Issues

• report: a handler return value of -1 shows as -0x1

  bug
  mandiant/speakeasy#480 · Filter by author williballenthin opened on Nov 3, 2026
  

• DriverSection list holds only the driver entry, and InMemoryOrderLinks.Flink is 0

  bug
  mandiant/speakeasy#479 · Filter by author williballenthin opened on Nov 3, 2026
  

• load_container ignores pid and session of the is_main_exe entry

  bug
  mandiant/speakeasy#478 · Filter by author williballenthin opened on Nov 3, 2026
  

• kernel32: CreateProcess ignores lpCurrentDirectory

  bug
  mandiant/speakeasy#477 · Filter by author williballenthin opened on Nov 3, 2026
  

• ci: build the Docker image

  enhancement
  mandiant/speakeasy#473 · Filter by author williballenthin opened on Nov 2, 2026
  

• read_mem_string drops a bad UTF-16 unit, the report signature shows U+FFFD

  bug
  mandiant/speakeasy#472 · Filter by author williballenthin opened on Nov 2, 2026
  

• get_mem_strings: remove the input mem_tag check, which never matches

  enhancement
  mandiant/speakeasy#471 · Filter by author williballenthin opened on Nov 2, 2026
  

• wininet: InternetOpenUrl records an https URL as http

  bug
  mandiant/speakeasy#470 · Filter by author williballenthin opened on Nov 2, 2026
  

• cli: BrokenPipeError when stdout closes early

  bug
  mandiant/speakeasy#469 · Filter by author williballenthin opened on Nov 2, 2026
  

• add_instruction_hook without insn fails in ctypes

  bug
  mandiant/speakeasy#468 · Filter by author williballenthin opened on Nov 2, 2026
  

• load_module and load_shellcode do not add the pending hooks

  bug
  mandiant/speakeasy#467 · Filter by author williballenthin opened on Nov 2, 2026
  

• kernel32: WideCharToMultiByte does not write lpUsedDefaultChar

  bug
  mandiant/speakeasy#466 · Filter by author williballenthin opened on Nov 2, 2026
  

• gdi32: GetObjectA returns cbBuffer for a device context handle

  bug
  mandiant/speakeasy#465 · Filter by author williballenthin opened on Nov 2, 2026
  

• GetVersionEx, PsGetVersion and NetWkstaGetInfo raise when os_ver leaves a field unset

  bug
  mandiant/speakeasy#464 · Filter by author williballenthin opened on Nov 2, 2026
  

• Tracking: cleanup and fixes for the 2.0 release

  mandiant/speakeasy#435 · Filter by author williballenthin opened on Nov 2, 2026
  1

• CLI: missing --arch, volume tracebacks, number bases, exit code, wall-clock limit

  bug
  mandiant/speakeasy#434 · Filter by author williballenthin opened on Nov 2, 2026

• Small handler bugs: GetDriveType, SID functions, RtlTimeToTimeFields, NT path prefix, GetObjectA

  bug
  mandiant/speakeasy#433 · Filter by author williballenthin opened on Nov 2, 2026
  

• Version sources: ntdll RtlGetVersion and KUSER_SHARED_DATA do not agree with the config

  bug
  mandiant/speakeasy#432 · Filter by author williballenthin opened on Nov 2, 2026
  

• String compare handlers return 1 for each pair of strings that is not equal

  bug
  mandiant/speakeasy#431 · Filter by author williballenthin opened on Nov 2, 2026
  

• The process list has the main process two times, or misses the configured processes

  bug
  mandiant/speakeasy#430 · Filter by author williballenthin opened on Nov 2, 2026
  

• Docs: missing CLI flags, showboat files with local paths, uppercase --env names

  documentation
  mandiant/speakeasy#429 · Filter by author williballenthin opened on Nov 2, 2026
  1

  

• Packaging: setuptools minimum, sdist tests, Docker build, stale extras and env vars

  bug
  mandiant/speakeasy#428 · Filter by author williballenthin opened on Nov 2, 2026

• Type the apihook and impdata decorators

  enhancement
  mandiant/speakeasy#427 · Filter by author williballenthin opened on Nov 2, 2026
  

• Add ruff rule groups that find bugs; lint only tracked files

  enhancement
  mandiant/speakeasy#426 · Filter by author williballenthin opened on Nov 2, 2026
  

• Constants: one IntEnum or IntFlag per SDK set, one name lookup

  enhancement
  mandiant/speakeasy#425 · Filter by author williballenthin opened on Nov 2, 2026