Also interesting, but like Qiling it simulates the kernel. That seems weird to me, that two projects would independently converge on the same solution. Is it that hard to emulate both rings, or is it that it makes useful analysis more difficult?
Maybe some KVM patching to use SLAT for breakpoints/watchpoints would fit your bill? Not sure.