Isolated System Emulation

When you find a code sequence that you do not understand, you can step through it to learn what it does. But debugging malware is risky, and to do it safely you usually must leave your analysis to set up a VM or a remote debugger.

The isolated system emulator removes this risk. Start an interactive "debug" session with one click on the dedicated toolbar button (the "magic wand"). The code runs in an emulator, so the sample cannot escape or damage data, and you cannot run malicious code on your system by accident. The add-on sets up the configuration, dialogs, and auditing for you.

Step, set breakpoints, and stop or restart with IDA's debugger controls. A session is fast to start and restart, so you can run a sequence again until you understand it. When you rename an item during emulation, IDA keeps the new name in the disassembly and pseudocode views, and you can import the results of the emulation into the IDB.

Backends

The add-on supports two emulator backends. Both run Windows PE files. For other file types, the toolbar button is not available.

Sogen

Sogen runs the real Windows system DLLs on an emulated CPU, so the sample behaves as it does on a real system. Sogen runs 64-bit PE files, and 32-bit PE files through WOW64.

Speakeasy

Speakeasy models the Windows API in Python. It is the default backend. When the sample calls an API that Speakeasy does not model, the call returns 1 and the session continues.

Configuration

To change the settings, select Malware Analysis > Isolated system emulator > Configure emulator..., or use HCLI:

hcli extension config one-click-debugging set backend sogen

Restart IDA after you change a setting.

Setting	Default	Description
backend	speakeasy	The emulator to use: speakeasy or sogen.
sogen_root	empty	The Sogen emulation root. The directory must contain filesys/c. When empty, the add-on uses the root from the ida-sogen-runtime dependency.
sogen_analyzer	empty	The path to the Sogen analyzer binary. When empty, the add-on uses the analyzer from the ida-sogen-runtime dependency.

To start a session, select Malware Analysis > Isolated system emulator > Start interactive emulation, or click the toolbar button. To stop a session, select Debugger > Terminate process. If the database has no breakpoints, the add-on adds a breakpoint at the entry point.

During a session, the add-on selects IDA's remote GDB debugger on 127.0.0.1 and a random free port. When the session ends, the add-on restores your debugger settings. With Sogen, the add-on copies the sample into the emulation root as C:\<file name>. This copy replaces a file with the same name and stays there after the session.

The IDC function start_emulator() starts a session with the configured backend. start_emulator_with_backend("sogen") or start_emulator_with_backend("speakeasy") uses a different backend for one session.