{
  "added_at": "2026-11-02",
  "additional_evidence_urls": [
    "https://github.com/tklengyel/drakvuf/blob/b2f64d8d73d456840e5fc276c13f0df0b2b79231/LICENSE",
    "https://github.com/tklengyel/drakvuf/blob/b2f64d8d73d456840e5fc276c13f0df0b2b79231/.gitmodules",
    "https://github.com/tklengyel/drakvuf/blob/b2f64d8d73d456840e5fc276c13f0df0b2b79231/meson.build",
    "https://github.com/tklengyel/drakvuf/tree/b2f64d8d73d456840e5fc276c13f0df0b2b79231/src/plugins",
    "https://github.com/tklengyel/drakvuf/blob/b2f64d8d73d456840e5fc276c13f0df0b2b79231/.github/workflows/ci.yml",
    "https://drakvuf.com/",
    "https://github.com/tklengyel/drakvuf/releases/tag/1.0",
    "https://github.com/tklengyel/drakvuf-builds/releases/tag/build-b2f64d8d73d456840e5fc276c13f0df0b2b79231"
  ],
  "category": "dynamic-analysis",
  "description_en": "Tamas K Lengyel's virtualization-based, agentless black-box binary analysis system: running on the Xen hypervisor through LibVMI, it traces execution in Windows and Linux guests, from kernel functions to user-mode code, without installing software inside the analyzed virtual machine. Plugins log system calls, API calls and file, registry, process, socket and memory activity, extract files from memory before they are deleted and dump process memory, while an injector starts programs in the guest without an in-guest helper. CERT Polska's separate DRAKVUF Sandbox builds an automated sandbox with a GUI on top of it.",
  "description_zh": "由 Tamas K Lengyel 开发的基于虚拟化、无需代理的黑盒二进制分析系统：它运行在 Xen 虚拟机监控器上并借助 LibVMI，跟踪 Windows 和 Linux 客户机中从内核函数到用户态代码的执行过程，且无需在被分析的虚拟机内安装任何软件。各插件可记录系统调用、API 调用以及文件、注册表、进程、套接字和内存活动，在文件被删除前从内存中提取文件并转储进程内存；注入器无需客户机内辅助程序即可在客户机中启动程序。CERT Polska 另行开发的 DRAKVUF Sandbox 在其基础上构建了带图形界面的自动化沙箱。",
  "entry_url": "https://awesomerea.org/resources/drakvuf/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/drakvuf/",
  "evidence_url": "https://github.com/tklengyel/drakvuf/blob/b2f64d8d73d456840e5fc276c13f0df0b2b79231/README.md",
  "group": "tools",
  "id": "drakvuf",
  "json_url": "https://awesomerea.org/resources/drakvuf/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/drakvuf/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/drakvuf/index.md",
  "name": "DRAKVUF",
  "name_zh": "DRAKVUF 虚拟化黑盒二进制分析系统",
  "record_type": "resource",
  "relationship": "foundation",
  "requirements": [
    "Latest tagged release: 1.0, published 2022-12-29 with Debian and Ubuntu packages. meson.build at the reviewed main commit of 2026-09-30 declares version 1.1, and the separate drakvuf-builds repository publishes per-commit drakvuf-bundle 1.1 packages for Debian bookworm and Ubuntu 22.04 and 24.04 with matching Xen 4.20.1 hypervisor packages, including a build of the reviewed commit.",
    "Needs an Intel CPU with VT-x and Extended Page Tables; the README says DRAKVUF will not work on AMD or on Intel CPUs without them. DRAKVUF runs in Xen's dom0. The project website's installation guide, last updated 2022-12-29 for Xen 4.17 and mainly tested on Ubuntu 22.04, builds Xen from the bundled submodule, sets Xen boot options, asks for a dom0 kernel of 5.11 or newer and stores guest disks on LVM; DRAKVUF itself builds with meson and ninja.",
    "The README lists Windows 7 and 8 (32- and 64-bit), Windows 10 64-bit and Linux 2.6.x to 6.x guests; the older website guide says Linux up to 5.x. The analyst installs the guest from their own operating-system media and generates a JSON kernel profile for LibVMI, from the Windows kernel's PDB with the bundled Volatility 3 pdbconv script or from Linux kernel debug symbols with dwarf2json; extra per-module profiles, such as one for tcpip.sys, enable plugins like socketmon.",
    "Custom license: GPL version 2 only with the author's clarifications and exceptions, which read derivative works broadly, bar combining DRAKVUF with plain-GPL software and offer alternative licenses for proprietary use; GitHub does not classify it. Xen, LibVMI, Volatility 3 and dwarf2json are git submodules under their own licenses. The README presents it mainly for malware analysis."
  ],
  "requirements_zh": [
    "最新的带标签版本为 1.0，发布于 2022-12-29，附带 Debian 和 Ubuntu 软件包。所审阅的 2026-09-30 main 提交中，meson.build 声明版本为 1.1；独立的 drakvuf-builds 仓库按提交发布面向 Debian bookworm 以及 Ubuntu 22.04 和 24.04 的 drakvuf-bundle 1.1 软件包，并附配套的 Xen 4.20.1 虚拟机监控器软件包，其中包括所审阅提交的构建。",
    "需要支持 VT-x 和扩展页表（EPT）的 Intel 处理器；README 称 DRAKVUF 无法在 AMD 处理器或缺少这些扩展的 Intel 处理器上运行。DRAKVUF 运行于 Xen 的 dom0 中。项目网站的安装指南最后更新于 2022-12-29，针对 Xen 4.17，主要在 Ubuntu 22.04 上测试：它从自带的子模块构建 Xen、设置 Xen 启动参数、要求 dom0 内核为 5.11 或更新版本，并把客户机磁盘放在 LVM 上；DRAKVUF 本身用 meson 和 ninja 构建。",
    "README 列出的客户机包括 Windows 7 和 8（32 位与 64 位）、64 位 Windows 10 以及 Linux 2.6.x 至 6.x；较早的网站指南则称 Linux 支持到 5.x。分析者需用自己的操作系统安装介质安装客户机，并为 LibVMI 生成 JSON 内核配置文件：Windows 从内核 PDB 用自带的 Volatility 3 pdbconv 脚本生成，Linux 则用 dwarf2json 从内核调试符号生成；针对单个模块的额外配置文件（如 tcpip.sys 的配置）可启用 socketmon 等插件。",
    "采用自定义许可：仅限 GPL 第 2 版，并附作者的澄清与例外条款，这些条款对衍生作品作宽泛解释，禁止将 DRAKVUF 与普通 GPL 软件结合，并为专有用途提供替代许可；GitHub 无法识别该许可。Xen、LibVMI、Volatility 3 和 dwarf2json 作为 git 子模块引入，各自适用其许可证。README 主要将其定位于恶意软件分析。"
  ],
  "targets": [
    "binary"
  ],
  "url": "https://github.com/tklengyel/drakvuf",
  "verification": "source-reviewed",
  "verified_at": "2026-10-20"
}