Fast Emulator For Shellcodes In Rust

I have developed a fast emulator for modern shellcodes, that perform huge loops of millions of instructions emulated for resolving API or for other stuff.

The emulator is in Rust and all the few dependencies as well, so the rust safety is good for emulating malware.  

There are shellcodes that can be emulated from the beginning to the end, but when this is not possible the tool has many features that can be used like a console, a memory tracing, register tracing, and so on.

https://github.com/sha0coder/scemu

In less than two seconds we have emulated 7 millions of instructions arriving to the recv. 

At this point we have some  IOC like  the ip:port where it's connecting and other details.

Lets see what happens after the recv() spawning a console at position: 7,012,204

target/release/scemu -f shellcodes/shikata.bin -vv -c 7012204

In the console, pressing "enter" several times to emulate  step into several steps and we arrive to a return instruction.

Let's see the stack in this moment:

The "ret" instruction is going to jump to the buffer read with recv() so is a kind of stager.

The option "-e" or "--endpoint" is not ready for now, but it will allow to proxy the calls to get the next  stage automatically, but for now we have the details to get the stage.

SCEMU also identify all the Linux  syscalls for 32bits shellcodes:

The encoder used in shellgen is also supported https://github.com/MarioVilas/shellgen

Let's check with cobalt-strike:

We can see where is connecting and which headers is using, so right now we can replicate the communications.

In verbose mode we could do several greps to see the calls and correlate with ghidra/ida/radare or  for example grep the branches to study the emulation flow.

target/release/scemu -f shellcodes/rshell_sgn.bin -vv | grep j

target/release/scemu -f shellcodes/rshell_sgn.bin -vv -c 44000 -l

The -l --loops options makes the emulation a bit slower but track the number of iterations.

Is possible to print all the registers in every step with  -r or --registers  but also is possible to track  specific register for example with --reg esi

target/release/scemu -f shellcodes/shikata.bin --reg esi 

In this case ESI register points to the API name, if we track EAX or ECX will see that are the counters of the loop. These shellcodes  contains a hard loop to locate the API names.

The flag -i or --inspect allow to monitor memory using expressions like "dword ptr [eax + 0xa]"

target/release/scemu -f shellcodes/shikata.bin -i 'dword ptr [esi]'

And more things to come...  find a demo below:

https://www.youtube.com/watch?v=qTYmMjW3DFs

Related posts

1. Hacker Tools
2. Pentest Tools Online
3. Hacking App
4. Hack Tools 2019
5. Pentest Tools Open Source
6. Wifi Hacker Tools For Windows
7. Pentest Tools Apk
8. How To Make Hacking Tools
9. Hacker Tools Apk
10. Hacker Security Tools
11. Hacking Tools Name
12. Pentest Tools Free
13. What Are Hacking Tools
14. Pentest Tools Tcp Port Scanner
15. Pentest Tools Subdomain
16. Hacking Tools Windows 10
17. Hacking Tools For Windows 7
18. Hacker Tools Hardware
19. Physical Pentest Tools
20. Pentest Tools Download
21. Pentest Tools Nmap
22. Pentest Tools
23. How To Hack
24. Tools Used For Hacking
25. Hacking Tools Name
26. Black Hat Hacker Tools
27. Nsa Hack Tools
28. How To Hack
29. Pentest Tools Linux
30. Hack Tools Github
31. What Is Hacking Tools
32. Hacker Tools Online
33. Hacking Tools For Games
34. Hack Tools Github
35. Tools For Hacker
36. Pentest Tools Windows
37. Pentest Reporting Tools
38. New Hack Tools
39. Hacking Tools Hardware
40. Pentest Tools Github
41. Tools 4 Hack
42. Pentest Tools Alternative
43. Hacking Tools Hardware
44. Blackhat Hacker Tools
45. Pentest Tools Nmap
46. Hacker Tools For Mac
47. Easy Hack Tools
48. Physical Pentest Tools
49. Pentest Tools Kali Linux
50. Hacking Tools
51. Hacker Tools Free
52. Hacking Tools And Software
53. Pentest Tools Bluekeep
54. Tools 4 Hack
55. Nsa Hacker Tools
56. Pentest Tools Free
57. Pentest Tools Github
58. Github Hacking Tools
59. Tools 4 Hack
60. Hack Tools For Windows
61. Computer Hacker
62. Pentest Tools Alternative
63. Hacking Tools Pc
64. Best Hacking Tools 2019
65. Hacking Tools Mac
66. Hacking Tools Hardware
67. Black Hat Hacker Tools
68. Hacker Tools For Ios
69. Hacker Hardware Tools
70. Pentest Tools Download
71. Hacker Tools Hardware
72. Hacker Tool Kit
73. Pentest Tools Website
74. Tools For Hacker
75. Hack Tools For Pc
76. Hacker Tools Online
77. Pentest Tools
78. Hacking Tools Kit
79. Pentest Reporting Tools
80. Pentest Box Tools Download
81. How To Hack
82. Nsa Hack Tools
83. Pentest Tools For Android
84. Pentest Tools Website Vulnerability
85. Pentest Box Tools Download
86. Hacking Tools Windows 10
87. Hacker Tools List
88. Hackers Toolbox
89. Pentest Tools Website
90. Pentest Tools Android
91. Hack Tools Online