Fast Emulator For Shellcodes In Rust

I have developed a fast emulator for modern shellcodes, that perform huge loops of millions of instructions emulated for resolving API or for other stuff.

The emulator is in Rust and all the few dependencies as well, so the rust safety is good for emulating malware.  

There are shellcodes that can be emulated from the beginning to the end, but when this is not possible the tool has many features that can be used like a console, a memory tracing, register tracing, and so on.

https://github.com/sha0coder/scemu

In less than two seconds we have emulated 7 millions of instructions arriving to the recv. 

At this point we have some  IOC like  the ip:port where it's connecting and other details.

Lets see what happens after the recv() spawning a console at position: 7,012,204

target/release/scemu -f shellcodes/shikata.bin -vv -c 7012204

In the console, pressing "enter" several times to emulate  step into several steps and we arrive to a return instruction.

Let's see the stack in this moment:

The "ret" instruction is going to jump to the buffer read with recv() so is a kind of stager.

The option "-e" or "--endpoint" is not ready for now, but it will allow to proxy the calls to get the next  stage automatically, but for now we have the details to get the stage.

SCEMU also identify all the Linux  syscalls for 32bits shellcodes:

The encoder used in shellgen is also supported https://github.com/MarioVilas/shellgen

Let's check with cobalt-strike:

We can see where is connecting and which headers is using, so right now we can replicate the communications.

In verbose mode we could do several greps to see the calls and correlate with ghidra/ida/radare or  for example grep the branches to study the emulation flow.

target/release/scemu -f shellcodes/rshell_sgn.bin -vv | grep j

target/release/scemu -f shellcodes/rshell_sgn.bin -vv -c 44000 -l

The -l --loops options makes the emulation a bit slower but track the number of iterations.

Is possible to print all the registers in every step with  -r or --registers  but also is possible to track  specific register for example with --reg esi

target/release/scemu -f shellcodes/shikata.bin --reg esi 

In this case ESI register points to the API name, if we track EAX or ECX will see that are the counters of the loop. These shellcodes  contains a hard loop to locate the API names.

The flag -i or --inspect allow to monitor memory using expressions like "dword ptr [eax + 0xa]"

target/release/scemu -f shellcodes/shikata.bin -i 'dword ptr [esi]'

And more things to come...  find a demo below:

https://www.youtube.com/watch?v=qTYmMjW3DFs

More info

1. Hacker Tools Hardware
2. Pentest Tools Find Subdomains
3. Hacking Tools Software
4. Hacker Hardware Tools
5. Pentest Tools For Android
6. Pentest Tools Review
7. Hacking Tools For Mac
8. Hacking Tools Mac
9. Hacker Tools Linux
10. What Are Hacking Tools
11. Hacking Tools
12. Hacker Tools For Ios
13. Best Hacking Tools 2020
14. Underground Hacker Sites
15. Tools For Hacker
16. Hack Tools For Games
17. Hacking Tools For Pc
18. Hacker Tools List
19. Hacking Tools Pc
20. Pentest Tools Find Subdomains
21. Hacker Tools Free
22. Hacker
23. Bluetooth Hacking Tools Kali
24. Pentest Tools Nmap
25. Hacking Tools
26. Hacker Security Tools
27. What Are Hacking Tools
28. How To Make Hacking Tools
29. Hacker Techniques Tools And Incident Handling
30. Hacker Tools Linux
31. Hacker Tools Hardware
32. Hacker Tools 2019
33. Hacker Tools 2019
34. Hacking Tools Online
35. Pentest Automation Tools
36. Kik Hack Tools
37. Hacker Tools Windows
38. Hacking Tools Online
39. New Hack Tools
40. Hacker Tools Github
41. Hack Tool Apk No Root
42. Pentest Box Tools Download
43. Hack Tools
44. Best Hacking Tools 2020
45. Hacker Tools For Mac
46. Best Pentesting Tools 2018
47. Hack Tools Github
48. Nsa Hack Tools
49. Best Hacking Tools 2020
50. Top Pentest Tools
51. Pentest Tools For Android
52. What Are Hacking Tools
53. Hack Tools For Mac
54. How To Install Pentest Tools In Ubuntu
55. Pentest Tools For Ubuntu
56. Beginner Hacker Tools
57. Hacking Tools Pc
58. Hacking Tools Hardware
59. Pentest Tools For Ubuntu
60. Best Hacking Tools 2019
61. Hacker Tools Mac
62. Hacking Tools Free Download
63. Pentest Tools Review
64. Hacker Hardware Tools
65. Computer Hacker
66. Ethical Hacker Tools
67. Hacking Tools Download
68. How To Hack
69. Pentest Tools Kali Linux
70. Pentest Tools Framework
71. Hacking Tools For Windows
72. Hack Tools Github
73. Hacking Tools Free Download
74. Hacker
75. Hacker Hardware Tools
76. Hacking Tools Online
77. Pentest Tools Nmap
78. Hack Apps
79. Termux Hacking Tools 2019
80. Hacking Tools For Beginners
81. Pentest Tools For Windows
82. Nsa Hack Tools Download
83. Hacker Tools Hardware