Non-transitory machine-readable mediums including instructions that, when executed by processing circuitry of a machine, configure the processing circuitry for detection of policy violations in an unmodified binary in a virtual environment, the processing circuitry configured to perform operations comprising: receiving the unmodified binary, the unmodified binary in an executable and linkable format 'ELF'; executing, via an emulator, the unmodified binary within the virtual environment, wherein the executing comprises: determining, by an instruction set emulator, a symbol that is referenced during the executing of the unmodified binary; sending, to a software policy engine, the symbol, a current state of the executing of the unmodified binary, and a global state of the executing of the unmodified binary; determining, by the software policy engine, an assertion associated with the symbol, the assertion verifying a policy is enforced; updating a previous state of the executing of the unmodified binary based on the symbol; executing the assertion based on the current state of the executing of the unmodified binary, the previous state of the executing of the unmodified binary, and the global state of the executing of the unmodified binary; determining the assertion failed based on the executing the assertion, a failure indicating a violation of the policy; logging a warning indicating the failed assertion, the warning including the symbol and the current state of the executing of the unmodified binary; receiving, by the emulator, physical data from an emulated physical sensor; modifying the physical data by a first random amount, wherein the current state of the executing of the unmodified binary comprises the modified physical data; receiving, by the emulator, location data from a location sensor; and modifying the location data by a second random amount, wherein the current state of the executing of the unmodified binary comprises the modified location data, and wherein code associated with the symbol references the physical data or the location data. receiving the unmodified binary, the unmodified binary in an executable and linkable format 'ELF'; executing, via an emulator, the unmodified binary within the virtual environment, wherein the executing comprises: determining, by an instruction set emulator, a symbol that is referenced during the executing of the unmodified binary; sending, to a software policy engine, the symbol, a current state of the executing of the unmodified binary, and a global state of the executing of the unmodified binary; determining, by the software policy engine, an assertion associated with the symbol, the assertion verifying a policy is enforced; updating a previous state of the executing of the unmodified binary based on the symbol; executing the assertion based on the current state of the executing of the unmodified binary, the previous state of the executing of the unmodified binary, and the global state of the executing of the unmodified binary; determining the assertion failed based on the executing the assertion, a failure indicating a violation of the policy; logging a warning indicating the failed assertion, the warning including the symbol and the current state of the executing of the unmodified binary; receiving, by the emulator, physical data from an emulated physical sensor; modifying the physical data by a first random amount, wherein the current state of the executing of the unmodified binary comprises the modified physical data; receiving, by the emulator, location data from a location sensor; and modifying the location data by a second random amount, wherein the current state of the executing of the unmodified binary comprises the modified location data, and wherein code associated with the symbol references the physical data or the location data. determining, by an instruction set emulator, a symbol that is referenced during the executing of the unmodified binary; sending, to a software policy engine, the symbol, a current state of the executing of the unmodified binary, and a global state of the executing of the unmodified binary; determining, by the software policy engine, an assertion associated with the symbol, the assertion verifying a policy is enforced; updating a previous state of the executing of the unmodified binary based on the symbol; executing the assertion based on the current state of the executing of the unmodified binary, the previous state of the executing of the unmodified binary, and the global state of the executing of the unmodified binary; determining the assertion failed based on the executing the assertion, a failure indicating a violation of the policy; logging a warning indicating the failed assertion, the warning including the symbol and the current state of the executing of the unmodified binary; receiving, by the emulator, physical data from an emulated physical sensor; modifying the physical data by a first random amount, wherein the current state of the executing of the unmodified binary comprises the modified physical data; receiving, by the emulator, location data from a location sensor; and modifying the location data by a second random amount, wherein the current state of the executing of the unmodified binary comprises the modified location data, and wherein code associated with the symbol references the physical data or the location data.