Reversing and De-Obfuscating Malware with Software Emulation | Nullcon Webinar 2022

### Overview In this Nullcon Webinar 2022 presentation, security researcher Chiziar Fidzi explores how software emulation can be used to reverse engineer and de-obfuscate malware. Hosted by Sakshi from the Nullcon team, the webinar contrasts software emulation against traditional full-OS sandboxing (such as Cuckoo, Anubis, or Joe Sandbox). While a sandbox runs malware within an actual operating system, emulation constructs a simulated OS environment around the binary using engines like Unicorn and Speakeasy. This approach gives analysts fine-grained control to inspect API calls, bypass network failures, instrument instructions, and force execution down specific paths.

### Key Topics - **Emulation vs. Sandboxing**: Understanding the distinction between detonating malware in a live VM and emulating hardware/OS structures (such as TEB/PEB via Python engines) to achieve deep code instrumentation. - **Overcoming Infrastructure Downtime**: Faking network and API responses when external Command and Control (C2) servers or domains are already dead. - **De-obfuscating Control Flow Flattening**: Resolving complex dispatcher loops, switch/state machines, and opaque execution flows by inspecting and instrumenting CPU registers. - **Analyzing In-Memory Evasion**: Tracking API hooks and memory dumps to identify unhooking techniques aimed at evading EDR/antivirus tools.

### Technical Details The speaker uses Ghidra for static analysis alongside his Python-based tool **Resploit** (RispR0it), which builds upon Unicorn and Speakeasy.

1. **Case 1: Excel Macro Shellcode Extraction & Emulation** - A malicious Excel macro extracts an array of bytes, creates a buffer via `VirtualAlloc`, and executes shellcode using `CreateThread`. - Running Resploit’s `emulate payload` command reveals process injection: a suspended `rundll32.exe` process is spawned via `CreateProcess`, memory is written, and execution continues via `CreateRemoteThread`. - Unlike full sandbox runs (e.g., Any.run), which stalled at unresolved DNS queries for `shinyobjects.birds`, the emulator simulates network functions, dumping a second-stage payload (`metal.exe` saved locally as `chrome.exe`). Resploit dumps thread memory using the `-t` flag and skips long sleep cycles automatically.

2. **Case 2: De-obfuscating a Flattened Ramnit / Bumblebee DLL** - The target is an x86 DLL lacking standard exports, requiring execution via `DllMain` (`DLL_PROCESS_ATTACH`). - The malware utilizes `MapViewOfFile` to map `ntdll.dll` into memory. In an emulator, missing OS files must be provided in the tool's filesystem directory to avoid path errors. - Ghidra reveals heavy control flow flattening (a complex state machine driven by nested `while` loops and the `EAX` register). - By inserting Python instrumentation into the emulation script at address `32B6`, the speaker logs the values of `EAX` at the start of loop iterations, effectively unrolling the flattened control flow. - Tracking the unrolled state reveals the loop searches for the export `NtProtectVirtualMemory` within the mapped `ntdll.dll`. - Using Resploit's `-m` flag (dumping memory allocations on read, execute, or free), the speaker captures the allocated buffer before the function breaks. Cross-referencing the dumped memory in PE-bear confirms the malware is copying a clean version of `NtProtectVirtualMemory` directly into memory to bypass EDR/AV userland hooks.

### Takeaways - Emulation offers unparalleled control over code flow, letting analysts trace internal registers, modify branch execution, and dump unpacked memory buffers on demand. - While emulation encounters performance bottlenecks with repetitive loops (making it substantially slower than bare-metal execution), it provides critical advantages when dealing with offline C2 infrastructure, complex API unhooking, and control flow flattening.