During runtime. With minimal performance impact on the target.

Platform is Windows 7.

Objective is to gather a lot of data for clustering and ML. To ultimately assist with protocol reversing. All input will also be logged including packets (decrypted).

1 Answer 1


There is no way you're going to be able to do this online -- the overhead of tracking registers and memory read/writes is way too high. However, you could instead use a technique called record & replay to log the nondeterministic inputs to the system. The overhead of this is reasonable and still allows programs to run normally. Then you can replay and do heavyweight logging.

The general approach is described in the paper Decoupling dynamic program analysis from execution in virtual environments. This is the approach that PANDA is built around. If you want a large set of traces to work off of, we have a database of around 24,000 malware traces, and it is fairly simple to write a PANDA plugin to collect the memory and register traces you want.

Not the answer you're looking for? Browse other questions tagged or ask your own question.