REW-sploit: Dissect Payloads With Ease by Cesare Pizzi

## Overview Cesare Pizzi presents REW-sploit, an open-source reverse-engineering tool designed to analyze and extract artifacts from malicious payloads, particularly those generated by Metasploit and Cobalt Strike. Built on Unicorn Engine (a CPU emulator) and Mandiant Speakeasy, the tool addresses a gap in red-team tooling by providing defenders and reverse engineers with dynamic emulation-based analysis of encrypted and obfuscated payloads.

## Key Capabilities REW-sploit automatically detects payload formats (32/64-bit shellcode, DLLs, executables) and performs emulation to extract API calls, encryption keys, configuration data, and other artifacts. For Metasploit payloads, it can extract RC4 and ChaCha encryption keys, identify C2 addresses, and decrypt second-stage payloads captured in PCAP files. For Meterpreter shells, it detects RSA/AES encryption handshakes and can force fallback to weaker encryption if the attacker's RSA public key import fails. Cobalt Strike beacon analysis extracts configuration, C2 parameters, and sleep masks even when heavily customized by attackers.

## Technical Approach The tool uses dynamic emulation rather than static analysis to defeat obfuscation and encryption common in modern malware. Pizzi implemented numerous "fix-ups" to address emulation fragility—including workarounds for Shikata Ga Nai encoded code, floating-point instruction inconsistencies, stack size limitations, and API call failures in Unicorn/Speakeasy. The CLI-based interface supports features like memory allocation dumping, thread extraction, and anti-debug trick detection across 20+ known techniques.

## Supported Threats Beyond Metasploit and Cobalt Strike, REW-sploit extends support to Donut (position-independent code conversion), PEzzer (packer), and SGN. Each integration required custom fix-ups to ensure reliable emulation. The tool is designed modular and extensible via YARA rules and Python scripting, allowing users to guide execution through specific code branches for deeper analysis.

## Advantages and Limitations Advantages include defeating encryption and obfuscation without decryption keys, interactively modifying code execution to explore alternate branches, and rapid extraction of artifacts. Disadvantages include emulation fragility (not a true sandbox), slower execution, and a learning curve. Pizzi emphasizes this is not a replacement for traditional reverse-engineering tools like IDA or Ghidra but a complementary analysis accelerator.

## Project Status and Future Work REW-sploit is at version 0.4 and open-source on GitHub. Pizzi actively contributes improvements back to upstream projects (Speakeasy, Unicorn) and seeks community contributions. Next steps include improved stability, performance optimization, expanded debug coverage, and broader platform support. The speaker encourages users to open issues and engage on GitHub for collaborative development.