# kdemulator

> kdemulator executes Windows x86-64 kernel-driver binaries outside a live kernel for IOCTL analysis. It maps PE sections into Unicorn, intercepts imported NT API calls and supplies minimal kernel-object and memory stubs. The CLI can invoke DriverEntry, send one IOCTL or run a mutation loop over an IOCTL input buffer.

- Type: Tool
- Targets: Binary
- Category: Debugging and dynamic analysis
- Relationship: Foundation tool
- Sources reviewed: 2026-11-06
- Added to the catalog: 2026-11-06
- Original resource: <https://github.com/000nico/kdemulator>
- Primary source: <https://github.com/000nico/kdemulator/blob/44c05218b4b83d8a864df540aead218dbdf48e6a/README.md>
- Catalog page: <https://awesomerea.org/resources/kdemulator/>
- Record JSON: <https://awesomerea.org/resources/kdemulator/record.json>
- Chinese version: [简体中文](https://awesomerea.org/zh/resources/kdemulator/index.md)

## Requirements & limits

- **Scope:** Windows x86-64 driver .sys files are the documented inputs.
- **Limits:** Emulation covers only the driver's own code and directly imported functions; hardware-facing drivers need additional stubs.
- **License:** Unlicense.

## Primary sources

1. <https://github.com/000nico/kdemulator/blob/44c05218b4b83d8a864df540aead218dbdf48e6a/README.md>
2. <https://github.com/000nico/kdemulator/blob/44c05218b4b83d8a864df540aead218dbdf48e6a/emu-cli.md>
3. <https://github.com/000nico/kdemulator/blob/44c05218b4b83d8a864df540aead218dbdf48e6a/LICENSE>

## More in Native binaries

- [DownUnderCTF: masked-squares flag checker](https://awesomerea.org/resources/rea-ctf-case/index.md) · Case study
- [Show Your Work: a measured dissection of REA's evidence architecture](https://awesomerea.org/resources/noflag-rea-evidence-architecture-study/index.md) · Case study
- [Windows loader: static malware analysis with REA and Codex](https://awesomerea.org/resources/windows-loader-static-analysis-case/index.md) · Case study
- [OpenBSD netcat: static REA and Ghidra investigation](https://awesomerea.org/resources/netcat-openbsd-rea-static-case/index.md) · Case study
- [m0rph: tracing an obfuscated ELF flag checker](https://awesomerea.org/resources/m0rph-ctf-analysis-case/index.md) · Case study
- [CPQ IO Scheduler: reconstructing Xiaomi's block scheduler](https://awesomerea.org/resources/cpq-iosched-case/index.md) · Case study

## About this entry

The description was reviewed against primary sources.
Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.