Sogen

Sogen is an open source emulator that "runs Windows and Linux programs without a real operating system, and lets you see and control everything they do." Sogen does not reimplement the Windows API. It emulates the program at the CPU and syscall level and runs the real system DLLs, such as ntdll, kernel32, and user32, so the behavior is close to a real Windows system. It supports PE loading with relocations and TLS, SEH, threads, the registry, the file system, and networking.

Sogen is a good sandbox for interactive analysis. The sample runs in the emulator and cannot access your host. Its files come from an emulation root, a directory that contains a virtual C: drive and a registry. Runs are deterministic, so when you restart a session the sample does the same things again. Sogen can also hook each instruction, memory access, and API call.

Sogen is licensed under the GPL-2.0. The source is at github.com/momo5502/sogen, and you can try it in a browser at sogen.dev.

How the add-on uses Sogen

The add-on includes a prebuilt Sogen analyzer and an emulation root in the ida-sogen-runtime dependency. The analyzer is available for Windows x86-64, Linux x86-64, Linux AArch64, and macOS on Apple silicon. The add-on runs the analyzer as a separate process and does not load it into IDA.

For isolated system emulation, set the backend setting to sogen. The add-on copies the sample into the emulation root as C:\<file name>, starts the analyzer with a GDB server on 127.0.0.1, and connects IDA's remote GDB debugger to it. Sogen runs 64-bit PE files, and 32-bit PE files through WOW64. The sogen_root and sogen_analyzer settings select a different emulation root or analyzer.

For automated unpacking, set default_debugger to sogen. The unpacker then starts Sogen through the isolated system emulator and runs its heuristics on the emulated process.

Sogen is not a backend for sandbox integration. To import a trace from an emulator, use Speakeasy.