Kyle Gwinnup - Next Generation Process Emulation with Binee
Introduces Binee, an open-source Windows process emulator designed for rapid malware analysis without requiring a full Windows environment.
Summary
Windows Process Emulation with Binee
Kyle Gwinnup (Principal Software Engineer, Crowdstrike) presents Binee, an open-source Windows PE binary emulator built on the Unicorn CPU emulator and a custom Windows API stub library.
Emulation vs. Sandboxing
Traditional malware sandboxes run samples in real Windows VMs, requiring significant infrastructure and risking VM escape. Binee emulates the Windows execution environment at the API level — the CPU executes real code, but Windows API calls are handled by Binee's stub implementations rather than a real Windows kernel.
API Stub Library
Binee implements hundreds of Windows API functions (file I/O, registry, network, process management) as Python stubs that log API calls and return realistic values, enabling analysis of malware's intended behavior without requiring a full Windows environment.
Analysis Use Cases
Binee rapidly executes and logs API call sequences from packed and obfuscated malware, providing high-confidence behavioral indicators without sandbox evasion. The talk demonstrates unpacking and analyzing AgentTesla, Emotet, and custom-packed implants.
Related talks
Videos·38 min
Presenters detail vulnerability discovery and exploitation in Malware Emulation of SysJoker and Linux Threats.
Black Hat·25 min
Hiroaki Hara
Engineers explore architecture and security mechanisms for Think Inside the Box: In-the-Wild Abuse of Windows Sandbox in Targeted Attacks.
Black Hat·56 min
Engineers explore architecture and security mechanisms for Automating Linux Malware Analysis Using Limon Sandbox.