GitHub: internet-sicherheit/hypersis-drakvuf
HypErSIS DRAKVUF is a fork from the official DRAKVUF software by Tamas K Lengyel (@tklengyel). This fork repository contains a number of modifications, improvements, and plugin extensions that we have made to DRAKVUF as part of the HypErSIS research project.
This includes the following:
- new YaraScanner plugin (VAD-tree aware in memory scanner for virtual process address spaces)
- new EtwEventMon plugin (live monitoring of Event Tracing for Windows (ETW) events)
- new LibHypersis with a new TrapManager, InterPluginCall, SymbolManager, Logger
- some breaking changes (improvements) to Syscalls and ApiMon plugins and some DRAKVUF libs
- scripts for extracting a lot of interesting PDBs from target guest Windows and converting them into volatilitiy symbol profiles (JSON)
- scripts for XEN/QEMU snapshot management
- scripts for build, package, installation, uninstallation of DRAKVUF, LibVMI, XEN/QUEMU and their dependencies
- support for Ubuntu 24.04
The 3-year joint project HypErSIS is a cooperation of the ThreatLab working group
of the Institute for Internet Security at the Westphalian University of Applied Sciences
and Cyberus Technology GmbH.
It is funded by the German Federal Ministry Research, Technology and Space (BMFTR) under the funding code 16KIS1746.
- get HypErSIS DRAKVUF from GitHub
git clone git@github.com:internet-sicherheit/hypersis-drakvuf.git
cd hypersis-drakvuf- checkout the branch which is preperated for setup on Ubuntu 24.04
git checkout ubuntu-24-04- initialize the submodules (XEN, LibVMI, Volatility, Dwarf2Json)
git submodule update --init- install Drakvuf Dependencies
./drakvuf_install_dependencies.sh- Build and install XEN and Drakvuf
./drakvuf_install.sh-
reboot with XEN
-
Build HypErSIS Drakvuf
./drakvuf_dev_build.sh- (Optional) add custom aliases
GitHub: tklengyel/drakvuf
DRAKVUF is a virtualization based agentless black-box binary analysis system. DRAKVUF allows for in-depth execution tracing of arbitrary binaries (including operating systems), all without having to install any special software within the virtual machine used for analysis.
DRAKVUF uses hardware virtualization extensions found in Intel CPUs. You will need an Intel CPU with virtualization support (VT-x) and with Extended Page Tables (EPT). DRAKVUF is not going to work on any other CPUs (such as AMD) or on Intel CPUs without the required virtualization extensions.
DRAKVUF currently supports:
- Windows 7 - 8, both 32 and 64-bit
- Windows 10 64-bit
- Linux 2.6.x - 6.x, both 32-bit and 64-bit
You can find pre-built Debian packages of the latest DRAKVUF builds at https://github.com/tklengyel/drakvuf-builds/releases
DRAKVUF provides a perfect platform for stealthy malware analysis as its footprint is nearly undectebable from the malware's perspective. While DRAKVUF has been mainly developed with malware analysis in mind, it is certainly not limited to that task as it can be used to monitor the execution of anything that executes within a VM, including firmware, OS kernels and user-space processes.
If you would like a full-featured DRAKVUF GUI to setup as automated analysis sandbox, check out the DRAKVUF Sandbox project.
Installation steps can be found on the project website: https://drakvuf.com