Package: zelos
ZelosZelos (ZeropointEmulatedLightweightOperatingSystem) is a python-based binary emulation platform. One use of zelos is to quickly assess the dynamic behavior of binaries via command-line or python scripts. All syscalls are emulated to isolate the target binary. Linux x86_64 (32- and 64-bit), ARM and MIPS binaries are supported.Unicornprovides CPU emulation.Full documentationis availablehere.InstallationUse the package managerpipto install zelos.pipinstallzelosBasic UsageCommand-lineTo emulate a binary with default options:$zelosmy_binaryTo view the instructions that are being executed, add the--instflag:$zelos--instmy_binaryYou can print only the first time each instruction is executed, rather thaneveryexecution, using--fasttrace:$zelos--inst--fasttracemy_binaryBy default, syscalls are emitted on stdout. To write syscalls to a file instead, use the--trace_fileflag:$zelos--trace_filepath/to/filemy_binarySpecify any command line arguments after the binary name:$zelosmy_binaryarg1arg2Programmaticimportzelosz=zelos.Zelos("my_binary")z.start(timeout=3)PluginsZelos supports first- and third-partyplugins. Some notable plugins thus far:crashdcrash analyzer combining execution trace, dataflow and memory sanitization.overlay (ida plugin): highlightszelosexecution trace in IDA with instruction-level comments added.angr integration: enables symbolic execution inzelos.zdbserver: remote control and debugging of emulated binaries.syscall limiter: demonstrates event hooking and provides syscall-based execution and termination options.ContributingPull requests are welcome. For major changes, please open an issue first to discuss what you would like to change.Please make sure to update tests as appropriate.Local Development EnvironmentFirst, create a new python virtual environment. This will ensure no package version conflicts arise:$python3-mvenv~/.venv/zelos$source~/.venv/zelos/bin/activateNow clone the repository and change into thezelosdirectory:(zelos)$gitclonegit@github.com:zeropointdynamics/zelos.git(zelos)$cdzelosInstall aneditableversion of zelos into the virtual environment. This makesimport zelosavailable, and any local changes to zelos will be effective immediately:(zelos)$pipinstall-e'.[dev]'At this point, tests should pass and documentation should build:(zelos)$pytest(zelos)$cddocs(zelos)$makehtmlBuilt documentation is found indocs/_build/html/.Install zelos pre-commit hooks to ensure code style compliance:(zelos)$pre-commitinstallIn addition to automatically running every commit, you can run them anytime with:(zelos)$pre-commitrun--all-filesWindows Development:Commands vary slightly on Windows:C:\> python3 -m venv zelos_venvC:\> zelos_venv\Scripts\activate.bat(zelos)C:\> pip install -e .[dev]LicenseAGPL v3ChangelogAll notable changes to this project will be documented in this file.The format is based onKeep a Changelog,
and this project adheres toSemantic Versioning.[Version 0.2.0] - 2020-08-04AddedPlugins: YarascanIntroduction of Zelos Manipulation Language (ZML), used for specifying events on the command line and in scripts. New zml_hook function in apiAbility to redirect input to stdinHooks for internal memory reads, writes, and mapsLinked to crashd plugin, containing separate plugins for heap memory guards, static analysis via IDA Pro, and dataflow using QEMU TCGChangedMoved to different command line flags for specifying what degree of information (instructions or syscalls) is printed while runningBetter support for lists in command line argumentsFlags can be passed to the emulated program via the command lineMisc. bug fixes (thanks to seth1002)General improvements to syscallsRemovedVerbosity command line flag (now handled via other flags)[Version 0.1.0] - 2020-05-29AddedPlugins: IDA overlays, remote debug serverAdditional plugin APIsChangedMinor syscall emulation improvementsMemory management overhaulRemovedN/A[Version 0.0.1] - 2020-03-03AddedN/AChangedUpdated documentationRemovedN/A[Version 0.0.0] - 2020-03-02Initial public release.AddedInitial open source commit.ChangedN/ARemovedN/AThe Core Zelos TeamKevin Valakuzhy- Research Engineer, DeveloperRyan C. Court- Research Engineer, DeveloperKevin Z. Snow- Co-Founder, DeveloperSpecial Thanks ToFabian Monrose - Co-FounderAnn Cox - DHS Program ManagerAngelos Keromytis - DARPA Program Manager (Former)Dustin Fraze - DARPA Program ManagerSuyup Kim - Intern