Sogen is a Windows and Linux userspace emulator that runs programs without a real operating system while providing complete visibility and control over their execution.
Rather than reimplementing thousands of operating system APIs, Sogen emulates binaries at the CPU and syscall level while executing real system DLLs like ntdll, kernel32, and user32. This approach ensures behavior closely matches actual operating systems. The tool supports multiple CPU backends including Unicorn Engine, icicle-emu, Hyper-V, KVM, and FEX, allowing users to choose the execution strategy that best fits their needs. Every instruction, memory access, and API call can be hooked, inspected, or rewritten. Execution is fully deterministic, and the entire emulator state can be snapshotted and restored for reproducible analysis.
Sogen suits reverse-engineering workflows, security research, and sandboxed execution of untrusted code. It handles native GUI applications with working windows and dialogs, and supports GPU paravirtualization for 3D acceleration, making it capable of running games. The tool includes undetectable debugging through GDB protocol integration and an in-browser debugger that operates at the emulator level, remaining invisible to anti-debug checks. Direct3D titles run through DXVK translation to Vulkan. The project runs across Windows, Linux, macOS, Android, iOS, and browsers on both x86-64 and ARM64 architectures. Python bindings are available for programmatic access.
The project shows consistent development activity with regular commits and active issue tracking. The codebase is written in C++ and maintains a build pipeline with automated testing. The tool provides comprehensive Windows internals support including PE loading with relocations and TLS, Windows memory types, structured exception handling, threading, registry access, filesystem operations, and networking capabilities.
