This software can be used to emulate instructions of the samples without actually executing them directly on the testing machine. It can be extremely useful when analyzing malware that's been compiled for the platform that's different than the one being used for analysis:
- libemu: This is a small emulator library that supports x86 ISA. It's shipped with a small tool, sctest, which prints the emulation state.
- QEMU: Not everybody knows that Qemu can be used not only to emulate the whole operating system (so-called system mode), but also to run a single program (user mode), commonly mentioned as qemu-user (for example, the qemu-arm/qemu-arm-static tool). Dynamically linked samples will also likely require libraries from their platform to be installed and pointed to separately. The -g argument can be used to specify the port for running the GDB server with the requested tool. Now, it becomes possible to connect to it using various debuggers (see the following...
