An open-source platform for architecture-neutral dynamic analysis built on QEMU, enabling whole-system record/replay and deep analysis.
PANDA is an open-source Platform for Architecture-Neutral Dynamic Analysis built on QEMU. It enables whole-system record and replay of executions, allowing deep analysis of software across multiple CPU architectures. The platform provides compact, shareable replay logs and a plugin architecture for developing custom dynamic analyses.
Security researchers, reverse engineers, and academic teams conducting dynamic analysis, vulnerability research, or malware analysis who need whole-system visibility and repeatable experiments.
Developers choose PANDA for its architecture-neutral approach, allowing a single analysis to run across thirteen CPU architectures via LLVM IR, and its powerful record/replay capability that creates compact, shareable traces for collaborative research.
Platform for Architecture-Neutral Dynamic Analysis
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Supports thirteen CPU architectures via QEMU and translates to LLVM IR, enabling a single analysis to run across platforms without modification, as highlighted in the README.
Captures full system executions into shareable logs of only a few hundred MB for billions of instructions, making experiments repeatable and collaborative, with examples like FreeBSD boot traces.
Offers a simple plugin architecture with shared functionality mechanisms, increasing code re-use and simplifying complex analysis development, as described in the plugin documentation.
Provides a Python interface installable via pip, allowing for easier scripting and integration of analyses without needing standalone binaries, as noted in the quickstart section.
Building from source requires specific steps, LLVM 14, and is only well-tested on Ubuntu/Debian; Docker helps but adds abstraction, and scripts for other OSes like MacOS are less reliable.
Cannot replay traces between 32-bit and 64-bit builds due to pointer representation in logs, limiting trace portability and requiring 64-bit builds for most users, as admitted in the limitations section.
Only x86, x86_64, and ARM fully support record/replay; other architectures like MIPS may run but lack this key feature, restricting analysis capabilities for some targets.