omni_dynamic_probe
Dump live packed process memory, emulate x86/x64 instructions, inject Frida hooks, and control ADB devices to analyze or unpack protected binaries.
Instructions
Live dynamic instrumentation, memory dumping & CPU emulation: Win32 dynamic memory unrolling (Themida/VMProtect/Crypters), Unicorn x86/x64 instruction tracing, Frida script hooking, and ADB device control.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| action | Yes | Action: 'memory_dump' (dump RAM & decrypt LCG strings/VM from running packed process), 'unicorn_emulate', 'frida_devices', 'frida_processes', 'frida_inject', 'adb_devices', 'adb_shell', 'adb_pull', 'adb_logcat'. | |
| target | No | Target PE path (for unicorn_emulate), PID, process name, device ID, or remote path. | |
| payload | No | Emulation range 'start_va:end_va' (e.g. '0x140001000:0x140001200'), Frida JavaScript script payload, shell command string, or local destination path. | |
| timeout | No | Execution timeout or max instructions (default 5.0 / 10000). |