Game Changing Advances in Windows Shellcode Analysis
Dr. Bramwell Brizendine introduces SHAREM, an advanced shellcode emulation framework providing complete code coverage and flawless Ghidra disassembly.
Summary
The Difficulties of Analyzing Obfuscated Shellcode
Malicious shellcode frequently employs custom encoding, environment hashing, and dynamic API resolving, causing static disassemblers like IDA Pro and Ghidra to produce incomplete or corrupted output.
Introducing the SHAREM Emulation Engine
Dr. Bramwell Brizendine, Austin Kersten, and Max Hince present SHAREM, a specialized emulation framework capable of emulating over 20,000 Windows API functions and 99% of system calls.
Achieving Complete Code Coverage via Snapshot Restores
SHAREM records CPU register contexts and memory state at every control flow fork; when execution terminates, it restores previous states to explore all divergent code branches.
Flawless Disassembly and Ghidra Plugin Integration
Integrating SHAREM’s runtime emulation data with a custom Ghidra plugin automatically resolves decoded shellcode, reconstructs obfuscated strings, and labels identified API calls.
Related talks
SAINTCON·24 min
Security researchers examine technical aspects of 2019 - Karl Sickendick - Reverse Engineering and Code Emulation with Ghidra.
Security BSides San Francisco·47 min
Presents BSidesSF 2020 - A Look at Jython-Enhanced Reverse Engineering with Ghidra (Byron Roosa) and evaluates key implications for security practitioners.
Creator Stage·22 min
Max 'Libra' Kersten
Demonstrates how to generate and distribute custom FunctionID and BSim symbol databases in Ghidra to accelerate reversing stripped Go binaries.