Speculos emulator

Estimated reading time: One minute

Sections in this page

• Bugs and contributions
• Limitations
• Security

Speculos emulates Ledger hardware wallets (Nano S, Nano X, Nano S Plus and Blue) on desktop computers. It is particularly useful when

• you don’t have the physical hardware device, or
• you want to facilitate the pressing of Nano buttons.

Click here for the Speculos GitHub repository.

Usage example:

./speculos.py apps/btc.elf
# ... and open a browser on http://127.0.0.1:5000

Bugs and contributions

Feel free to open issues and create pull requests on the Speculos GitHub repository.

The master branch is protected against force pushing. Contributions should be made through pull requests, which are reviewed by @LedgerHQ members before being merged to master:

• @LedgerHQ members can create branches directly on the repository (members with write access to the repository)
• External contributors should fork the repository

Limitations

The Speculos emulator handles only a few syscalls made by common apps; for instance, syscalls related to app installation, firmware updates or OS info can’t be implemented.

There is no guarantee that apps will have the same behaviour as on hardware devices:

• Invalid syscall parameters might throw an exception on real devices but be ignored on Speculos.
• Attempts to perform unaligned accesses when not allowed (eg. dereferencing a misaligned pointer) will cause an alignment fault on hardware devices.

Security

Apps can make arbitrary Linux system calls (and use QEMU semihosting features). Thus do not run untrusted apps on Speculos.

It is worth noting that system calls (src/) do not expect malicious inputs.
Also, in Speculos, there is no privilege separation between the app and the syscalls. This doesn’t reflect the security of the firmware on hardware devices where the App and OS isolation is enforced.

Speculos is not part of the Ledger bug bounty program.

---

Did you find this page helpful?

How would you improve this page for developers?

I am a developer.
Contributors will be chosen randomly to receive rewards. Check this box to send your email and participate.

Ledger collects your email address to send you rewards for your contribution to improve the Developer Portal documentation. Learn more about how we manage your data and your rights.

By providing your email address, you consent that Ledger may contact you for rewards delivery purposes. If you are part of the randomly selected contributors, we will send you an email to ask for your physical address and if necessary, ask you for additional information on the suggestion you made. Your information will only be available to Ledger and will be retained for no longer than 90 days. It may be transferred to non-European countries that ensure an adequate level of protection or under the standard contractual clauses adopted by the EU Commission.

Please note that you may withdraw your consent at any time, access your data and request their rectification or deletion. You may also request the limitation of the processing of your data. To exercise your rights or for any question on the processing of your data, please contact LEDGER’s Data Protection Officer here. If nevertheless you believe LEDGER did not adequately address your concerns and mishandled your data, you may lodge a complaint with the personal data protection authority of your country.

Build (Linux)

Next →