Unicorn – The Ultimate CPU Emulator

For anyone who isn't familiar with Unicorn, it doesn't emulate any specific whole-system, it's a library/framework for emulation of just the CPU. You are responsible for hooking up the whole "rest of the world" to the emulated CPU, for whatever you might need. This includes things like emulating peripherals, syscalls, binary loading, etc.

You usually use it to build your own emulator or other analysis tool, often for reverse engineering.

I’m using it a lot in AI-driven reverse-engineering (old DOS games), agents love it (usually Python harness)

Somewhat relatedly, is there something halfway between QEMU and Unicorn? That is, a full VM in a library, with debugging capabilities. I'd like to be able to configure a VM, save the execution at a specific point, modify memory, run, and stop when some condition is hit (e.g. a memory address is read, or executed). For years I've had this idea of running the Jamella editor in multiple threads to crack Diablo II item seeds.

I was just looking at Unicorn last week because it's used by unipacker to do automated unpacking of binaries. I built a "toolbox" for gpt-5.5 to do semi-automated malware and exploit reverse engineering and unipacker is sometimes useful for that purpose.

"Based on Qemu 5, we built Unicorn2 from scratch"

What?

uh.. what is a cpu emulator? or what can I do with it? I am kind of having hard time comprehend this.

> Based on Qemu 5, we built Unicorn2 from scratch, […] still maintaining backward compatibility with the current version, […] we also added 2 highly-demanded architectures in PowerPC & RISCV.

Qemu supports RV and PPC!

And that is not what “from scratch” means!

You usually use it to build your own emulator or other analysis tool, often for reverse engineering.

I’m using it a lot in AI-driven reverse-engineering (old DOS games), agents love it (usually Python harness)

"Based on Qemu 5, we built Unicorn2 from scratch"

What?

Unicorn is more like a fork of Qemu than something that depends on it. So what they're saying here is, they reimplemented the Unicorn feature-set (which dramatically diverges from the Qemu feature-set) from scratch based on a newer Qemu branch.

I use Qiling [0] (built on top of Unicorn) sometimes for this kind of things (it can take application snapshots, that you can restore; and you can also use something similar to x86/x86-64 memory hardware breakpoints too). Might fit what you want, although it can sometimes be in a pain in the rear to set up...

[0] https://github.com/qilingframework/qiling

Well, there's ptrace/gdb? (Since you mentioned Diablo II, you might want a windows debugger, but same idea)

uh.. what is a cpu emulator? or what can I do with it? I am kind of having hard time comprehend this.

Low-level debugging, older games (so many consoles have used everything from MIPS to PowerPC as CPUs), etc.

In the early 2000s, I used a linux-based emulator to virtualize some ancient manufacturing hardware control software that was still running on EOL and very expensive PA-RISC kit. It saved the company tens of thousands of dollars in new hardware, while also running faster (it involved early 1990s-era proprietary vector graphics as part of it was printing on the goods). The HP sales people were not amused and tried very hard to get my 22 year old self fired, but my manager convinced them to use it and the old hardware as a backup for awhile. Last I heard in 2011 it was still being used, though running in linux on VMware.

This comparison to qemu gives some idea: https://www.unicorn-engine.org/docs/beyond_qemu.html

The ability to execute and inspect some code without any context (no OS, not even a complete binary) is useful for reverse/security engineering.

An emulator is a computer program that executes the machine code of some system. For example, if your computer is x86, you can't natively run ARM machine code. But an emulator can.

QEMU is an emulator that can run entire operating systems, because it emulates hardware devices like hard drives and displays. Unicorn doesn't emulate any of those things, it only emulates the CPU. It's probably mostly useful for compiler development and security research / reverse engineering.

Well, say all you've got is an x86 device, but you want to develop for ARM. You can write and compile your code, push it to unicorn, and see how it runs.

Or you can use it as a sandbox serving x86 software on an x86 machine.

Or as a "virtual machine" serving say AOSP for ARM on a Windows x86 host.

There's a long list of projects using Unicorn at https://www.unicorn-engine.org/showcase/

It can be used for many things. But the main use is reverse engineering.

> Based on Qemu 5, we built Unicorn2 from scratch, […] still maintaining backward compatibility with the current version, […] we also added 2 highly-demanded architectures in PowerPC & RISCV.

Qemu supports RV and PPC!

And that is not what “from scratch” means!

Well, there's ptrace/gdb? (Since you mentioned Diablo II, you might want a windows debugger, but same idea)

Well, the program doesn't really work anymore, hence why I want a VM.

[0] https://github.com/qilingframework/qiling

This comparison to qemu gives some idea: https://www.unicorn-engine.org/docs/beyond_qemu.html

The ability to execute and inspect some code without any context (no OS, not even a complete binary) is useful for reverse/security engineering.

Low-level debugging, older games (so many consoles have used everything from MIPS to PowerPC as CPUs), etc.

Sweet, thanks. It doesn't seem to be exactly what I'm looking for, in that it simulates (replaces) the OS instead of hosting it, but it's still interesting.

An emulator is a computer program that executes the machine code of some system. For example, if your computer is x86, you can't natively run ARM machine code. But an emulator can.

It can be used for many things. But the main use is reverse engineering.

Sweet, thanks. It doesn't seem to be exactly what I'm looking for, in that it simulates (replaces) the OS instead of hosting it, but it's still interesting.

Well, the program doesn't really work anymore, hence why I want a VM.

If it runs in Wine, you can use winedbg

Well, say all you've got is an x86 device, but you want to develop for ARM. You can write and compile your code, push it to unicorn, and see how it runs.

Or you can use it as a sandbox serving x86 software on an x86 machine.

Or as a "virtual machine" serving say AOSP for ARM on a Windows x86 host.

There's a long list of projects using Unicorn at https://www.unicorn-engine.org/showcase/

How's this one differ from QEMU?

If it runs in Wine, you can use winedbg

How's this one differ from QEMU?

Unicorn is a lightweight multi-platform, multi-architecture CPU emulator framework.

Highlight features:

Multi-architectures: ARM, ARM64 (ARMv8), m68k, MIPS, PowerPC, RISC-V, S390x (SystemZ), SPARC, TriCore & x86 (include x86_64).
Clean/simple/lightweight/intuitive architecture-neutral API.
Implemented in pure C language, with bindings for Pharo, Crystal, Clojure, Visual Basic, Perl, Rust, Haskell, Ruby, Python, Java, Go, D, Lua, JavaScript, .NET, Delphi/Pascal & MSVC available.
Native support for Windows & *nix (with macOS, Linux, Android, *BSD & Solaris confirmed).
High performance by using Just-In-Time compiler technique.
Support fine-grained instrumentation at various levels.
Thread-safe by design.
Distributed under free software license GPLv2.

Find in this BlackHat USA 2015 slides more technical details behind Unicorn engine.

Unicorn is based on QEMU, but it goes much further with a lot more to offer.

Asian Star 10x10 Award

November 13, 2022

We are happy to announce that Unicorn Engine was awarded by Alibaba Cloud for its impact on the cybersecurity field (and beyond since our project is widely used for other purposes, too)!

Unicorn Engine was created and released more than 7 years ago to the public. We launched Unicorn Engine under an open-source license with the goal of contributing to the community and helping as many people as possible with our code. Our team has worked hard to maintain and develop the project to its fullest potential. We are pleased to see Unicorn Engine becoming a de facto emulator and laying the foundation for various innovative works in academia and industry.

We want to thank the whole community for your continuous support over the years. This recognition is for all of us!

For further information on the award, see https://asiastar10x10.kr-asia.com/awardees-2022/

Version 2.0.1

November 1, 2022

Unicorn Engine Team is happy to announce the new version 2.0.1 of our framework!

This version fixes many issues of v2.0 in the core and some bindings. See the ChangeLog for more details.

The source code & precompiled binaries are available in the Download section. See Documentation for how to compile and install Unicorn.

As always, we would like to thank the whole community for your tireless support on developing and maintaining Unicorn project!

Version 2.0.0

July 7, 2022

We are very happy to announce version 2.0.0 of Unicorn Engine, also known as Unicorn2!

This release is a major step forward for our project. While we still maintain backward compatibility with Unicorn 1.0.x, Unicorn2 supports the updated instruction set of all important CPU architectures, including X86, Arm, Aarch64, Mips, Sparc & M68k. Moreover, we added 4 more architectures in PowerPC, RISCV, S390x & TriCore.

Another significant change on this version is the addition of some new APIs to allow better control on how the core engine works. Check it out the Changelog for more details, and sample codes for how to use these new features.

We would like to thank the whole community for your generous & tireless support for the last 7 years! Without your help, Unicorn would not made this far!

The source code of Unicorn2 is now available on Github. Check out COMPILE.md for how to compile and install it.

Please contact if you want to support our work for the next versions.

Unicorn2

October 3, 2021

We are very excited to announce Unicorn2 beta to the public!

Unicorn engine was first introduced at Blackhat USA 2015 as the only cross-platform-architecture framework for CPU emulation. After its release, Unicorn made some good impact in the security community and quickly established itself as the foundation of various innovative work. More than 6 years passed, it is time to make a major step forward with Unicorn2!

Based on Qemu 5, we built Unicorn2 from scratch, with a lot of optimization on performance & code size. While still maintaining backward compatibility with the current version, Unicorn2 supports the latest instruction set of all important CPU architectures, including X86, Arm, Aarch64, Mips, Sparc & M68k. Going further, we also added 2 highly-demanded architectures in PowerPC & RISCV.

The source code of Unicorn2 is now available at dev branch on our Github repo. Check out COMPILE.md for how to compile and install Unicorn2.

Since this important milestone deserves it, we also designed a new logo for Unicorn, as you can see at the top of this post!

What is next now? Help us to fix bugs, update bindings so we can officially release Unicorn v2.0.

Please contact if you want to support our work.

Version 1.0.3

May 26, 2021

We are very happy to announce version 1.0.3 of Unicorn Engine!

This version fixes some minor issues of v1.0.2 in the core and some bindings. We also added a new binding in Rust. See the ChangeLog for more details.

The source code & precompiled binaries are available in the Download section. See Documentation for how to compile and install Unicorn.

We also wish to express our sincere gratitude to all contributors, who generously supported us to maintain Unicorn project!

What is next now? Let us look forward to the next major update: Unicorn 2. Please contact if you want to support our work.

Version 1.0.2

October 21, 2020

We are very happy to announce version 1.0.2 of Unicorn Engine!

It has been more than 3.5 years since the last major update, and this version marks 5 year of Unicorn. Such a long journey for an open source project! That is really exciting to see our magical animal having more and more impact in both academia community and the cybersecurity industry.

This version fixes various issues of v1.0.1, adds some new API and introduces more bindings. See the ChangeLog for more details.

The source code & precompiled binaries are available in the Download section. See Documentation for how to compile and install Unicorn.

In no particular order, we would like to thank CatenaCyber, Grayshift and Google Patch Rewards for sponsoring this release!

We also wish to express our sincere gratitude to all contributors, who generously supported us to maintain Unicorn project!

What is next now? Let us look forward to the next major update: Unicorn 2. Please contact if you want to support our work.

Version 1.0.1

April 20, 2017

We are excited to announce version 1.0.1 of Unicorn Engine!

The source code & precompiled binaries are available in the download section. See documentation for how to compile and install Unicorn.

A quick tutorial on how to program with Unicorn in C & Python can be found here.

Important changes since v1.0 include:

Properly handle selected-architecture build.
Fix compilation issues on PPC & S390x.
Fix a memory leak on uc_mem_protect().
ARM:
- Support big-endian mode.
- Correct instruction size of Thumb/Thumb2 code.
- Support read/write APSR register.
ARM64:
- Support read/write NEON registers.
- Support read/write NZCV registers.
Mips: Support read/write Mips64 registers.
X86: Support read/write MSR.
Haskell binding: update to the latest API.
Python: allow not having PATH setup.

Community also provide independent bindings for Pascal, Rust & Perl.

Version 1.0

February 23, 2017

We are very happy to announce version 1.0 of Unicorn Engine!

The source code & precompiled binaries are available in the download section. See documentation for how to compile and install Unicorn.

A quick tutorial on how to program with Unicorn in C & Python can be found here.

Important changes since v0.9 include:

Lots of bugfixes in all architectures.
Fix many memory leaking issues.
New APIs: uc_query, uc_reg_write_batch, uc_reg_read_batch, uc_mem_map_ptr, uc_mem_regions, uc_free, uc_context_alloc, uc_context_save & uc_context_restore.
New memory hook type: UC_HOOK_MEM_READ_AFTER.
Add new version macros UC_VERSION_MAJOR, UC_VERSION_MINOR, UC_VERSION_EXTRA.
Remove glib & pkconfig dependency.
Windows: export a static lib that can be used outside of Mingw.
ARM:
- Support MCLASS cpu (Cortex-M3).
- Better support for Thumb mode.
- uc_reg_write now can modify CPSR register.
- Add some ARM coproc registers.
ARM64: uc_reg_read & uc_reg_write now handles W0-W31 registers.
X86:
- Fix 16bit address computation.
- Fix initial state of segment registers.
Windows: fix a double free bug in uc_close.
3 new bindings: Haskell, MSVC, VB6.
Python:
- Better support for Python3
- Fix memory leaking that prevents UC instances from being GC.

Community also provide independent bindings for Pascal, Rust & Perl.

Huge thanks to all the heroic contributors who worked hard for over 1 year to make this release possible!

First public release!

October 15, 2015

We are very excited to announce the first public release, version 0.9, of Unicorn Engine!

The source code & precompiled binaries are available in the download section. See documentation for how to compile and install Unicorn.

A quick tutorial on how to program with Unicorn in C & Python can be found here.

We would like show our gratitude to the beta testers for bug reports & code contributions during the beta phase! Their invaluable helps have been tremendous for us to keep this far.

Unicorn aims to lay the ground for innovative works. We look forward to seeing many advanced research & development in the security area built on this engine. Let the fun begin!

Beta-test phase begin!

September 1, 2015

We are excited to announce that the beta-test phase of the Unicorn engine has officially kicked off!

The plan is to run this testing phase in few weeks, then if the code is considered good enough, version 1.0 will be released to public immediately.

We are honoured to have following heroes helping out us in this phase (list is in no particular order)

Nguyen Tan Cong
Loi Anh Tuan
Edgar Barbosa
Joxean Koret
Chris Eagle
Jay Little, Trail of Bits
Jeong Wook Oh
Luis Miras
Yan Shoshitaishvili, Shellphish & UC Santa Barbara
Erik Fischer
Darel Griffin, NCC Group
Anton Cherepanov
Mohamed Saher (halsten)
Tyler Colgan
Jonathon Reinhart
Blue Skeye
Chris Maixner
Sergi Alvarez, aka pancake (author of radare)
Ryan Hileman
Tim “diff” Strazzere
WanderingGlitch of the Zero Day Initiative
Sascha Schirra
François Serman
Sean Heelan
Luke Burnett
Parker Thompson
Daniel Godas-Lopez
Antonio “s4tan” Parata
Corey Kallenberg
Shift
Gabriel Quadros
Fabian Yamaguchi
Ralf-Philipp Weinmann
Mike Guidry
Joshua “posixninja” Hill

Call for beta test!

August 7, 2015

We gave a presentation on Unicorn engine at the BlackHat USA 2015 security conference. The talk went well, and we got nice feedbacks from the audience.

The slides is now available in PDF format. Find in the presentation more details on the design \& implementation of Unicorn.

We would like to improve the code quality before the official release. Therefore, Unicorn project is now calling for beta testers!

Are you are willing to help to test Unicorn to find \& clean bugs?
Can you code? You do not need to be an excellent coder, but writing some tools using Unicorn is the only way to find bugs at this phase.

If the answer is “Yes” for both questions, then email us with some self-instroduction on why you are interested, and how you can help.

Unicorn will be released soon with full source code - in GPL license - after this short beta phase.

BlackHat USA 2015 presentation

August 2, 2015

We are working to release more contents & prepare for our BlackHat USA 2015 talk. Meanwhile, check out a sample code in Python and C language to see how Unicorn can be useful for a real problem.

Our presentation at BlackHat USA will be on August 5th, 10:20 - 11:10, in room “South Seas IJ”.

See you there with some cool Unicorn stickers, soon!

Website launched!

August 1, 2015

We are happy to launch the website for Unicorn CPU Emulator! Also find here the mailing list and twitter address where we will update information on the project.

Unicorn now has a mailing list. Subscribe to the list for updated information & do conversation
Users are also encouraged to follow us on Twitter for important announcements.

Hacker Times

Hacker Times

Unicorn – The Ultimate CPU Emulator

Discussion

Discussion

Asian Star 10x10 Award

Version 2.0.1

Version 2.0.0

Unicorn2

Version 1.0.3

Version 1.0.2

Version 1.0.1

Version 1.0

First public release!

Beta-test phase begin!

Call for beta test!

BlackHat USA 2015 presentation

Website launched!