Skip to content

Back to the catalog

github.comrepo

DeepZero

DeepZero is an open-source orchestration engine that lets researchers define vulnerability-research pipelines declaratively in YAML, handling parallel execution (ThreadPoolExecutor), resumable/fault-tolerant state, and LLM-assessment stages via LiteLLM/Jinja2 prompts. It ships example processors for Ghidra headless decompilation, LOLDrivers.io hash exclusion filtering, PE header/driver metadata extraction, and batch Semgrep scanning, with a dedicated pipeline for BYOVD kernel driver vulnerability research. An extensibility model lets users plug in custom Python processors referenced by path in the YAML config.

TL;DR A YAML-driven pipeline engine for automating vulnerability research, with built-in Ghidra, LOLDrivers, PE-parsing, and Semgrep processors geared toward BYOVD driver analysis.
Open original ↗
Document

What it is

DeepZero is a pipeline orchestration engine (MIT license, Python 3.11+) with a concrete CLI and demo workflow that the summary doesn't surface: deepzero run and deepzero report.

What to do

A full no-dependency trial run:

git clone https://github.com/416rehman/DeepZero.git
cd DeepZero
python -m pip install -e .
deepzero run pipelines/demo/samples -p pipelines/demo/pipeline.yaml
deepzero report -p pipelines/demo/pipeline.yaml --open

This demo requires no API keys, Ghidra, or driver corpus — it discovers two harmless text files, keeps one, filters the other, and opens a browsable HTML report. Re-running the same command resumes from saved state rather than restarting, demonstrating the fault-tolerance claim directly. The real BYOVD/driver-analysis pipeline requires following a separate setup guide with its own prerequisites (Ghidra, a driver corpus, API keys for LLM assessment).

Repo layout clarifies where to extend it: built-in stages live in src/deepzero/stages/ (map, reduce, ingest), example external processors live under processors/ (ghidra_decompile, loldrivers_filter, pe_ingest, semgrep_scanner), and the loldrivers BYOVD pipeline bundles its own assessment.j2 LLM prompt template and semgrep rules/ directory alongside pipeline.yaml.

For contributors, CI runs on Python 3.11–3.14, and the required pre-submission check is:

ruff check . && ruff format --check . && bandit -ll -ii -c pyproject.toml -r .

Caveats

The REST API for querying run/sample state is explicitly marked WIP — "experimental and incomplete" — so don't rely on it yet. The demo run is stated to only exercise the orchestration engine, not actual vulnerability analysis.

Technologies named here

Techniques named here

Related in Offensive Security