mwemu is a pure-Rust hardware emulator and OS process simulator that lets authorized analysts safely detonate shellcode, PE32/PE64 payloads, and loader-stage malware inside a controlled virtual CPU.
| Tool | mwemuorg/mwemu — x86/AArch64 malware emulator and Windows process simulator written in pure Rust |
| Category | Malware analysis / emulation framework |
| Primary Use | Emulating shellcode, PE32/PE64 samples, metasploit encoders and cobaltstrike loaders to decrypt strings, unpack payloads, and extract IOCs in a sandboxed environment |
| Safe Use | Educational and documentary analysis for malware researchers and authorized security teams working in isolated lab environments; the emulator never executes sample code natively on the host CPU |
| Telemetry Note | Emulation runs entirely in user space on the analyst's machine — the tool itself contacts no network and leaves the host untouched; defenders should note that emulated samples may attempt WinAPI calls that mwemu intercepts and logs rather than fulfills |
mwemu — formerly known as scemu — is a hardware emulator plus OS process simulator implemented entirely in Rust, with no native execution of the sample under analysis. That architectural decision matters a great deal for malware analysts: instead of running suspicious code on a real CPU and hoping your sandbox holds, mwemu interprets each instruction in software, which means you can stop at any point, inspect memory, mutate registers, and resume without the sample ever touching your filesystem or network in a meaningful way. The repository reports 315 stars, an Apache-2.0 license, and a Rust codebase with a minimum supported rustc version of 1.88+, which signals an actively maintained, professionally structured project rather than a weekend experiment.
The emulator supports x86 32-bit and 64-bit as well as AArch64, and the primary target OS is Windows, where it performs full process emulation: PEB and TEB structures, SEH chains, vectored exception handlers, IAT binding, delay loading, dynamic linking, and a memory allocator. There is growing support for Linux and macOS via syscalls, ELF and Mach-O loaders, and libc shims. For an analyst, this means the loader-stage tricks that malware uses to detect virtual environments — checking BeingDebugged in the PEB, walking SEH to confuse debuggers, issuing fake cpuid queries — are all emulatable and observable rather than being silent failure points.
Instruction coverage is substantial: 850 CPU instructions are implemented, backed by the iced-x86 disassembler library. On the Windows API side, the README claims 835 winapi functions implemented across 26 DLLs for 32-bit and 258 for 64-bit, plus all Linux syscalls. The performance figure quoted is around 12,700,000 instructions per second — roughly 20 million instructions emulated in about 1.5 seconds — and the author provides make test_speed so you can reproduce the benchmark yourself. That throughput is what makes the tool practical for heavily obfuscated loaders, which routinely burn tens or hundreds of millions of instructions in decryption loops before doing anything interesting.
The distribution model is unusually flexible. Beyond the mwemu command-line tool, the project ships libmwemu as a crates.io crate, cmwemu as a C binding, and pymwemu on PyPI for Python-driven automation. This opens the door to building automated unpacking pipelines — for example, scripting pymwemu to emulate a sample until a string-decryption routine completes, then dumping the plaintext — and the README documents exactly those workflows against families like raccoon, vidar, xloader, lokibot, mars, danabot, zloader, bumblebee, and gozi, including bumblebee unpacking after 25,515,274,634 emulated instructions and a gozi DGA predictor.
What makes mwemu distinct from a generic emulator is its debugging ergonomics. The -c flag stops emulation at a specific instruction count — the README calls this an emulation moment, a unique ID for a point in execution — and drops you into an interactive console. From there you can inspect registers, toggle flags, walk the stack, view SEH and VEH pointers, create or load memory maps, search strings and bytes across all maps, dump memory to disk, disassemble, and single-step. Breakpoints are supported on addresses, instruction numbers, and memory reads or writes (bmr/bmw), which is exactly the kind of surgical control you want when reverse engineering a decryption routine that operates on a buffer at a known offset.
The CLI surface is dense but coherent. Flags like -vv display the assembly as it executes, -m traces memory accesses, -r prints register values per step, -p traces the stack on push/pop, and --banzai skips unimplemented instructions to keep emulating what the CPU model does support — a pragmatic fallback for samples that touch rare opcodes. Options like -i 'dword ptr [ebp + 0x24]' let you monitor a specific memory expression, -R traces a chosen register across execution, and --iso ~/Downloads/win11.iso extracts genuine system32 DLLs from a Windows ISO to use as the API maps folder, giving more realistic API resolution than synthetic stubs alone.
Two installation/invocation patterns are worth highlighting from the README, both non-weaponized analysis workflows. Building and running locally is cargo run --release -- -f calc.exe -6 --winver win11, which emulates a benign 64-bit executable under a simulated Windows 11 profile; there is also a --syscall-mode variant that routes execution through syscall simulation. For shellcode, cargo run --release -- -f /tmp/shellcode.bin -6 -vv -c 19291 emulates a blob with assembly display and a console breakpoint at instruction 19291. Python users can pip install pymwemu to drive the same engine programmatically.
The README documents full emulation of well-known payloads including metasploit shellcodes, metasploit encoders such as shikata-ga-nai and SGN (both of which lean on FPU instructions to hide their polymorphism — mwemu provides -F to trace FPU state), cobaltstrike loaders, shellgen, and the mars stealer PE32 and bumblebee. Partial emulation is claimed for trickier specimens like guloader — where the author notes it progresses further than a conventional debugger — plus xloader and danabot. This is analysis of adversary tooling in a controlled harness, not reproduction of attacks, and it is precisely the workflow threat researchers use to extract configurations and IOCs.
Under the hood, the memory model is map-based: several maps exist by default and more can be created via emulated LoadLibraryA calls or manually from the console. The iteration detector and memory/register tracking features help analysts spot when a sample is stuck in a decryption loop versus making forward progress, and the -l flag surfaces loop iterations at the cost of speed. The ability to react to int3 and to fake cpuid results is essential for loaders that use debugger traps and hardware fingerprinting as anti-analysis measures — guloader's SIGTRAP confusion trick is shown in the project screenshots.
The project also integrates with the wider reversing ecosystem: an r2con2025 talk demonstrates using radare2 from inside mwemu for static analysis and visualization at an emulation moment, meaning you can pause execution and immediately disassemble or annotate the current state with r2 tooling. Official documentation lives at mwemu.github.io, and CI badges plus active crate and PyPI releases suggest a healthy release cadence rather than an abandoned dump.
For defenders and authorized security teams, mwemu occupies a specific niche between static analysis and full dynamic sandboxing: it gives you the determinism of static tooling with the behavioral visibility of detonation, without the infrastructure cost of virtual machines. The telemetry angle is worth stating plainly — because emulated WinAPI calls are intercepted and logged rather than executed, an analyst running mwemu generates a complete record of what a sample tried to do, which is directly useful for detection engineering and IOC extraction, all while the host machine remains untouched by the emulated code. As with any analysis tool, run it in an authorized lab environment on samples you are permitted to examine.
mwemuorg/mwemu.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.