Tool for exploration and tracing of the Windows kernel
Python

README.md

Fibratus

Build status Coverage Status Code Health

Fibratus is a tool which is able to capture the most of the Windows kernel activity - process/thread creation and termination, file system I/O, registry, network activity, DLL loading/unloading and much more. Fibratus has a very simple CLI which encapsulates the machinery to start the kernel event stream collector, set kernel event filters or run the lightweight Python modules called filaments. You can use filaments to extend Fibratus with your own arsenal of tools.

fibratus filaments

Requirements

  • Python 3.4
  • Visual C++ 2012 or above
  • Cython >=0.23.4

Installation

Install via the pip package manager:

pip install fibratus

Documentation

See the wiki.

Support

If you want to support Fibratus, please consider a donation.

Beerpay Beerpay