HID simulation for DRAKVUF

A GSoC 2021 project adds undetectable human-behavior simulation to the VMI-based sandbox DRAKVUF via the hidsim plugin, enabling HID event injection through QEMU’s QMP, replay of captured inputs with hiddump, randomized human-like mouse movements, and VMI-driven GUI reconstruction to auto-click dialogs on Windows 7. The write-up explains design decisions (favoring QMP over OS/kernel manipulation), plugin architecture (concurrent worker with timer-driven event injection), usage examples, and outlines future work such as richer behavior playbooks, broader Windows GUI support, and comparing VMI- vs vision-based approaches.