Fast Emulator For Shellcodes In Rust

I have developed a fast emulator for modern shellcodes, that perform huge loops of millions of instructions emulated for resolving API or for other stuff.

The emulator is in Rust and all the few dependencies as well, so the rust safety is good for emulating malware.  

There are shellcodes that can be emulated from the beginning to the end, but when this is not possible the tool has many features that can be used like a console, a memory tracing, register tracing, and so on.

https://github.com/sha0coder/scemu

In less than two seconds we have emulated 7 millions of instructions arriving to the recv. 

At this point we have some  IOC like  the ip:port where it's connecting and other details.

Lets see what happens after the recv() spawning a console at position: 7,012,204

target/release/scemu -f shellcodes/shikata.bin -vv -c 7012204

In the console, pressing "enter" several times to emulate  step into several steps and we arrive to a return instruction.

Let's see the stack in this moment:

The "ret" instruction is going to jump to the buffer read with recv() so is a kind of stager.

The option "-e" or "--endpoint" is not ready for now, but it will allow to proxy the calls to get the next  stage automatically, but for now we have the details to get the stage.

SCEMU also identify all the Linux  syscalls for 32bits shellcodes:

The encoder used in shellgen is also supported https://github.com/MarioVilas/shellgen

Let's check with cobalt-strike:

We can see where is connecting and which headers is using, so right now we can replicate the communications.

In verbose mode we could do several greps to see the calls and correlate with ghidra/ida/radare or  for example grep the branches to study the emulation flow.

target/release/scemu -f shellcodes/rshell_sgn.bin -vv | grep j

target/release/scemu -f shellcodes/rshell_sgn.bin -vv -c 44000 -l

The -l --loops options makes the emulation a bit slower but track the number of iterations.

Is possible to print all the registers in every step with  -r or --registers  but also is possible to track  specific register for example with --reg esi

target/release/scemu -f shellcodes/shikata.bin --reg esi 

In this case ESI register points to the API name, if we track EAX or ECX will see that are the counters of the loop. These shellcodes  contains a hard loop to locate the API names.

The flag -i or --inspect allow to monitor memory using expressions like "dword ptr [eax + 0xa]"

target/release/scemu -f shellcodes/shikata.bin -i 'dword ptr [esi]'

And more things to come...  find a demo below:

https://www.youtube.com/watch?v=qTYmMjW3DFs

Continue reading

1. Wifi Hacker Tools For Windows
2. Hack Tools Github
3. Hacking Tools Windows
4. Growth Hacker Tools
5. Bluetooth Hacking Tools Kali
6. Pentest Tools Port Scanner
7. Hack And Tools
8. Pentest Tools For Windows
9. Hack App
10. Hack Tools For Mac
11. Best Hacking Tools 2020
12. Ethical Hacker Tools
13. Pentest Tools Alternative
14. Hak5 Tools
15. Pentest Tools Nmap
16. Pentest Tools Bluekeep
17. Hack Tools
18. Pentest Tools Review
19. Hack Tools
20. Pentest Tools List
21. Hacker Tools
22. Hacker Tools Windows
23. Underground Hacker Sites
24. Hacking Tools Usb
25. Hacker Tools Free
26. Game Hacking
27. Hacking Tools For Mac
28. Hack Tools For Games
29. Pentest Tools Tcp Port Scanner
30. Pentest Recon Tools
31. Hacking Tools For Beginners
32. Pentest Box Tools Download
33. Hack Tools For Windows
34. Hacking Tools 2020
35. Hacker Techniques Tools And Incident Handling
36. Hacking Tools And Software
37. Computer Hacker
38. Hacking Tools For Windows
39. Hacking Tools Hardware
40. Hacks And Tools
41. Pentest Tools Download
42. Hacking Tools For Kali Linux
43. Pentest Tools Alternative
44. Hack Tools For Windows
45. Pentest Automation Tools
46. Hacker Tools Linux
47. Hacking Tools For Mac
48. Hack Tools For Pc
49. Hacker Tools Free Download
50. Hacker Tools
51. Pentest Tools Tcp Port Scanner
52. Hacker Tools 2019
53. Hacker Tools For Ios
54. Hack Tool Apk
55. Hacks And Tools
56. Hacking Tools 2020
57. Pentest Tools Website Vulnerability
58. Hacking Tools For Mac
59. Pentest Tools Bluekeep
60. Pentest Tools Open Source
61. Easy Hack Tools
62. Hacker Tool Kit
63. Hacking Tools For Windows
64. Hack Tools For Ubuntu
65. Hacker Tools For Mac
66. Usb Pentest Tools
67. Hack Website Online Tool
68. Growth Hacker Tools
69. Wifi Hacker Tools For Windows
70. Hacking Tools For Kali Linux
71. Hack Tools For Windows
72. Pentest Tools Framework
73. Github Hacking Tools
74. Pentest Tools Windows
75. Hack Tools For Mac
76. Pentest Tools Android
77. Hack Tools Pc
78. Hacker Search Tools
79. Hacking Tools Free Download
80. Hacking Tools 2020
81. Pentest Tools Nmap
82. Hack Tools
83. Growth Hacker Tools
84. Hack Tool Apk No Root
85. Hack And Tools
86. Tools 4 Hack
87. Hack Tools Download
88. Growth Hacker Tools
89. Hack Tool Apk No Root
90. Hack Tools 2019
91. Pentest Tools Framework
92. Hacker Tools Apk Download
93. Hacker Tools For Pc
94. Hacker Tools Online