DRAKVUF
DRAKVUF is a free, open-source system for tracing binaries inside virtual machines without installing an agent in the guest.
What DRAKVUF is
DRAKVUF is a free, open-source system for tracing binaries inside virtual machines without installing an agent in the guest. Developed mainly for malware analysis, it can also monitor other binaries, including operating systems. It can start execution on Windows and Linux, trace kernel functions on both, and monitor Windows userspace. Windows plugins can follow heap allocations, accessed files and TCP or UDP connections; they can also extract files from memory before deletion. The project describes its footprint as nearly undetectable from the malware’s perspective. DRAKVUF is self-hosted on Linux and requires an Intel CPU with VT-x and Extended Page Tables; it does not work on AMD CPUs or Intel CPUs without those extensions. The project lists Windows 7–8 in 32-bit and 64-bit, Windows 10 64-bit, and Linux 2.6.x–5.x in 32-bit and 64-bit as supported guests. Its installation guide says it runs best on Xen 4.17, was mainly tested on Ubuntu 22.04 LTS, and needs a dom0 kernel version 5.11 or later. Pre-built Debian packages and build instructions are available.
Good
- Free and open source
- Monitors Windows and Linux without a guest agent
- Windows plugins trace files and network connections
- Can extract files from memory before deletion
Watch out
- Requires Intel VT-x and Extended Page Tables
- Does not work on AMD CPUs
- Requires Linux self-hosting
Who it suits
DRAKVUF suits security teams and researchers who need agentless binary or malware analysis in virtual machines. Its hardware and host requirements make it a fit only for setups with compatible Intel virtualization support and Linux hosting.
Verdict
DRAKVUF offers agentless tracing for malware analysis and other binaries, with Windows plugins for detailed monitoring. Confirm the Intel hardware and host requirements before planning a deployment.
The facts
Each one read from DRAKVUF's own pages, with the date it was checked.
What it does
- Agentless monitoring
- Available features include agentless monitoring of Windows and Linux kernel functions and Windows userspace.checked 4 Oct 2026
- Downloads
- The site links to pre-built Debian packages of the latest builds and provides instructions for building from source.checked 9 Oct 2026
- Execution
- DRAKVUF can start binary execution agentlessly on Windows and Linux.checked 9 Oct 2026
- Execution and files
- DRAKVUF can start binary execution on Windows and Linux and insert files into Windows without an in-guest agent.checked 4 Oct 2026
- Guest support
- The site lists Windows 7–8 in 32-bit and 64-bit, Windows 10 64-bit, and Linux 2.6.x–5.x in 32-bit and 64-bit as supported guests.checked 4 Oct 2026
- Hardware requirement
- DRAKVUF requires an Intel CPU with VT-x and Extended Page Tables; the site says it does not work on AMD CPUs or Intel CPUs lacking those extensions.checked 9 Oct 2026
- Host setup
- The installation guide says DRAKVUF runs best on Xen 4.17, was mainly tested on Ubuntu 22.04 LTS, and requires a dom0 kernel version 5.11 or later.checked 9 Oct 2026
- Integration
- The project names IntelOwl as an example of integration into malware analysis operations.checked 9 Oct 2026
- Malware analysis
- The site says DRAKVUF was developed mainly for malware analysis and can also monitor arbitrary binaries.checked 4 Oct 2026
- Monitoring
- It can monitor Windows and Linux internal kernel functions and Windows userspace without an in-guest agent.checked 9 Oct 2026
- Open source
- DRAKVUF describes itself as an open-source project and welcomes patches and bug reports through its GitHub page.checked 9 Oct 2026
- Plugins
- Windows plugins include tracing heap allocations, accessed files, UDP and TCP connections, and extracting files from memory before deletion.checked 9 Oct 2026
- Product
- DRAKVUF is a virtualization-based, agentless black-box binary analysis system for tracing arbitrary binaries, including operating systems.checked 4 Oct 2026
- Purpose
- DRAKVUF is a virtualization-based, agentless black-box binary analysis system for tracing arbitrary binaries, including operating systems, without installing special software in the guest VM.checked 9 Oct 2026
- Release status
- The GitHub README lists Linux 2.6.x–6.x among supported guests and links to pre-built Debian packages.checked 9 Oct 2026
- Security policy
- The GitHub repository displays a Security policy link.checked 9 Oct 2026
- Stealth
- The site describes DRAKVUF as suitable for stealthy malware analysis because its footprint is nearly undetectable from the malware’s perspective.checked 4 Oct 2026
- Support and contributions
- The site welcomes patches and bug reports through its GitHub project page and points users to the project wiki for guidance.checked 4 Oct 2026
- Supported guests
- The project site lists Windows 7–8 (32-bit and 64-bit), Windows 10 64-bit, and Linux 2.6.x–5.x (32-bit and 64-bit) as supported monitored operating systems.checked 9 Oct 2026
- Use case
- The project was developed mainly for stealthy malware analysis and can also monitor arbitrary binaries.checked 9 Oct 2026
- Virtualization
- The installation guide says DRAKVUF runs best on Xen 4.17 and was mainly tested on Ubuntu 22.04 LTS.checked 4 Oct 2026
Alternatives to DRAKVUF
- 1
Binary Ninja
Free planWebAPILinuxmacOS7.8$199 one-time - 2
Frida
Free planOpen sourceAndroidiOSAPILinux7.7Free plan - 3
rev.ng
Free planOpen sourceWebAPILinuxmacOS7.7Free plan - 4
JEB
Free planAPILinuxmacOSSelf-hosted7.6From $1,200 a year - 5
Ghidra
Free planOpen sourceAPIExtensionLinuxmacOS7.3Free plan - 6
IDA Pro
Free planLinuxmacOSWindows7.0From $1,099 a year