Set a callback to fire when an invalid instruction is attempted to be executed args: cb: Callable python functio

Set a callback to fire when a memory address is mapped args: cb: Callable python function to execute begin:

Add a new run to the captured run list

Add a symlink for a device

Allocate PEB and related substructures for a given process

Allocate memory for the Process Environment Block (PEB). Subclasses must implement.

Call the handler to implement the imported API

Call the handler to initialize and return imported data variables

Creates a file archive package. The archive contains a manifest that can be used to match dropped files metadata with the acq

Create the service path in the registry for the created driver

Walk each attribute and handle accordingly. Since ctypes.Structure is a metaclass, we have to build the "_fields_" dynamically via a

Get the disassembly from an address args: addr: address to being disassebmly size: number of bytes to includ

Test if a file handler for a specified emulated file exists

Call the unload routine for a driver

Ensure a PE image in emulated memory has its IAT patched with sentinel values so that API calls are intercepted by speakeasy. Idempot

Expand a volume mapping into ``FileEntryFullPath``-compatible dicts. If *host_path* is a file, one entry is returned. If it is a directory,

Get the stack and format it for display

Get the number of APIs that were called during the run

Get the currently running module

Get the current process context

Get the current run context. Subclasses must implement.

Return a configured DNS TXT record (if any)

Get files that were written to disk during emulation return: Returns a list of files that were written by the sample

Get the total size of the export directory

Get the emulation report from the emulator formatted as a JSON string return: Get the emulation report as a JSON object

Get the base address of the kernel image (ntoskrnl.exe)

Get the listing of current memory maps

Get the required structure pack (defaults to pointer size)

Get processes that exist in the emulation space

Get the raw data associated with a decoy PE

Get the "MemMap" object that was only reserved for a specific address