Fast Emulator For Shellcodes In Rust

I have developed a fast emulator for modern shellcodes, that perform huge loops of millions of instructions emulated for resolving API or for other stuff.

The emulator is in Rust and all the few dependencies as well, so the rust safety is good for emulating malware.  

There are shellcodes that can be emulated from the beginning to the end, but when this is not possible the tool has many features that can be used like a console, a memory tracing, register tracing, and so on.

https://github.com/sha0coder/scemu

In less than two seconds we have emulated 7 millions of instructions arriving to the recv. 

At this point we have some  IOC like  the ip:port where it's connecting and other details.

Lets see what happens after the recv() spawning a console at position: 7,012,204

target/release/scemu -f shellcodes/shikata.bin -vv -c 7012204

In the console, pressing "enter" several times to emulate  step into several steps and we arrive to a return instruction.

Let's see the stack in this moment:

The "ret" instruction is going to jump to the buffer read with recv() so is a kind of stager.

The option "-e" or "--endpoint" is not ready for now, but it will allow to proxy the calls to get the next  stage automatically, but for now we have the details to get the stage.

SCEMU also identify all the Linux  syscalls for 32bits shellcodes:

The encoder used in shellgen is also supported https://github.com/MarioVilas/shellgen

Let's check with cobalt-strike:

We can see where is connecting and which headers is using, so right now we can replicate the communications.

In verbose mode we could do several greps to see the calls and correlate with ghidra/ida/radare or  for example grep the branches to study the emulation flow.

target/release/scemu -f shellcodes/rshell_sgn.bin -vv | grep j

target/release/scemu -f shellcodes/rshell_sgn.bin -vv -c 44000 -l

The -l --loops options makes the emulation a bit slower but track the number of iterations.

Is possible to print all the registers in every step with  -r or --registers  but also is possible to track  specific register for example with --reg esi

target/release/scemu -f shellcodes/shikata.bin --reg esi 

In this case ESI register points to the API name, if we track EAX or ECX will see that are the counters of the loop. These shellcodes  contains a hard loop to locate the API names.

The flag -i or --inspect allow to monitor memory using expressions like "dword ptr [eax + 0xa]"

target/release/scemu -f shellcodes/shikata.bin -i 'dword ptr [esi]'

And more things to come...  find a demo below:

https://www.youtube.com/watch?v=qTYmMjW3DFs

Related links

1. Pentest Tools Port Scanner
2. Hacker Tools List
3. Hacking Tools For Windows 7
4. Hacking App
5. Hack App
6. Hacking Tools For Kali Linux
7. Pentest Tools Website
8. New Hack Tools
9. Hacker Tools Online
10. Hack Tools For Mac
11. Hacker Tools Github
12. Best Pentesting Tools 2018
13. Hack Tools For Windows
14. Pentest Tools For Android
15. Hack Tools For Games
16. Hacking Tools For Pc
17. Pentest Tools Nmap
18. Termux Hacking Tools 2019
19. Nsa Hack Tools
20. Hacking Tools Name
21. Hacker Security Tools
22. Hacker Tools Free Download
23. New Hack Tools
24. Pentest Tools Alternative
25. Hackrf Tools
26. Pentest Tools For Ubuntu
27. Hacker Tools Online
28. Hacking Tools Windows
29. Pentest Tools Url Fuzzer
30. What Are Hacking Tools
31. Ethical Hacker Tools
32. Hacker Tools For Ios
33. Best Hacking Tools 2019
34. Beginner Hacker Tools
35. Hacking App
36. Pentest Tools Website
37. Hacking Tools Free Download
38. Pentest Tools Nmap
39. Hack And Tools
40. Pentest Recon Tools
41. Hacking Tools For Mac
42. Hacking Tools For Mac
43. Hacker
44. Pentest Tools For Mac
45. Hacking Tools For Windows Free Download
46. Hack Tools For Windows
47. Free Pentest Tools For Windows
48. Hacker Tools Apk Download
49. Hacker Tools
50. Hack Rom Tools
51. Ethical Hacker Tools
52. Usb Pentest Tools
53. Hacking Tools Windows 10
54. Nsa Hack Tools Download
55. Hacker Tools Hardware
56. Hack Tools For Ubuntu
57. Hacking Tools For Mac
58. Hacking Tools Windows
59. Hacking Tools Download
60. Hacking Tools For Mac
61. Pentest Tools Github
62. Easy Hack Tools
63. Pentest Box Tools Download
64. Pentest Tools For Windows
65. Hacker Tools Free
66. Hacking Tools For Windows
67. Pentest Tools
68. Computer Hacker