Fast Emulator For Shellcodes In Rust

I have developed a fast emulator for modern shellcodes, that perform huge loops of millions of instructions emulated for resolving API or for other stuff.

The emulator is in Rust and all the few dependencies as well, so the rust safety is good for emulating malware.  

There are shellcodes that can be emulated from the beginning to the end, but when this is not possible the tool has many features that can be used like a console, a memory tracing, register tracing, and so on.

https://github.com/sha0coder/scemu

In less than two seconds we have emulated 7 millions of instructions arriving to the recv. 

At this point we have some  IOC like  the ip:port where it's connecting and other details.

Lets see what happens after the recv() spawning a console at position: 7,012,204

target/release/scemu -f shellcodes/shikata.bin -vv -c 7012204

In the console, pressing "enter" several times to emulate  step into several steps and we arrive to a return instruction.

Let's see the stack in this moment:

The "ret" instruction is going to jump to the buffer read with recv() so is a kind of stager.

The option "-e" or "--endpoint" is not ready for now, but it will allow to proxy the calls to get the next  stage automatically, but for now we have the details to get the stage.

SCEMU also identify all the Linux  syscalls for 32bits shellcodes:

The encoder used in shellgen is also supported https://github.com/MarioVilas/shellgen

Let's check with cobalt-strike:

We can see where is connecting and which headers is using, so right now we can replicate the communications.

In verbose mode we could do several greps to see the calls and correlate with ghidra/ida/radare or  for example grep the branches to study the emulation flow.

target/release/scemu -f shellcodes/rshell_sgn.bin -vv | grep j

target/release/scemu -f shellcodes/rshell_sgn.bin -vv -c 44000 -l

The -l --loops options makes the emulation a bit slower but track the number of iterations.

Is possible to print all the registers in every step with  -r or --registers  but also is possible to track  specific register for example with --reg esi

target/release/scemu -f shellcodes/shikata.bin --reg esi 

In this case ESI register points to the API name, if we track EAX or ECX will see that are the counters of the loop. These shellcodes  contains a hard loop to locate the API names.

The flag -i or --inspect allow to monitor memory using expressions like "dword ptr [eax + 0xa]"

target/release/scemu -f shellcodes/shikata.bin -i 'dword ptr [esi]'

And more things to come...  find a demo below:

https://www.youtube.com/watch?v=qTYmMjW3DFs

Related articles

1. Tools For Hacker
2. Game Hacking
3. Nsa Hack Tools
4. Hacker Tools Software
5. Hacker Tools Hardware
6. Hacking Tools Mac
7. Pentest Tools List
8. Hacking Tools For Windows Free Download
9. Hacking Apps
10. Android Hack Tools Github
11. Best Hacking Tools 2019
12. Android Hack Tools Github
13. Hacker Tools Online
14. Hacker Tools
15. Growth Hacker Tools
16. Hacker Tools Windows
17. Hacking Tools Online
18. Hacker Tools For Windows
19. Hack Tools For Mac
20. Hackers Toolbox
21. Hack Tools
22. Hacker Tool Kit
23. Hacker Tools For Mac
24. Hacker Tools Online
25. Hacking Tools Free Download
26. How To Make Hacking Tools
27. Best Hacking Tools 2020
28. Hacker Tools Windows
29. Hacking Tools For Windows
30. Hacking Tools 2020
31. Hacking Tools Usb
32. Tools 4 Hack
33. Blackhat Hacker Tools
34. Tools Used For Hacking
35. Pentest Tools Nmap
36. Hacking Tools Download
37. Nsa Hack Tools
38. Tools 4 Hack
39. Hacker Tools Github
40. Hacker Security Tools
41. Hacking Tools Software
42. Pentest Tools Review
43. Pentest Reporting Tools
44. Hacking Tools Online
45. Hacker Tools For Windows
46. Hacking Tools And Software
47. Pentest Tools Framework
48. Computer Hacker
49. Hacker Tools 2019
50. Hacker Tools Linux
51. Hacking Tools For Games
52. Hacker Search Tools
53. Tools 4 Hack
54. Hacker Tools Free
55. Hacker
56. Hacker Hardware Tools
57. Hacking Tools Online
58. Easy Hack Tools
59. Pentest Tools
60. Tools For Hacker
61. Pentest Tools For Ubuntu
62. Hacking Tools For Pc
63. Pentest Tools Android
64. Hack Tools Pc
65. Pentest Automation Tools
66. Pentest Tools Tcp Port Scanner
67. Pentest Tools Kali Linux