Scallop Shell

Inspiration

GDB, pwndbg, Ghidra, IDA, are the current industry standards in reverse engineering. They are not well optimized for reverse engineering polymorphic binaries. The debuggers statically disassemble memory instead of displaying currently run instructions. They also aren't supported on Windows, and the windows debuggers are mostly GUI based. The decompilers completely break once you involve polymorphic code.

What it does

Debug polymorphic code, dynamic memory patching, file I/O watching, multithreaded debugging, and then restructuring instruction traces to give to a decompiler like Ghidra.

How I built it

A year of tears.

Challenges I ran into

QEMU does not like me.

Accomplishments that I'm proud of

It's the first way anyone has been able to decompile self modifying code. So that is pretty cool to say I did.

What I learned

I learned much more about how to be smart with constructing a complex program. It is by far the biggest project I've ever done, and I have rewritten it twice (nearly 3 times)

What's next for Scallop Shell

• In memory execution ( Executable mmap() ) loading
  • Currently filters out everything outside of the binary range to get rid of LibC and Linux libraries
• Built in assembler
• Improved symbol parsing
• Time Travel Debugging
  • Already have access to memory and register read / write values
  • File I/O reversibility is a key focus
• Heavily improved decompiler stager
• Support for macOS officially, Windows
  • macOS is straightforward and requires minimal changes
  • Windows requires the replacement of the QEMU API with a Windows instrumentation kit
• Scallop Shell MCP
• Becoming an overall “dynamic as possible” debugger
  • Program should be a mutable entity

Built With

• c++
• llvm
• x64