Thursday, January 18, 2024

Fast Emulator For Shellcodes In Rust

I have developed a fast emulator for modern shellcodes, that perform huge loops of millions of instructions emulated for resolving API or for other stuff.

The emulator is in Rust and all the few dependencies as well, so the rust safety is good for emulating malware.  

There are shellcodes that can be emulated from the beginning to the end, but when this is not possible the tool has many features that can be used like a console, a memory tracing, register tracing, and so on.

https://github.com/sha0coder/scemu



In less than two seconds we have emulated 7 millions of instructions arriving to the recv. 

At this point we have some  IOC like  the ip:port where it's connecting and other details.

Lets see what happens after the recv() spawning a console at position: 7,012,204


target/release/scemu -f shellcodes/shikata.bin -vv -c 7012204



In the console, pressing "enter" several times to emulate  step into several steps and we arrive to a return instruction.


Let's see the stack in this moment:


The "ret" instruction is going to jump to the buffer read with recv() so is a kind of stager.

The option "-e" or "--endpoint" is not ready for now, but it will allow to proxy the calls to get the next  stage automatically, but for now we have the details to get the stage.


SCEMU also identify all the Linux  syscalls for 32bits shellcodes:



The encoder used in shellgen is also supported https://github.com/MarioVilas/shellgen

Let's check with cobalt-strike:


We can see where is connecting and which headers is using, so right now we can replicate the communications.



In verbose mode we could do several greps to see the calls and correlate with ghidra/ida/radare or  for example grep the branches to study the emulation flow.


target/release/scemu -f shellcodes/rshell_sgn.bin -vv | grep j


target/release/scemu -f shellcodes/rshell_sgn.bin -vv -c 44000 -l


The -l --loops options makes the emulation a bit slower but track the number of iterations.

Is possible to print all the registers in every step with  -r or --registers  but also is possible to track  specific register for example with --reg esi


target/release/scemu -f shellcodes/shikata.bin --reg esi 


In this case ESI register points to the API name, if we track EAX or ECX will see that are the counters of the loop. These shellcodes  contains a hard loop to locate the API names.

The flag -i or --inspect allow to monitor memory using expressions like "dword ptr [eax + 0xa]"

target/release/scemu -f shellcodes/shikata.bin -i 'dword ptr [esi]'

And more things to come...  find a demo below:

https://www.youtube.com/watch?v=qTYmMjW3DFs





Related articles
  1. What Are Hacking Tools
  2. Hacker Tools 2019
  3. Tools For Hacker
  4. Bluetooth Hacking Tools Kali
  5. Hacker Tools 2020
  6. Easy Hack Tools
  7. Hacking Tools For Mac
  8. Best Hacking Tools 2020
  9. Hacking Tools Kit
  10. Hacking Tools For Windows 7
  11. Computer Hacker
  12. Tools 4 Hack
  13. What Are Hacking Tools
  14. Hack Rom Tools
  15. Wifi Hacker Tools For Windows
  16. Android Hack Tools Github
  17. Hacker Tools Apk Download
  18. Pentest Tools Website
  19. Hacking Tools For Windows
  20. Wifi Hacker Tools For Windows
  21. Pentest Recon Tools
  22. Pentest Tools Nmap
  23. Hackers Toolbox
  24. Hacking Tools Kit
  25. Blackhat Hacker Tools
  26. Hacking Tools For Games
  27. Hacker Tools Free Download
  28. Hacker Tools Github
  29. Pentest Tools Subdomain
  30. Hacker Tools Apk
  31. Hacker Tools 2020
  32. Hacking Tools Free Download
  33. Hacking Tools And Software
  34. Pentest Tools Online
  35. Nsa Hack Tools
  36. Hacker Tools For Ios
  37. New Hack Tools
  38. Hacking Tools And Software
  39. Computer Hacker
  40. Pentest Reporting Tools
  41. Pentest Tools Review
  42. Computer Hacker
  43. Hacker Tools Mac
  44. Hacker Tools Linux
  45. Best Pentesting Tools 2018
  46. Pentest Tools Android
  47. Hack Tools For Pc
  48. New Hack Tools
  49. Pentest Tools Port Scanner
  50. Hacker Hardware Tools
  51. Hacker Tools 2019
  52. Hacker Tools
  53. Hacker Tools 2019
  54. Pentest Tools Download
  55. Hacking Tools Name
  56. Pentest Tools Windows
  57. Hacking Tools Pc
  58. Hacks And Tools
  59. Hacking Tools Windows
  60. Nsa Hacker Tools
  61. Pentest Tools For Windows
  62. World No 1 Hacker Software
  63. Hacking Tools Hardware
  64. Hacking Tools 2019
  65. Hacker Tools Free Download
  66. Hacking Tools Software
  67. Hak5 Tools
  68. Hack And Tools
  69. Pentest Tools For Windows
  70. Hacking Tools For Windows Free Download
  71. Hack Tools Online
  72. Bluetooth Hacking Tools Kali
  73. Tools For Hacker
  74. Hacking Tools For Beginners
  75. Pentest Recon Tools
  76. Pentest Tools Android
  77. Pentest Tools Download
  78. Hacking Tools Hardware
  79. Game Hacking
  80. Beginner Hacker Tools
  81. Pentest Tools For Android
  82. Pentest Tools Open Source
  83. Hack Website Online Tool
  84. Pentest Tools Linux
  85. Hacking Tools For Pc
  86. Wifi Hacker Tools For Windows
  87. Pentest Tools Android
  88. Hacking Tools For Windows Free Download
  89. Termux Hacking Tools 2019
  90. Hacker Tools 2019
  91. Hacker Tools Free
  92. Hacking Tools Online
  93. Hacking Tools Github
  94. Pentest Tools Url Fuzzer
  95. Hacker
  96. New Hacker Tools
  97. Hack Tools 2019
  98. Hacking Tools Online
  99. Hack Tools 2019
  100. Blackhat Hacker Tools
  101. Hacking Tools For Kali Linux
  102. Android Hack Tools Github
  103. Hacking Tools Download
  104. Hack Tools Pc
  105. Hack Tools
  106. Hacking App
  107. Beginner Hacker Tools

No comments:

Post a Comment