Fast Emulator For Shellcodes In Rust

I have developed a fast emulator for modern shellcodes, that perform huge loops of millions of instructions emulated for resolving API or for other stuff.

The emulator is in Rust and all the few dependencies as well, so the rust safety is good for emulating malware.  

There are shellcodes that can be emulated from the beginning to the end, but when this is not possible the tool has many features that can be used like a console, a memory tracing, register tracing, and so on.

https://github.com/sha0coder/scemu

In less than two seconds we have emulated 7 millions of instructions arriving to the recv. 

At this point we have some  IOC like  the ip:port where it's connecting and other details.

Lets see what happens after the recv() spawning a console at position: 7,012,204

target/release/scemu -f shellcodes/shikata.bin -vv -c 7012204

In the console, pressing "enter" several times to emulate  step into several steps and we arrive to a return instruction.

Let's see the stack in this moment:

The "ret" instruction is going to jump to the buffer read with recv() so is a kind of stager.

The option "-e" or "--endpoint" is not ready for now, but it will allow to proxy the calls to get the next  stage automatically, but for now we have the details to get the stage.

SCEMU also identify all the Linux  syscalls for 32bits shellcodes:

The encoder used in shellgen is also supported https://github.com/MarioVilas/shellgen

Let's check with cobalt-strike:

We can see where is connecting and which headers is using, so right now we can replicate the communications.

In verbose mode we could do several greps to see the calls and correlate with ghidra/ida/radare or  for example grep the branches to study the emulation flow.

target/release/scemu -f shellcodes/rshell_sgn.bin -vv | grep j

target/release/scemu -f shellcodes/rshell_sgn.bin -vv -c 44000 -l

The -l --loops options makes the emulation a bit slower but track the number of iterations.

Is possible to print all the registers in every step with  -r or --registers  but also is possible to track  specific register for example with --reg esi

target/release/scemu -f shellcodes/shikata.bin --reg esi 

In this case ESI register points to the API name, if we track EAX or ECX will see that are the counters of the loop. These shellcodes  contains a hard loop to locate the API names.

The flag -i or --inspect allow to monitor memory using expressions like "dword ptr [eax + 0xa]"

target/release/scemu -f shellcodes/shikata.bin -i 'dword ptr [esi]'

And more things to come...  find a demo below:

https://www.youtube.com/watch?v=qTYmMjW3DFs

More articles

1. Hacking Tools Download
2. Pentest Tools Open Source
3. Hacking Tools Online
4. Game Hacking
5. Hack Apps
6. Hacker Tools For Mac
7. Pentest Tools Open Source
8. Pentest Tools Alternative
9. Pentest Tools Linux
10. Hacker Tools 2019
11. What Are Hacking Tools
12. Github Hacking Tools
13. Hack Tools For Ubuntu
14. Top Pentest Tools
15. Pentest Tools Framework
16. How To Make Hacking Tools
17. Bluetooth Hacking Tools Kali
18. Hack Tools Pc
19. Hacking Tools Usb
20. Hacking Tools Usb
21. What Are Hacking Tools
22. Pentest Tools Nmap
23. Pentest Tools For Ubuntu
24. Termux Hacking Tools 2019
25. Best Hacking Tools 2020
26. Pentest Tools Android
27. Pentest Tools List
28. Hacker Tools Free
29. Best Pentesting Tools 2018
30. Hacker Tools Free Download
31. Hacking Tools Online
32. Tools Used For Hacking
33. Nsa Hack Tools
34. Hack Tools
35. Hacker Tools
36. Hacking Tools For Windows 7
37. Pentest Tools Tcp Port Scanner
38. Pentest Tools Online
39. Hack Tools
40. Pentest Tools Find Subdomains
41. Tools Used For Hacking
42. Pentest Tools Tcp Port Scanner
43. Pentest Tools Android
44. Hack Tools Online
45. Pentest Tools Bluekeep
46. World No 1 Hacker Software
47. Pentest Reporting Tools
48. Pentest Recon Tools
49. Hacker
50. Hacker Tools For Mac
51. Hacking Tools Free Download
52. Hacker Tools For Windows
53. Underground Hacker Sites
54. Hacker Tools For Windows
55. Black Hat Hacker Tools
56. Hacking Tools Usb
57. Nsa Hacker Tools
58. Hacking Apps
59. New Hacker Tools
60. Hacking Tools Free Download
61. Best Pentesting Tools 2018
62. Nsa Hack Tools
63. Pentest Tools Android
64. Computer Hacker
65. Hacking Tools For Kali Linux
66. Pentest Tools Nmap
67. How To Hack
68. Nsa Hacker Tools
69. Hacker Tools
70. Nsa Hack Tools Download
71. Black Hat Hacker Tools
72. Hack Tools 2019
73. Hacking Tools For Windows 7
74. Hacker Tools For Pc
75. Tools 4 Hack
76. Pentest Tools Download
77. What Are Hacking Tools
78. Hacking Tools Pc
79. Hack Website Online Tool
80. Pentest Tools Free
81. Hacking Tools Pc
82. Hacker Tools Linux
83. Growth Hacker Tools
84. Hacker Tools For Pc
85. Pentest Tools For Mac
86. Hacks And Tools
87. New Hack Tools
88. Hacking Tools For Windows
89. Growth Hacker Tools
90. Hacker Tools For Mac
91. Android Hack Tools Github
92. Hack Rom Tools
93. Hacking App
94. Pentest Tools Free
95. Bluetooth Hacking Tools Kali
96. Pentest Box Tools Download
97. Hacking Tools Download
98. Hacker Tools For Windows
99. Pentest Tools List
100. Pentest Tools For Mac
101. What Is Hacking Tools
102. Pentest Tools For Mac
103. Pentest Tools Alternative
104. Hacker Tools Apk Download
105. Hacker Search Tools
106. Top Pentest Tools
107. Install Pentest Tools Ubuntu
108. Hack Rom Tools
109. Hacking Tools Free Download
110. Hacker Tools
111. Pentest Tools Open Source
112. Hacker Tools Free Download
113. Hack Tools For Windows
114. Pentest Tools Download
115. Best Hacking Tools 2019
116. Hacker
117. Hacker Tools Mac
118. Hacking Tools Windows
119. Pentest Tools Github
120. Termux Hacking Tools 2019
121. Hacking Tools For Games
122. Hacking Tools For Windows 7
123. Black Hat Hacker Tools
124. Hacker Tools
125. Pentest Tools Online
126. Hacking Tools Windows 10