App Review Kernel Mode Driver Emulation with Speakeasy

[struppigel]

Content source

https://youtu.be/tm6xjiQFGwc

A video on the emulator Speakeasy by Mandiant. It can aid in analysis of kernel mode drivers, user mode malware and shellcode.

Speakeasy: GitHub - mandiant/speakeasy: Windows kernel and user mode emulation.

Samples:
MalwareBazaar | Browse malware samples
MalwareBazaar | Browse malware samples

MalwareBazaar | Browse malware samples

bazaar.abuse.ch

 

[lain]

This is pretty slick, thank you for the share!

 

[Andy Ful]

Some introductory articles about Speakeasy can be found on the Mandiant website:

https://www.mandiant.com/resources/blog/emulation-of-malicious-shellcode-with-speakeasy

https://www.mandiant.com/resources/blog/emulation-of-kernel-mode-rootkits-with-speakeasy

Another interesting emulator available on GitHub is probably Qiling Framework (supports also Linux).

GitHub - qilingframework/qiling: Qiling Advanced Binary Emulation Framework

Qiling Advanced Binary Emulation Framework. Contribute to qilingframework/qiling development by creating an account on GitHub.

github.com

https://conference.hitb.org/hitbsecconf2021ams/materials/D1T2%20-%20When%20Qiling%20Framework%20Meets%20Symbolic%20Execution%20-%20Kaijern%20Lau,%20Kong%20ZiQiao%20&%20Wu%20ChenXu.pdf