AwesomeREA.org

Tool

Speakeasy

Mandiant's Windows malware emulation framework, which runs PE executables, DLLs, kernel drivers and raw x86/amd64 shellcode on the Unicorn CPU emulator inside a modeled Windows runtime instead of a full VM. Hand-written handlers and a signature database built from win32metadata and phnt emulate Windows API calls, process and thread behavior, the filesystem, registry and network, and each run is recorded as a structured JSON report of API events with named arguments, dropped files and optional memory snapshots. It runs from the speakeasy CLI or as a Python library, and a built-in GDB stub lets an analyst step through an emulated sample.

Requirements & limits

  • Latest release at review: v2.0.0b9, a GitHub pre-release published 2026-10-11 that tags the reviewed master commit and moves the report format to version 5.0.0. The newest stable speakeasy-emulator on PyPI is still 1.5.11 from 2022, and pip skips pre-releases by default, so the README's plain pip install resolves to 1.5.11 unless a 2.0 beta is requested.
  • Requires Python 3.10+; dependencies include Unicorn 2.1.4+, pefile, Capstone and pycryptodome, and the package is marked OS independent. Source installs need a recursive clone for the win32json and phnt submodules plus two scripts that generate the API signature databases; the Dockerfile builds a Python 3.13 image that mounts samples at /sandbox. GDB sessions connect gdb-multiarch or another GDB to the stub, which the documentation warns has no authentication.
  • Samples come from the user. The tests use small test executables, DLLs, WDM drivers and a shellcode blob under tests/bins, and the capa-testfiles submodule of Mandiant's capa test data, which supplies Practical Malware Analysis lab samples; handle both as malware-analysis material.
  • The limitations page says only a curated subset of APIs has handlers: APIs emulated from signatures alone return success values without real side effects, unknown imports stop a run, and a missing file, registry key or network response can look like anti-analysis behavior, so reports need analyst interpretation. MIT licensed; the win32json, phnt and capa-testfiles submodules keep their own terms. Nothing was installed or run, and the reviewed sources establish no REA connection.

About this entry

Type
Tool
Category
Debugging and dynamic analysis
Relationship
Foundation tool
Targets
Binary

Sources reviewed

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · mandiant/speakeasy · Revision aa9f226
  2. doc/install.md GitHub · mandiant/speakeasy · Revision aa9f226
  3. doc/limitations.md GitHub · mandiant/speakeasy · Revision aa9f226
  4. doc/cli-reference.md GitHub · mandiant/speakeasy · Revision aa9f226
  5. doc/reporting.md GitHub · mandiant/speakeasy · Revision aa9f226
  6. doc/gdb.md GitHub · mandiant/speakeasy · Revision aa9f226
  7. pyproject.toml GitHub · mandiant/speakeasy · Revision aa9f226
  8. speakeasy/version.py GitHub · mandiant/speakeasy · Revision aa9f226
  9. .gitmodules GitHub · mandiant/speakeasy · Revision aa9f226
  10. Dockerfile GitHub · mandiant/speakeasy · Revision aa9f226
  11. LICENSE.txt GitHub · mandiant/speakeasy · Revision aa9f226
  12. tests/bins GitHub · mandiant/speakeasy · Revision aa9f226
  13. tests/pma_cases.py GitHub · mandiant/speakeasy · Revision aa9f226
  14. https://github.com/mandiant/speakeasy/releases/tag/v2.0.0b9
  15. https://pypi.org/project/speakeasy-emulator/1.5.11/

More in Native binaries

All 94 entries in Native binaries