# Cisco-Talos/pyrebox

Python scriptable Reverse Engineering Sandbox, a Virtual Machine instrumentation and inspection framework based on QEMU

Repository: https://github.com/Cisco-Talos/pyrebox
Canonical: https://ross.abutalabs.com/products/pyrebox
Homepage: https://talosintelligence.com/pyrebox
Language: C
License: GPL-2.0
License Family: copyleft
Archived: true
Last push: 2024-02-14T14:54:36+00:00

## Health v2 (maintenance only)
Score: 10/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 0, release rhythm 35, longevity 100
- inputs: {"age_days": 3344, "days_push": 931, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: no_releases, archived
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1684, forks 254 (observed 2026-08-28T04:05:21.943407+00:00)

## What it is
PyREBox is a Python-scriptable reverse engineering sandbox built on QEMU that provides whole-system dynamic analysis and debugging of running virtual machines. It uses virtual machine introspection to inspect and modify guest memory and registers without modifying the guest OS, driven via an IPython shell and Python API.

## Use cases
- analyze malware in an instrumented VM
- script dynamic analysis of a running guest OS
- inspect guest memory and registers from outside the VM
- automate reverse engineering tasks with Python scripts
- trace process execution inside a QEMU emulator
- extract forensic information from a live VM

## When to choose
- you need whole-system, guest-transparent dynamic analysis of Windows or Linux VMs
- you want to write analysis tooling in Python on top of QEMU
- you are doing malware analysis or threat research with VM introspection

## When to avoid
- you need an actively maintained tool - the project is archived and unmaintained
- you need modern CPU/OS support or recent QEMU features
- you need static analysis or symbolic execution out of the box

## Facets
- artifact type: framework
- maturity: abandoned
- function: reverse-engineering, simulation, security
- domain: security, reverse-engineering
- platform: python, cpp
- tags: qemu, vmi, malware-analysis, dynamic-analysis, sandbox, archived, debugging, instrumentation, virtualization, linux

## Member repositories
- Cisco-Talos/pyrebox (main) score 10

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:05:21.943407+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T03:41:15.728385+00:00, confidence not recorded.
  - readme: https://github.com/Cisco-Talos/pyrebox (fetched 2026-08-28T04:05:21.943407+00:00, sha cdf059dfa1dc)
  - homepage: https://talosintelligence.com/pyrebox (fetched 2026-08-29T11:13:58.757863+00:00, sha 3263ab1aec8d)
  - site_page: https://talosintelligence.com/about (fetched 2026-08-29T11:13:58.767175+00:00, sha cb4423ee92ac)
  - site_page: https://support.talosintelligence.com (fetched 2026-08-29T11:13:58.769215+00:00, sha c0133f3b8a0e)
- Data as of 2026-08-30T08:39:29.467469+00:00.