Base class for API errors

Wrapper class for invoking the speakeasy emulators

This class represents the basic execution primative for the emulation engine A "run" can represent any form of execution: a thread, a callbac

Base class for emulation errors

Represents a symbolicated chunk of memory that can be tracked

For now, a basic python object will serve as a C style enum. Supports arbitrary attribute access for dynamic enum-style constants.

Base class for Speakeasy errors

Base class for an emulated file

Locates where an event occurred in execution time and context. Every emitted event carries this structure so consumers can reconstruct chrono

Base class for Windows user mode emulation errors

The profiler class exists to generate an execution report for all runs that occur within a binary emulation.

Base class for Windows emulation errors

Represents PE files loaded into the emulator

Captures failure context for top-level or per-entry-point errors. Error records can represent unsupported API termination, instruction faults,

Class that defines a memory mapping (e.g. heap/pool alloc, binary image, etc.)

Represents a registry key

Raised during validating configuration

Represents a console window object

Stores one deduplicated binary payload referenced elsewhere in a report. Payloads are keyed by SHA-256 in the top-level ``Report.data`` mapping.

Container class for struct exceptions

Manages file system activity during emulation

Represents a memory mapped file

Base class for Windows user mode emulation errors

Raised during network emulation errors

Describes a memory region for exception context.

Raised during registry emulation errors

Top-level Speakeasy output report model. This object combines run telemetry, metadata for the emulated input, and optional analysis artifacts

Represents one categorized bucket of extracted strings. String extraction runs both on static image bytes and post-emulation memory snapshots

Represents a TOKEN object

User Mode Windows Emulator Class

Class used to emulate Windows drivers

Represents a GUI window

Records one intercepted API invocation. API events are emitted by import-call handlers and represent core behavioral telemetry for most runs.

Detect and attempt to mitigate API hammering as part of anti-sandbox or anti-emulation in malware samples

The Component Object Model (COM) manager for the emulator. This will manage COM interfaces.

Represents crypto context used by crypto functions

Manages the emulation of crypto functions

Print debug port prints to the console

Represents a Desktop object

Manages the emulation of Windows drives. Currently assumes one volume per drive.

Represents one file artifact written by emulated execution. Dropped-file entries are created from filesystem manager state when a run complet

Describes one dynamically generated code region that executed. Dynamic code segments are added when execution reaches memory previously regis

Represents one emulation execution primitive captured as a run. A run may be a module entry point, callback, exported function, injected thre

Records handled exception dispatch activity. Emitted when exception handling telemetry is captured during execution. Use this to understand

Records file creation/open-with-create semantics. Emitted when file APIs request creation semantics for a path. Use with follow-up write eve

Manifest entry used by dropped-file archive exports. These records are stored in ``speakeasy_manifest.json`` inside file archive bundles crea

Records file open operations without explicit create intent. Emitted for open-style file API calls. Use to reconstruct file-read dependency

Records reads from a file handle. Emitted when file-read APIs pull bytes from emulated files. Useful for identifying configuration ingestion

Records writes to a file handle. Emitted when file-write APIs append or overwrite emulated file data. Combine with dropped-file summaries to

Directs IO requests to a module handler. For example, if a user mode application sends an ioctl to a device this can be handled here.

Represents a IO_STACK_LOCATION struct that is part of an IRP.

Class used to rapidly assemble a decoy PE that will only contain an export table so malware can parse it.

Base class for Windows kernel mode emulation errors

Captures one module visible in the run's loaded-module inventory. Module entries are assembled from runtime module objects at run completion.

Represents a shared memory view

Records remote or explicit process memory allocation activity. Emitted by memory allocation APIs that target process virtual memory. Commonl

Records memory free/decommit operations. Emitted when memory free APIs are invoked against process regions. Use this to track lifecycle of a

Records memory protection changes. Emitted for API paths that alter page permissions in process memory. This is a key indicator for RWX tran

Records reads from process memory. Emitted for API-mediated memory reads and may merge adjacent reads in the profiler for compactness. U

Records writes into process memory. Emitted for API-mediated memory writes and may merge adjacent writes in the profiler for compactness.

Aggregates read/write/execute counters for one memory region. These counters are produced by runtime memory tracing hooks when enabled. Use

Bundles memory-region and loaded-module snapshots for one run. This object is populated when the emulator captures run-end memory state. Use

Represents one memory layout entry captured for an entry point. Memory layout capture runs at run completion and may include section-split mo

Records dynamic module loading activity. Emitted when module load operations map additional images during runtime. Useful for dependency dis

Describes one section-like segment within a loaded module. Segment data is collected from module metadata during memory layout capture. Use

Records DNS name resolution activity. Emitted when DNS APIs request host resolution or related lookups. Use for C2 endpoint discovery and fa

Records HTTP request telemetry. Emitted by WinInet/WinHTTP handlers when requests are issued. Use these records to inspect request metadata

Records non-HTTP network traffic and socket-level activity. Emitted for connect/bind/send/recv style network events. Use this for protocol f

Class that manages network connections during emulation

Sample is not currently supported

Represents the process environment block. This structure contains a large amount of fields that are used internally by Windows. Shellcode may