Awesome REA
中文Star on GitHubStar1.1k stars
Star on GitHubStar1.1k stars

Tool

Speakeasy

Mandiant's Windows malware emulation framework, which runs PE executables, DLLs, kernel drivers and raw x86/amd64 shellcode on the Unicorn CPU emulator inside a modeled Windows runtime instead of a full VM. Hand-written handlers and a signature database built from win32metadata and phnt emulate Windows API calls, process and thread behavior, the filesystem, registry and network, and each run is recorded as a structured JSON report of API events with named arguments, dropped files and optional memory snapshots. It runs from the speakeasy CLI or as a Python library, and a built-in GDB stub lets an analyst step through an emulated sample.

Targets
Binary
Category
Debugging and dynamic analysis
Relationship
Foundation tool
Sources reviewed

Requirements & limits

  • Latest release at review: v2.0.0b9, a GitHub pre-release published 2026-10-11 that tags the reviewed master commit and moves the report format to version 5.0.0. The newest stable speakeasy-emulator on PyPI is still 1.5.11 from 2022, and pip skips pre-releases by default, so the README's plain pip install resolves to 1.5.11 unless a 2.0 beta is requested.
  • Requires Python 3.10+; dependencies include Unicorn 2.1.4+, pefile, Capstone and pycryptodome, and the package is marked OS independent. Source installs need a recursive clone for the win32json and phnt submodules plus two scripts that generate the API signature databases; the Dockerfile builds a Python 3.13 image that mounts samples at /sandbox. GDB sessions connect gdb-multiarch or another GDB to the stub, which the documentation warns has no authentication.
  • Samples come from the user. The tests use small test executables, DLLs, WDM drivers and a shellcode blob under tests/bins, and the capa-testfiles submodule of Mandiant's capa test data, which supplies Practical Malware Analysis lab samples; handle both as malware-analysis material.
  • The limitations page says only a curated subset of APIs has handlers: APIs emulated from signatures alone return success values without real side effects, unknown imports stop a run, and a missing file, registry key or network response can look like anti-analysis behavior, so reports need analyst interpretation. MIT licensed; the win32json, phnt and capa-testfiles submodules keep their own terms.

About this entry

The description was reviewed against primary sources.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · mandiant/speakeasy · Revision aa9f226
  2. doc/install.md GitHub · mandiant/speakeasy · Revision aa9f226
  3. doc/limitations.md GitHub · mandiant/speakeasy · Revision aa9f226
  4. doc/cli-reference.md GitHub · mandiant/speakeasy · Revision aa9f226
  5. doc/reporting.md GitHub · mandiant/speakeasy · Revision aa9f226
  6. doc/gdb.md GitHub · mandiant/speakeasy · Revision aa9f226
  7. pyproject.toml GitHub · mandiant/speakeasy · Revision aa9f226
  8. speakeasy/version.py GitHub · mandiant/speakeasy · Revision aa9f226
  9. .gitmodules GitHub · mandiant/speakeasy · Revision aa9f226
  10. Dockerfile GitHub · mandiant/speakeasy · Revision aa9f226
  11. LICENSE.txt GitHub · mandiant/speakeasy · Revision aa9f226
  12. tests/bins GitHub · mandiant/speakeasy · Revision aa9f226
  13. tests/pma_cases.py GitHub · mandiant/speakeasy · Revision aa9f226
  14. https://github.com/mandiant/speakeasy/releases/tag/v2.0.0b9
  15. https://pypi.org/project/speakeasy-emulator/1.5.11/

More in Native binaries

All 269 entries in Native binaries

↑↓ move↵ open⌘↵ new tab