Fast Emulator For Shellcodes In Rust

I have developed a fast emulator for modern shellcodes, that perform huge loops of millions of instructions emulated for resolving API or for other stuff.

The emulator is in Rust and all the few dependencies as well, so the rust safety is good for emulating malware.  

There are shellcodes that can be emulated from the beginning to the end, but when this is not possible the tool has many features that can be used like a console, a memory tracing, register tracing, and so on.

https://github.com/sha0coder/scemu

In less than two seconds we have emulated 7 millions of instructions arriving to the recv. 

At this point we have some  IOC like  the ip:port where it's connecting and other details.

Lets see what happens after the recv() spawning a console at position: 7,012,204

target/release/scemu -f shellcodes/shikata.bin -vv -c 7012204

In the console, pressing "enter" several times to emulate  step into several steps and we arrive to a return instruction.

Let's see the stack in this moment:

The "ret" instruction is going to jump to the buffer read with recv() so is a kind of stager.

The option "-e" or "--endpoint" is not ready for now, but it will allow to proxy the calls to get the next  stage automatically, but for now we have the details to get the stage.

SCEMU also identify all the Linux  syscalls for 32bits shellcodes:

The encoder used in shellgen is also supported https://github.com/MarioVilas/shellgen

Let's check with cobalt-strike:

We can see where is connecting and which headers is using, so right now we can replicate the communications.

In verbose mode we could do several greps to see the calls and correlate with ghidra/ida/radare or  for example grep the branches to study the emulation flow.

target/release/scemu -f shellcodes/rshell_sgn.bin -vv | grep j

target/release/scemu -f shellcodes/rshell_sgn.bin -vv -c 44000 -l

The -l --loops options makes the emulation a bit slower but track the number of iterations.

Is possible to print all the registers in every step with  -r or --registers  but also is possible to track  specific register for example with --reg esi

target/release/scemu -f shellcodes/shikata.bin --reg esi 

In this case ESI register points to the API name, if we track EAX or ECX will see that are the counters of the loop. These shellcodes  contains a hard loop to locate the API names.

The flag -i or --inspect allow to monitor memory using expressions like "dword ptr [eax + 0xa]"

target/release/scemu -f shellcodes/shikata.bin -i 'dword ptr [esi]'

And more things to come...  find a demo below:

https://www.youtube.com/watch?v=qTYmMjW3DFs

Related posts

1. Hacking Tools Pc
2. Wifi Hacker Tools For Windows
3. Easy Hack Tools
4. Install Pentest Tools Ubuntu
5. Pentest Tools Find Subdomains
6. Hacker Tools 2019
7. Pentest Tools Bluekeep
8. New Hacker Tools
9. Hacking Tools Usb
10. Hacker Tools Software
11. Hack Tools Download
12. Pentest Tools Online
13. Hak5 Tools
14. Hack Tools
15. Hacking App
16. Hacking Tools Hardware
17. Hacking Tools For Kali Linux
18. Hack Tools Mac
19. Pentest Tools For Android
20. Free Pentest Tools For Windows
21. Hack Tools Github
22. Hacker Tools Apk Download
23. Computer Hacker
24. Hacking Tools Name
25. Hacking Tools And Software
26. Pentest Tools Open Source
27. Beginner Hacker Tools
28. Hacking Tools For Mac
29. Hacker Tools Free Download
30. Computer Hacker
31. Hack Apps
32. Hacker Tools Mac
33. Pentest Tools Github
34. Pentest Automation Tools
35. Hackrf Tools
36. Hak5 Tools
37. Hack Tools
38. Hacking Tools Software
39. Hack Tools 2019
40. Best Hacking Tools 2020
41. Pentest Recon Tools
42. Termux Hacking Tools 2019
43. Pentest Tools Framework
44. Tools Used For Hacking
45. Hacking Tools Mac
46. Hacker Security Tools
47. Hacking Tools Free Download
48. Tools Used For Hacking
49. How To Hack
50. Underground Hacker Sites
51. Github Hacking Tools
52. Hacker Tools Free
53. Hacking Tools Software
54. Hacking Tools And Software
55. Beginner Hacker Tools
56. Github Hacking Tools
57. Hacker Tools List
58. Nsa Hack Tools