This release is a pre-release and may not be stable for production use.
Sogen exposes Python bindings for its Windows userspace emulator. The Python API is meant for scripting runs, building small analysis helpers, and quickly iterating on callbacks and hooks without rebuilding C++.
Install from PyPI:
pip install sogen
Project links:
- PyPI: https://pypi.org/project/sogen/
- Repository: https://github.com/momo5502/sogen
- Ready-made emulation root: https://sogen.dev/root.zip
What you need
The Python package still needs an emulation root at runtime. Download ready-made root here:
Extract it somewhere convenient, for example:
./root
Most examples in this document use:
emulation_root="./root"
Quick start
import sogen
app = sogen.windows.create_application(
"c:/test-sample.exe",
emulation_root="./root",
)
app.callbacks.on_stdout = lambda text: print(text, end="")
app.start()
print("exit status:", app.process.exit_status)
Minimal example with file + port mappings
from pathlib import Path
import sogen
app = sogen.windows.create_application(
"c:/test-sample.exe",
emulation_root="./root",
path_mappings={"c:/a.txt": Path("./a.txt")},
port_mappings={28970: 28980},
)
app.callbacks.on_stdout = lambda text: print(text, end="")
app.start()
print("exit status:", app.process.exit_status)
Choosing backend
sogen.windows.create_empty() and sogen.windows.create_application() accept an explicit backend.
import sogen
emu = sogen.windows.create_empty(
emulation_root="./root",
backend=sogen.Backend.unicorn,
)
Available values:
sogen.Backend.unicornsogen.Backend.iciclesogen.Backend.whp(Windows)sogen.Backend.kvm(Linux x86_64)
Default is sogen.Backend.unicorn.
High-level structure
Main entry points:
sogen.windows.create_empty(...)sogen.windows.create_application(...)
Compatibility aliases currently remain at top level:
sogen.create_empty(...)sogen.create_application(...)
Common objects exposed by the bindings:
sogen.windows.Emulator/sogen.windows.WindowsEmulatorProcessContextThreadMemoryManagerHooksCallbacks
Common things you will do:
- run application with
app.start() - watch output with
app.callbacks.on_stdout - react to module loads with
app.callbacks.on_module_load - intercept WinAPI calls with
app.hooks.apis[...] - read/write emulator memory with
read_memory()/write_memory() - save and restore state with
save_snapshot()/restore_snapshot()
Callbacks
Example: print loaded modules.
import sogen
app = sogen.windows.create_application(
"c:/test-sample.exe",
emulation_root="./root",
)
def on_module_load(module):
print(f"loaded {module.name} @ 0x{module.entry_point:x}")
app.callbacks.on_module_load = on_module_load
app.start()
Useful callback slots include:
app.callbacks.on_stdoutapp.callbacks.on_syscallapp.callbacks.on_memory_violateapp.callbacks.on_module_loadapp.callbacks.on_module_unload
API hooks
API hooks are registered through app.hooks.apis.
Use @sogen.windows.api_call(...) to describe calling convention and parameters.
Top-level sogen.api_call(...) remains as compatibility alias.
Observe API call, then run original
import ctypes
import sogen
app = sogen.windows.create_application(
"c:/test-sample.exe",
emulation_root="./root",
)
@sogen.windows.api_call(cc=sogen.CallingConvention.stdcall, params=[ctypes.c_uint32])
def on_sleep(call, params):
print(f"Sleep({params[0]})")
app.hooks.apis["Sleep"] = on_sleep
app.start()
Intercept API call and return custom value
import sogen
app = sogen.windows.create_application(
"c:/hook-sample.exe",
emulation_root="./root",
)
@sogen.windows.api_call(cc=sogen.CallingConvention.stdcall, params=[])
def on_get_current_process_id(call, params):
call.return_value = 0xC0FFEE01
return sogen.ApiContinuation.intercept
app.hooks.apis["GetCurrentProcessId"] = on_get_current_process_id
app.start()
print(app.process.exit_status)
Hook keys can be either:
- bare API name, for example
"Sleep" - qualified module form, for example
"kernel32!Sleep"
Memory and state
The emulator exposes direct state access.
import sogen
emu = sogen.windows.create_empty(emulation_root="./root")
base = emu.memory.allocate_memory(0x1000, sogen.MemoryPermission.read_write)
emu.write_memory(base, b"ABCD")
print(emu.read_memory(base, 4))
state = emu.serialize_state()
emu.write_memory(base, b"WXYZ")
emu.deserialize_state(state)
print(emu.read_memory(base, 4))
For checkpoint-style workflows, use snapshots:
emu.save_snapshot()
# ... mutate state ...
emu.restore_snapshot()
Examples
Small runnable example:
examples/python/basic_usage.py
Example setup notes:
examples/python/README.md
Current limitations / expectations
- bindings require an emulation root
- samples in this repo assume Windows-style guest paths like
c:/... - some workflows are easiest to validate against repo sample binaries such as
test-sample.exeandhook-sample.exe - backend availability depends on platform and how Sogen was built
1 maintainer
Metadata
1 maintainer
Release files for sogen 0.0.1.dev4320
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| sogen-0.0.1.dev4320.tar.gz | 44.9 MB | Details |
Built distributions (wheels)
| File | Reset | |||
|---|---|---|---|---|
| sogen-0.0.1.dev4320-cp39-cp39-win_amd64.whl | CPython 3.9 | CPython 3.9 | Windows x86-64 | Details |
| sogen-0.0.1.dev4320-cp39-cp39-manylinux_2_39_x86_64.whl | CPython 3.9 | CPython 3.9 | Linux glibc 2.39+ x86-64 | Details |
| sogen-0.0.1.dev4320-cp39-cp39-macosx_11_0_arm64.whl | CPython 3.9 | CPython 3.9 | macOS 11.0+ ARM64 | Details |
| sogen-0.0.1.dev4320-cp39-cp39-macosx_10_13_x86_64.whl | CPython 3.9 | CPython 3.9 | macOS 10.13+ x86-64 | Details |
Total release size: 71.4 MB
Release files / sogen-0.0.1.dev4320.tar.gz
| Download URL | sogen-0.0.1.dev4320.tar.gz |
|---|---|
| Size | 44.9 MB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
ca252d99aeb60b369ac95e47a8298914686261ec709651e63c7c5b158815131d
|
|
BLAKE2b-256 checksum How to use checksums |
351df65fd3025b71ed5e3e7337782d9ff00904f85ab133310d80465902a631a1
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/6.1.0 CPython/3.13.12
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Jun 28, 2026.
Transparency logRelease files / sogen-0.0.1.dev4320-cp39-cp39-win_amd64.whl
| Download URL | sogen-0.0.1.dev4320-cp39-cp39-win_amd64.whl |
|---|---|
| Size | 5.0 MB |
| Tags | CPython 3.9 Windows x86-64 |
|
SHA-256 checksum How to use checksums |
06326f9d50b1b9c3dae3959a0e39c80c164d5f21bcb2fbe75b234ee3931ab7a8
|
|
BLAKE2b-256 checksum How to use checksums |
7238e6b1c25942e1e0729df1e9068b43d4c891eaf1c543b55aa7a794b6da5ae9
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/6.1.0 CPython/3.13.12
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Jun 28, 2026.
Transparency logRelease files / sogen-0.0.1.dev4320-cp39-cp39-manylinux_2_39_x86_64.whl
| Download URL | sogen-0.0.1.dev4320-cp39-cp39-manylinux_2_39_x86_64.whl |
|---|---|
| Size | 8.8 MB |
| Tags | CPython 3.9 Linux glibc 2.39+ x86-64 |
|
SHA-256 checksum How to use checksums |
0f3df852fb58beb0a1da5055fb65e94057278409beab6612725246b9b6342d78
|
|
BLAKE2b-256 checksum How to use checksums |
50989b98b6a8399004982748511757e119fd9dd5b02ee2c732f8ad13110dbe67
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/6.1.0 CPython/3.13.12
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Jun 28, 2026.
Transparency logRelease files / sogen-0.0.1.dev4320-cp39-cp39-macosx_11_0_arm64.whl
| Download URL | sogen-0.0.1.dev4320-cp39-cp39-macosx_11_0_arm64.whl |
|---|---|
| Size | 5.9 MB |
| Tags | CPython 3.9 macOS 11.0+ ARM64 |
|
SHA-256 checksum How to use checksums |
2e3f9984d62dbf31d12b80dd5a61a51a59849fa8c645a8b1bd03406a5e57a9dc
|
|
BLAKE2b-256 checksum How to use checksums |
1ff0f8e8f9cebe8b509f95f9e4aa0a883e76cca8fc775ee8e9fe6280363766d3
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/6.1.0 CPython/3.13.12
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Jun 28, 2026.
Transparency logRelease files / sogen-0.0.1.dev4320-cp39-cp39-macosx_10_13_x86_64.whl
| Download URL | sogen-0.0.1.dev4320-cp39-cp39-macosx_10_13_x86_64.whl |
|---|---|
| Size | 6.9 MB |
| Tags | CPython 3.9 macOS 10.13+ x86-64 |
|
SHA-256 checksum How to use checksums |
6c4b7c91781408b5719a27f8468d4f08da71be915babfd8e69480124e63541e8
|
|
BLAKE2b-256 checksum How to use checksums |
8ac3b1ad37de1ce5385082637c2011b479aa5ed107939f87010522aa96f1dd79
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/6.1.0 CPython/3.13.12
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Jun 28, 2026.
Transparency log
