Type-1 hypervisor · Ring −1 · AMD SVM
A bare-metal hypervisor that rebuilds the platform beneath Windows — firmware, TPM, IOMMU, Secure Boot — and lets you see straight through it.
Ships with Kratos, the free reverse-engineering platform
r = 1.0 rₛ — Event horizon
Modern Windows interrogates the platform before it trusts it. Umbra answers every question the way real silicon would — because every piece of it is virtualized, down to the firmware. And nothing in the guest reaches back: Umbra’s own memory, its private store and the physical TPM sit outside anything Windows can address.
Guest memory, from the outside in. Umbra sits beneath the kernel, so nothing inside the guest stands between you and a single page of its memory.
Every layer of the stack resolves to a single point beneath it. That point is yours.
Run Windows with virtualization-based security switched on. Hyper-V boots inside Umbra, the Secure Kernel comes up in VTL 1 — and Hyper-V is never told it has company.
UMBRA
Ring −1
Microsoft’s way of nesting Hyper-V tells it that it is a guest. Umbra was built from a close reading of what Hyper-V checks on real silicon — and answers it the way the silicon would.
UMBRA, the console that comes with every licence: the hypervisor’s state, its exit rate and the platform’s security posture, live.
Green is what UMBRA expects: VBS and HVCI on, Secure Boot on. Test signing stays grey while it is off, as it should be.
UMBRA
×
KRATOS
Kratos is a free reverse-engineering platform — disassembler, decompiler, debugger, and an AI agent that drives them all. Put Umbra underneath and Kratos gains a hypervisor backend that reads and writes a live Windows from below the kernel. No driver to load, no debug port to enable.
Six reverse-engineering and debugging tools in the bundle, each reading memory through the hypervisor rather than through Windows.
The reverse-engineering platform, standalone.
The hypervisor and the tools that see through it.
Ship Umbra inside your own product. Licence credits at 35–65% off retail, or a flat monthly plan.
Prices in USD, before tax. No refunds — cancel any time and keep using Umbra until the end of the period you paid for.
Debuggers, analysers, research tools — if it needs to see a machine from below, it can stand on Umbra. Approved developers get the SDK, their own panel, and licensing that disappears into theirs.
An AMD processor with SVM (AMD-V) and the IOMMU switched on in your firmware settings, Windows 10 22H2 or Windows 11 25H2 (64-bit) installed in UEFI mode on an NVMe SSD, and a dedicated graphics card. Intel processors are not supported yet.
Yes — Umbra expects them on. Hyper-V runs nested inside Umbra, the Secure Kernel comes up in VTL 1, and Secure Boot is checked by Umbra’s own firmware.
It checks your machine first, then installs the boot loader, the service and the console, and creates a 128 MiB partition for the virtual TPM — from free space if there is any, otherwise by shrinking C: by 128 MiB. It asks before it partitions anything.
Disarm the boot entry in the console and the next start is Windows on its own. The uninstaller removes everything setup added.
Yes. Kratos is free to download and use. Its hypervisor backend needs Umbra underneath, which comes with the Umbra × Kratos subscription.
No. You can cancel at any time from your dashboard, and Umbra keeps working until the end of the period you already paid for — it just does not renew.
One per subscription. Moving to a new machine takes one click in your dashboard.
Yes, through the developer program. Tell us what you are building; once approved you get the SDK, your own panel and licence linking, and you choose between licence credits at 35–65% off retail or a flat monthly plan.
