Fast Emulator For Shellcodes In Rust

I have developed a fast emulator for modern shellcodes, that perform huge loops of millions of instructions emulated for resolving API or for other stuff.

The emulator is in Rust and all the few dependencies as well, so the rust safety is good for emulating malware.  

There are shellcodes that can be emulated from the beginning to the end, but when this is not possible the tool has many features that can be used like a console, a memory tracing, register tracing, and so on.

https://github.com/sha0coder/scemu

In less than two seconds we have emulated 7 millions of instructions arriving to the recv. 

At this point we have some  IOC like  the ip:port where it's connecting and other details.

Lets see what happens after the recv() spawning a console at position: 7,012,204

target/release/scemu -f shellcodes/shikata.bin -vv -c 7012204

In the console, pressing "enter" several times to emulate  step into several steps and we arrive to a return instruction.

Let's see the stack in this moment:

The "ret" instruction is going to jump to the buffer read with recv() so is a kind of stager.

The option "-e" or "--endpoint" is not ready for now, but it will allow to proxy the calls to get the next  stage automatically, but for now we have the details to get the stage.

SCEMU also identify all the Linux  syscalls for 32bits shellcodes:

The encoder used in shellgen is also supported https://github.com/MarioVilas/shellgen

Let's check with cobalt-strike:

We can see where is connecting and which headers is using, so right now we can replicate the communications.

In verbose mode we could do several greps to see the calls and correlate with ghidra/ida/radare or  for example grep the branches to study the emulation flow.

target/release/scemu -f shellcodes/rshell_sgn.bin -vv | grep j

target/release/scemu -f shellcodes/rshell_sgn.bin -vv -c 44000 -l

The -l --loops options makes the emulation a bit slower but track the number of iterations.

Is possible to print all the registers in every step with  -r or --registers  but also is possible to track  specific register for example with --reg esi

target/release/scemu -f shellcodes/shikata.bin --reg esi 

In this case ESI register points to the API name, if we track EAX or ECX will see that are the counters of the loop. These shellcodes  contains a hard loop to locate the API names.

The flag -i or --inspect allow to monitor memory using expressions like "dword ptr [eax + 0xa]"

target/release/scemu -f shellcodes/shikata.bin -i 'dword ptr [esi]'

And more things to come...  find a demo below:

https://www.youtube.com/watch?v=qTYmMjW3DFs

More articles

1. Hacking Tools For Games
2. Best Pentesting Tools 2018
3. Pentest Tools Nmap
4. Black Hat Hacker Tools
5. Hacker
6. Hack Tools
7. Hack Tools 2019
8. Hacker Tools Free
9. Top Pentest Tools
10. Pentest Tools Alternative
11. Hacker Tools 2020
12. Nsa Hack Tools
13. Hacker Tools Linux
14. Hacking Tools Github
15. Easy Hack Tools
16. Hacking Tools Software
17. Hacker Tools 2019
18. What Is Hacking Tools
19. What Are Hacking Tools
20. Pentest Tools Subdomain
21. Usb Pentest Tools
22. Hak5 Tools
23. Pentest Tools Linux
24. How To Make Hacking Tools
25. Hacking Tools Windows
26. Best Hacking Tools 2019
27. Hacker Tools Windows
28. Pentest Tools Website Vulnerability
29. Hacking Tools For Windows
30. Hack Tools For Pc
31. Hacker Tools For Windows
32. Hack Apps
33. How To Install Pentest Tools In Ubuntu
34. Hacking Tools For Beginners
35. Hack Tools For Mac
36. Growth Hacker Tools
37. Hacking Tools
38. Pentest Tools Find Subdomains
39. Hacking Tools
40. Hacker Tools Github
41. Hack Tools Online
42. Pentest Tools Url Fuzzer
43. Hack Tools 2019
44. Hacking Tools For Pc
45. Pentest Tools For Windows
46. Termux Hacking Tools 2019
47. Hack Tools For Mac
48. Hack Tool Apk No Root
49. Pentest Tools Nmap
50. Tools Used For Hacking
51. Hack Tools Mac
52. Hacker Tools Free Download
53. Hack Tool Apk
54. Hackers Toolbox
55. Pentest Reporting Tools
56. Pentest Tools Download
57. Hacker Tools
58. Computer Hacker
59. Hacker Tools Windows
60. Pentest Tools For Mac
61. Best Pentesting Tools 2018
62. Hacker Techniques Tools And Incident Handling
63. Hack Tools 2019
64. Tools For Hacker
65. What Is Hacking Tools
66. Pentest Tools Online
67. Hacker Tools For Pc
68. Hacking Tools Mac
69. Computer Hacker
70. Pentest Tools Bluekeep
71. Hacking Apps
72. Hack Tools Online
73. Hacker Security Tools
74. Hack Tools For Games
75. Hacker Tools For Pc
76. Pentest Reporting Tools
77. Hacker Tools Hardware
78. Hacking Tools Online
79. Pentest Tools Android
80. Hack Apps
81. Hack Tools For Mac
82. Hacking Tools Free Download
83. Nsa Hack Tools Download
84. Pentest Tools
85. Hacker Tools Apk Download
86. Pentest Tools Online
87. Hacker
88. World No 1 Hacker Software
89. Hacking Tools For Games
90. Pentest Tools Github
91. Hack Tool Apk No Root
92. Hacking Tools Github
93. Kik Hack Tools
94. Hack Tools For Pc
95. Pentest Tools Alternative
96. Hack Tools Download
97. Game Hacking