A powerful, instrumentable, real-time malware analysis platform, software reverse-engineering suite & IDS.
Current: Community Preview Beta 2.0
Next public release: Early September 2026
A virtual machine on Windows 10 22H2 or higher, 64-bit.
Warning
Blackbird performs kernel-level instrumentation and may affect system stability depending on configuration. Always use it within a controlled virtual machine environment and not on systems containing important data.
Important
Blackbird is in early-development. The current state of Blackbird showcases the core system's functionality and implementation. Detection tuning, threat-intel integration, performance improvements and much more are in the works. Blackbird Community (This) is a subset of a larger version of Blackbird, so updates may be delayed.
- Full local analysis interface for malware detonation, reverse engineering, and triage
- Kernel capture for process, thread, image, handle, memory, registry, filesystem, network
- Target launch and attach workflows for EXE and DLL subjects, including suspended launch, deferred resume, and execution control
- In-process usermode telemetry
- Memory behaviour & mapping
- Views for process relations, child process tracking, handles, registry, file, network, ETW, COM and performance
- Thread stacks
- QPC timing compensation
- Offline capture analysis
Please use this project board to open issues & enhancements. This also loosely tracks live-development.
The public local-stack introduction, installation, architecture, security notes, and UI manual are provided here:
Session archives are stored as .bkcap (SQLite + LZ4). Detections can be exported as SIEM JSON Lines, Splunk HEC JSON, Elastic ECS NDJSON, CEF, or CSV. Detection reference scenarios are in DetectionExamples.exe.
You need Visual Studio 2022+ with Windows Driver Kit (WDK) and .NET (Desktop Development).
Clone Blackbird:
git clone https://github.com/8damon/Blackbird
Open the Blackbird.slnx file & select Release & build.
Note
Some instability or unexpected behavior may occur due to the low-level nature of the platform. This is expected during development.