As within, so without; as above, so below.
A hypervisor workbench.
Run any operating system in a hypervisor you fully control. Observe untrusted code without letting it observe you back. Decide what your machine tells the software you run.
What it is
A hypervisor-based sandbox for reverse engineering, malware analysis, and researcher privacy.
Hypervisor isolation
Your operating system runs inside a hypervisor sandbox you control. Untrusted binaries execute within a boundary you define.
A system fully controlled by you
Read & write memory to the sandbox, change execution flow, set breakpoints and even map new code or modules all hidden from any malware sample.
Identity you control
Drive identity, network identity, ram identity, cpu identity, gpu identity, and many more all either randomly and generically generated or curated and fine-tuned by you.
Scripted analysis
Lua engine runs outside of the OS: read memory, enumerate modules, hook events. Ship repeatable scripts instead of one-off IDA sessions.
Private by default
All filesystem changes made during a session are discarded when it ends.
Choose your TPM
Your own chip(s), one shared by a friend, rented from a donor, or emulated by our software. Expose what you want exposed.
What's included
Each session ships with a complete reverse-engineering toolchain, with Ghidra and IDA installed and configured out of the box. An integrated MCP server exposes sandbox state to AI assistants such as Claude and LM Studio, enabling model-driven analysis and live-debugging assistance for learners and professionals alike.
Paid products (IDA, Claude) require a user-supplied license or API key.
Why private, not just isolated
Many samples fingerprint their runtime environment before executing their primary payload, altering behavior when analysis artifacts are detected. An environment that exposes those artifacts limits visibility to samples that do not perform such checks. Presenting a standard workstation profile is a precondition for observing the rest.