- Home
- Reverse Engineering Tools
- DRAKVUF
On the recordRead 9 Oct 202621 facts
DRAKVUF
On the record
- Agentless monitoring
- Available features include agentless monitoring of Windows and Linux kernel functions and Windows userspace.drakvuf.com · read 4 Oct 2026
- Downloads
- The site links to pre-built Debian packages of the latest builds and provides instructions for building from source.drakvuf.com · read 9 Oct 2026
- Execution
- DRAKVUF can start binary execution agentlessly on Windows and Linux.drakvuf.com · read 9 Oct 2026
- Execution and files
- DRAKVUF can start binary execution on Windows and Linux and insert files into Windows without an in-guest agent.drakvuf.com · read 4 Oct 2026
- Guest support
- The site lists Windows 7–8 in 32-bit and 64-bit, Windows 10 64-bit, and Linux 2.6.x–5.x in 32-bit and 64-bit as supported guests.drakvuf.com · read 4 Oct 2026
- Hardware requirement
- DRAKVUF requires an Intel CPU with VT-x and Extended Page Tables; the site says it does not work on AMD CPUs or Intel CPUs lacking those extensions.drakvuf.com · read 9 Oct 2026
- Host setup
- The installation guide says DRAKVUF runs best on Xen 4.17, was mainly tested on Ubuntu 22.04 LTS, and requires a dom0 kernel version 5.11 or later.drakvuf.com · read 9 Oct 2026
- Integration
- The project names IntelOwl as an example of integration into malware analysis operations.drakvuf.com · read 9 Oct 2026
- Malware analysis
- The site says DRAKVUF was developed mainly for malware analysis and can also monitor arbitrary binaries.drakvuf.com · read 4 Oct 2026
- Monitoring
- It can monitor Windows and Linux internal kernel functions and Windows userspace without an in-guest agent.drakvuf.com · read 9 Oct 2026
- Open source
- DRAKVUF describes itself as an open-source project and welcomes patches and bug reports through its GitHub page.drakvuf.com · read 9 Oct 2026
- Plugins
- Windows plugins include tracing heap allocations, accessed files, UDP and TCP connections, and extracting files from memory before deletion.drakvuf.com · read 9 Oct 2026
- Product
- DRAKVUF is a virtualization-based, agentless black-box binary analysis system for tracing arbitrary binaries, including operating systems.drakvuf.com · read 4 Oct 2026
- Purpose
- DRAKVUF is a virtualization-based, agentless black-box binary analysis system for tracing arbitrary binaries, including operating systems, without installing special software in the guest VM.drakvuf.com · read 9 Oct 2026
- Release status
- The GitHub README lists Linux 2.6.x–6.x among supported guests and links to pre-built Debian packages.github.com · read 9 Oct 2026
- Security policy
- The GitHub repository displays a Security policy link.github.com · read 9 Oct 2026
- Stealth
- The site describes DRAKVUF as suitable for stealthy malware analysis because its footprint is nearly undetectable from the malware’s perspective.drakvuf.com · read 4 Oct 2026
- Support and contributions
- The site welcomes patches and bug reports through its GitHub project page and points users to the project wiki for guidance.drakvuf.com · read 4 Oct 2026
