Advertising

SponsoredTweets referral badge

Fast Emulator For Shellcodes In Rust

I have developed a fast emulator for modern shellcodes, that perform huge loops of millions of instructions emulated for resolving API or for other stuff.

The emulator is in Rust and all the few dependencies as well, so the rust safety is good for emulating malware.  

There are shellcodes that can be emulated from the beginning to the end, but when this is not possible the tool has many features that can be used like a console, a memory tracing, register tracing, and so on.

https://github.com/sha0coder/scemu



In less than two seconds we have emulated 7 millions of instructions arriving to the recv. 

At this point we have some  IOC like  the ip:port where it's connecting and other details.

Lets see what happens after the recv() spawning a console at position: 7,012,204


target/release/scemu -f shellcodes/shikata.bin -vv -c 7012204



In the console, pressing "enter" several times to emulate  step into several steps and we arrive to a return instruction.


Let's see the stack in this moment:


The "ret" instruction is going to jump to the buffer read with recv() so is a kind of stager.

The option "-e" or "--endpoint" is not ready for now, but it will allow to proxy the calls to get the next  stage automatically, but for now we have the details to get the stage.


SCEMU also identify all the Linux  syscalls for 32bits shellcodes:



The encoder used in shellgen is also supported https://github.com/MarioVilas/shellgen

Let's check with cobalt-strike:


We can see where is connecting and which headers is using, so right now we can replicate the communications.



In verbose mode we could do several greps to see the calls and correlate with ghidra/ida/radare or  for example grep the branches to study the emulation flow.


target/release/scemu -f shellcodes/rshell_sgn.bin -vv | grep j


target/release/scemu -f shellcodes/rshell_sgn.bin -vv -c 44000 -l


The -l --loops options makes the emulation a bit slower but track the number of iterations.

Is possible to print all the registers in every step with  -r or --registers  but also is possible to track  specific register for example with --reg esi


target/release/scemu -f shellcodes/shikata.bin --reg esi 


In this case ESI register points to the API name, if we track EAX or ECX will see that are the counters of the loop. These shellcodes  contains a hard loop to locate the API names.

The flag -i or --inspect allow to monitor memory using expressions like "dword ptr [eax + 0xa]"

target/release/scemu -f shellcodes/shikata.bin -i 'dword ptr [esi]'

And more things to come...  find a demo below:

https://www.youtube.com/watch?v=qTYmMjW3DFs





Related word


  1. Hacker Tools Mac
  2. Hacking Tools Pc
  3. Pentest Tools Download
  4. Hacking Tools Pc
  5. Computer Hacker
  6. Hacker Hardware Tools
  7. Hack Website Online Tool
  8. Pentest Recon Tools
  9. New Hacker Tools
  10. Pentest Tools Windows
  11. Underground Hacker Sites
  12. Hacker Tools Software
  13. How To Make Hacking Tools
  14. Pentest Tools Open Source
  15. Usb Pentest Tools
  16. Hacker Tools Free
  17. Hacker Tools For Pc
  18. Hacker Techniques Tools And Incident Handling
  19. Pentest Tools Url Fuzzer
  20. Hacking Tools Windows 10
  21. Hacking Tools Software
  22. Hacker Tools For Ios
  23. Free Pentest Tools For Windows
  24. Hacking Tools For Windows Free Download
  25. Pentest Tools Bluekeep
  26. Tools For Hacker
  27. Hacking App
  28. Install Pentest Tools Ubuntu
  29. Pentest Automation Tools
  30. Hacker Tools For Pc
  31. Hacking Tools Windows
  32. Hack Tools Mac
  33. Hacking Apps
  34. How To Hack
  35. Hacker Tools Apk
  36. Ethical Hacker Tools
  37. Pentest Tools
  38. Hacker Search Tools
  39. Hacking Tools Name
  40. Easy Hack Tools
  41. Hacking Tools Mac
  42. Pentest Tools Find Subdomains
  43. Tools 4 Hack
  44. Hacker Tools Windows
  45. Tools 4 Hack
  46. Hacking Tools Name
  47. Install Pentest Tools Ubuntu
  48. How To Hack
  49. Kik Hack Tools
  50. Hack Website Online Tool
  51. Hacker Tools List
  52. Hacker Tools Free
  53. Hacker Tools Mac
  54. Hack Tool Apk No Root
  55. Hack Tools For Ubuntu
  56. Easy Hack Tools
  57. Hacker Tools Github
  58. Hack Tools For Mac
  59. Hacker Hardware Tools
  60. Hack Tools Mac
  61. Pentest Tools Website
  62. Hacking Tools And Software
  63. Hacking App
  64. Pentest Tools
  65. Hack Tools 2019
  66. Computer Hacker
  67. Hacking Tools For Windows Free Download
  68. Nsa Hack Tools
  69. Pentest Tools Alternative
  70. Underground Hacker Sites
  71. Pentest Tools Free
  72. Termux Hacking Tools 2019
  73. Hacking Tools
  74. Pentest Tools For Windows
  75. Hacker Tools

Freelancer