Documentation

Everything in ARXOS, from the kernel scheduler to the dock.

"You cannot reason with a tiger when your head is in its mouth."

Overview

ARXOS is a heavily-modified Arch system for offensive & defensive security, focused on speed and performance. It pairs a complete security arsenal (2840+ tools under the Weapons menu) with a refined, cohesive desktop, a graphical Calamares installer, and a native tool suite.

Default user: arxos · password: root (passwordless sudo via wheel)
Kernel: a tuned rt-bore performance kernel (zen / hardened / lts selectable)
Desktop: a refined, cohesive environment on XFCE 4.20
Shell: zsh + starship · prompt arxos@admin (user)
Runs on: bare metal, QEMU/KVM, VirtualBox and VMware

Install

Write the ISO to a USB drive, boot the live desktop, then launch the installer.

# write the ISO (replace sdX with your drive) sudo dd if=arxos-0.0.1-x86_64.iso of=/dev/sdX bs=4M status=progress oflag=sync # boot it, then on the desktop: Install ARXOS # the Calamares (Qt6) wizard handles the rest

On bare metal it ships firmware + CPU microcode and the full driver set; in a VM it auto-detects the hypervisor and resizes to fit.

The Desktop

A desktop ARXOS makes its own: a top menubar with the Weapons app menu, a centered dock, fluid window controls and a host-matched font stack.

App menu → the arsenal lives under a dedicated Weapons menu (red Arch icon).
Sensible shortcuts, a themed terminal, and a curated wallpaper slideshow.

arx, the package manager

A quiet TUI over pacman. It suppresses every repo/sync log, shows a clean phase spinner, and collapses errors into one accurate line. All friendly aliases route through it.

Command	Does
arx update	Upgrade system + ARXOS tools, one unified updater
arx tools / system	Update just the ARXOS tools / just system packages
arx install <pkg>	Install package(s)
arx remove <pkg>	Remove package(s) + deps
arx search <term>	Search the repositories
arx info <pkg>	Package details
arx clean / orphans	Trim cache / remove orphans
arx aur <pkg>	Install from the AUR

arxctl, the Control Center

ARXOS' own Control Center, a real-time GTK GUI (a clean TUI is still a terminal away via arxctl). Launch from the dock, or with arxctl-gui. Every option is a live card, no terminal pops up.

Update (system + tools) · Kernels · Performance (CPU governor) · Privacy (Tor)
Snapshots · Services · Wallpaper · System info, each refreshing in real time

Self-update, one unified updater

Every ARXOS tool is its own GitHub repo under thearxos. A single arx update upgrades the system and pulls + reinstalls every ARXOS tool, one command, one clean loader. A systemd timer keeps it current automatically.

# system packages + every ARXOS tool, in one pass arx update # just the ARXOS tools (the former standalone arxupd) arx tools # (maintainers) commit + push all feature repos at once arxpush "message"

The manifest lives at /etc/arxos/repos.list and points only at thearxos/* repos.

Kernels

ARXOS boots a tuned rt-bore performance kernel by default. Switch from arxctl → 2, which configures the kernel repo and installs your pick:

rt-bore, realtime BORE (default)
bore-eevdf · lts, long-term support
zen · hardened

Weapons, the arsenal

ARXOS curates 2840+ tools, grouped by category under the Weapons menu, recon, exploitation, wireless, web, forensics, post-exploitation and more. Install anything on demand:

# install a single tool, or a whole arsenal category arx install <tool> arx install weaponCat-webapp # every web tool arx install weaponCat-wireless # every wireless tool

ARXOS arsenal categories use the weaponCat- prefix, arx resolves them to the right tool group under the hood.

Privacy

Firefox and Brave ship with hardened, zero-telemetry policies and thearxos.oxborn3.com as the start page. Route all traffic through Tor with one toggle:

arxctl # → 4 privacy → route through tor # or directly: sudo t0rctl start # transparent Tor proxy sudo t0rctl stop

arxguard, zero-trust command guard

Every command is screened before it runs. On bash, CRITICAL findings are blocked; MEDIUM findings warn and continue. Zero overhead on clean input, a pure-shell scan, no per-command process.

Blocked: homograph / IDN URLs (a hidden Cyrillic і), bidi / invisible characters, base64 → bash, pipe-to-root-shell, fork bombs, rm -rf /, dd/mkfs to a disk
Warned: curl … | sh, chmod 777, credential-file exfiltration, raw-IP fetches

arxguard status # live protection state arxguard test # detection self-test arxguard check -- '<cmd>' # screen a command by hand ARXGUARD=0 <cmd> # bypass once

A minimal, self-owned reimplementation of the threat model from tirith, ARXOS keeps an upstream watch (arxguard upstream-check) instead of vendoring the dependency.

Hardware & VMs

ARXOS runs on real hardware and in any hypervisor. It ships linux-firmware, Intel/AMD microcode, NVIDIA (dkms), mesa/vulkan, and the RTL8812AU Wi-Fi driver. On login it detects the environment and starts the right resize/guest agent, QEMU/KVM (spice-vdagent), VirtualBox (VBoxClient), VMware (open-vm-tools), or nothing extra on bare metal.

FAQ

Login credentials?

User arxos, password root. Root password is also root. Sudo is passwordless.

How do I update everything?

System packages: arx update. ARXOS tools: arxupd (also automatic via the timer).

Does it run on bare metal?

Yes, firmware, microcode and the full driver set are included; the VM-only agents simply stay idle.