Download
Sogen is a high-performance Windows user-space emulator designed to operate at the syscall level, offering deep control over process execution and behavior. Unlike traditional emulators that reimplement full operating system APIs, Sogen works closer to the kernel boundary by intercepting and emulating system calls, allowing it to leverage native system libraries while maintaining granular control. This approach makes it particularly valuable for advanced use cases such as malware analysis, reverse engineering, and DRM research, where precise observation and manipulation of execution flow are critical. The emulator supports multiple backends, including Unicorn Engine and Hyper-V, enabling flexible deployment depending on performance or accuracy requirements. It also includes robust support for loading Portable Executable (PE) files, including proper handling of relocations, thread-local storage, and memory mapping.
Features
- Syscall-level emulation for precise execution control
- Support for multiple emulation backends like Unicorn and Hyper-V
- Advanced PE loading with relocations and TLS handling
- Fine-grained hooking capabilities for analysis workflows
- Windows-specific memory management simulation
- Designed for malware analysis and reverse engineering
Project Samples
