Arion is a library that aims to emulate various executable formats (ELF, PE, Mach-O...) coming from different platforms (Linux, Windows, macOS...) and with different CPU architectures (x86, ARM, MIPS...).
Based on Unicorn and written in C++, it should allow fast emulation especially for fuzzing purposes.
Inspired by Qiling, Arion in its current form is not intended to replace this awesome Python library, but to complement it with higher performance.

This project is still in alpha development. It can be unstable and/or lead to undesired behaviors so you may want to deploy it in a containerized environment.

Arion currently implements the following features :

• Emulating Linux ELFs for x86, x86-64, ARM, ARM64
• Emulating more than 120 syscalls
• Fork handling
• Multithreading handling (unstable)
• Saving / restoring context
• Hooking the target with ~20 functions
• Memory reading / writing
• File system management
• Network sockets management

Installation
      Download a release
      Build the library with Docker
Performance comparison
How to use ?
      Examples
Contributing

Check the Releases tab on the Github project and download the latest one.

1. Clone the repository git clone https://github.com/h311d1n3r/Arion.git && cd Arion.
2. Check the available Dockerfiles under Arion/docker.
3. Build the docker image of your choice ./scripts/docker_build.sh {OS}{OS_VERSION} {BUILD_VERSION}.
4. You can build against Arion library from inside the docker or extract it on your host.

1. Clone the repository git clone https://github.com/h311d1n3r/Arion.git && cd Arion.
2. Initialize git dependencies : git submodule update --init
3. Create the build directory mkdir build && cd build.
4. Run CMake to configure the project cmake ...
5. Run make to compile the project make -j4.
6. Run make install to deploy the project sudo make install.

Since Arion is entirely written in C++, it has a much lower execution time than Qiling because of its to-and-fro in the Python context.
The next two graphs have been realized with the same program, run in the same context with both Arion and Qiling. In the first graph, the variable is the amount of syscalls executed by the target wheras in the second it is the amount of basic blocks hit, when all basic blocks are hooked.

A wiki and a documentation are to come. For now, you can rely on the examples and visit the headers in include directory to learn more about what you can do with Arion.

You can find examples inside the examples directory. These examples are by no means exhaustive, but they will teach you how to deal with Arion.

Arion can be compiled with -DDEV=1 to increase build speed. This require externals libs to be compiled with the following cmake flags:

for all libraries

-DCMAKE_POSITION_INDEPENDENT_CODE=ON

for spdlog specific flags:

-DCMAKE_POSITION_INDEPENDENT_CODE=ON -DCMAKE_BUILD_TYPE=Debug -DCMAKE_DEBUG_POSTFIX=d

It is higly recommended to use library version from lib/. Capstone > 6.0.0alpha is required.

Feel free to contribute to the project by implementing new features on the dev branch.