tklengyel/drakvuf

Health v2 · maintenance only

Flags: no_license

Adoption not part of the score

1268 stars · 270 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

DRAKVUF is a virtualization-based, agentless black-box binary analysis system that traces execution of arbitrary binaries, kernels, and firmware inside a VM without installing any software in the guest. It runs on Xen with Intel VT-x/EPT hardware and is primarily used for stealthy malware analysis.

Use cases

• analyze malware in a stealthy sandbox without in-guest agents
• trace Windows kernel function execution and heap allocations from outside the VM
• extract deleted files from guest memory before they are discarded
• inject and start executables inside a Windows guest without a helper
• monitor execution of firmware, OS kernels, and user-space processes in a VM

When to choose

• you need agentless, hard-to-detect dynamic analysis of Windows or Linux binaries
• you have Intel VT-x/EPT hardware and want VM introspection on Xen
• you want to build an automated malware analysis sandbox (e.g., with DRAKVUF Sandbox)

When to avoid

• you have an AMD CPU or Intel CPU without EPT - it will not run
• you need static analysis or a simple user-mode debugger
• you want a hosted/GUI-first sandbox out of the box without extra setup

Facets

application · maturity active

security reverse-engineering monitoring tracing security reverse-engineering cli self-hosted malware-analysis xen virtual-machine-introspection agentless binary-analysis sandbox virtualization linux

Member repositories

For agents

markdown · JSON · MCP: product_card(name="tklengyel/drakvuf")