Struct EmulationConfig
pub struct EmulationConfig {
pub limits: EmulationLimits,
pub unknown_method: UnknownMethodBehavior,
pub symbolic_tracking: bool,
pub threading_enabled: bool,
pub thread_quantum: usize,
pub max_threads: usize,
pub exception_handling: bool,
pub allow_unwind: bool,
pub pointer_size: PointerSize,
pub memory: MemoryConfig,
pub stubs: StubConfig,
pub tracing: TracingConfig,
}Expand description
Comprehensive emulation configuration with fine-grained control.
EmulationConfig is the top-level configuration container that controls
all aspects of .NET emulation behavior. It aggregates sub-configurations
for limits, memory, stubs, and tracing.
§Default Configuration
The default configuration provides reasonable settings for general use:
- 10 million instruction limit
- 1000 call depth limit
- 256 MB heap limit
- Threading and exceptions enabled
- All stubs enabled in non-strict mode
§Presets
Use the preset methods for common scenarios:
extraction()- For unpacking protected assembliesanalysis()- For static analysisfull()- For complete emulationminimal()- For simple constant folding
§Example
use dotscope::emulation::EmulationConfig;
// Default configuration
let config = EmulationConfig::default();
// Preset for extraction
let config = EmulationConfig::extraction();
// Custom configuration
let config = EmulationConfig {
symbolic_tracking: true,
threading_enabled: false,
..EmulationConfig::analysis()
};Fields§
§limits: EmulationLimitsExecution limits controlling resource usage.
Includes maximum instructions, call depth, heap size, and timeout.
unknown_method: UnknownMethodBehaviorBehavior when encountering methods without stubs.
Determines whether to return symbolic values, fail, use defaults, or skip the call entirely.
symbolic_tracking: boolWhether to track symbolic values for data flow analysis.
When enabled, operations on unknown values produce symbolic expressions that can be analyzed for patterns.
threading_enabled: boolWhether to enable multi-threading support.
When enabled, the emulator can handle Thread.Start and related operations. Disable for deterministic single-threaded execution.
thread_quantum: usizeThread scheduling quantum in instructions.
Number of instructions to execute per thread before switching to the next ready thread.
max_threads: usizeMaximum number of concurrent threads.
Limits the number of threads that can be created during emulation to prevent resource exhaustion.
exception_handling: boolWhether to enable exception handling.
When enabled, try/catch/finally blocks are respected. Disable for simpler analysis that ignores exceptions.
allow_unwind: boolWhether to allow stack unwinding on unhandled exceptions.
When true, unhandled exceptions propagate up the call stack. When false, they immediately terminate emulation.
pointer_size: PointerSizeTarget pointer size for native int/uint types.
Derived from the PE header (PE32 → Bit32, PE32+ → Bit64).
Auto-detected by super::ProcessBuilder::build() when an assembly is loaded;
defaults to Bit64.
memory: MemoryConfigMemory subsystem configuration.
Controls heap size, stack size, and memory tracking options.
stubs: StubConfigMethod stub configuration.
Controls which categories of stubs are enabled and strict mode.
tracing: TracingConfigLogging and tracing configuration.
Controls what events are logged during emulation.
Implementations§
§impl EmulationConfig
Preset configurations for common use cases.
impl EmulationConfig
Preset configurations for common use cases.
pub fn extraction() -> Self
pub fn extraction() -> Self
Creates a configuration optimized for extracting packed/encrypted assemblies.
This preset is designed for unpacking scenarios where the goal is to run the unpacker/decryptor and capture the resulting assembly.
§Settings
- Instruction limit: 50 million (high to allow complex unpacking)
- Unknown methods: Return default values (unpacker may call irrelevant BCL methods)
- Threading: Enabled (some unpackers use threads)
- Exceptions: Enabled (unpackers may use try/catch)
- Strict mode: Disabled (tolerate missing stubs)
§Example
use dotscope::emulation::{EmulationConfig, ProcessBuilder};
use dotscope::CilObject;
let config = EmulationConfig::extraction();
let process = ProcessBuilder::new()
.assembly(packed_assembly)
.config(config)
.capture_assemblies()
.build()?;pub fn analysis() -> Self
pub fn analysis() -> Self
Creates a configuration optimized for static analysis and constant propagation.
This preset is designed for analyzing code behavior without full execution, tracking symbolic values to understand data flow.
§Settings
- Instruction limit: 1 million (moderate for analysis)
- Unknown methods: Return symbolic values (track data flow)
- Symbolic tracking: Enabled
- Threading: Disabled (for determinism)
- Exceptions: Disabled (simplify control flow)
§Example
use dotscope::emulation::EmulationConfig;
let config = EmulationConfig::analysis();
// Use for constant propagation, dead code detection, etc.pub fn full() -> Self
pub fn full() -> Self
Creates a configuration for complete emulation with all features enabled.
This preset provides the most accurate emulation at the cost of requiring stubs for all called methods.
§Settings
- Instruction limit: 100 million (very high for complex programs)
- Timeout: 5 minutes
- Unknown methods: Fail (strict - all methods must have stubs)
- Threading: Enabled
- Exceptions: Enabled
- Strict mode: Enabled
§Warning
This mode will fail if any called method lacks a stub. Only use when you have comprehensive stub coverage.
pub fn minimal() -> Self
pub fn minimal() -> Self
Creates a minimal configuration for simple constant folding.
This preset is designed for lightweight analysis scenarios like evaluating simple expressions or folding constants.
§Settings
- Instruction limit: 10,000 (very low)
- Call depth: 10 (shallow)
- Unknown methods: Skip (ignore irrelevant calls)
- Threading: Disabled
- Exceptions: Disabled
- Stubs: Only BCL enabled
§Example
use dotscope::emulation::EmulationConfig;
let config = EmulationConfig::minimal();
// Use for simple constant evaluationTrait Implementations§
§impl Clone for EmulationConfig
impl Clone for EmulationConfig
§fn clone(&self) -> EmulationConfig
fn clone(&self) -> EmulationConfig
1.0.0 · Source§fn clone_from(&mut self, source: &Self)
fn clone_from(&mut self, source: &Self)
source. Read more§impl Debug for EmulationConfig
impl Debug for EmulationConfig
§impl Default for EmulationConfig
impl Default for EmulationConfig
Auto Trait Implementations§
impl Freeze for EmulationConfig
impl RefUnwindSafe for EmulationConfig
impl Send for EmulationConfig
impl Sync for EmulationConfig
impl Unpin for EmulationConfig
impl UnwindSafe for EmulationConfig
Blanket Implementations§
Source§impl<T> BorrowMut<T> for Twhere
T: ?Sized,
impl<T> BorrowMut<T> for Twhere
T: ?Sized,
Source§fn borrow_mut(&mut self) -> &mut T
fn borrow_mut(&mut self) -> &mut T
Source§impl<T> CloneToUninit for Twhere
T: Clone,
impl<T> CloneToUninit for Twhere
T: Clone,
Source§impl<T> IntoEither for T
impl<T> IntoEither for T
Source§fn into_either(self, into_left: bool) -> Either<Self, Self>
fn into_either(self, into_left: bool) -> Either<Self, Self>
self into a Left variant of Either<Self, Self>
if into_left is true.
Converts self into a Right variant of Either<Self, Self>
otherwise. Read moreSource§fn into_either_with<F>(self, into_left: F) -> Either<Self, Self>
fn into_either_with<F>(self, into_left: F) -> Either<Self, Self>
self into a Left variant of Either<Self, Self>
if into_left(&self) returns true.
Converts self into a Right variant of Either<Self, Self>
otherwise. Read more