Package: pyscemu
PYSCEMUGpt Assistanthttps://chat.openai.com/g/g-sfrh5tzEM-pyscemu-helperInstallpipinstall--upgradepip
pip3install--upgradepip
curl--proto'=https'--tlsv1.2-sSfhttps://sh.rustup.rs|sh
pipinstallpyscemu
pip3installpyscemuMac Installsame procedure, if there is a problem with !tapi-tbd the solution is:sudoxcode-select--switch/Library/Developer/CommandLineToolsDownload mapsdownload maps32 from releases or maps64 better from git:https://github.com/sha0coder/scemureleases:https://github.com/sha0coder/scemu/releases/download/maps/maps32.ziphttps://github.com/sha0coder/scemu/releases/download/maps/maps64.zipExampleshttps://github.com/sha0coder/pyscemu/tree/main/examplesDocumentationhttps://github.com/sha0coder/pyscemu/blob/main/DOCUMENTATION.mdUsageFully emulation of a shellcode~❯❯❯python3Python3.9.2(default,Feb282021,17:03:44)[GCC10.2.120210110]onlinuxType"help","copyright","credits"or"license"formoreinformation.>>>importpyscemu>>>emu=pyscemu.init32()>>>emu.load_maps('/home/sha0/src/scemu/maps32/')initializingregsloadingmemorymapsLoadednsi.dll4sectionsbaseaddr0x776c0000createdpe32mapforsection`.text`at0x776c1000size:5624createdpe32mapforsection`.data`at0x776c3000size:16createdpe32mapforsection`.rsrc`at0x776c4000size:1008/!\warning:rawsz:8704off:8192sz:512off+sz:8704createdpe32mapforsection`.reloc`at0x776c5000size:88>>>>>>emu.load_binary('/home/sha0/src/scemu/shellcodes32/shikata.bin')shellcodedetected.>>>emu.set_verbose(0)# by default already 0>>>emu.disable_console()# by default already disabled>>>emu.run()#-----emulation-----**333368kernel32!LoadLibraryA'ws2_32'=0x77480000**1618021ws2_32!WsaStartup**2902832ws2_32!WsaSocketA**4180546ws2_32!connectfamily:2192.168.1.38:1337**5456468ws2_32!recvbuff:0x22de64sz:4**5736281kernel32!VirtualAllocsz:256addr:0x164**7012203ws2_32!recvbuff:0x164sz:256redirectingcodeflowtononmapedaddress0x264>>>help(emu.run)Helponbuilt-infunctionrun:run(end_addr)methodofbuiltins.Emuinstancestartemulatingthebinaryuntilreachtheprovidedend_addr.Userun()withnoparamforemulatingforever.Loading Danabot PE>>>emu.load_binary('/home/sha0/samples/danabot/2023-04-03-MainModule/unpacked2/dbmm_unpacked.dll')PE32headerdetected.IATbindingstarted...Loaded/home/sha0/src/scemu/maps32/version.dll5sectionsbaseaddr0x52180000createdpe32mapforsection`.text`at0x52181000size:10431createdpe32mapforsection`.data`at0x52184000size:872createdpe32mapforsection`.idata`at0x52185000size:3176createdpe32mapforsection`.rsrc`at0x52186000size:1064createdpe32mapforsection`.reloc`at0x52187000size:820Loaded/home/sha0/src/scemu/maps32/mpr.dll6sectionsbaseaddr0x4b680000createdpe32mapforsection`.text`at0x4b681000size:71344createdpe32mapforsection`.data`at0x4b693000size:1260createdpe32mapforsection`.idata`at0x4b694000size:4228createdpe32mapforsection`.didat`at0x4b696000size:80createdpe32mapforsection`.rsrc`at0x4b697000size:1296createdpe32mapforsection`.reloc`at0x4b698000size:3856Loaded/home/sha0/src/scemu/maps32/netapi32.dll4sectionsbaseaddr0x40ac0000createdpe32mapforsection`.text`at0x40ac1000size:51905createdpe32mapforsection`.data`at0x40ace000size:992createdpe32mapforsection`.rsrc`at0x40acf000size:1016/!\warning:rawsz:56832off:55808sz:1024off+sz:56832createdpe32mapforsection`.reloc`at0x40ad0000size:908Loaded/home/sha0/src/scemu/maps32/shell32.dll4sectionsbaseaddr0x73800000createdpe32mapforsection`.text`at0x73801000size:3966180createdpe32mapforsection`.data`at0x73bca000size:26872createdpe32mapforsection`.rsrc`at0x73bd1000size:8670296/!\warning:rawsz:12872192off:12660736sz:211456off+sz:12872192createdpe32mapforsection`.reloc`at0x74416000size:211060Loaded/home/sha0/src/scemu/maps32/esent.dll7sectionsbaseaddr0x10000000createdpe32mapforsection`.text`at0x10001000size:2573914createdpe32mapforsection`.data`at0x10276000size:22056createdpe32mapforsection`.idata`at0x1027c000size:7442createdpe32mapforsection`.didat`at0x1027e000size:44createdpe32mapforsection`cachelin`at0x1027f000size:1824createdpe32mapforsection`.rsrc`at0x10280000size:1360/!\warning:rawsz:2712064off:2597376sz:114688off+sz:2712064createdpe32mapforsection`.reloc`at0x10281000size:114200Loaded/home/sha0/src/scemu/maps32/iphlpapi.dll4sectionsbaseaddr0x40c90000createdpe32mapforsection`.text`at0x40c91000size:96173createdpe32mapforsection`.data`at0x40ca9000size:1936createdpe32mapforsection`.rsrc`at0x40caa000size:1288/!\warning:rawsz:103936off:101376sz:2560off+sz:103936createdpe32mapforsection`.reloc`at0x40cab000size:2372Loaded/home/sha0/src/scemu/maps32/winspool.drv.dll6sectionsbaseaddr0x4cc80000createdpe32mapforsection`.text`at0x4cc81000size:328345createdpe32mapforsection`.data`at0x4ccd2000size:4972createdpe32mapforsection`.idata`at0x4ccd4000size:8628createdpe32mapforsection`.didat`at0x4ccd7000size:548createdpe32mapforsection`.rsrc`at0x4ccd8000size:88632/!\warning:rawsz:449536off:430080sz:19456off+sz:449536createdpe32mapforsection`.reloc`at0x4ccee000size:19448Loaded/home/sha0/src/scemu/maps32/netapi32.dll4sectionsbaseaddr0x40ac0000createdpe32mapforsection`.text`at0x40ac1000size:51905createdpe32mapforsection`.data`at0x40ace000size:992createdpe32mapforsection`.rsrc`at0x40acf000size:1016/!\warning:rawsz:56832off:55808sz:1024off+sz:56832createdpe32mapforsection`.reloc`at0x40ad0000size:908Loaded/home/sha0/src/scemu/maps32/rasapi32.dll6sectionsbaseaddr0x10000000createdpe32mapforsection`.text`at0x10001000size:812208createdpe32mapforsection`.data`at0x100c8000size:5692createdpe32mapforsection`.idata`at0x100ca000size:9484createdpe32mapforsection`.didat`at0x100cd000size:524createdpe32mapforsection`.rsrc`at0x100ce000size:1296/!\warning:rawsz:875008off:826880sz:48128off+sz:875008createdpe32mapforsection`.reloc`at0x100cf000size:47656Loaded/home/sha0/src/scemu/maps32/shell32.dll4sectionsbaseaddr0x73800000createdpe32mapforsection`.text`at0x73801000size:3966180createdpe32mapforsection`.data`at0x73bca000size:26872createdpe32mapforsection`.rsrc`at0x73bd1000size:8670296/!\warning:rawsz:12872192off:12660736sz:211456off+sz:12872192createdpe32mapforsection`.reloc`at0x74416000size:211060Loaded/home/sha0/src/scemu/maps32/pstorec.dll5sectionsbaseaddr0x5a800000createdpe32mapforsection`.text`at0x5a801000size:1105createdpe32mapforsection`.data`at0x5a802000size:804createdpe32mapforsection`.idata`at0x5a803000size:480createdpe32mapforsection`.rsrc`at0x5a804000size:9936/!\warning:rawsz:14336off:13824sz:512off+sz:14336createdpe32mapforsection`.reloc`at0x5a807000size:44Loaded/home/sha0/src/scemu/maps32/rasapi32.dll6sectionsbaseaddr0x10000000createdpe32mapforsection`.text`at0x10001000size:812208createdpe32mapforsection`.data`at0x100c8000size:5692createdpe32mapforsection`.idata`at0x100ca000size:9484createdpe32mapforsection`.didat`at0x100cd000size:524createdpe32mapforsection`.rsrc`at0x100ce000size:1296/!\warning:rawsz:875008off:826880sz:48128off+sz:875008createdpe32mapforsection`.reloc`at0x100cf000size:47656IATBound.Loaded/home/sha0/samples/danabot/2023-04-03-MainModule/unpacked2/dbmm_unpacked.dll10sectionsbaseaddr0x1e70000createdpe32mapforsection`.text`at0x1e71000size:31920128entrypointat0x22f79680x487968createdpe32mapforsection`.itext`at0x22f6000size:36659200createdpe32mapforsection`.data`at0x22f8000size:36667392createdpe32mapforsection`.bss`at0x236f000size:37154816createdpe32mapforsection`.idata`at0x2489000size:38309888createdpe32mapforsection`.didata`at0x248e000size:38330368createdpe32mapforsection`.edata`at0x248f000size:38334464createdpe32mapforsection`.rdata`at0x2490000size:38338560createdpe32mapforsection`.reloc`at0x2491000size:38342656/!\warning:rawsz:372658176off:334061568sz:38596608off+sz:372658176createdpe32mapforsection`.rsrc`at0x24cd000size:38596608calling xloader keygen function with 1 params.>>>hex(emu.get_reg('eip'))'0x22f7968'>>>struct_ptr=0x03DB000# somewhere, evrithing is writable.>>>xloader_key1_keygen=0x03DB687>>>eax=emu.call32(xloader_key1_keygen,[struct_ptr])>>>rc4_key=emu.read_string_of_bytes(struct_ptr+1980,20)>>>rc4_key'03 00 00 6a 02 51 ff d2 80 3b 00 74 4e 8b 4d 14 6a 08 89 8e 'other way to do the call:>>>struct_ptr=0x03DB000>>>xloader_key1_keygen=0x03DB687>>>old_eip=emu.set_reg('eip',xloader_key1_keygen)>>>ret_addr=old_eip>>>emu.stack_push32(struct_ptr)True>>>emu.stack_push32(ret_addr)True>>>emu.run(ret_addr)# point ret_addr to some mapped place and run until ret_addrSpawn console by address or by position.>>>emu.spawn_console_at_pos(6)>>>emu.set_verbose(3)>>>emu.run(0)shellcodedetected.10x3c8b97:pushebp;0x22f00020x3c8b97:pushebp;0x22f00030x3c8b98:movebp,esp40x3c8b9a:movecx,[ebp+0Ch]50x3c8b9d:moveax,[ebp+8]-------60x3c8ba0:xor[eax],ecx---console---=>reaxeax:0x3c00003932160(code)=>recxecx:0x4641124'AAAABBBB'(struct_buff)=>