# momo5502/sogen

🪅 Windows & Linux userspace emulator

Repository: https://github.com/momo5502/sogen
Canonical: https://ross.abutalabs.com/products/sogen
Homepage: https://sogen.dev
Language: C++
License: GPL-2.0
License Family: copyleft
Topics: emulator, hacktoberfest, reverse-engineering, windows, cpp, linux
Last push: 2026-08-26T14:06:25+00:00

## Health v2 (maintenance only)
Score: 67/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 99, release rhythm 35, longevity 53
- inputs: {"age_days": 748, "days_push": 7, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: no_releases
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 3553, forks 243 (observed 2026-08-28T04:08:09.574779+00:00)

## What it is
Sogen is a C++ userspace emulator that runs Windows and Linux binaries at the CPU and syscall level without a real operating system, executing real system DLLs for faithful behavior. It supports pluggable CPU backends (Unicorn, icicle-emu, Hyper-V, KVM, FEX), full hooking/rewriting of instructions, memory and API calls, deterministic runs, and snapshot/restore of emulator state.

## Use cases
- emulate a Windows binary on Linux without a VM
- analyze malware in a sandboxed deterministic environment
- debug a process invisibly to bypass anti-debug checks
- trace and rewrite syscalls and API calls of a program
- run Windows games and apps cross-platform
- snapshot and restore emulator state during reverse engineering
- hook individual instructions and memory accesses

## When to choose
- you need instruction-level visibility and control over a Windows or Linux binary
- you want deterministic, reproducible execution for analysis
- you need debugging that is invisible to anti-debug techniques
- you want to run real system DLLs instead of reimplemented API stubs
- you need cross-platform emulation including browser or ARM targets

## When to avoid
- you just want to run Windows software normally with full performance - use Wine or a VM
- you need a full OS environment with real drivers and hardware access
- you need production deployment of applications rather than analysis
- you require perfect compatibility with complex GUI applications

## Facets
- artifact type: library
- maturity: active
- function: simulation, reverse-engineering, security, parser
- domain: reverse-engineering, security, developer-tools, simulation
- platform: windows, browser, cpp, cross-platform
- tags: userspace-emulator, cpu-emulation, syscall-emulation, malware-analysis, gdb-protocol, unicorn-engine, deterministic-execution, snapshot-restore, pe-loader, anti-debug, debugging, linux, macos, android, ios

## Member repositories
- momo5502/sogen (main) score 67

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:08:09.574779+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-29T18:34:18.943904+00:00, confidence not recorded.
  - readme: https://github.com/momo5502/sogen (fetched 2026-08-28T04:08:09.574779+00:00, sha f9a974ff216e)
  - homepage: https://sogen.dev (fetched 2026-08-29T09:28:08.583226+00:00, sha 6c81b12e03ce)
- Data as of 2026-08-30T08:39:29.467469+00:00.