Fast Emulator For Shellcodes In Rust

I have developed a fast emulator for modern shellcodes, that perform huge loops of millions of instructions emulated for resolving API or for other stuff.

The emulator is in Rust and all the few dependencies as well, so the rust safety is good for emulating malware.  

There are shellcodes that can be emulated from the beginning to the end, but when this is not possible the tool has many features that can be used like a console, a memory tracing, register tracing, and so on.

https://github.com/sha0coder/scemu

In less than two seconds we have emulated 7 millions of instructions arriving to the recv. 

At this point we have some  IOC like  the ip:port where it's connecting and other details.

Lets see what happens after the recv() spawning a console at position: 7,012,204

target/release/scemu -f shellcodes/shikata.bin -vv -c 7012204

In the console, pressing "enter" several times to emulate  step into several steps and we arrive to a return instruction.

Let's see the stack in this moment:

The "ret" instruction is going to jump to the buffer read with recv() so is a kind of stager.

The option "-e" or "--endpoint" is not ready for now, but it will allow to proxy the calls to get the next  stage automatically, but for now we have the details to get the stage.

SCEMU also identify all the Linux  syscalls for 32bits shellcodes:

The encoder used in shellgen is also supported https://github.com/MarioVilas/shellgen

Let's check with cobalt-strike:

We can see where is connecting and which headers is using, so right now we can replicate the communications.

In verbose mode we could do several greps to see the calls and correlate with ghidra/ida/radare or  for example grep the branches to study the emulation flow.

target/release/scemu -f shellcodes/rshell_sgn.bin -vv | grep j

target/release/scemu -f shellcodes/rshell_sgn.bin -vv -c 44000 -l

The -l --loops options makes the emulation a bit slower but track the number of iterations.

Is possible to print all the registers in every step with  -r or --registers  but also is possible to track  specific register for example with --reg esi

target/release/scemu -f shellcodes/shikata.bin --reg esi 

In this case ESI register points to the API name, if we track EAX or ECX will see that are the counters of the loop. These shellcodes  contains a hard loop to locate the API names.

The flag -i or --inspect allow to monitor memory using expressions like "dword ptr [eax + 0xa]"

target/release/scemu -f shellcodes/shikata.bin -i 'dword ptr [esi]'

And more things to come...  find a demo below:

https://www.youtube.com/watch?v=qTYmMjW3DFs

Related articles

1. Hacking Tools Software
2. Easy Hack Tools
3. Hack Website Online Tool
4. Hacker Tool Kit
5. Hack Tools For Pc
6. Pentest Tools Subdomain
7. Hack Website Online Tool
8. Pentest Tools Framework
9. Top Pentest Tools
10. Hacking Tools Name
11. Tools Used For Hacking
12. Pentest Tools Bluekeep
13. Hacking Tools Github
14. Hacker Tools
15. Hacking Tools For Games
16. Hacking Tools Name
17. Physical Pentest Tools
18. Hack Website Online Tool
19. Pentest Box Tools Download
20. Black Hat Hacker Tools
21. Hack Tool Apk No Root
22. Hack Tools For Games
23. Wifi Hacker Tools For Windows
24. Hacker Tools Software
25. How To Hack
26. Pentest Tools For Ubuntu
27. Hacking Tools For Beginners
28. Pentest Tools
29. Pentest Tools Find Subdomains
30. Hacker Tools For Pc
31. Pentest Tools Download
32. Usb Pentest Tools
33. Pentest Tools Online
34. Hacker Tools 2019
35. Hack Tools For Pc
36. Hacker Tools For Ios
37. Pentest Tools Nmap
38. Pentest Tools For Android
39. Hack App
40. Hacking App
41. Pentest Tools For Android
42. Pentest Box Tools Download
43. Hacker Tools For Pc
44. How To Install Pentest Tools In Ubuntu
45. Hacks And Tools
46. Pentest Tools
47. What Are Hacking Tools
48. Pentest Tools Free
49. Pentest Tools Open Source
50. Hacking Tools For Games
51. Hacking Tools Free Download
52. Pentest Tools Url Fuzzer
53. Hacker Tools For Mac
54. Hacker Tools For Pc
55. Hacker
56. Hacking Tools For Kali Linux
57. Hacker Tools Free
58. Hacking Tools For Windows 7
59. How To Install Pentest Tools In Ubuntu
60. Growth Hacker Tools
61. Hack Tools
62. Nsa Hack Tools Download
63. Tools For Hacker
64. Pentest Tools Bluekeep
65. Pentest Tools For Windows
66. How To Make Hacking Tools
67. Hackers Toolbox
68. Hack Tool Apk
69. Hacker Tools 2020
70. Top Pentest Tools
71. Pentest Tools Windows
72. Hacker Tools For Ios
73. What Are Hacking Tools
74. Hacking Tools For Kali Linux
75. Best Hacking Tools 2020
76. Install Pentest Tools Ubuntu