libemu – x86 Shellcode Emulation

[Nytro]

[h=1]libemu – x86 Shellcode Emulation[/h]

libemu is a small library written in C offering basic x86 emulation and shellcode detection using GetPC heuristics. It is designed to be used within network intrusion/prevention detections and honeypots.

libemu supports:

• Executing x86 instructions
  
  • Reading x86 binary code
    
  • Register emulation
    
  • Basic FPU emulation
    

  [*]Shellcode execution

  • Shellcode detection
    
    • Using GetPC heuristics
      
    • Static analysis
      
    • Binary backwardstraversal
      

    [*]Win32 API hooking

With libemu one can:

• Detect shellcodes
  
• Execute the shellcodes
  
• Profile shellcode behaviour
  

Download:

http://sourceforge.net/projects/nepenthes/files/libemu%20development/0.1.0/

Sursa si Info: libemu – x86 Shellcode Emulation