{ "added_at": "2026-11-02", "additional_evidence_urls": [ "https://github.com/mandiant/speakeasy/blob/aa9f22643f4519e0555141cd16ee25eb971b5518/doc/install.md", "https://github.com/mandiant/speakeasy/blob/aa9f22643f4519e0555141cd16ee25eb971b5518/doc/limitations.md", "https://github.com/mandiant/speakeasy/blob/aa9f22643f4519e0555141cd16ee25eb971b5518/doc/cli-reference.md", "https://github.com/mandiant/speakeasy/blob/aa9f22643f4519e0555141cd16ee25eb971b5518/doc/reporting.md", "https://github.com/mandiant/speakeasy/blob/aa9f22643f4519e0555141cd16ee25eb971b5518/doc/gdb.md", "https://github.com/mandiant/speakeasy/blob/aa9f22643f4519e0555141cd16ee25eb971b5518/pyproject.toml", "https://github.com/mandiant/speakeasy/blob/aa9f22643f4519e0555141cd16ee25eb971b5518/speakeasy/version.py", "https://github.com/mandiant/speakeasy/blob/aa9f22643f4519e0555141cd16ee25eb971b5518/.gitmodules", "https://github.com/mandiant/speakeasy/blob/aa9f22643f4519e0555141cd16ee25eb971b5518/Dockerfile", "https://github.com/mandiant/speakeasy/blob/aa9f22643f4519e0555141cd16ee25eb971b5518/LICENSE.txt", "https://github.com/mandiant/speakeasy/tree/aa9f22643f4519e0555141cd16ee25eb971b5518/tests/bins", "https://github.com/mandiant/speakeasy/blob/aa9f22643f4519e0555141cd16ee25eb971b5518/tests/pma_cases.py", "https://github.com/mandiant/speakeasy/releases/tag/v2.0.0b9", "https://pypi.org/project/speakeasy-emulator/1.5.11/" ], "category": "dynamic-analysis", "description_en": "Mandiant's Windows malware emulation framework, which runs PE executables, DLLs, kernel drivers and raw x86/amd64 shellcode on the Unicorn CPU emulator inside a modeled Windows runtime instead of a full VM. Hand-written handlers and a signature database built from win32metadata and phnt emulate Windows API calls, process and thread behavior, the filesystem, registry and network, and each run is recorded as a structured JSON report of API events with named arguments, dropped files and optional memory snapshots. It runs from the speakeasy CLI or as a Python library, and a built-in GDB stub lets an analyst step through an emulated sample.", "description_zh": "Mandiant 的 Windows 恶意软件仿真框架，借助 Unicorn CPU 仿真器，在模拟的 Windows 运行环境（而非完整虚拟机）中运行 PE 可执行文件、DLL、内核驱动和原始 x86/amd64 shellcode。手写的处理程序加上由 win32metadata 和 phnt 生成的签名库，负责模拟 Windows API 调用、进程与线程行为、文件系统、注册表和网络，每次运行都记录为结构化 JSON 报告，其中包含带参数名的 API 事件、释放的文件以及可选的内存快照。它可通过 speakeasy 命令行或作为 Python 库使用，内置的 GDB 桩可让分析者单步调试仿真中的样本。", "entry_url": "https://awesomerea.org/resources/speakeasy/", "entry_url_zh": "https://awesomerea.org/zh/resources/speakeasy/", "evidence_url": "https://github.com/mandiant/speakeasy/blob/aa9f22643f4519e0555141cd16ee25eb971b5518/README.md", "group": "tools", "id": "speakeasy", "json_url": "https://awesomerea.org/resources/speakeasy/record.json", "kind": "tool", "markdown_url": "https://awesomerea.org/resources/speakeasy/index.md", "markdown_url_zh": "https://awesomerea.org/zh/resources/speakeasy/index.md", "name": "Speakeasy", "name_zh": "Speakeasy Windows 恶意软件仿真框架", "record_type": "resource", "relationship": "foundation", "requirements": [ "Latest release at review: v2.0.0b9, a GitHub pre-release published 2026-10-11 that tags the reviewed master commit and moves the report format to version 5.0.0. The newest stable speakeasy-emulator on PyPI is still 1.5.11 from 2022, and pip skips pre-releases by default, so the README's plain pip install resolves to 1.5.11 unless a 2.0 beta is requested.", "Requires Python 3.10+; dependencies include Unicorn 2.1.4+, pefile, Capstone and pycryptodome, and the package is marked OS independent. Source installs need a recursive clone for the win32json and phnt submodules plus two scripts that generate the API signature databases; the Dockerfile builds a Python 3.13 image that mounts samples at /sandbox. GDB sessions connect gdb-multiarch or another GDB to the stub, which the documentation warns has no authentication.", "Samples come from the user. The tests use small test executables, DLLs, WDM drivers and a shellcode blob under tests/bins, and the capa-testfiles submodule of Mandiant's capa test data, which supplies Practical Malware Analysis lab samples; handle both as malware-analysis material.", "The limitations page says only a curated subset of APIs has handlers: APIs emulated from signatures alone return success values without real side effects, unknown imports stop a run, and a missing file, registry key or network response can look like anti-analysis behavior, so reports need analyst interpretation. MIT licensed; the win32json, phnt and capa-testfiles submodules keep their own terms." ], "requirements_zh": [ "审阅时最新版本为 v2.0.0b9，是 2026-10-11 发布的 GitHub 预发布版，指向所审阅的 master 提交，并将报告格式升级为 5.0.0 版。PyPI 上 speakeasy-emulator 的最新稳定版仍是 2022 年的 1.5.11，而 pip 默认跳过预发布版本，因此除非明确指定 2.0 测试版，README 中直接 pip install 的命令会装到 1.5.11。", "需要 Python 3.10+；依赖包括 Unicorn 2.1.4+、pefile、Capstone 和 pycryptodome，包元数据标注为与操作系统无关。从源码安装需递归克隆 win32json 和 phnt 子模块，并运行两个生成 API 签名库的脚本；Dockerfile 构建 Python 3.13 镜像，样本挂载在 /sandbox。GDB 调试需用 gdb-multiarch 或其他 GDB 连接调试桩，文档提醒该调试桩没有任何身份验证。", "样本由使用者自行提供。测试使用 tests/bins 下的小型测试可执行文件、DLL、WDM 驱动和一个 shellcode 样本，以及 capa-testfiles 子模块中 Mandiant 的 capa 测试数据，后者提供《Practical Malware Analysis》实验样本；两者都应按恶意软件分析材料处理。", "局限说明页指出，只有精选的一部分 API 有手写处理程序：仅凭签名仿真的 API 只返回成功值而没有真实副作用，未知导入会终止运行，缺失的文件、注册表项或网络响应可能看起来像反分析行为，因此报告需要分析者自行解读。采用 MIT 许可；win32json、phnt 和 capa-testfiles 子模块适用各自条款。" ], "targets": [ "binary" ], "url": "https://github.com/mandiant/speakeasy", "verification": "source-reviewed", "verified_at": "2026-10-20" }