416rehman/DeepZero
Find zero-days while you sleep. DeepZero is an automated vulnerability research framework that parses, decompiles, and analyzes thousands of Windows kernel drivers for exploitable IOCTLs natively using AI agents.
What it solves
DeepZero is an automated pipeline engine designed for vulnerability research. It allows security researchers to automate the process of ingesting, filtering, and analyzing software (such as kernel drivers) to find security flaws, replacing manual orchestration with a declarative system.
How it works
Users define their research workflows as YAML files, which act as a sequence of stages. The engine handles the execution of these stages, managing parallelism via a ThreadPoolExecutor and ensuring fault tolerance by saving the state of each sample to disk. This allows runs to be paused and resumed without losing progress. For the analysis phase, it integrates with various LLM providers through LiteLLM, using Jinja2 templates to prompt the models to assess the findings.
Who it’s for
It is built for security researchers and vulnerability analysts who need to scale their analysis of large corpora of files (e.g., binary files or source code) using a combination of traditional security tools and AI-driven assessment.
Highlights
- Pipeline-as-YAML: Define complex chains of ingestion, filtering, and transformation stages declaratively.
- Resumable Runs: Atomic per-sample state persistence allows users to pick up exactly where they left off after an interruption.
- LLM Integration: Flexible prompting via Jinja2 templates and support for multiple LLM providers via LiteLLM.
- Extensible Architecture: Users can create custom processors as Python classes to integrate their own specialized tools.
- Parallel Execution: Configurable concurrency per stage to speed up processing of large datasets.