Catch what disappears.
Some evidence exists for only a moment. We’re exploring ways to capture changing code and memory while the context still matters.
DEPTH / BEYOND THE SURFACE A RHINELAB RESEARCH PROJECT
CORVUS.
Malware hides.
Look deeper.
Code changes. Execution moves. Evidence fades.
We’re designing CORVUS, a Windows malware sandbox for the questions event logs alone can’t answer.
In planning · Sample analysis is not yet available
01 / THE APPROACH
An event is a moment.
A threat is a sequence.
A payload unpacks. A process hands off execution. The trail gets harder to follow. Our research starts there: preserve what changes, connect what happens, and make the result explainable.
Follow the handoff.
Behavior can cross process boundaries and change form. Our goal is to follow those connections and show the evidence that links one action to the next.
CONTEXT / ACROSS BOUNDARIESKnow why it matters.
A finding should invite scrutiny. We’re designing for evidence you can revisit, reasoning you can examine, and gaps you can see.
EVIDENCE / OPEN TO SCRUTINY02 / OBSERVATION ARCHITECTURE
Change the vantage point.
Deepen the investigation.
Each layer reveals a different part of the story. Our proposed architecture brings them together, from behavior inside Windows to observation beyond the guest.
Every action needs context.
Which process acted? What did it load? What came next? System events and runtime observations are candidates for connecting those details into a useful account of execution.
System eventsRuntime context
Entity lifecyclesPROCESS · THREAD · MODULE
Validate access requirements, event fields, and coverage for each Windows build.
The moment matters.
Memory changes. Objects disappear. We’re evaluating targeted kernel probes and debugger-assisted capture to preserve the state around a critical action, alongside a record of how observation affected it.
Targeted probesDebug context
Event-time captureCONTEXT · MEMORY · VERSION
Compare baseline and instrumented environments; record pauses, races, and partial reads.
A different angle on execution.
The hypervisor offers another place to observe. We’re evaluating Xen, DRAKVUF, and LibVMI for external inspection, with Intel PT as a candidate for examining execution paths on supported configurations.
IntrospectionExecution traces
State & path evidenceVMI · CODE · CONTROL FLOW
External observation has compatibility and perturbation limits. PT needs matching code and context.
Make the reasoning visible.
Start with the original observation. Connect it to an action, a piece of content, and a finding. The proposed evidence model keeps facts, inferences, and unknowns explicit, so researchers can challenge the interpretation.
Raw observationsCoverage records
Correlation & findingsFACTS · RELATIONS · GAPS
Keep gaps explicit when sources fail. Missing records do not establish that an action never occurred.
Proposed architecture · Implementation and integration validation pendingCONCEPT → VALIDATION → EVIDENCE
03 / RESEARCH ROADMAP
Ask harder questions.
Build better answers.
Depth is something to demonstrate. Our roadmap moves from a defined research question to a working analysis flow, then tests how much each new perspective adds.
Where we stand- G0
Frame the investigation
CurrentChoose the behaviors to study, the evidence needed to explain them, and the experiments that will test our approach.
- G1
Complete the first analysis
PlannedBuild a repeatable path from controlled execution to preserved evidence and a readable report, starting with one validated platform.
- G2
Follow the difficult cases
PlannedTest against changing memory, cross-process behavior, and delegated execution. Measure what we capture, what we miss, and the noise we introduce.
- G3
Let evidence guide expansion
PlannedCompare new tracing and observation techniques against the baseline. Expand where they produce clearer, more useful answers.
Research tracks may run in parallel. Progress depends on validation; release dates have not been set.
WHERE WE STANDA clear direction.
A clear direction.
An open research agenda.
CORVUS is in planning and technical evaluation. This is the vision we’re working toward. Implementation and validation are ahead.
When can I try CORVUS?
Sample submission and analysis are not available yet, and a release date has not been set. Current work focuses on architecture, technology evaluation, and validation design.
Who’s behind the project?
CORVUS is a research project by RhineLab, focused on understanding malware through deeper observation and evidence that can be examined.
Where does the research begin?
Windows PE samples are our initial focus. We’re investigating changing code and memory, execution across process boundaries, and ways to preserve the trail when observation sources fail. Depth, coverage, and explainability guide the work.
Look deeper.
Understand more.