out-of-tree kernel {module, exploit} development tool
Branch: master
Clone or download
Type Name Latest commit message Commit time
Failed to load latest commit information.
config Move to fmt.Errorf Dec 10, 2018
examples Print kernel config skeleton to stdout Nov 28, 2018
qemu Rename qemu package Feb 2, 2019
tools Use relative path for bootstrap script Feb 6, 2019
.gitignore Remove snap support Dec 2, 2018
.travis.yml Travis-CI: fix bootstrap.sh path Feb 6, 2019
LICENSE Change license to GNU AGPLv3 Oct 8, 2018
bootstrap.config.go Implements bootstrap, fixes #3 Dec 1, 2018
bootstrap.go Improve logging Dec 2, 2018
debug.go Move upstream to code.dumpstack.io Feb 2, 2019
gen.go Move upstream to code.dumpstack.io Feb 2, 2019
go.mod Go modules support Feb 2, 2019
go.sum Go modules support Feb 2, 2019
kernel.go Move upstream to code.dumpstack.io Feb 2, 2019
pew.go Move upstream to code.dumpstack.io Feb 2, 2019
pew_test.go Use go timers for kill docker by timeout, fixes #12 Dec 8, 2018


Build Status Go Report Card


out-of-tree kernel {module, exploit} development tool



Qemu, docker and golang is required.

Also do not forget to set GOPATH and PATH e.g.:

$ echo 'export GOPATH=$HOME' >> ~/.bashrc
$ echo 'export PATH=$PATH:$HOME/bin' >> ~/.bashrc
$ source ~/.bashrc


# emerge app-emulation/qemu app-emulation/docker dev-lang/go


$ brew install go qemu
$ brew cask install docker


$ sudo dnf install go qemu moby-engine

Also check out docker post-installation steps.

Build from source

$ go get -u code.dumpstack.io/tools/out-of-tree
$ out-of-tree bootstrap

Then you can check it on kernel module example:

$ cd $GOPATH/src/code.dumpstack.io/tools/out-of-tree/examples/kernel-module
$ out-of-tree kernel autogen # generate kernels based on .out-of-tree.toml
$ out-of-tree pew


Run by absolute path

$ out-of-tree --path /path/to/exploit/directory pew

Test only with one kernel:

$ out-of-tree pew --kernel='Ubuntu:4.10.0-30-generic'

Run debug environment:

$ out-of-tree debug --kernel='Ubuntu:4.10.0-30-generic'

Test binary module/exploit with implicit defined test ($BINARY_test)

$ out-of-tree pew --binary /path/to/exploit

Test binary module/exploit with explicit defined test

$ out-of-tree pew --binary /path/to/exploit --test /path/to/exploit_test

Guess work kernels:

$ out-of-tree pew --guess

Use custom kernels config

$ out-of-tree --kernels /path/to/kernels.toml pew

Generate all kernels

$ out-of-tree kernel genall --distro Ubuntu --ver 16.04


Read Qemu API.

Generate images

$ cd $GOPATH/src/code.dumpstack.io/tools/out-of-tree/tools/qemu-debian-img/
$ docker run --privileged -v $(pwd):/shared -e IMAGE=/shared/ubuntu1404.img -e RELEASE=trusty -t gen-ubuntu1804-image
$ docker run --privileged -v $(pwd):/shared -e IMAGE=/shared/ubuntu1604.img -e RELEASE=xenial -t gen-ubuntu1804-image