x86 / x64 / ARM64 emulator for securely emulating malware and system internals.
Emulate shellcode and PE / ELF / Mach-O binaries — step by step, scriptable, no VM required.
| Repo | What it is |
|---|---|
| mwemu | The command-line emulator — the flagship tool. |
| libmwemu | Core emulation engine as a Rust library (crates.io). |
| pymwemu | Python bindings (PyPI). |
| cmwemu | C ABI bindings (cdylib / staticlib + generated header). |
| mwemu-mcp | Model Context Protocol server — drive mwemu from AI tooling. |
- x86 (32 & 64-bit) and AArch64 emulation
- Windows / Linux / macOS userland and system internals
- Shellcode and PE / ELF / Mach-O loaders
- Scriptable from Rust, Python and C
--winver: genuine Windows system DLLs fetched on demand from Microsoft's symbol server (no ISO needed)
Core work by @sha0coder (creator & maintainer),
@brandonros (AArch64, macOS & serialization),
@acheron2302 (DLL emulation, loaders, optimizations),
@mrexodia (GDB stub),
@ElCapor (instruction hooks & exceptions) and
@SleathCobra (pymwemu — Python type stubs .pyi for IDE autocompletion).
Thanks also to everyone who opened issues and shaped the direction — @Thell (who first proposed a library back in the scemu days), @darknessxk, @icyfox168168, @carouselcarousel, @omarandlorraine and more.
mwemu is licensed under GPL-3.0-only. For commercial or proprietary use under different terms, contact the author for a separate license.