DRAKVUF

Spec sheet

Purpose

DRAKVUF is a virtualization-based, agentless black-box binary analysis system for tracing arbitrary binaries, including operating systems, without installing special software in the guest VM.Read 9 Oct 2026 · drakvuf.com

Product

DRAKVUF is a virtualization-based, agentless black-box binary analysis system for tracing arbitrary binaries, including operating systems.Read 4 Oct 2026 · drakvuf.com

Agentless monitoring

Available features include agentless monitoring of Windows and Linux kernel functions and Windows userspace.Read 4 Oct 2026 · drakvuf.com

Downloads

The site links to pre-built Debian packages of the latest builds and provides instructions for building from source.Read 9 Oct 2026 · drakvuf.com

Execution

DRAKVUF can start binary execution agentlessly on Windows and Linux.Read 9 Oct 2026 · drakvuf.com

Execution and files

DRAKVUF can start binary execution on Windows and Linux and insert files into Windows without an in-guest agent.Read 4 Oct 2026 · drakvuf.com

Guest support

The site lists Windows 7–8 in 32-bit and 64-bit, Windows 10 64-bit, and Linux 2.6.x–5.x in 32-bit and 64-bit as supported guests.Read 4 Oct 2026 · drakvuf.com

Hardware requirement

DRAKVUF requires an Intel CPU with VT-x and Extended Page Tables; the site says it does not work on AMD CPUs or Intel CPUs lacking those extensions.Read 9 Oct 2026 · drakvuf.com

Host setup

The installation guide says DRAKVUF runs best on Xen 4.17, was mainly tested on Ubuntu 22.04 LTS, and requires a dom0 kernel version 5.11 or later.Read 9 Oct 2026 · drakvuf.com

Integration

The project names IntelOwl as an example of integration into malware analysis operations.Read 9 Oct 2026 · drakvuf.com

Malware analysis

The site says DRAKVUF was developed mainly for malware analysis and can also monitor arbitrary binaries.Read 4 Oct 2026 · drakvuf.com

Monitoring

It can monitor Windows and Linux internal kernel functions and Windows userspace without an in-guest agent.Read 9 Oct 2026 · drakvuf.com

Open source

DRAKVUF describes itself as an open-source project and welcomes patches and bug reports through its GitHub page.Read 9 Oct 2026 · drakvuf.com

Plugins

Windows plugins include tracing heap allocations, accessed files, UDP and TCP connections, and extracting files from memory before deletion.Read 9 Oct 2026 · drakvuf.com

Release status

The GitHub README lists Linux 2.6.x–6.x among supported guests and links to pre-built Debian packages.Read 9 Oct 2026 · github.com

Security policy

The GitHub repository displays a Security policy link.Read 9 Oct 2026 · github.com

Stealth

The site describes DRAKVUF as suitable for stealthy malware analysis because its footprint is nearly undetectable from the malware’s perspective.Read 4 Oct 2026 · drakvuf.com

Support and contributions

The site welcomes patches and bug reports through its GitHub project page and points users to the project wiki for guidance.Read 4 Oct 2026 · drakvuf.com

Supported guests

The project site lists Windows 7–8 (32-bit and 64-bit), Windows 10 64-bit, and Linux 2.6.x–5.x (32-bit and 64-bit) as supported monitored operating systems.Read 9 Oct 2026 · drakvuf.com

Use case

The project was developed mainly for stealthy malware analysis and can also monitor arbitrary binaries.Read 9 Oct 2026 · drakvuf.com

Virtualization

The installation guide says DRAKVUF runs best on Xen 4.17 and was mainly tested on Ubuntu 22.04 LTS.Read 4 Oct 2026 · drakvuf.com

Where Specifiction places it

• Reverse Engineering Tools#38 of 737.3
• Sandbox Software#18 of 267.3