Fast Emulator For Shellcodes In Rust

I have developed a fast emulator for modern shellcodes, that perform huge loops of millions of instructions emulated for resolving API or for other stuff.

The emulator is in Rust and all the few dependencies as well, so the rust safety is good for emulating malware.  

There are shellcodes that can be emulated from the beginning to the end, but when this is not possible the tool has many features that can be used like a console, a memory tracing, register tracing, and so on.

https://github.com/sha0coder/scemu

In less than two seconds we have emulated 7 millions of instructions arriving to the recv. 

At this point we have some  IOC like  the ip:port where it's connecting and other details.

Lets see what happens after the recv() spawning a console at position: 7,012,204

target/release/scemu -f shellcodes/shikata.bin -vv -c 7012204

In the console, pressing "enter" several times to emulate  step into several steps and we arrive to a return instruction.

Let's see the stack in this moment:

The "ret" instruction is going to jump to the buffer read with recv() so is a kind of stager.

The option "-e" or "--endpoint" is not ready for now, but it will allow to proxy the calls to get the next  stage automatically, but for now we have the details to get the stage.

SCEMU also identify all the Linux  syscalls for 32bits shellcodes:

The encoder used in shellgen is also supported https://github.com/MarioVilas/shellgen

Let's check with cobalt-strike:

We can see where is connecting and which headers is using, so right now we can replicate the communications.

In verbose mode we could do several greps to see the calls and correlate with ghidra/ida/radare or  for example grep the branches to study the emulation flow.

target/release/scemu -f shellcodes/rshell_sgn.bin -vv | grep j

target/release/scemu -f shellcodes/rshell_sgn.bin -vv -c 44000 -l

The -l --loops options makes the emulation a bit slower but track the number of iterations.

Is possible to print all the registers in every step with  -r or --registers  but also is possible to track  specific register for example with --reg esi

target/release/scemu -f shellcodes/shikata.bin --reg esi 

In this case ESI register points to the API name, if we track EAX or ECX will see that are the counters of the loop. These shellcodes  contains a hard loop to locate the API names.

The flag -i or --inspect allow to monitor memory using expressions like "dword ptr [eax + 0xa]"

target/release/scemu -f shellcodes/shikata.bin -i 'dword ptr [esi]'

And more things to come...  find a demo below:

https://www.youtube.com/watch?v=qTYmMjW3DFs

Read more

1. Hacker Tools For Mac
2. How To Hack
3. Hak5 Tools
4. Hacking Tools
5. Tools For Hacker
6. Wifi Hacker Tools For Windows
7. Hacking Tools Software
8. Hacker Tools For Mac
9. Hacking Tools Online
10. Hacker
11. Hacker Tools Github
12. Hack Tools For Mac
13. Pentest Tools Website
14. Hack Tools For Windows
15. Hacking Tools 2020
16. World No 1 Hacker Software
17. Hacking Tools
18. Hacking Tools Mac
19. Hacking Tools Windows 10
20. Hacking Tools Name
21. Pentest Reporting Tools
22. Pentest Tools Bluekeep
23. Hacker Tools For Windows
24. Best Pentesting Tools 2018
25. Hack Apps
26. Hacking Tools Mac
27. Hack And Tools
28. Pentest Tools Nmap
29. Hacker Search Tools
30. Hacking Tools For Windows Free Download
31. Android Hack Tools Github
32. Hacks And Tools
33. Tools Used For Hacking
34. Pentest Box Tools Download
35. Best Hacking Tools 2019
36. Nsa Hack Tools Download
37. Blackhat Hacker Tools
38. Hacking Tools For Windows 7
39. Pentest Tools For Windows
40. Termux Hacking Tools 2019
41. Hack Tools For Pc
42. Hackers Toolbox
43. Hacker Security Tools
44. Hacker Tool Kit
45. Hack Apps
46. Hacking Tools Hardware
47. Hackrf Tools
48. Hacking Tools For Pc
49. Beginner Hacker Tools
50. Hacker Tools For Mac
51. Github Hacking Tools
52. Pentest Tools Android
53. Pentest Tools For Windows
54. Hacker Search Tools
55. Hack Tools For Mac
56. Hacking Tools Usb
57. Hack Website Online Tool