Tool
kdemulator
kdemulator executes Windows x86-64 kernel-driver binaries outside a live kernel for IOCTL analysis. It maps PE sections into Unicorn, intercepts imported NT API calls and supplies minimal kernel-object and memory stubs. The CLI can invoke DriverEntry, send one IOCTL or run a mutation loop over an IOCTL input buffer.
- Targets
- Binary
- Category
- Debugging and dynamic analysis
- Relationship
- Foundation tool
- Sources reviewed
Requirements & limits
- Scope: Windows x86-64 driver .sys files are the documented inputs.
- Limits: Emulation covers only the driver's own code and directly imported functions; hardware-facing drivers need additional stubs.
- License: Unlicense.
About this entry
The description was reviewed against primary sources.
Primary sources
- README.md GitHub · 000nico/kdemulator · Revision 44c0521
- emu-cli.md GitHub · 000nico/kdemulator · Revision 44c0521
- LICENSE GitHub · 000nico/kdemulator · Revision 44c0521
More in Native binaries
- DownUnderCTF: masked-squares flag checker · Case study
- Show Your Work: a measured dissection of REA's evidence architecture · Case study
- Windows loader: static malware analysis with REA and Codex · Case study
- OpenBSD netcat: static REA and Ghidra investigation · Case study
- m0rph: tracing an obfuscated ELF flag checker · Case study
- CPQ IO Scheduler: reconstructing Xiaomi's block scheduler · Case study