scdbg download

scdbg is a shellcode analysis application built around the libemu emulation library. When run it will display to the user all of the Windows API the shellcode attempts to call. What I wanted was a emulation version of sclog that I could be free to run without worry on my dekstop.

• scdbg -f shellcode_file.sc

• scdbg -f shellcode.sc -fopen bad.doc_ -u -i

• Training video 1
• Online Manual
• some sample shellcode files - ./files/_sc_samples.zip (the google site block mafia prevents me from including a direct link):

• Win32 Binaries
• Source

• win32 binaries
• Source

scdbg is an adaption of the libemu library and sctest project
  Libemu Copyright (C) 2007  Paul Baecher & Markus Koetter
  scdbg developer: David Zimmer 
  Compile date: Oct 16 2019 19:41:30

  /f fpath              load shellcode from file - accepts binary, %u, x, %x, hex blob
  /api                  scan memory and try to find API table
  /auto                 running as part of an automation run
  /ba hexnum            break above - breaks if eip > hexnum
  /bp varies            set breakpoint on file offset, virtual addr or api name (max 10)
  /bs int               break on step (shortcut for -las  -vvv)
  /b0                   break if 00 00 add [eax],al
  /cmd "string data"    data to use for GetCommandLineA (use " to embed quotes)
  /cfo                  CreateFileOverRide - if /fopen use handle else open real arg
  /d                    dump unpacked shellcode
  /dir  folder          process *.sc in  supports: -r (1 report), -v (report mode), -u
  /disasm int           Disasm int lines (can be used with /foff)
  /dump                 view hexdump (can be used with /foff)
  /e int                verbosity on error (3 = debug shell)
  /findsc               detect possible shellcode buffers (brute force) (supports -dump, -disasm)
  /fopen file           Opens a handle to  for use with GetFileSize() scanners
  /foff hexnum          starts execution at file offset (also supports virtual addresses)
  /h                    show this help
  /hex                  show hex dumps for hook reads/writes (paged)
  /hooks                dumps a list all implemented api hooks
  /i                    enable interactive hooks (file and network)
  /las int              log at step ex. -las 100
  /laa hexnum           log at address or api ex. -laa 0x401020 or -laa ReadFile
  /lookup api           shows the address of WinAPi function ex. -lookup GetProcAddress
  /mm                   enabled Memory Monitor (logs access to key addresses)
  /mdll                 Monitor Dll - log direct access to dll memory (hook detection/patches)
  /min steps            min number of steps (decimal) to trigger record in findsc mode (def 200)
  /nc                   no color (if using sending output to other apps)
  /noseh                Disables support for seh and UnhandledExceptionFilter
  /norw                 Disables display of read/write file hooks
  /o hexnum             base offset to use (default: 0x401000)
  /patch fpath          load patch file  into libemu memory
  /pad 0xVal            add an extra 0xVal bytes to shellcode
  /r                    show analysis report at end of run (includes -mm)
  /redir ip:port        redirect connect to ip (port optional)
  /s int                max number of steps to run (def=2000000, -1 unlimited)
  /sigs                 show signatures (can be used with -disasm)
  /t int                MS to delay between steps (v1-2) or api (v0)
  /temp folder          use folder as temp path for interactive mode file writes
  /u                    unlimited steps (same as -s -1)
  /v                    verbosity, can be used up to 4 times, ex. /v /v /vv
  /- /+                 increments or decrements GetFileSize, can be used multiple times
  /va 0xBase-0xSize     VirtualAlloc memory at 0xBase of 0xSize
  /raw 0xBase-fpath     Raw Patch Mode: load fpath into mem at 0xBase (not PE aware)
  /llo dllName-0xBase   LoadLibrary Override: returns 0xBase for LoadLibrary/GetModuleHandle
  /wbyte 0xBase-0xVal   Write 8bit 0xValue at 0xBase (/wb shortcut supported)
  /wint 0xBase-0xVal    Write 32bit integer 0xValue at 0xBase
  /wstr 0xBase-Str      Write string at base ex. 0x401000-0x9090EB15CCBB or "0xBase-ascii string"
  /dllmap               show the name, base, size, and version of all built in dlls
  /nofile               assumes you have loaded shellcode manually with -raw, -wstr, or -wint
  /bswap                byte swaps -f and -wstr input buffers
  /eswap                endian swaps -f and -wstr input buffers
  /xor 0xVal            xor -f and -wstr input buffers with 1 - 4 byte keys
  /conv path            outputs converted shellcode to file (%u,x,bswap,eswap..)
  /ida                  connects to last opened IDA instance on startup
  /[reg] value          sets init register value ex: -eax 0x20 -ebx 20 -ecx base -reg base

   dbg>
        ? - help, this help screen, h also works
        v - change verbosity (0-4)
        g - go - continue with v=0
        s - step, continues execution, ENTER also works
        c - reset step counter
        r - execute till return (v=0 recommended)
        u - unassembled x instructions at address (default eip)
        b - sets next free breakpoint (10 max)
        m - reset max step count (-1 = infinate)
        e - set eip (file offset or VA)
        w - dWord dump,(32bit ints) prompted for hex base addr and then size
        d - Dump Memory (hex dump) prompted for hex base addr and then size
        x - execute x steps (use with reset step count)
        t - set time delay (ms) for verbosity level 1/2
        k - show stack
        i - break at instruction (scans disasm for next string match)
        f - dereF registers (show any common api addresses in regs)
        j - show log of last 10 instructions executed
        o - step over
        ; - Set comment in IDA if .idasync active
        +/- - basic calculator to add or subtract 2 hex values
        .bl - list set breakpoints
        .bc - clear breakpoint
        .api - scan memory for api table
        .nop - nops out instruction at address (default eip)
        .seh - shows current value at fs[0]
        .segs - show values of segment registers
        .skip - skips current instruction and goes to next
        .reg - manually set register value
        .dllmap - show dll map
        .poke1 - write a single byte to memory
        .poke4 - write a 4 byte value to memory
        .lookup - get symbol for address
        .symbol - get address for symbol (special: peb,dllmap,fs0)
        .savemem - saves a memdump of specified range to file
        .idasync - connect IDASrvr plugin and sync view at step or break.
        .allocs - list memory allocations made
        q - quit




         

Comments: (5)