BLACKBIRD

A powerful, instrumentable, real-time malware analysis platform, software reverse-engineering suite & IDS.

ROADMAP

Current: Community Preview Beta 2.0
Next public release: Early September 2026

REQUIREMENTS

A virtual machine on Windows 10 22H2 or higher, 64-bit.

Warning

Blackbird performs kernel-level instrumentation and may affect system stability depending on configuration. Always use it within a controlled virtual machine environment and not on systems containing important data.

Important

Blackbird is in early-development. The current state of Blackbird showcases the core system's functionality and implementation. Detection tuning, threat-intel integration, performance improvements and much more are in the works. Blackbird Community (This) is a subset of a larger version of Blackbird, so updates may be delayed.

FEATURES

• Full local analysis interface for malware detonation, reverse engineering, and triage
• Kernel capture for process, thread, image, handle, memory, registry, filesystem, network
• Target launch and attach workflows for EXE and DLL subjects, including suspended launch, deferred resume, and execution control
• In-process usermode telemetry
• Memory behaviour & mapping
• Views for process relations, child process tracking, handles, registry, file, network, ETW, COM and performance
• Thread stacks
• QPC timing compensation
• Offline capture analysis

BUGS & ENHANCEMENTS

Please use this project board to open issues & enhancements. This also loosely tracks live-development.

DOCUMENTATION

The public local-stack introduction, installation, architecture, security notes, and UI manual are provided here:

• Blackbird Docs

Session archives are stored as .bkcap (SQLite + LZ4). Detections can be exported as SIEM JSON Lines, Splunk HEC JSON, Elastic ECS NDJSON, CEF, or CSV. Detection reference scenarios are in DetectionExamples.exe.

COMPILATION

You need Visual Studio 2022+ with Windows Driver Kit (WDK) and .NET (Desktop Development).

Clone Blackbird:

git clone https://github.com/8damon/Blackbird

Open the Blackbird.slnx file & select Release & build.

Note

Some instability or unexpected behavior may occur due to the low-level nature of the platform. This is expected during development.