Observed arrival · 2026-11-01
Umbra × Kratos: a Ring −1 hypervisor
Credibility concern recorded. The source reference remains available for verification and correction.
The site presents Umbra as a bare-metal hypervisor for Windows, bundled with the free reverse-engineering platform Kratos.
- For
- Windows reverse engineers and virtualization developers
- Worth noticing
- The page describes a 128 MiB private store for TPM state and firmware variables that Windows cannot read or write.
Field notes
The page frames Umbra as a Type-1 hypervisor on AMD SVM and lists virtual UEFI, TPM 2.0, IOMMU, Secure Boot, NVMe, and GPU passthrough. It says an existing Windows installation can boot from its own SSD, while TPM state and firmware variables persist in a 128 MiB private store. A separate section describes live guest-memory reads and writes, page watching, and split-view cloaking; the extract does not independently verify these capabilities or explain their use cases in more detail.
Observed signals
Read the marks
Editorial observations of this landing page, not a rating.
One card from the complete issue