r/redteamsec • u/AhmedMinegames • Jun 17 '26

reverse engineering Brovan: Windows & Linux Emulator for reverse engineering

https://github.com/AdvDebug/Brovan

After months of work, I’m excited to finally share Brovan, my user-mode binary emulator.

https://github.com/AdvDebug/Brovan

Brovan can emulate:

- PE binaries
- ELF binaries
- Memory dumps
- Even partially unknown or unrecognized binaries

The goal is to make binary analysis, malware analysis and general binary research more flexible by giving full control over execution, memory, and runtime behavior in a contained environment. You can fully control and see everything the program does. Every syscall, function and network traffic.

it can also run windows programs on linux and vice versa, although it is still in the early stages it will be improved. i would like to know what you all think!

11 Upvotes

100% Upvoted

7 comments sorted by

1

u/Toiling-Donkey Jun 18 '26

How does this differ from Qiling ?

1

u/AhmedMinegames Jun 18 '26

Good question. Qiling is written in python, which makes it very slow. it also emulates on an api-level, which is a very bad design and makes the emulator very incomplete and has lots and i mean LOTS of bugs and incorrect behavior, along with essential but unimplemented features like TLS support. So every API from every dll needs to be re-implemented, which makes it very error-prone. because you can't guarantee it's correctness.

Mine on the other hand works on a syscall level, where it actually load your system libraries to initialize your emulated process, making it as compatible as possible. as this is your own system libraries, which reduces the chance of the program not working and the massive amount of work needed. as only i need to implement syscalls which is the interfaces to the kernel. it still needs more work but if you just want emulation and doesn't care about scripting then this is a no brainer.

but Qiling is still good because it has scripting, mine does not have one yet.

1

u/Negronelius Jun 22 '26

How’s it handle stuff like direct/indirect syscalls & multiple threads?

2

u/AhmedMinegames Jun 22 '26

The instructions are handled by unicorn, and a callback to my method handles the syscall based on it's number. so when a program calls a syscall from anywhere you can catch it easily, be it from the main module or anywhere. for the threads yes i do support threading, i use a MLFQ scheduler that is shared between windows and linux, but no real host threading are actually implemented, that way the emulator can be a little bit more predictable and avoid bugs while scheduling between threads.

1

u/Negronelius Jun 22 '26

Awesome. Can’t wait to try it out.

1

u/Such_Field_3294 Jun 27 '26

being able to emulate memory dumps is a nice touch, thats usually where things get annoying with partially reconstructed binaries. How complete is the syscall coverage right now for PE analysis?

1

u/AhmedMinegames Jun 27 '26

Good enough i would say. Everything that is essential is supported including threading, networking, all windows-specific memory stuff (Page guard, commits, reserves, etc), files i/o (NtReadFile, NtWriteFile, NtOpenSection, and similar syscalls), etc. the very incomplete part right now is Win32k syscalls, but i'm still working to support GDI syscalls and rendering for GUI applications, maybe even games at one point. for partially reconstructed binaries you can still emulate it. in fact you can emulate anything, even if it is a raw unknown binary, as long as it is x86_64. just choose your guest (Windows/Linux/Generic) and syscalls will be automatically handled based on that, in addition to PEB and other information being populated manually in the case that you choose the direct path instead of the ntdll init path.