AwesomeREA.org

Tool

DRAKVUF

Tamas K Lengyel's virtualization-based, agentless black-box binary analysis system: running on the Xen hypervisor through LibVMI, it traces execution in Windows and Linux guests, from kernel functions to user-mode code, without installing software inside the analyzed virtual machine. Plugins log system calls, API calls and file, registry, process, socket and memory activity, extract files from memory before they are deleted and dump process memory, while an injector starts programs in the guest without an in-guest helper. CERT Polska's separate DRAKVUF Sandbox builds an automated sandbox with a GUI on top of it.

Requirements & limits

  • Latest tagged release: 1.0, published 2022-12-29 with Debian and Ubuntu packages. meson.build at the reviewed main commit of 2026-09-30 declares version 1.1, and the separate drakvuf-builds repository publishes per-commit drakvuf-bundle 1.1 packages for Debian bookworm and Ubuntu 22.04 and 24.04 with matching Xen 4.20.1 hypervisor packages, including a build of the reviewed commit.
  • Needs an Intel CPU with VT-x and Extended Page Tables; the README says DRAKVUF will not work on AMD or on Intel CPUs without them. DRAKVUF runs in Xen's dom0. The project website's installation guide, last updated 2022-12-29 for Xen 4.17 and mainly tested on Ubuntu 22.04, builds Xen from the bundled submodule, sets Xen boot options, asks for a dom0 kernel of 5.11 or newer and stores guest disks on LVM; DRAKVUF itself builds with meson and ninja.
  • The README lists Windows 7 and 8 (32- and 64-bit), Windows 10 64-bit and Linux 2.6.x to 6.x guests; the older website guide says Linux up to 5.x. The analyst installs the guest from their own operating-system media and generates a JSON kernel profile for LibVMI, from the Windows kernel's PDB with the bundled Volatility 3 pdbconv script or from Linux kernel debug symbols with dwarf2json; extra per-module profiles, such as one for tcpip.sys, enable plugins like socketmon.
  • Custom license: GPL version 2 only with the author's clarifications and exceptions, which read derivative works broadly, bar combining DRAKVUF with plain-GPL software and offer alternative licenses for proprietary use; GitHub does not classify it. Xen, LibVMI, Volatility 3 and dwarf2json are git submodules under their own licenses. The README presents it mainly for malware analysis; this entry covers execution tracing only, not its stealth claims or the guest-concealment plugins. No VM was set up and nothing was run.

About this entry

Type
Tool
Category
Debugging and dynamic analysis
Relationship
Foundation tool
Targets
Binary

Sources reviewed

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · tklengyel/drakvuf · Revision b2f64d8
  2. LICENSE GitHub · tklengyel/drakvuf · Revision b2f64d8
  3. .gitmodules GitHub · tklengyel/drakvuf · Revision b2f64d8
  4. meson.build GitHub · tklengyel/drakvuf · Revision b2f64d8
  5. src/plugins GitHub · tklengyel/drakvuf · Revision b2f64d8
  6. .github/workflows/ci.yml GitHub · tklengyel/drakvuf · Revision b2f64d8
  7. https://drakvuf.com/
  8. https://github.com/tklengyel/drakvuf/releases/tag/1.0
  9. https://github.com/tklengyel/drakvuf-builds/releases/tag/build-b2f64d8d73d456840e5fc276c13f0df0b2b79231

More in Native binaries

All 105 entries in Native binaries