# scdbgc
> Shellcode emulator — analyze shellcode behavior through API-level emulation

**Category:** [[categories/dynamically-reverse-engineer-code-shellcode|Dynamically Reverse-Engineer Code > Shellcode]] | **Tier:** Rich (FOR610)
**Docs:** [https://docs.remnux.org/discover-the-tools/dynamically+reverse-engineer+code/shellcode](https://docs.remnux.org/discover-the-tools/dynamically+reverse-engineer+code/shellcode)

## Usage
```bash
scdbgc /f shellcode.bin /s -1
scdbgc /f shellcode.bin /foff 0x3B /fopen qa.doc
scdbgc /f shellcode.bin /s -1 /norw
```

## Recipes
- [[recipes/office-full-decode-chain|Full Office Macro Decode Chain]]
- [[recipes/rtf-shellcode-extraction|Extract Shellcode from RTF Document]]
- [[recipes/shellcode-emulate-with-offset|Emulate Shellcode at Specific Offset]]

## Workflows
- [[workflows/document-analysis-workflow|Malicious Document Analysis]] — Step 6: Embedded Object Analysis
- [[workflows/shellcode-analysis-workflow|Shellcode Analysis]] — Step 3: Emulation

## Related Tools
- [[tools/libemu|libemu]] — A library for x86 code emulation and shellcode detection.
- [[tools/runsc32|runsc32]] — Execute extracted shellcode for dynamic analysis
- [[tools/shcode2exe|shcode2exe]] — Convert raw shellcode to a Windows PE executable for analysi
- [[tools/shellcode2exe-bat|shellcode2exe-bat]] — Convert 32 and 64-bit shellcode to a Windows executable file

## FOR610
**Labs:** 3.4, 3.5, 4.6
**Sections:** 3, 4

#shellcode #emulation #api-calls