This is the third part of our three-part series on code emulation for malware analysis:

• Part 1 explains how to use radare2’s function emulation feature, featuring a password-cracking exercise using radare2’s Python scripting plugin, r2pipe.
• Part 2 demonstrates how to decode the configuration of the Mirai IoT botnet by writing an automation script using radare2’s Python scripting capabilities.
• Part 3 (this post) builds on the previous script by adding support for searching encrypted string addresses and generating function signatures to locate the decryption routine dynamically.

In the previous two posts, we explored how to emulate string decryption routines using radare2 macros and Python scripts. We successfully decrypted parts of the configuration, but not all of it. In this post, we will enhance our automation script to solve this. Specifically, we will find the addresses of the encrypted data dynamically and feed them into our emulator.

We will also address another interesting challenge: when testing our script against different Mirai variants, the decryption function offset changes. Even though the underlying assembly remains identical, the hardcoded address breaks. We can elegantly solve this by creating function signatures—another incredibly useful feature in radare2. Let’s get right into it!

This is the second part of a three-part series on code emulation for reverse engineering malware:

• Part 1 covers radare2 function emulation basics and walk through cracking a password-checking function using radare2’s Python scripting plugin, r2pipe.
• Part 2 (this post) details how to leverage emulation to decode the configuration of a Mirai IoT botnet sample by implementing a decryption script in Python.
• Part 3 refactors our script to automatically locate encrypted string references and generate function signatures, eliminating hardcoded function offsets.

In the previous post, we explored how to use partial code emulation to decrypt obfuscated strings inside a binary. In this post, we will look at a real-world sample of the infamous Mirai IoT malware. We chose Mirai because it hides critical configuration details—like command-and-control (C2) servers and ports—behind encryption. Since Mirai is compiled for multiple architectures, we will focus on the x86 variant for this analysis.

Our main goal is to automate the decryption of this configuration array using radare2. Along the way, we will perform static analysis on the binary and reverse-engineer the decryption routine to understand its inner workings.

Yet another Linux Botnet sample by the name of Bushido by a group called 0ffsecurity, but this time things are little interesting, the bad actor is not just interested in using compromised IOT device as DOS attack surface but also using compromised web servers. In this post, we will examine how a small infection shell script which leads to the unravelling of dozens of malware. Solving this case also uncovered the hacker group behind this malware.

This is the first part of our three-part series on code emulation for malware analysis:

• Part 1 (this post) explains how to use radare2’s function emulation feature, featuring a password-cracking exercise using radare2’s Python scripting plugin, r2pipe.
• Part 2 demonstrates how to decode the configuration of the Mirai IoT botnet by writing an automation script using radare2’s Python scripting capabilities.
• Part 3 builds on the previous script by adding support for searching encrypted string addresses and generating function signatures to locate the decryption routine dynamically.

radare2 is an exceptionally powerful reverse engineering framework supporting a wide variety of CPU architectures. Among its many capabilities, one feature that consistently stands out is partial code emulation. While I was initially skeptical about its practical use cases, experimenting with it quickly revealed its massive potential. It is simply a game-changer for static analysis.