Top AI Repos — open-source AI, indexed and scored
Top AI Repos tracks AI repositories on GitHub and answers two different questions about each one: is it moving right now, and would you bet a product on it.
Top AI Repos tracks AI repositories on GitHub and answers two different questions about each one: is it moving right now, and would you bet a product on it.
Binee: binary emulation environment
| Date | Stars |
|---|---|
| 2026-07-24 | 532 |
| 2026-07-25 | 532 |
| 2026-07-28 | 532 |
| 2026-07-30 | 532 |
| 2026-08-06 | 532 |
Today
— stars today
This week
— stars this week
This month
— stars this month
Momentum
0.0
growth rate 0.00%/day
# binee (Binary Emulation Environment)
Binee is a complete binary emulation environment that focuses on introspection
of all IO operations. Primary goals for this project are to provide a flexible
environment for determining a binaries side effects on the system.
The goals Binee tries to solve are the following:
1. Realistic loading of a PE file and its required dependencies. The userland
memory should look as close to a real execution as possible.
2. Easy to use hooking framework. We want to create a flexible hooking
framework that allows the analyst to rapidly implement new hooks and capture
data.
3. Mock out as much of the OS internals as reasonably possible. Currently,
there are small mocks of the file system, registry, threading and TIB/PEB
structures for Windows.
4. The OS environment, as much as possible, should be defined in a
configuration file. This enables rapid movement from environment to
environment.
**If you choose to use Binee to emulate portions of Microsoft Windows, you are
solely responsible for obtaining any necessary rights and licenses from
Microsoft.**
## Development and Support
Please feel free to submit github issues or if you want to talk with us directly, come join is in slack
[slack workspace](https://join.slack.com/t/cb-binee/shared_invite/zt-e13fhpox-yq6ncXpX6hXR8vJ0p8PEvw)
## DEF CON 27 Materials
[slides](https://github.com/carbonblack/binee/blob/defcon27/Kyle%20Gwinnup%20-%20Next%20Generation%20Process%20Emulation%20with%20Binee.pdf)
[demo video](https://github.com/carbonblack/binee/blob/defcon27/Kyle%20Gwinnup%20-%20Next%20Generation%20Process%20Emulation%20with%20Binee%20Demo.mp4)
[presentation](https://www.youtube.com/watch?v=z4OvVFw5pYI)
# Setup and developing in Docker container
If you are running Binee on Microsoft Windows, you can skip the mock file system step.
Most malware will require at least some standard DLLs and these DLLs will need
to be accessible from the mock file system. The default "root" mock file system
is located in `os/win10_32/`. In order to allow for the malware to load up DLLs
you will need to copy them into the appropriate location within the mock file
system. Typically, these should be copied into,
`os/win10_32/windows/system32/`. Currently, only 32-bit DLL's pulled from a 32-bit
Windows installation are supported. Once you have the required files in that
directory, you can move onto the compiling and running step.
## Compiling and running
Build with the following docker command `docker build -t binee .`
```
docker run -it -v $PWD:/bineedev/go/src/github.com/carbonblack/binee binee bash
```
Download Golang dependencies and build Binee
```
root@2b0fee41629f:~/go/src/github.com/carbonblack/binee# go build
```
_Note: presence of go.mod file will direct the build utility to collect dependencies upon build, and also allow for the repository to be cloned and developed at any path (regardless of `$GOPATH`) directory_
At this point you should be able to execute binee within the Docker container
and see the usage menu.
```
root@6a6fe8c2b2a7:~/go/src/github.com/carbonblack/binee# ./binee -h
Usage of ./binee:
-A list all apisets and their mappings
-a string
get the real dll name from an apiset name
-c string
path to configuration file
-d show the dll prfix on all function calls
-e dump pe file's exports table
-i dump a pe file's imports table
-j output data as json
-l call DLLMain while loading DLLs
-r string
root path of mock file system, defaults to ./os/win10_32 (default "os/win10_32/")
-v verbose level 1
-vv
verbose level 2
```
If you are running on Microsoft Windows and/or you have your mock file system
configured properly, you should be able to execute all the PE files within the
`tests/` directory.
```
root@6a6fe8c2b2a7:~/go/src/github.com/carbonblack/binee# go build && ./binee tests/ConsoleApplication1_x86.exe
[1] 0x2190c0b0: F GetSystemTimeAsFileTExcerpt of 7,954 characters
Read on GitHub
31
17
11
9
8
Robin · Sweden
7
4
1
1
1
Would you bet a product on this? Bounded 0–100 and slow moving.
matched fp:5bf94b7dead2f357, topic:testing