Unicorn

Unicorn is a CPU emulator. It is the right tool when you can define memory, registers, and stop conditions yourself.

Use Unicorn when

• the target is shellcode, a decoder, checksum loop, custom VM handler, crypto primitive, or small boot stub
• OS behavior would be noise
• you know or can infer load address, entry address, mapped memory, stack, registers, and inputs
• memory/register hooks are the evidence you need

Do not use Unicorn as a shortcut for real userland execution. If the target needs syscalls, files, dynamic linking, registry, interrupts, or hardware peripherals, use Qiling, QEMU, or Renode instead.

Setup checklist