loupe
emulation-based malware deobfuscator and unpacker
Loupe is an emulation-based malware deobfuscator and unpacker. It is designed to let suspicious code reveal itself inside an instrumented environment without granting it control of a complete operating system.
The project is also a practical study of Portable Executable internals, low-level execution, and the boundary between static and dynamic malware analysis.
inspect
Parse PE headers, sections, imports, and execution context before emulation.
instrument
Patch imports and intercept behavior inside a controlled Unicorn Engine harness.
recover
Observe execution and extract a cleaner artifact for further analysis.
Building the emulator scaffold and establishing reliable import-address-table patching.
Run the first complete sample through the parse, patch, emulate, and recover pipeline.