Reconstruct from memory
Discover address spaces, processes and virtualization relationships from physical-memory evidence. Architectural reconstruction reduces dependence on potentially manipulated OS-maintained views.
Security Objectives / inVtero.net
Runtime integrity.
Across your topology.
inVtero.net is a memory-integrity and machine-state analysis platform for bare metal, virtual systems, mixed physical and hypervisor environments, nested page-table topologies and SmartNIC-connected inspection.
Reconstruct computational state. Validate executable code. Put the evidence to work in the integrity pipeline you choose.
Existing foundation
More than a memory-dump utility.
Validate executable code
Combine code-page hashing, executable-image context and relocation-aware comparison to distinguish reference matches from changes that need investigation.
Fit the integrity pipeline
Use programmatic interfaces and Python/.NET analysis workflows within an existing assurance process. Keep acquisition, reconstruction, verification and policy independently understandable.
Core implementation and developer documentation live in the K2 fork. Exact acquisition coverage and platform combinations should be validated for each deployment.
Supported topology scope
Physical. Virtual. Nested. Alongside the host.
The inspection path and the system being inspected are different parts of the architecture. Keep both visible.
inVtero.net / Nested
Follow the translation layers.
Recursive introspection accounts for nested page-table and hypervisor relationships, rather than treating every address as if it belonged to one flat machine.
This is a logical view of nesting, not a claim that every platform exposes the same hardware page-table walk.
- L2 guest virtual addresses
- L2 guest physical addresses
- L1 guest physical addresses
- L0 host physical memory
Observation
Recursive translation context
Reconstruct
Verify
Interpret
Composable by design
An integrity component. Not a prescribed stack.
Integrate inVtero where reconstruction and verification are needed without conflating them with collection, policy enforcement or hardware attestation.
01
Acquisition
Memory snapshots or connected inspection backends supply the bytes. Record the source, access boundaries and capture consistency.
02
Reconstruction
Recover virtual-to-physical relationships, execution context and relevant host/guest or nested topology.
03
Verification
Compare executable memory with reference material, account for relocations and distinguish matches, changes and unobserved regions.
04
Integration
Carry evidence into investigation, audit and policy workflows. AI-assisted interpretation is a proposed consumer, not the root of trust.
inVtero.net add-ons
Add depth to the verification layer.
Complement reconstruction with trusted-reference comparison and relocation normalization. HashServer and Reloc are open-source foundations for integration, with compatibility and modernization scoped around your pipeline.
Trusted-reference verification
HashServer
A just-in-time hashing service for comparing executable memory with trusted reference binaries, taking load-time relocation into account. Bring your reference material into the verification workflow.
Scope reference provenance, image refresh, deployment and verification coverage for your environment.
Explore HashServerRelocation normalization
Reloc
A companion for normalizing supported memory-extracted PE images toward their on-disk representation before comparison. Account for relocation without treating missing pages or an incomplete capture as verified.
Scope the available PE metadata, relocation inputs and target binaries before integration.
Explore RelocDiscuss an add-on integration
Deployment, support and any modernization are agreed per integration. These are integration-scoped components, not a bundled hosted service.
AI direction / Proposed extensions
The evidence layer for AI-assisted security.
AI becomes useful when it can reason over contextualized observations instead of an opaque memory dump. The roadmap builds on the integrity engine while keeping observations, verification results and model interpretations separate.
Machine-state evidence graph
Represent processes, mappings, executable images, translation relationships and integrity results as structured evidence that an AI system can query.
Semantic change analysis
Focus models on relevant differences and surrounding context. Investigate possible explanations without converting a model hypothesis into a cryptographic verdict.
Evidence-backed investigation
Let an agent request bounded, read-only analysis and cite the observations behind its conclusions. Keep policy decisions and active response separately controlled.
Accelerated analysis & device integration
Evaluate NVIDIA GPU acceleration for correlation and inference, and device-specific BlueField/DOCA integration for SmartNIC inspection workflows. These are development opportunities, not announced integrations.
SmartNIC topology support is distinct from a validated adapter for a specific device. The roadmap does not claim direct GPU-memory introspection, a shipping BlueField/DOCA integration, or NVIDIA endorsement.
Developer resources
Built in the K2 fork.
Also from Security Objectives
XAMMY: trace the output.
Explore the complementary watermarking and provenance project for generated language.
Explore XAMMY