advdebug/brovan

Brovan is a binary emulator, a tool that lets you run and inspect program files inside a controlled, simulated environment instead of executing them directly on your computer. You load a Windows or Linux program into it and watch what the program does step by step, without putting your real system at risk. The main use case is security analysis. If you receive a suspicious file or want to understand what a piece of software is actually doing, Brovan lets you load it and observe every instruction, memory access, and system interaction it makes. It supports several file formats, including the standard executable formats used by Windows called PE, the ones used by Linux called ELF, raw memory dumps, and generic files that do not match a recognized format. Once a binary is loaded, Brovan opens an interactive command shell similar to a debugger, where you can pause execution, step through code one instruction at a time, set breakpoints that stop execution at chosen points, inspect and search memory, and save snapshots of the program's state to restore later. It can also trace system calls, monitor function calls with their arguments, and control whether the emulated program can reach the network, with settings ranging from no access at all to full network access. Brovan protects the host machine by redirecting the emulated program's file writes into its own virtual filesystem rather than the real disk. File reads can still touch real host files in some cases, since a program may need genuine system libraries to run correctly, so the README recommends treating unknown samples with the same caution used in any malware lab and disabling network access by default when analyzing unfamiliar files. This tool suits security researchers analyzing malware, developers debugging low level code, and anyone doing reverse engineering, meaning the practice of understanding software by observing its behavior rather than reading source code. It is written in C sharp and requires the dotnet 8 SDK to build, along with the Unicorn emulation engine.