Speakeasy is a Windows malware emulation framework developed by Mandiant (FireEye). It executes Windows PE executables, DLLs, drivers, and shellcode in a fully emulated Windows environment, intercepting API calls via a large set of stub handlers that model kernel32, ntdll, ws2_32, user32, ntoskrnl, and many other DLLs. The emulation is powered by Unicorn (CPU emulation) and Capstone (disassembly). It provides both a CLI tool (`speakeasy`) and a Python library (`Speakeasy` class) for programmatic use. Key features include: user-mode and kernel-mode emulation, GDB remote debugging support, configurable file system, registry, network, and process models, SEH handling, API hammering detection, and structured JSON reports with profiling events, memory captures, and artifact deduplication. The architecture is a monolithic Python package with a core emulator class, platform-specific emulators (Win32Emulator, WinKernelEmulator), and a large set of API handler modules organized by DLL. Dependencies include unicorn, capstone, pefile, pydantic, rich, and pyelftools. The project is primarily used for automated malware analysis and reverse engineering.
This repository provides an ARM64 tracing and emulation workflow based on the Unicorn engine, designed to work as an IDA Pro plugin and with standalone replay capabilities. The system allows users to trace ARM64 code execution within IDA, dump memory segments, generate Tenet-compatible logs for analysis, and replay traces offline. Key features include dynamic code simulation, memory dumping, register state tracking, instruction-level logging, and special handling for ARM64-specific instructions like MRS TPIDR_EL0 and AUTIASP. The architecture separates IDA integration (dyn_trace_ida.py) from core emulation logic (unicorn_trace/unicorn_class.py), enabling both interactive tracing within IDA and offline replay of captured traces.