# DeepZero ELI5 Wiki

> DeepZero is a pipeline engine that automates vulnerability research on Windows kernel drivers: you describe the work in a YAML file and it discovers, filters, decompiles, scans, and asks an AI to rank every driver for you. It handles parallelism, crash-recovery, and custom plug-in processors so researchers can focus on results instead of plumbing.

This is a Grok-Wiki source-grounded repository wiki. Use the complete Markdown link when an agent needs the full repo context.

## Context Links

- [Complete Markdown wiki](https://grok-wiki.com/public/wiki/416rehman-deepzero-841693239324/llms-full.txt)
- [Complete Markdown alias](https://grok-wiki.com/public/wiki/416rehman-deepzero-841693239324.md)
- [Human interactive wiki](https://grok-wiki.com/public/wiki/416rehman-deepzero-841693239324)
- [GitHub repository](https://github.com/416rehman/DeepZero)

## Repository

- Repository: 416rehman/DeepZero

- Generated: 2026-05-22T02:28:22.406Z
- Updated: 2026-05-22T02:28:28.812Z
- Runtime: Claude Code
- Format: Explain Like I'm 5
- Pages: 6

## Pages

- [Explain It Simply: What DeepZero Does](https://grok-wiki.com/public/wiki/416rehman-deepzero-841693239324/pages/01-explain-it-simply-what-deepzero-does.md): Plain-language explanation of the whole project — what problem it solves, the one analogy to hold in mind, and the three ideas every reader must leave with before going deeper.
- [The Recipe Card: Pipeline YAML](https://grok-wiki.com/public/wiki/416rehman-deepzero-841693239324/pages/02-the-recipe-card-pipeline-yaml.md): How a pipeline.yaml file works — what each field means, how stages chain together, how environment variables are expanded, and the hard rule that the first stage must always be an ingest processor.
- [The Kitchen: Runner & State Store](https://grok-wiki.com/public/wiki/416rehman-deepzero-841693239324/pages/03-the-kitchen-runner-state-store.md): How the engine executes stages in parallel threads, writes per-sample JSON atomically so a Ctrl-C mid-run loses nothing, and resumes exactly where it stopped on the next run. Covers StateStore, SampleState, and the atomic-replace trick for Windows Defender.
- [The Workers: Processors & the Registry](https://grok-wiki.com/public/wiki/416rehman-deepzero-841693239324/pages/04-the-workers-processors-the-registry.md): The four processor types (ingest, map, reduce, bulk-map), how the registry resolves a bare name versus a file path versus a dotted import, and how to write a custom processor as a Python class. Covers built-in stages: filter, hash_filter, top_k, sort, command, and llm.
- [A Real Run: The loldrivers Vulnerability Pipeline](https://grok-wiki.com/public/wiki/416rehman-deepzero-841693239324/pages/05-a-real-run-the-loldrivers-vulnerability-pipeline.md): Step-by-step walkthrough of the shipped example pipeline — from PE discovery through IOCTL filtering, loldrivers.io dedup, Ghidra decompilation, Semgrep batch scan, top-10 selection, to LLM assessment with a Jinja2 prompt template. Shows what each external processor does and what data it passes to the next stage.
- [The One Idea to Keep & What to Read Next](https://grok-wiki.com/public/wiki/416rehman-deepzero-841693239324/pages/06-the-one-idea-to-keep-what-to-read-next.md): Closing recap: the core idea in one sentence, the analogy that holds, the three things that make DeepZero different from a script, and concrete pointers to where to look next in the codebase.

## Source Files

- `pipelines/loldrivers/assessment.j2`
- `pipelines/loldrivers/pipeline.yaml`
- `processors/ghidra_decompile/ghidra_decompile.py`
- `processors/loldrivers_filter/loldrivers_filter.py`
- `processors/pe_ingest/pe_ingest.py`
- `processors/semgrep_scanner/semgrep_scanner.py`
- `pyproject.toml`
- `README.md`
- `src/deepzero/__main__.py`
- `src/deepzero/api/server.py`
- `src/deepzero/cli.py`
- `src/deepzero/engine/context.py`
- `src/deepzero/engine/llm.py`
- `src/deepzero/engine/pipeline.py`
- `src/deepzero/engine/registry.py`
- `src/deepzero/engine/runner.py`
- `src/deepzero/engine/stage.py`
- `src/deepzero/engine/state.py`
- `src/deepzero/engine/types.py`
- `src/deepzero/engine/ui.py`
- `src/deepzero/stages/filter.py`
- `src/deepzero/stages/ingest.py`
- `src/deepzero/stages/llm.py`
- `src/deepzero/stages/top_k.py`