> For the complete documentation index, see [llms.txt](https://docs.remnux.org/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.remnux.org/discover-the-tools/dynamically+reverse-engineer+code/shellcode.md).

# Shellcode

Dynamically Reverse-Engineer Code

## shcode2exe

Convert 32 and 64-bit shellcode to a Windows executable file.

**Website**: <https://github.com/accidentalrebel/shcode2exe>\
**Author**: Karlo Licudine: <https://x.com/accidentalrebel>\
**License**: GNU General Public License (GPL) v3.0: <https://github.com/accidentalrebel/shcode2exe/blob/master/LICENSE>\
**Available on**: Intel/AMD (amd64) and ARM (arm64)\
**State File**: [remnux.scripts.shcode2exe](https://github.com/REMnux/salt-states/blob/master/remnux/scripts/shcode2exe.sls)

## shellcode2exe.bat

Convert 32 and 64-bit shellcode to a Windows executable file.

**Website**: <https://github.com/repnz/shellcode2exe>\
**Author**: Ori Damari: <https://x.com/0xrepnz>\
**License**: Free, unknown license\
**Available on**: Intel/AMD (amd64) only\
**Alternative on arm64**: Use speakeasy or qiling instead.\
**Notes**: Use full path name to specify the input file; look for the output file in /usr/local/shellcode2exe-bat\
**State File**: [remnux.tools.shellcode2exe-bat](https://github.com/REMnux/salt-states/blob/master/remnux/tools/shellcode2exe-bat.sls)

## scdbg

Analyze shellcode by emulating its execution.

**Website**: <http://sandsprite.com/blogs/index.php?uid=7&pid=152>\
**Author**: David Zimmer\
**License**: Free, unknown license\
**Available on**: Intel/AMD (amd64) only\
**Alternative on arm64**: Use speakeasy or qiling instead.\
**Notes**: scdbg (GUI), scdbgc (console).\
**State File**: [remnux.packages.scdbg](https://github.com/REMnux/salt-states/blob/master/remnux/packages/scdbg.sls)

## runsc

Run shellcode to trace and analyze its execution.

**Website**: <https://github.com/edygert/runsc>\
**Author**: Evan Dygert: <https://x.com/edygert>\
**License**: MIT License: <https://github.com/edygert/runsc/blob/main/LICENSE>\
**Available on**: Intel/AMD (amd64) only\
**Alternative on arm64**: Use speakeasy or qiling instead.\
**Notes**: Use the `tracesc` command to execute runsc within Wine in a way that traces the execution of shellcode. WARNING! This wrapper will actually execute the shellcode on the system, which might lead to your system becoming infected. Only use this wrapper in a properly configured, isolated laboratory environment, which you can return to a pristine state at the end of your analysis.\
**State File**: [remnux.packages.runsc](https://github.com/REMnux/salt-states/blob/master/remnux/packages/runsc.sls)

## Speakeasy

Emulate code execution, including shellcode, Windows drivers, and Windows PE files.

**Website**: <https://github.com/mandiant/speakeasy>\
**Author**: Mandiant, Andrew Davis\
**License**: MIT License: <https://github.com/mandiant/speakeasy/blob/master/LICENSE.txt>\
**Available on**: Intel/AMD (amd64) and ARM (arm64)\
**Notes**: To run the tool, use `speakeasy`, `emu_exe.py`, and `emu_dll.py` commands.\
**State File**: [remnux.python3-packages.speakeasy](https://github.com/REMnux/salt-states/blob/master/remnux/python3-packages/speakeasy.sls)

## Qiling

Emulate code execution of PE files, shellcode, etc. for a variety of OS and hardware platforms.

**Website**: <https://www.qiling.io>\
**Author**: <https://github.com/qilingframework/qiling/blob/master/AUTHORS.TXT>\
**License**: GNU General Public License (GPL) v2.0: <https://github.com/qilingframework/qiling/blob/master/COPYING>\
**Available on**: Intel/AMD (amd64) and ARM (arm64)\
**Notes**: Use `qltool` to analyze artifacts. Before analyzing Windows artifacts, gather Windows DLLs and other components using the [dllscollector.bat](https://github.com/qilingframework/qiling/blob/master/examples/scripts/dllscollector.bat) script. Read the tool's [documentation](https://docs.qiling.io) to get started.\
**State File**: [remnux.python3-packages.qiling](https://github.com/REMnux/salt-states/blob/master/remnux/python3-packages/qiling.sls)

## libemu

A library for x86 code emulation and shellcode detection.

**Website**: <https://github.com/buffer/libemu>\
**Author**: <https://github.com/buffer/libemu/blob/master/AUTHORS>\
**License**: Free, unknown license\
**Available on**: Intel/AMD (amd64) and ARM (arm64)\
**State File**: [remnux.packages.libemu](https://github.com/REMnux/salt-states/blob/master/remnux/packages/libemu.sls)

## XORSearch

Locate and decode strings obfuscated using common techniques.

**Website**: <https://blog.didierstevens.com/programs/xorsearch/>\
**Author**: Didier Stevens: <https://x.com/DidierStevens>\
**License**: Public Domain\
**Available on**: Intel/AMD (amd64) and ARM (arm64)\
**Notes**: xorsearch\
**State File**: [remnux.packages.xorsearch](https://github.com/REMnux/salt-states/blob/master/remnux/packages/xorsearch.sls)