mandiant/speakeasy

Health v2 · maintenance only

Adoption not part of the score

2081 stars · 293 forks observed · 2026-10-21

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

Speakeasy is a Windows user-mode and kernel-mode emulation framework that runs binaries, drivers, and shellcode inside a modeled Windows runtime instead of a full VM. It can be driven via a CLI for fast triage or embedded as a Python library, producing structured JSON reports of API, filesystem, registry, and network activity.

Use cases

• emulate windows malware samples without a vm
• analyze malicious shellcode behavior safely
• triage suspicious dlls and drivers quickly
• trace api calls made by a windows binary
• generate reports of malware execution
• reverse engineer windows kernel rootkit drivers

When to choose

• you need fast, scriptable windows binary emulation without spinning up a VM
• you want structured JSON reports of API, filesystem, registry, and network activity
• you want to embed emulation into a Python analysis pipeline
• you need to emulate both user-mode binaries and kernel drivers

When to avoid

• you need full fidelity execution of complex software that depends on unmodeled Windows internals
• you need dynamic analysis of non-Windows binaries
• you want a turnkey sandbox with a GUI rather than a programmable framework

Facets

framework · maturity active

simulation security reverse-engineering cli sdk security reverse-engineering windows python cross-platform cli emulation malware-analysis windows-kernel sandbox binary-analysis

Member repositories

For agents

markdown · JSON · MCP: product_card(name="mandiant/speakeasy")