sogen

Sogen is a userspace emulator that runs Windows and Linux programs without a real operating system, providing full visibility and control over their execution. Instead of reimplementing OS APIs, it emulates binaries at the CPU and syscall level while running the actual system DLLs (e.g., ntdll, kernel32, user32), ensuring behavior closely matches a real OS. Key capabilities include: - **Real system DLLs**: Uses genuine Windows system libraries rather than stubs. - **Hook & rewrite**: Intercept and modify memory, instructions, syscalls, and API calls. - **Faithful internals**: Supports PE loading (relocations, TLS), Windows memory types, SEH, threading, registry, filesystem, and networking. - **Snapshot & restore**: Full state serialization, fast in-memory snapshots, and minidump loading. - **Cross-platform**: Runs on Windows, Linux, macOS, Android, iOS, and browsers, supporting x86-64 and arm64. - **Deterministic execution**: Reproducible runs down to individual instructions. It offers multiple CPU backends: Unicorn Engine, icicle-emu, Hyper-V (WHP), KVM, and FEX. Debugging is possible via GDB protocol (e.g., with IDA Pro) or a built-in browser debugger, operating at the emulator level to remain invisible to anti-debug checks. Native GUI apps and games can run in a sandbox, with GPU paravirtualization for 3D acceleration and Direct3D 8/9/10/11 support via DXVK translation to Vulkan. Python bindings are available via `pip install sogen`, requiring an emulation root (downloadable or self-created). Unofficial Dart bindings exist in a separate repository. The project is built in C++ and includes a quick-start guide for Windows with Visual Studio, involving cloning with submodules, CMake preset, building, and creating a registry dump for analysis.