GPL v3 Early Development Linux

Quartzine

USB interception & sandboxed analysis for malware labs

github.com/Mathos6/Quartzine kanijeremie06@gmail.com

What is Quartzine?

When a USB drive is plugged into a Linux machine, Quartzine intercepts the event before the OS mounts anything, and lets you choose what happens next.

Mount normally — standard OS behavior
Open in a VM — the drive is passed through to a disposable virtual machine instead of the host

Built for environments that handle physically untrusted media, like a school or lab where USB keys move between machines.

How it works

USB plugged in

↓ udev intercepts, before udisks2 mounts

Mount normally → standard OS behavior

Open in VM → device passed through to QEMU/KVM, nothing touches the host

Stack

USB detection	udev rules, pyudev
VM orchestration	Python, QEMU/KVM
Config	TOML
Service	systemd

Requirements

Linux x86_64 with KVM support — Python 3.10+

Installation

git clone https://github.com/Mathos6/Quartzine
chmod +x Quartzine/configd/install.sh
sudo ./Quartzine/configd/install.sh

A VM disk image (.qcow2) is needed for VM mode — path is set in configd/config.toml.

Status

Early development, built and maintained solo. Working: udev interception, USB passthrough to a VM. In progress: VM lifecycle management, headless/systemd display handling. Planned: host-side observation (eBPF), network isolation, report generation.

Not ready for production use. Test on a disposable machine, not one you rely on.