git404hub

what is porthole-guest-driver fr?

gnif/porthole-guest-driver — explained in plain English

Analysis updated 2026-07-21 · repo last pushed 2019-11-12

2CAudience · developerComplexity · 4/5DormantLicenseSetup · hard

tl;dr

A Windows driver for a custom QEMU virtual device that lets the host computer inspect the memory and state of a running Windows virtual machine from the outside, useful for malware analysis and low-level debugging.

vibe map

mindmap
  root((repo))
    What it does
      Bridges VM to host
      Inspects guest memory
      Enables external monitoring
    Tech stack
      C
      Windows Driver
      QEMU
    Use cases
      Malware analysis
      Low-level debugging
      Security research
    Setup caveats
      Custom QEMU build
      Unsigned driver
      Windows security warnings
    License
      MIT license
      Open source

Code map

Detail Auto

An interactive map of this repo's files and how they connect — its source is parsed live in your browser. Click Visualize to build it.

filefunction / class

what do people make with this?

VIBE 1

Monitor a Windows virtual machine's internal state from the host for malware analysis.

VIBE 2

Debug a guest Windows OS at a low level without running inspection software inside the VM.

VIBE 3

Build security research tooling that inspects VM memory externally via QEMU.

VIBE 4

Develop and test custom QEMU virtual device communication with Windows guests.

what's the stack?

CWindows DriverQEMU

how it stacks up fr

gnif/porthole-guest-driverdouglascorrea/syscall-agentlibretro/fixnes
Stars222
LanguageCCC
Last pushed2019-11-122026-04-20
MaintenanceDormantMaintained
Setup difficultyhardmoderatemoderate
Complexity4/54/53/5
Audiencedeveloperdeveloperdeveloper

Figures from each repo's GitHub metadata at analysis time.

how do i run it?

Difficulty · hard time til it works · 1day+

Requires building a custom QEMU fork from the author's repository and installing an unsigned Windows driver, which needs test-signing mode or signature enforcement disabled.

Use freely for any purpose, including commercial use, as long as you keep the copyright notice.

in plain english

This repo provides a Windows driver for a custom virtual device called "porthole," designed to work inside QEMU (software that lets you run virtual machines on your computer). The driver lets a Windows virtual machine communicate with this special virtual device so that the host system, the real computer running the VM, can peek inside and inspect what the guest operating system is doing. At a high level, the porthole device acts as a bridge between the virtual machine and the outside world. When you run a Windows VM in QEMU, the guest operating system needs a driver to know how to talk to any virtual hardware it encounters. This project is that driver, it tells Windows how to interact with the porthole device so that inspection or introspection data can flow out of the VM to whatever tool on the host is listening. This would be useful for developers or security researchers who need to monitor or analyze a Windows virtual machine from the outside. For example, if you're building malware analysis tooling or debugging a guest OS at a low level, being able to inspect the VM's internal state without software running inside the guest itself is valuable. The porthole device essentially gives you a window into the VM's memory and state from the host side. A few practical caveats: the porthole device itself is still under development and hasn't been officially merged into the main QEMU project yet. To actually use this driver, you'd need a custom build of QEMU from the author's own repository. There's also no signed driver build available, which means Windows will likely complain about security warnings when installing it, since it lacks the digital signature Microsoft normally requires for approved drivers. The project is open-source under the MIT license.

prompts (copy fr)

prompt 1
I'm building a custom QEMU setup with a porthole virtual device and need to write a Windows guest driver that communicates with it. How should I structure the driver to send introspection data to the host?
prompt 2
Help me configure Windows to install an unsigned driver for the porthole-guest-driver project, bypassing the digital signature warnings so I can test VM introspection.
prompt 3
I want to use the porthole device to inspect a Windows VM's memory from the host side in QEMU. Walk me through building the custom QEMU fork and installing this driver in the guest.
prompt 4
I'm doing malware analysis on a Windows VM running in QEMU. How can I use the porthole driver to externally monitor the guest's state without installing tools inside the VM?

Frequently asked questions

what is porthole-guest-driver fr?

A Windows driver for a custom QEMU virtual device that lets the host computer inspect the memory and state of a running Windows virtual machine from the outside, useful for malware analysis and low-level debugging.

What language is porthole-guest-driver written in?

Mainly C. The stack also includes C, Windows Driver, QEMU.

Is porthole-guest-driver actively maintained?

Dormant — no commits in 2+ years (last push 2019-11-12).

What license does porthole-guest-driver use?

Use freely for any purpose, including commercial use, as long as you keep the copyright notice.

How hard is porthole-guest-driver to set up?

Setup difficulty is rated hard, with roughly 1day+ to a first successful run.

Who is porthole-guest-driver for?

Mainly developer.

peek the repo → explain another one

This repo across BitVibe Labs

double-check against the repo, no cap.