Lord_Monstey Unicorn Stepper v2.0.1

An interactive Unicorn x64 emulator for IDA 9.x. Start it from the current IDA address, then press Enter to execute precisely one instruction at a time.

It never executes the target natively and never attaches to a live process.

Install

1. Close IDA.
2. Extract the ZIP.
3. Double-click install_monstey_micro_emulator.cmd.
4. When asked, enter the Python executable configured by IDAPython. Press Enter to use py -3.
5. Let the installer add Unicorn, then start IDA again.

The installer copies the plugin into %APPDATA%\Hex-Rays\IDA Pro\plugins\monstey_micro_emulator.py. It also installs unicorn>=2.1,<3 in the selected Python environment.

Use

Right-click in a disassembly or pseudocode view:

• Lord_Monstey: Unicorn step selected/current code: starts from the current instruction.

The window opens on the current instruction and maps IDB pages only when Unicorn needs them. Press Enter to execute one instruction. The Follow RIP in IDA toggle is enabled by default, so the active disassembly line follows Unicorn as you step.

The register pane always shows the current RAX through R15, RSP, RIP, and the important EFLAGS bits. The trace and memory-write panes update after each instruction. Reset returns to the first selected instruction.

Imported calls do not execute outside the IDB. Common memory and WinAPI helpers such as VirtualAlloc, VirtualProtect, memset, and memcpy are replaced by small static stubs. Other imports return a deterministic success value and advance to the next instruction.

Unicorn executes real x64 instructions, including common obfuscation arithmetic and indirect dispatcher sequences. An invalid read/write/fetch inside a loaded IDA segment maps that IDB page on demand. Accesses outside mapped IDB, stack, or synthetic allocation memory stop cleanly and leave the current state visible.

For the stack dispatcher pattern:

push rcx
lea rcx, target
add rcx, offset
mov [rsp+10h], rcx
pop rcx
jmp qword ptr [rsp+8]

open the stepper and press Enter through each instruction. The stack write is performed by Unicorn; the next jmp qword ptr [rsp+8] transfers RIP to the recovered target, and IDA follows it when Follow RIP in IDA is enabled.

The stepper stops on memory accesses that cannot be backed by the IDB, synthetic heap, or its controlled stack. This keeps execution deterministic and suitable for static IDB work.

Signed Lord_Monstey.