Lion Cipher Lab
Emulate a malware binary with Qiling to extract its behaviour and config
- Threat Intel Analyst
- Advanced
- ~90 min
- Free · no account required
Why it matters
Two of the hardest problems in malware analysis are recovering a config that is encrypted at rest and observing what a sample DOES without letting it run on a real machine. Static tools stall at the first hurdle: `strings` and a disassembler show you the encrypted husk, not the http://... the loader decrypts into memory a millisecond before it beacons. A full sandbox solves the second problem but is heavy, is loud (malware often detects it), and for a Windows sample you may not have the right OS handy. Full-binary EMULATION is the scalpel in between. Qiling loads a whole PE or ELF, gives it…
What you'll learn
- the difference between a CPU emulator (Unicorn: registers and memory, no OS) and a BINARY emulator (Qiling: a loader, an emulated filesystem/rootfs and syscall handling on top of Unicorn), and why full-binary emulation sits between static triage and detonation in a sandbox
- standing up Qiling in a Python venv, supplying a rootfs, loading a full ELF and running it to completion with ql.run()
- compiling a benign, reproducible 'malware-like' sample that hides its C2 config XOR-encrypted at rest and only decrypts it into a global buffer at runtime -- so `strings` on the file reveals nothing
- resolving a static symbol's address with nm/objdump on a -no-pie -static binary, then hooking that exact address with ql.hook_address
- dumping the DECRYPTED config out of emulated memory with ql.mem.read the instant after the sample decrypts it -- recovering a value static analysis cannot reach
- reading the sample's behaviour through the emulated OS: the file it drops lands inside the rootfs, not your real disk, and Qiling's verbose log shows every syscall it makes
- surgically altering execution: forcing a register or branch with a hook (ql.arch.regs) to skip an anti-analysis check, the emulation equivalent of a debugger patch
- the honest limits: unimplemented syscalls/APIs that halt emulation, anti-emulation checks (timing, CPUID, rare instructions), and that Qiling is NOT a network sandbox -- when to reach for it versus Cuckoo/CAPE versus a debugger
Steps in this lab
- Why a second emulator: Qiling is a whole OS around Unicorn
- Set up a clean venv and install Qiling (pinned)
- Get a rootfs for the emulated machine
- Build a benign sample that hides its config like real malware
- Prove static analysis cannot see the config
- Find the addresses you will hook
- Emulate the whole binary with Qiling
- Dump the decrypted config from emulated memory with a hook
- Read the behaviour: the dropped file landed in the rootfs, not your disk
- Surgical control: patch a branch to skip a check
- The limits, and when to reach for what (the judgment)