Tool
kdemulator
kdemulator executes Windows x86-64 kernel-driver binaries outside a live kernel for IOCTL analysis. It maps PE sections into Unicorn, intercepts imported NT API calls and supplies minimal kernel-object and memory stubs. The CLI can invoke DriverEntry, send one IOCTL or run a mutation loop over an IOCTL input buffer.
- Targets
- Binary
- Category
- Debugging and dynamic analysis
- Relationship
- Foundation tool
- Sources reviewed
Requirements & limits
- Scope: Windows x86-64 driver .sys files are the documented inputs.
- Limits: Emulation covers only the driver's own code and directly imported functions; hardware-facing drivers need additional stubs.
- License: Unlicense.
About this entry
The description was reviewed against primary sources.
Primary sources
- README.md GitHub · 000nico/kdemulator · Revision 44c0521
- emu-cli.md GitHub · 000nico/kdemulator · Revision 44c0521
- LICENSE GitHub · 000nico/kdemulator · Revision 44c0521
More in Native binaries
- angr-management · Tool
- QIRA · Tool
- Dependencies · Tool
- Hachoir · Tool
- Pigaios · Tool
- MachOExplorer · Tool