I'm trying to analyze some Windows kernel driver. What I want to achieve is full execution trace, from driver entry to end point. Driver is heavily virtualized and contains multiple anti-debugging checks so using WinDbg isn't an option. I have tried VMWare gdb stub connected with IDA but tracing seems to doesn't work, it hangs and even few hours aren't enough. Have you any ideas how to do it in the simplest way?
It’s not geared towards exactly this purpose but you can probably make something based on Bochspwn:
Bochspwn Reloaded is an instrumentation module for the Bochs IA-32 emulator, similar to the original Bochspwn project from 2013. It performs taint tracking of the kernel address space of the guest operating systems, to detect the disclosure of uninitialized kernel stack/heap memory to user-mode and other data sinks.