Their goal seems to be providing a more convenient way to talk to the lower-level hardware interfaces that are normally not reachable from a running OS. The pro

Their goal seems to be providing a more convenient way to talk to the lower-level hardware interfaces that are normally not reachable from a running OS. The project includes a generic kernel driver and a python framework for interacting with that driver. They mention that this should only be installed on test systems, not end-user production systems. I think it's designed for use in forensics and development. Malware probably could still fake out the interface the driver talks to. Even good OS-level rootkits leave indications of compromise that can be detected from the OS. I suspect it's similar with compromised firmware. Having some visibility is better than no visibility.