This release is a pre-release and may not be stable for production use.
Speakeasy
Speakeasy is a Windows malware emulation framework that executes binaries, drivers, and shellcode in a modeled Windows runtime instead of a full VM. It emulates APIs, process/thread behavior, filesystem, registry, and network activity so samples can keep moving through realistic execution paths. You can run it from the speakeasy CLI for fast triage or embed it as a Python library and consume structured JSON reports.
Background context: Mandiant's overview post.
Quick start
Install from PyPI:
python3 -m pip install speakeasy-emulator
Run a sample and inspect high-level report fields (replace sample.dll with your target):
speakeasy -t sample.dll --no-mp -o report.json 2>/dev/null
jq '{sha256, arch, filetype, entry_points: (.entry_points | length)}' report.json
{
"sha256": "30ec092d122a90441a2560f6778ef8233c98079cd34b7633f7bbc2874c8d7a45",
"arch": "x86",
"filetype": "dll",
"entry_points": 3
}
Executable proof for this snippet: doc/readme-quickstart-showboat.md.
Documentation map
Start here
CLI usage
- CLI reference
- CLI analysis recipes
- CLI environment overrides
- CLI execution controls
- CLI help snapshot (showboat)
Reports, configuration, and runtime behavior
Debugging and extension
- GDB debugging reference
- GDB sessions (showboat)
- Mounting host files with
--volume - Adding API handlers
- Examples directory
- Speakeasy 2 walkthrough outline
Questions and help
Start with doc/help.md.
If you still need help, open an issue at github.com/mandiant/speakeasy/issues.
2 maintainers
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
Built Distribution
Filter files by name, interpreter, ABI, and platform.
If you're not sure about the file name format, learn more about wheel file names.
Copy a direct link to the current filters
File details
Details for the file speakeasy_emulator-2.0.0b6.tar.gz.
File metadata
- Download URL: speakeasy_emulator-2.0.0b6.tar.gz
- Upload date:
- Size: 306.3 kB
- Tags: Source
- Uploaded using Trusted Publishing? Yes
- Uploaded via: twine/6.1.0 CPython/3.13.7
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 |
cb268f0f41e7344863e7f2d9233eca29c17d6e2125e31254f4b1c0439d272d36
|
|
| MD5 |
2d3aed16ee50c1e5704d3c141750e3ce
|
|
| BLAKE2b-256 |
863a28e1e067de250488f40d719aa7cee61a3b0c61d024db37c0302b9e2bead3
|
Provenance
The following attestation bundles were made for speakeasy_emulator-2.0.0b6.tar.gz:
Publisher:
python-publish.yml on mandiant/speakeasy
-
Statement:
-
Statement type:
https://in-toto.io/Statement/v1 -
Predicate type:
https://docs.pypi.org/attestations/publish/v1 -
Subject name:
speakeasy_emulator-2.0.0b6.tar.gz -
Subject digest:
cb268f0f41e7344863e7f2d9233eca29c17d6e2125e31254f4b1c0439d272d36 - Sigstore transparency entry: 2452931106
- Sigstore integration time:
-
Permalink:
mandiant/speakeasy@b364d53ce9364e1f8aa898b9ed53597be39b23cb -
Branch / Tag:
refs/tags/v2.0.0b6 - Owner: https://github.com/mandiant
-
Access:
public
-
Token Issuer:
https://token.actions.githubusercontent.com -
Runner Environment:
github-hosted -
Publication workflow:
python-publish.yml@b364d53ce9364e1f8aa898b9ed53597be39b23cb -
Trigger Event:
release
-
Statement type:
File details
Details for the file speakeasy_emulator-2.0.0b6-py3-none-any.whl.
File metadata
- Download URL: speakeasy_emulator-2.0.0b6-py3-none-any.whl
- Upload date:
- Size: 369.9 kB
- Tags: Python 3
- Uploaded using Trusted Publishing? Yes
- Uploaded via: twine/6.1.0 CPython/3.13.7
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 |
a33a0e456726070e2e4a4e62fa8a9a1cd388b2b074e31800b463555102e368ab
|
|
| MD5 |
4bd776825b9ea55919d98deef59da1ef
|
|
| BLAKE2b-256 |
170ae239ca6d227795c96e59a42ed8ebdeaa021365e3d26469f01eb54ee24ea3
|
Provenance
The following attestation bundles were made for speakeasy_emulator-2.0.0b6-py3-none-any.whl:
Publisher:
python-publish.yml on mandiant/speakeasy
-
Statement:
-
Statement type:
https://in-toto.io/Statement/v1 -
Predicate type:
https://docs.pypi.org/attestations/publish/v1 -
Subject name:
speakeasy_emulator-2.0.0b6-py3-none-any.whl -
Subject digest:
a33a0e456726070e2e4a4e62fa8a9a1cd388b2b074e31800b463555102e368ab - Sigstore transparency entry: 2452931207
- Sigstore integration time:
-
Permalink:
mandiant/speakeasy@b364d53ce9364e1f8aa898b9ed53597be39b23cb -
Branch / Tag:
refs/tags/v2.0.0b6 - Owner: https://github.com/mandiant
-
Access:
public
-
Token Issuer:
https://token.actions.githubusercontent.com -
Runner Environment:
github-hosted -
Publication workflow:
python-publish.yml@b364d53ce9364e1f8aa898b9ed53597be39b23cb -
Trigger Event:
release
-
Statement type:
