Push the Red Button

The PANDA Virtual machine has once again been updated, and you can download it from: http://laredo-13.mit.edu/~brendan/pandavm-20151002.ova Notable changes: We fixed a record/replay bug that was preventing Debian Wheezy and above from replaying properly. The QEMU GDB stub now works during replay, so you can break, step, etc. at various points during the replay to figure out what's going on. We still haven't implemented reverse-step though – hopefully in a future release. Thanks to Manolis Stamatogiannakis, the Linux OS Introspection code can now resolve file descriptors to actual filenames. Tim Leek then extended the file_taint plugin to use this information, so file-based tainting should be more accurate now, even if things like dup() are used. We have added support for more versions of Windows in the syscalls2 code. Enjoy!

The PANDA virtual machine has been updated to the latest version of PANDA, which corresponds to commit ce866e1508719282b970da4d8a2222f29f959dcd . You can download it here: http://laredo-13.mit.edu/~brendan/pandavm-20150413.tar.bz2 Some notable changes: The taint system has been rewritten and is now available as the taint2 plugin. It is at least 10x faster, and uses much less memory. You can check out an example of how to use it in the recently updated tainted instructions tutorial . Since taint is now usable, I have increased the amount of memory in the VM to 4GB, which is reasonable for most tasks that use taint. PANDA now understands system calls and their arguments on Linux (x86 and ARM) and Windows 7 (x86). This is available in the syscalls2 plugin, and even has some documentation . There is now a generic logging format for PANDA, which uses Protocol Buffers. Check out the pandalog documentation for more details. There's lots more that has changed, and I will t...

By popular request, I've updated the PANDA VM to a more recent version of PANDA. Get it here: pandavm-20141005.tar.bz2 The version in the VM is based on Git revision  28787825aaf514da22e11650fdfca3ba82b9fc57 . Enjoy!

I have just created a prebuilt Virtualbox VM for testing PANDA . It's a current Debian 7.1 install with the latest (as of 10/4/2013) version of PANDA and prerequisites installed. The username and password for the VM are " panda:panda ", with root password " panda ". Also included is a Debian i386 QCOW2 image (created by Aurelien Jarno ) that can be used to test PANDA. Once you have the VM booted and you're logged in, you can cd into the panda/qemu directory and do: panda@pandavm:~/panda/qemu$ x86_64-softmmu/qemu-system-x86_64 \ -m 256 -hda ~/qcow/debian_squeeze_i386_standard.qcow2 -monitor stdio This will start up an instance of PANDA and boot the Debian image. From there you can create recordings and replay them with PANDA's various plugins; see the documentation for more details. Hopefully this will make it easier for people to get started with PANDA!