Ripr : Python encapsulation of binary code

Abstract

We present ripr, a tool for automatically packaging binary code as a functionally identical Python class. We achieve this by pairing the Unicorn emulator with a static analysis back-end. In many cases, this gives us access to enough information to automatically create an emulation environment that will be functionally identical to an execution of the original binary code. This can drastically reduce, and in many cases completely eliminate, time spent reimplementing functionality; an exceedingly common scenario in many reverse-engineering endeavors.