Fast Emulator For Shellcodes In Rust

I have developed a fast emulator for modern shellcodes, that perform huge loops of millions of instructions emulated for resolving API or for other stuff.

The emulator is in Rust and all the few dependencies as well, so the rust safety is good for emulating malware.  

There are shellcodes that can be emulated from the beginning to the end, but when this is not possible the tool has many features that can be used like a console, a memory tracing, register tracing, and so on.

https://github.com/sha0coder/scemu

In less than two seconds we have emulated 7 millions of instructions arriving to the recv. 

At this point we have some  IOC like  the ip:port where it's connecting and other details.

Lets see what happens after the recv() spawning a console at position: 7,012,204

target/release/scemu -f shellcodes/shikata.bin -vv -c 7012204

In the console, pressing "enter" several times to emulate  step into several steps and we arrive to a return instruction.

Let's see the stack in this moment:

The "ret" instruction is going to jump to the buffer read with recv() so is a kind of stager.

The option "-e" or "--endpoint" is not ready for now, but it will allow to proxy the calls to get the next  stage automatically, but for now we have the details to get the stage.

SCEMU also identify all the Linux  syscalls for 32bits shellcodes:

The encoder used in shellgen is also supported https://github.com/MarioVilas/shellgen

Let's check with cobalt-strike:

We can see where is connecting and which headers is using, so right now we can replicate the communications.

In verbose mode we could do several greps to see the calls and correlate with ghidra/ida/radare or  for example grep the branches to study the emulation flow.

target/release/scemu -f shellcodes/rshell_sgn.bin -vv | grep j

target/release/scemu -f shellcodes/rshell_sgn.bin -vv -c 44000 -l

The -l --loops options makes the emulation a bit slower but track the number of iterations.

Is possible to print all the registers in every step with  -r or --registers  but also is possible to track  specific register for example with --reg esi

target/release/scemu -f shellcodes/shikata.bin --reg esi 

In this case ESI register points to the API name, if we track EAX or ECX will see that are the counters of the loop. These shellcodes  contains a hard loop to locate the API names.

The flag -i or --inspect allow to monitor memory using expressions like "dword ptr [eax + 0xa]"

target/release/scemu -f shellcodes/shikata.bin -i 'dword ptr [esi]'

And more things to come...  find a demo below:

https://www.youtube.com/watch?v=qTYmMjW3DFs

Continue reading

1. Black Hat Hacker Tools
2. Underground Hacker Sites
3. Tools 4 Hack
4. Hacker Tool Kit
5. Hacker Tools For Pc
6. Hacking Tools And Software
7. Hack Tools Online
8. Bluetooth Hacking Tools Kali
9. Hacking Tools Hardware
10. Hack Tools Mac
11. Hackrf Tools
12. What Is Hacking Tools
13. Hack Tools Pc
14. Hacking Tools Windows
15. Tools Used For Hacking
16. Hack Tools Online
17. Pentest Tools For Mac
18. What Are Hacking Tools
19. Hackrf Tools
20. Hacking Tools 2020
21. Hacker Tools Online
22. Android Hack Tools Github
23. What Are Hacking Tools
24. Hacker Tools For Mac
25. Pentest Tools For Mac
26. Pentest Tools Free
27. Hacker Tools Github
28. Hacking Tools For Pc
29. Hack Tools Github
30. What Are Hacking Tools
31. Wifi Hacker Tools For Windows
32. Hacking Tools Usb
33. Hack Tool Apk
34. Hacking Tools Software
35. Hack Tools
36. Hacking Tools 2019
37. Blackhat Hacker Tools
38. Hacking Tools Download
39. Pentest Automation Tools
40. Hack Tools Download
41. Hacking Tools
42. New Hacker Tools
43. Hacking Tools Github
44. Hacking Tools Hardware
45. Usb Pentest Tools
46. Pentest Tools Nmap
47. Hacking Tools Free Download
48. Pentest Tools Port Scanner
49. Hacker Hardware Tools
50. Hacker Tools Online
51. Hak5 Tools
52. Pentest Tools Review
53. Hack Tools Online
54. Hacks And Tools
55. Hak5 Tools
56. Hacker Techniques Tools And Incident Handling
57. Pentest Tools Nmap
58. Hacking Tools And Software
59. Hackrf Tools
60. Hacking Tools
61. Pentest Tools Free
62. Hack Apps
63. Hacking Tools Hardware
64. Hacking Tools Pc
65. Hacking Tools For Beginners
66. Hacking Apps
67. Hacker Tools 2020
68. Hacking Tools 2019
69. Pentest Tools Find Subdomains
70. How To Hack
71. Hacking Tools And Software
72. Pentest Recon Tools
73. Hacking Tools 2019
74. Hacker Tools Free
75. Hacker Tools Online
76. Pentest Tools Bluekeep
77. Hackrf Tools
78. Hack Rom Tools
79. Hacking Tools Kit
80. Computer Hacker
81. Hacking Tools Pc
82. Hack And Tools
83. Hacking Tools Hardware
84. Hacker Hardware Tools
85. Pentest Tools Website Vulnerability
86. Pentest Tools Apk
87. Pentest Recon Tools
88. Hack Tools For Games
89. Hacking Tools
90. Pentest Tools Github
91. Pentest Box Tools Download