BLACKBIRD

A defensive software reverse-engineering (SRE) / IDS and real-time malware analysis platform

REQUIREMENTS

A virtual machine on Windows 10 22H2 or higher, 64-bit.

Important

Blackbird performs kernel-level instrumentation and may affect system stability depending on configuration. Always use it within a controlled virtual machine environment and not on systems containing important data.

FEATURES

• Fully fledged analysis interface
• Kernel-backed
• Integrated heuristics & detections
• Detailed overview and inspection of process-activity
• WPA-like event-viewing graph
• Target execution control
• Target API hooking
• API call analyzer & graph
• API call argument observation
• Full symbol resolution
• Thread & Thread-stack analyzers
• Memory analyzer & Disassembler
• Registry activity overview
• File activity overview
• Process-relations & child processes overview
• Handles overview
• Network overview
• ETW overview
• COM overview
• Performance analytics
• Configurable/importable local rules with SIEM detection exports
• Diagnostics suite
• Optional private remote control via the self-hosted server
• Optional private self-hosted server for VM enrollment, node inventory, artifact jobs, captures, RBAC, SSO, and audit

BUGS & ENHANCEMENTS

Please use this project board to open issues & enhancements. This also loosely tracks live-development.

DOCUMENTATION

The introduction, installation, architecture, security, optional server operations, and UI manual are provided here:

• Blackbird Docs
• Local engineering docs under Docs/ when included in an internal working tree
• Private self-hosted server docs when the optional server tree is included

Session archives are stored as .bkcap (SQLite + LZ4). Detections can be exported as SIEM JSON Lines, Splunk HEC JSON, Elastic ECS NDJSON, CEF, or CSV. Detection reference scenarios are in DetectionExamples.exe.

COMPILATION

You need Visual Studio 2022+ with Windows Driver Kit (WDK) and .NET (Desktop Development).

Clone Blackbird:

git clone https://github.com/8damon/Blackbird

Open the Blackbird.slnx file & select Release & build.

KNOWN ISSUES

• The optional private self-hosted server and operator transport use the secure node command channel. Discovery/status metadata is not identity proof; secure control requires pinned node identity and VM enrollment/trusted operator fingerprints.

• Rules Intel supports local rule evaluation, MITRE attribution where available, and memory/page sample scanning in the analysis interface. External third-party rule packs are not part of the public tree until reviewed.

• Some executables when launched present with ERROR_BAD_IMPERSONATION_LEVEL (1346), this is a known bug and the root cause is being identified.

• "Uplink Failed" / "Service Not Found", this is due to you not running the installer script Scripts\installer.ps1, which installs and starts the driver and controller services.

• Memory attribution is heuristic when direct allocator telemetry is unavailable. Thread execution through a region is shown as an ownership clue, not definitive ownership proof.

Note

Some instability or unexpected behavior may occur due to the low-level nature of the platform. This is expected during development.