to use hooking framework. We want to create a flexible hooking
framework that allows the analyst to rapidly implement new hooks and capture
data.
3. Mock out as much of the OS internals as reasonably possible. Currently,
there are small mocks of the file system, registry, threading and TIB/PEB
structures for Windows.
4. The OS en, as much as possible, should be defined in a
configuration file. This enables rapid mo from en to
en.

**If you choose to use Binee to emulate portions of Microsoft Windows, you are
solely responsible for obtaining any necessary rights and licenses from
Microsoft.**

De and Support

Please feel free to submit github issues or if you want to talk with us directly, come join is in slack

slack workspace

DEF CON 27 Materials

slides

demo video

presentation

Setup and de in Docker container

If you are running Binee on Microsoft Windows, you can skip the mock file system step.

Most malware will require at least some standard DLLs and these DLLs will need
to be accessible from the mock file system. The default "root" mock file system
is located in os/win10_32/. In order to allow for the malware to load up DLLs
you will need to copy them into the appropriate location within the mock file
system. Typically, these should be copied into,
os/win10_32/windows/system32/. Currently, only 32-bit DLL's pulled from a 32-bit
Windows installation are supported. Once you have the required files in that
directory, you can move onto the compiling and running step.

Compiling and running

Build with the following docker command docker build -t binee .

Download Golang dependencies and build Binee

_Note: presence of go.mod file will direct the build utility to collect dependencies upon build, and also allow for the repository to be cloned and de at any path (regardless of $GOPATH) directory_

At this point you should be able to execute binee within the Docker container
and see the usage menu.

If you are running on Microsoft Windows and/or you have your mock file system
configured properly, you should be able to execute all the PE files within the
tests/ directory.

Compiling on windows:

1-Install MSYS64/32 :
2-update the system packages :
$ pacman --needed -Sy bash pacman pacman-mirrors msys2-runtime
-restart MSYS then update e else :
$ pacman -Su

To compile for Windows 32-bit, run:

To compile for Windows 64-bit, run:

-install Go :
pacman -S mingw-w64-x86_64-go

3-restart MSYS again ; then clone into unicorn and install it:
git clone
cd unicorn
./make.sh
./make.sh install

4-Clone Binee and Build
cd binee
go build

项目信息

开发语言：Go

Star 数：531

技术要点

该项目属于病毒分析方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Binee: binary emulation environment展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。