out-of-tree kernel {module, exploit} development tool
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
dump_stack() c1a3cb6ce5
Bump version
3 月之前
.github/workflows GitHub Actions: convert case 7 月之前
config Support custom docker commands 7 月之前
docs Fix spelling 7 月之前
examples Fix spelling 7 月之前
qemu Fix spelling 7 月之前
tools Add policykit-1 to rootfs 7 月之前
.gitignore Remove snap support 1 年之前
.travis.yml Travis-CI: xenial -> bionic 7 月之前
CHANGELOG.md Bump version 3 月之前
LICENSE Change license to GNU AGPLv3 1 年之前
README.md Fix link to Travis-CI 7 月之前
db.go Refactor [2] 7 月之前
debug.go Fix spelling 7 月之前
gen.go Move upstream to code.dumpstack.io 1 年之前
go.mod Generate markdown table statistics for tag 7 月之前
go.sum Generate markdown table statistics for tag 7 月之前
images.config.go Remove bootstrap, download images on-demand 7 月之前
images.go Remove bootstrap, download images on-demand 7 月之前
kernel.go Do not check for (host) vsyscall support on the non-Linux systems 3 月之前
kernel_linux.go Exclude host kernel generation for macOS 7 月之前
kernel_macos.go Exclude host kernel generation for macOS 7 月之前
log.go Refactor 7 月之前
main.go Bump version 3 月之前
pack.go Add flag for verbose output 4 月之前
pew.go Add flag for verbose output 4 月之前
pew_test.go Use go timers for kill docker by timeout, fixes #12 1 年之前


Codacy Badge Build Status Go Report Card Documentation Status Donate Donate


out-of-tree kernel {module, exploit} development tool

out-of-tree is for automating some routine actions for creating development environments for debugging kernel modules and exploits, generating reliability statistics for exploits, and also provides the ability to easily integrate into CI (Continuous Integration).



Qemu, docker and golang is required.

Also do not forget to set GOPATH and PATH e.g.:

$ echo 'export GOPATH=$HOME' >> ~/.bashrc
$ echo 'export PATH=$PATH:$HOME/bin' >> ~/.bashrc
$ source ~/.bashrc


# emerge app-emulation/qemu app-emulation/docker dev-lang/go


$ brew install go qemu
$ brew cask install docker


$ sudo dnf install go qemu moby-engine

Also check out docker post-installation steps.

Build from source

$ go get -u code.dumpstack.io/tools/out-of-tree

Then you can check it on kernel module example:

$ cd $GOPATH/src/code.dumpstack.io/tools/out-of-tree/examples/kernel-module
$ out-of-tree kernel autogen # generate kernels based on .out-of-tree.toml
$ out-of-tree pew


Run by absolute path

$ out-of-tree --path /path/to/exploit/directory pew

Test only with one kernel:

$ out-of-tree pew --kernel='Ubuntu:4.10.0-30-generic'

Run debug environment:

$ out-of-tree debug --kernel='Ubuntu:4.10.0-30-generic'

Test binary module/exploit with implicit defined test ($BINARY_test)

$ out-of-tree pew --binary /path/to/exploit

Test binary module/exploit with explicit defined test

$ out-of-tree pew --binary /path/to/exploit --test /path/to/exploit_test

Guess work kernels:

$ out-of-tree pew --guess

Use custom kernels config

$ out-of-tree --kernels /path/to/kernels.toml pew

Generate all kernels

$ out-of-tree kernel genall --distro Ubuntu --ver 16.04


If anything happens that you cannot solve -- just remove $HOME/.out-of-tree.

But it’ll be better if you’ll write the bug report.


Read Qemu API.

Generate images

$ cd $GOPATH/src/code.dumpstack.io/tools/out-of-tree/tools/qemu-debian-img/
$ docker run --privileged -v $(pwd):/shared -e IMAGE=/shared/ubuntu1404.img -e RELEASE=trusty -t gen-ubuntu1804-image
$ docker run --privileged -v $(pwd):/shared -e IMAGE=/shared/ubuntu1604.img -e RELEASE=xenial -t gen-ubuntu1804-image