libmwemu 0.24.1

x86 32/64bits and system internals emulator, for securely emulating malware and other stuff.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29

use crate::{tests::helpers, *};

#[test]
// this tests a windows 64bits shellcode, and pointing o sockaddr structure.
// also tests steps.
pub fn sc64win_metasploit() {
    helpers::setup();

    let mut emu = emu64();
    emu.cfg.maps_folder = "../../maps/maps64/".to_string();

    let sample = "../../test/sc64win_metasploit.bin";
    emu.load_code(sample);
    //emu.set_verbose(3);
    emu.run(Some(0x3c00c8));
    emu.step();
    emu.run(Some(0x3c00c8));
    emu.step();
    emu.run(Some(0x3c00c8));
    emu.step();
    emu.run(Some(0x3c00c8));
    //emu.spawn_console();

    let stack = emu.regs().rsp;
    let sockaddr_ptr = emu.maps.read_qword(stack + 8).unwrap();
    let sockaddr = emu.maps.read_qword(sockaddr_ptr).unwrap();

    assert_eq!(sockaddr, 0x12c190a5c110002);
}