{"id":22852686,"url":"https://github.com/sha0coder/pyscemu","last_synced_at":"2025-04-30T09:20:43.133Z","repository":{"id":158946656,"uuid":"634316331","full_name":"sha0coder/pyscemu","owner":"sha0coder","description":"PySCEmu, python support for rust emulator libscemu","archived":false,"fork":false,"pushed_at":"2024-03-27T19:09:45.000Z","size":1322,"stargazers_count":2,"open_issues_count":0,"forks_count":0,"subscribers_count":2,"default_branch":"main","last_synced_at":"2024-03-27T20:26:22.294Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/sha0coder.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null}},"created_at":"2023-04-29T18:21:25.000Z","updated_at":"2024-03-27T20:26:23.254Z","dependencies_parsed_at":"2023-09-22T10:27:09.395Z","dependency_job_id":"8a85c984-f56f-424e-9727-a1c4df036d6a","html_url":"https://github.com/sha0coder/pyscemu","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sha0coder%2Fpyscemu","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sha0coder%2Fpyscemu/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sha0coder%2Fpyscemu/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sha0coder%2Fpyscemu/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/sha0coder","download_url":"https://codeload.github.com/sha0coder/pyscemu/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":251674962,"owners_count":21625712,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-12-13T06:08:55.441Z","updated_at":"2025-04-30T09:20:43.120Z","avatar_url":"https://github.com/sha0coder.png","language":"Rust","funding_links":[],"categories":[],"sub_categories":[],"readme":"# PYSCEMU\n\nThis repo has been archived, now libscemu, pyscemu and scemu become 1 repo:\nhttps://github.com/sha0coder/mwemu\n\n## Examples\n\nhttps://github.com/sha0coder/pyscemu/tree/main/examples\n\n## Documentation\n\nhttps://github.com/sha0coder/pyscemu/blob/main/DOCUMENTATION.md\n\n## Gpt Assistant\n\nhttps://chat.openai.com/g/g-sfrh5tzEM-pyscemu-helper\n\n## Install\n```bash\npip install --upgrade pip\npip3 install --upgrade pip\ncurl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh\npip install pyscemu\npip3 install pyscemu\n```\n\n## Mac Install\nsame procedure, if there is a problem with !tapi-tbd the solution is:\n```bash\nsudo xcode-select --switch /Library/Developer/CommandLineTools\n```\n\n## Download maps\ndownload maps32 from releases or maps64 better from git:\nhttps://github.com/sha0coder/scemu\n\nreleases:\n\nhttps://github.com/sha0coder/scemu/releases/download/maps/maps32.zip\nhttps://github.com/sha0coder/scemu/releases/download/maps/maps64.zip\n\n\n## Usage\n\n### Fully emulation of a shellcode\n\n```python\n~ ❯❯❯ python3\nPython 3.9.2 (default, Feb 28 2021, 17:03:44) \n[GCC 10.2.1 20210110] on linux\nType \"help\", \"copyright\", \"credits\" or \"license\" for more information.\n\u003e\u003e\u003e import pyscemu\n\u003e\u003e\u003e emu = pyscemu.init32()\n\u003e\u003e\u003e emu.load_maps('/home/sha0/src/scemu/maps32/')\ninitializing regs\nloading memory maps\nLoaded nsi.dll\n\t4 sections  base addr 0x776c0000\n\tcreated pe32 map for section `.text` at 0x776c1000 size: 5624\n\tcreated pe32 map for section `.data` at 0x776c3000 size: 16\n\tcreated pe32 map for section `.rsrc` at 0x776c4000 size: 1008\n/!\\ warning: raw sz:8704 off:8192 sz:512  off+sz:8704\n\tcreated pe32 map for section `.reloc` at 0x776c5000 size: 88\n\u003e\u003e\u003e \n\u003e\u003e\u003e emu.load_binary('/home/sha0/src/scemu/shellcodes32/shikata.bin')\nshellcode detected.\n\u003e\u003e\u003e emu.set_verbose(0)   # by default already 0\n\u003e\u003e\u003e emu.disable_console() # by default already disabled\n\u003e\u003e\u003e emu.run()   # \n ----- emulation -----\n** 333368 kernel32!LoadLibraryA  'ws2_32' =0x77480000 \n** 1618021 ws2_32!WsaStartup \n** 2902832 ws2_32!WsaSocketA \n** 4180546 ws2_32!connect  family: 2 192.168.1.38:1337 \n** 5456468 ws2_32!recv   buff: 0x22de64 sz: 4 \n** 5736281 kernel32!VirtualAlloc sz: 256 addr: 0x164 \n** 7012203 ws2_32!recv   buff: 0x164 sz: 256 \nredirecting code flow to non maped address 0x264\n\n\u003e\u003e\u003e help(emu.run)\nHelp on built-in function run:\n\nrun(end_addr) method of builtins.Emu instance\n    start emulating the binary until reach the provided end_addr. \n    Use run() with no param for emulating forever.\n```\n\n\n### Loading Danabot PE\n\n```python\n\u003e\u003e\u003e emu.load_binary('/home/sha0/samples/danabot/2023-04-03-MainModule/unpacked2/dbmm_unpacked.dll')\nPE32 header detected.\nIAT binding started ...\nLoaded /home/sha0/src/scemu/maps32/version.dll\n\t5 sections  base addr 0x52180000\n\tcreated pe32 map for section `.text` at 0x52181000 size: 10431\n\tcreated pe32 map for section `.data` at 0x52184000 size: 872\n\tcreated pe32 map for section `.idata` at 0x52185000 size: 3176\n\tcreated pe32 map for section `.rsrc` at 0x52186000 size: 1064\n\tcreated pe32 map for section `.reloc` at 0x52187000 size: 820\nLoaded /home/sha0/src/scemu/maps32/mpr.dll\n\t6 sections  base addr 0x4b680000\n\tcreated pe32 map for section `.text` at 0x4b681000 size: 71344\n\tcreated pe32 map for section `.data` at 0x4b693000 size: 1260\n\tcreated pe32 map for section `.idata` at 0x4b694000 size: 4228\n\tcreated pe32 map for section `.didat` at 0x4b696000 size: 80\n\tcreated pe32 map for section `.rsrc` at 0x4b697000 size: 1296\n\tcreated pe32 map for section `.reloc` at 0x4b698000 size: 3856\nLoaded /home/sha0/src/scemu/maps32/netapi32.dll\n\t4 sections  base addr 0x40ac0000\n\tcreated pe32 map for section `.text` at 0x40ac1000 size: 51905\n\tcreated pe32 map for section `.data` at 0x40ace000 size: 992\n\tcreated pe32 map for section `.rsrc` at 0x40acf000 size: 1016\n/!\\ warning: raw sz:56832 off:55808 sz:1024  off+sz:56832\n\tcreated pe32 map for section `.reloc` at 0x40ad0000 size: 908\nLoaded /home/sha0/src/scemu/maps32/shell32.dll\n\t4 sections  base addr 0x73800000\n\tcreated pe32 map for section `.text` at 0x73801000 size: 3966180\n\tcreated pe32 map for section `.data` at 0x73bca000 size: 26872\n\tcreated pe32 map for section `.rsrc` at 0x73bd1000 size: 8670296\n/!\\ warning: raw sz:12872192 off:12660736 sz:211456  off+sz:12872192\n\tcreated pe32 map for section `.reloc` at 0x74416000 size: 211060\nLoaded /home/sha0/src/scemu/maps32/esent.dll\n\t7 sections  base addr 0x10000000\n\tcreated pe32 map for section `.text` at 0x10001000 size: 2573914\n\tcreated pe32 map for section `.data` at 0x10276000 size: 22056\n\tcreated pe32 map for section `.idata` at 0x1027c000 size: 7442\n\tcreated pe32 map for section `.didat` at 0x1027e000 size: 44\n\tcreated pe32 map for section `cachelin` at 0x1027f000 size: 1824\n\tcreated pe32 map for section `.rsrc` at 0x10280000 size: 1360\n/!\\ warning: raw sz:2712064 off:2597376 sz:114688  off+sz:2712064\n\tcreated pe32 map for section `.reloc` at 0x10281000 size: 114200\nLoaded /home/sha0/src/scemu/maps32/iphlpapi.dll\n\t4 sections  base addr 0x40c90000\n\tcreated pe32 map for section `.text` at 0x40c91000 size: 96173\n\tcreated pe32 map for section `.data` at 0x40ca9000 size: 1936\n\tcreated pe32 map for section `.rsrc` at 0x40caa000 size: 1288\n/!\\ warning: raw sz:103936 off:101376 sz:2560  off+sz:103936\n\tcreated pe32 map for section `.reloc` at 0x40cab000 size: 2372\nLoaded /home/sha0/src/scemu/maps32/winspool.drv.dll\n\t6 sections  base addr 0x4cc80000\n\tcreated pe32 map for section `.text` at 0x4cc81000 size: 328345\n\tcreated pe32 map for section `.data` at 0x4ccd2000 size: 4972\n\tcreated pe32 map for section `.idata` at 0x4ccd4000 size: 8628\n\tcreated pe32 map for section `.didat` at 0x4ccd7000 size: 548\n\tcreated pe32 map for section `.rsrc` at 0x4ccd8000 size: 88632\n/!\\ warning: raw sz:449536 off:430080 sz:19456  off+sz:449536\n\tcreated pe32 map for section `.reloc` at 0x4ccee000 size: 19448\nLoaded /home/sha0/src/scemu/maps32/netapi32.dll\n\t4 sections  base addr 0x40ac0000\n\tcreated pe32 map for section `.text` at 0x40ac1000 size: 51905\n\tcreated pe32 map for section `.data` at 0x40ace000 size: 992\n\tcreated pe32 map for section `.rsrc` at 0x40acf000 size: 1016\n/!\\ warning: raw sz:56832 off:55808 sz:1024  off+sz:56832\n\tcreated pe32 map for section `.reloc` at 0x40ad0000 size: 908\nLoaded /home/sha0/src/scemu/maps32/rasapi32.dll\n\t6 sections  base addr 0x10000000\n\tcreated pe32 map for section `.text` at 0x10001000 size: 812208\n\tcreated pe32 map for section `.data` at 0x100c8000 size: 5692\n\tcreated pe32 map for section `.idata` at 0x100ca000 size: 9484\n\tcreated pe32 map for section `.didat` at 0x100cd000 size: 524\n\tcreated pe32 map for section `.rsrc` at 0x100ce000 size: 1296\n/!\\ warning: raw sz:875008 off:826880 sz:48128  off+sz:875008\n\tcreated pe32 map for section `.reloc` at 0x100cf000 size: 47656\nLoaded /home/sha0/src/scemu/maps32/shell32.dll\n\t4 sections  base addr 0x73800000\n\tcreated pe32 map for section `.text` at 0x73801000 size: 3966180\n\tcreated pe32 map for section `.data` at 0x73bca000 size: 26872\n\tcreated pe32 map for section `.rsrc` at 0x73bd1000 size: 8670296\n/!\\ warning: raw sz:12872192 off:12660736 sz:211456  off+sz:12872192\n\tcreated pe32 map for section `.reloc` at 0x74416000 size: 211060\nLoaded /home/sha0/src/scemu/maps32/pstorec.dll\n\t5 sections  base addr 0x5a800000\n\tcreated pe32 map for section `.text` at 0x5a801000 size: 1105\n\tcreated pe32 map for section `.data` at 0x5a802000 size: 804\n\tcreated pe32 map for section `.idata` at 0x5a803000 size: 480\n\tcreated pe32 map for section `.rsrc` at 0x5a804000 size: 9936\n/!\\ warning: raw sz:14336 off:13824 sz:512  off+sz:14336\n\tcreated pe32 map for section `.reloc` at 0x5a807000 size: 44\nLoaded /home/sha0/src/scemu/maps32/rasapi32.dll\n\t6 sections  base addr 0x10000000\n\tcreated pe32 map for section `.text` at 0x10001000 size: 812208\n\tcreated pe32 map for section `.data` at 0x100c8000 size: 5692\n\tcreated pe32 map for section `.idata` at 0x100ca000 size: 9484\n\tcreated pe32 map for section `.didat` at 0x100cd000 size: 524\n\tcreated pe32 map for section `.rsrc` at 0x100ce000 size: 1296\n/!\\ warning: raw sz:875008 off:826880 sz:48128  off+sz:875008\n\tcreated pe32 map for section `.reloc` at 0x100cf000 size: 47656\nIAT Bound.\nLoaded /home/sha0/samples/danabot/2023-04-03-MainModule/unpacked2/dbmm_unpacked.dll\n\t10 sections  base addr 0x1e70000\n\tcreated pe32 map for section `.text` at 0x1e71000 size: 31920128\n\tentry point at 0x22f7968  0x487968 \n\tcreated pe32 map for section `.itext` at 0x22f6000 size: 36659200\n\tcreated pe32 map for section `.data` at 0x22f8000 size: 36667392\n\tcreated pe32 map for section `.bss` at 0x236f000 size: 37154816\n\tcreated pe32 map for section `.idata` at 0x2489000 size: 38309888\n\tcreated pe32 map for section `.didata` at 0x248e000 size: 38330368\n\tcreated pe32 map for section `.edata` at 0x248f000 size: 38334464\n\tcreated pe32 map for section `.rdata` at 0x2490000 size: 38338560\n\tcreated pe32 map for section `.reloc` at 0x2491000 size: 38342656\n/!\\ warning: raw sz:372658176 off:334061568 sz:38596608  off+sz:372658176\n\tcreated pe32 map for section `.rsrc` at 0x24cd000 size: 38596608\n\n```\n\n### calling xloader keygen function with 1 params.\n\n```python\n\n\u003e\u003e\u003e hex(emu.get_reg('eip'))\n'0x22f7968'\n\n\u003e\u003e\u003e struct_ptr = 0x03DB000   # somewhere, evrithing is writable.\n\u003e\u003e\u003e xloader_key1_keygen = 0x03DB687\n\n\u003e\u003e\u003e eax = emu.call32(xloader_key1_keygen, [struct_ptr])\n\n\u003e\u003e\u003e rc4_key = emu.read_string_of_bytes(struct_ptr+1980, 20)\n\u003e\u003e\u003e rc4_key\n'03 00 00 6a 02 51 ff d2 80 3b 00 74 4e 8b 4d 14 6a 08 89 8e '\n\n```\n\nother way to do the call:\n\n```python\n\u003e\u003e\u003e struct_ptr = 0x03DB000\n\u003e\u003e\u003e xloader_key1_keygen = 0x03DB687\n\u003e\u003e\u003e old_eip = emu.set_reg('eip', xloader_key1_keygen)\n\u003e\u003e\u003e ret_addr = old_eip\n\u003e\u003e\u003e emu.stack_push32(struct_ptr)\nTrue\n\u003e\u003e\u003e emu.stack_push32(ret_addr)\nTrue\n\u003e\u003e\u003e emu.run(ret_addr)  # point ret_addr to some mapped place and run until ret_addr\n```\n\n\n### Spawn console by address or by position.\n\n```python\n\u003e\u003e\u003e emu.spawn_console_at_pos(6)\n\u003e\u003e\u003e emu.set_verbose(3)\n\u003e\u003e\u003e emu.run(0)\nshellcode detected.\n1 0x3c8b97: push  ebp ;0x22f000 \n2 0x3c8b97: push  ebp ;0x22f000 \n3 0x3c8b98: mov   ebp,esp\n4 0x3c8b9a: mov   ecx,[ebp+0Ch]\n5 0x3c8b9d: mov   eax,[ebp+8]\n-------\n6 0x3c8ba0: xor   [eax],ecx\n--- console ---\n=\u003er eax\n\teax: 0x3c0000 3932160 (code)\n=\u003er ecx\n\tecx: 0x464 1124 'AAAABBBB' (struct_buff)\n=\u003e\n```\n\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsha0coder%2Fpyscemu","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsha0coder%2Fpyscemu","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsha0coder%2Fpyscemu/lists"}