# Speakeasy > Mandiant's Windows malware emulation framework, which runs PE executables, DLLs, kernel drivers and raw x86/amd64 shellcode on the Unicorn CPU emulator inside a modeled Windows runtime instead of a full VM. Hand-written handlers and a signature database built from win32metadata and phnt emulate Windows API calls, process and thread behavior, the filesystem, registry and network, and each run is recorded as a structured JSON report of API events with named arguments, dropped files and optional memory snapshots. It runs from the speakeasy CLI or as a Python library, and a built-in GDB stub lets an analyst step through an emulated sample. - Type: Tool - Targets: Binary - Category: Debugging and dynamic analysis - Relationship: Foundation tool - Sources reviewed: 2026-10-20 - Added to the catalog: 2026-11-02 - Original resource: - Primary source: - Catalog page: - Record JSON: - Chinese version: [简体中文](https://awesomerea.org/zh/resources/speakeasy/index.md) ## Requirements & limits - Latest release at review: v2.0.0b9, a GitHub pre-release published 2026-10-11 that tags the reviewed master commit and moves the report format to version 5.0.0. The newest stable speakeasy-emulator on PyPI is still 1.5.11 from 2022, and pip skips pre-releases by default, so the README's plain pip install resolves to 1.5.11 unless a 2.0 beta is requested. - Requires Python 3.10+; dependencies include Unicorn 2.1.4+, pefile, Capstone and pycryptodome, and the package is marked OS independent. Source installs need a recursive clone for the win32json and phnt submodules plus two scripts that generate the API signature databases; the Dockerfile builds a Python 3.13 image that mounts samples at /sandbox. GDB sessions connect gdb-multiarch or another GDB to the stub, which the documentation warns has no authentication. - Samples come from the user. The tests use small test executables, DLLs, WDM drivers and a shellcode blob under tests/bins, and the capa-testfiles submodule of Mandiant's capa test data, which supplies Practical Malware Analysis lab samples; handle both as malware-analysis material. - The limitations page says only a curated subset of APIs has handlers: APIs emulated from signatures alone return success values without real side effects, unknown imports stop a run, and a missing file, registry key or network response can look like anti-analysis behavior, so reports need analyst interpretation. MIT licensed; the win32json, phnt and capa-testfiles submodules keep their own terms. ## Primary sources 1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 11. 12. 13. 14. 15. ## More in Native binaries - [LazyIDA](https://awesomerea.org/resources/lazyida/index.md) · Tool - [Tiny Tracer](https://awesomerea.org/resources/tiny-tracer/index.md) · Tool - [Ponce](https://awesomerea.org/resources/ponce/index.md) · Tool - [DRAKVUF Sandbox](https://awesomerea.org/resources/drakvuf-sandbox/index.md) · Tool - [HexRaysPyTools](https://awesomerea.org/resources/hexrayspytools/index.md) · Tool - [CAPE Sandbox (CAPEv2)](https://awesomerea.org/resources/capev2/index.md) · Tool ## About this entry The description was reviewed against primary sources. Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.