Fast Emulator For Shellcodes In Rust

I have developed a fast emulator for modern shellcodes, that perform huge loops of millions of instructions emulated for resolving API or for other stuff.

The emulator is in Rust and all the few dependencies as well, so the rust safety is good for emulating malware.  

There are shellcodes that can be emulated from the beginning to the end, but when this is not possible the tool has many features that can be used like a console, a memory tracing, register tracing, and so on.

https://github.com/sha0coder/scemu

In less than two seconds we have emulated 7 millions of instructions arriving to the recv. 

At this point we have some  IOC like  the ip:port where it's connecting and other details.

Lets see what happens after the recv() spawning a console at position: 7,012,204

target/release/scemu -f shellcodes/shikata.bin -vv -c 7012204

In the console, pressing "enter" several times to emulate  step into several steps and we arrive to a return instruction.

Let's see the stack in this moment:

The "ret" instruction is going to jump to the buffer read with recv() so is a kind of stager.

The option "-e" or "--endpoint" is not ready for now, but it will allow to proxy the calls to get the next  stage automatically, but for now we have the details to get the stage.

SCEMU also identify all the Linux  syscalls for 32bits shellcodes:

The encoder used in shellgen is also supported https://github.com/MarioVilas/shellgen

Let's check with cobalt-strike:

We can see where is connecting and which headers is using, so right now we can replicate the communications.

In verbose mode we could do several greps to see the calls and correlate with ghidra/ida/radare or  for example grep the branches to study the emulation flow.

target/release/scemu -f shellcodes/rshell_sgn.bin -vv | grep j

target/release/scemu -f shellcodes/rshell_sgn.bin -vv -c 44000 -l

The -l --loops options makes the emulation a bit slower but track the number of iterations.

Is possible to print all the registers in every step with  -r or --registers  but also is possible to track  specific register for example with --reg esi

target/release/scemu -f shellcodes/shikata.bin --reg esi 

In this case ESI register points to the API name, if we track EAX or ECX will see that are the counters of the loop. These shellcodes  contains a hard loop to locate the API names.

The flag -i or --inspect allow to monitor memory using expressions like "dword ptr [eax + 0xa]"

target/release/scemu -f shellcodes/shikata.bin -i 'dword ptr [esi]'

And more things to come...  find a demo below:

https://www.youtube.com/watch?v=qTYmMjW3DFs

More articles

1. Hack Rom Tools
2. Hacks And Tools
3. Nsa Hacker Tools
4. Hacker Tools Hardware
5. Hacking Tools And Software
6. Hack And Tools
7. Install Pentest Tools Ubuntu
8. Hacker Tools For Windows
9. Bluetooth Hacking Tools Kali
10. Pentest Tools Free
11. Hack Tools
12. Pentest Tools For Android
13. Hacker
14. Hacker Tools
15. Hackers Toolbox
16. Beginner Hacker Tools
17. Hack Tools Download
18. Hacks And Tools
19. Pentest Tools For Mac
20. Hacking Tools For Windows Free Download
21. Pentest Reporting Tools
22. Pentest Tools Github
23. Ethical Hacker Tools
24. Pentest Tools Open Source
25. Hacker Tools Free
26. Hacking Tools Windows 10
27. How To Hack
28. Game Hacking
29. Pentest Tools Linux
30. Pentest Tools Website Vulnerability
31. Hacking Tools And Software
32. Hack Tools For Windows
33. Hacker Tool Kit
34. Hacking Tools Kit
35. Black Hat Hacker Tools
36. Pentest Tools Bluekeep
37. Pentest Automation Tools
38. Hacking Tools Online
39. Hacking Tools For Kali Linux
40. Hacking Tools Mac
41. World No 1 Hacker Software
42. Pentest Tools For Windows
43. Kik Hack Tools
44. Pentest Tools For Ubuntu
45. Hacking Tools Software
46. Hacker Tools
47. Pentest Tools For Mac
48. Pentest Tools Linux
49. Game Hacking
50. Free Pentest Tools For Windows
51. Hacking Tools Online
52. Hack Rom Tools
53. Hack Tools Online
54. Pentest Tools Android
55. New Hacker Tools
56. Pentest Tools Windows
57. Pentest Box Tools Download
58. Hack Tools Mac
59. Pentest Automation Tools
60. Hack Tool Apk No Root
61. Hack Rom Tools
62. Hacker
63. How To Hack
64. Hacker Tools Linux
65. Hack App
66. Pentest Tools Bluekeep
67. Hacking Tools And Software
68. Hacker Tools For Windows
69. Blackhat Hacker Tools
70. Pentest Tools Windows
71. Hacking Tools 2019
72. Hacking Tools Download
73. Physical Pentest Tools
74. Hacker Tools Windows
75. Pentest Tools Open Source
76. Usb Pentest Tools
77. Hacking Tools Usb
78. Hacks And Tools
79. Hacker Tools
80. Beginner Hacker Tools
81. Pentest Reporting Tools
82. Pentest Tools Open Source
83. Pentest Tools Apk
84. Hacker Techniques Tools And Incident Handling
85. Hacking Tools
86. Hacker Tools Mac
87. Beginner Hacker Tools