Dr Semu

Abstract

1. Introduction

Dr.Semu runs executables in an isolated environment, monitors the behavior of a process, and based on Dr.Semu rules created by you or the community, detects if the process is malicious or not.

With Dr.Semu you can create rules to detect malware based on dynamic behavior of a process.

Everything happens from the user-mode. Windows Projected File System (ProjFS) is used to provide a virtual file system. For Registry redirection, it clones all Registry hives to a new location and redirects all Registry accesses.

2. Objective

DrSemu - Sandboxed Malware Detection and Classification Tool Based on Dynamic Behavior

This project demonstrates how C++ can be applied to a real-world Cybersecurity & Ethical Hacking problem.

4. Technology Stack

5. System Requirements

General requirements for this technology stack — check the README for exact versions.

• Arduino IDE / PlatformIO or a C++ compiler (g++)
• Target board (e.g. Arduino, ESP32) where applicable
• Git (to clone the repository)

6. Installation & Setup

git clone https://github.com/secrary/DrSemu.git
cd DrSemu

1. Use PowerShell to enable ProjFS in an elevated PowerShell window:
2. Download and extract a zip file from the releases page
3. Download DynamoRIO and extract into DrSemu folder and rename to dynamorio
4. Install Python 3 x64

Full setup instructions are in the project README.

7. Future Enhancements

Suggested extensions you can add to make this your own project.

• Add logging and alert notifications (email / Telegram)
• Write a threat model document for the tool
• Package it with Docker for safe lab testing

8. Viva / Review Questions

Common questions examiners ask for projects in this domain.

1. Which threat or attack does this project defend against?
2. What detection or protection technique is used and what are its limits?
3. How are false positives and false negatives handled?
4. Which cryptographic algorithms or security standards are involved?
5. What legal and ethical rules apply when testing a tool like this?

9. Source Code & License

This project is developed by secrary and published on GitHub under the GNU General Public License v3.0. Please follow the license terms and credit the original author when you use or modify this code.