Simplifying Shellcode Analysis

I run a purty darn big Darknet here in the Code Cave. I like to keep up to date with what is going on in the security space all over the world. I have peering agreements with other Darknetters all over the world to form a huge sensornet that we all benefit from. We have a ton of data to sift thru to find the good stuff. Feels like what panning for gold at Sutters Mill must have felt like in the 1800’s…without all the killin’ Sounds a little like my last family reunion, but I’ll save that for another blog… The problem is after we document an attack or we need to filter out some of the noise, we need to write our own sig to detect and catalogue a known attack. Pattern matching takes some time get the right amount of detail and has always kinda been like having a mother in law that cooks good… An x86 emulator is what is needed however, I have tried qemu and bochs (a little, mainly qemu) and I was not too impressed. They are OK but not cool enough to change my processes and rudimentary scripts. I been messin’ around with the tool Libemu to automate the process of shellcode pattern matching and I have been amazed. Libemu is a tool wrote in C (thank goodness) by Markus Koetter. This smokin’ hot tool allows me to feed raw decodes from my nepenthes directly into Libemu. It will in turn detect the shellcode offsets and does a analysis of what the shellcode is actually trying to do. I have been using this with a great amount of success in shellcode analysis and it has a hit rate of about 92%!!! Pairing up Libemu with Nepenthes has really cut down my manual shellcode analysis time and increased my cohiba and fishing time and in the end that’s what is all about. If you run honeys or do shellcode analysis; do yourself a big favor and start messin’ around with Libemu. Jimmy Ray