HackerReposA FIELD GUIDE TO OPEN SOURCE
ProSponsor the shelf♧ 0
← Back to top all-time
moyix
panda
C2014–2016
moyix / panda

panda

Deprecated repo for PANDA 1.0 – see PANDA 2.0 repository

Explore on GitHubRead Hacker News discussions
6Distinct people
9Mentions
0Explicit recommenders
108GitHub stars
REPOSITORY AT A GLANCE

What to know before exploring

What it is

Deprecated repo for PANDA 1.0 – see PANDA 2.0 repository

GitHub

Where it is used

No documented product use has been verified yet.

What people are saying

No recommendation phrase was found in the indexed comments.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

No other repository is repeatedly linked in the same discussions.

This week on Hacker News

Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 3:56:07 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by month9 dated mentions

Observed mentions: 2014-07-04 18:14:48 UTC to 2016-10-01 02:27:39 UTC.

0122014-07-01 00:00:00 UTC to 2014-08-01 00:00:00 UTC (exclusive): 2 mentions; 0 submissions, 2 commentsJul 20142014-08-01 00:00:00 UTC to 2014-09-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2014-09-01 00:00:00 UTC to 2014-10-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2014-10-01 00:00:00 UTC to 2014-11-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2014-11-01 00:00:00 UTC to 2014-12-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2014-12-01 00:00:00 UTC to 2015-01-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments2015-01-01 00:00:00 UTC to 2015-02-01 00:00:00 UTC (exclusive): 1 mentions; 1 submissions, 0 comments2015-02-01 00:00:00 UTC to 2015-03-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2015-03-01 00:00:00 UTC to 2015-04-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2015-04-01 00:00:00 UTC to 2015-05-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments2015-05-01 00:00:00 UTC to 2015-06-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2015-06-01 00:00:00 UTC to 2015-07-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments2015-07-01 00:00:00 UTC to 2015-08-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments2015-08-01 00:00:00 UTC to 2015-09-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 commentsAug 20152015-09-01 00:00:00 UTC to 2015-10-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2015-10-01 00:00:00 UTC to 2015-11-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2015-11-01 00:00:00 UTC to 2015-12-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments2015-12-01 00:00:00 UTC to 2016-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2016-01-01 00:00:00 UTC to 2016-02-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2016-02-01 00:00:00 UTC to 2016-03-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2016-03-01 00:00:00 UTC to 2016-04-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2016-04-01 00:00:00 UTC to 2016-05-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2016-05-01 00:00:00 UTC to 2016-06-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2016-06-01 00:00:00 UTC to 2016-07-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2016-07-01 00:00:00 UTC to 2016-08-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2016-08-01 00:00:00 UTC to 2016-09-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2016-09-01 00:00:00 UTC to 2016-10-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2016-10-01 00:00:00 UTC to 2016-11-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 commentsOct 2016

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges
UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
PeriodStart (UTC)End (exclusive, UTC)MentionsSubmissionsComments
Jul 20142014-07-01 00:00:00 UTC2014-08-01 00:00:00 UTC202
Aug 20142014-08-01 00:00:00 UTC2014-09-01 00:00:00 UTC000
Sep 20142014-09-01 00:00:00 UTC2014-10-01 00:00:00 UTC000
Oct 20142014-10-01 00:00:00 UTC2014-11-01 00:00:00 UTC000
Nov 20142014-11-01 00:00:00 UTC2014-12-01 00:00:00 UTC000
Dec 20142014-12-01 00:00:00 UTC2015-01-01 00:00:00 UTC101
Jan 20152015-01-01 00:00:00 UTC2015-02-01 00:00:00 UTC110
Feb 20152015-02-01 00:00:00 UTC2015-03-01 00:00:00 UTC000
Mar 20152015-03-01 00:00:00 UTC2015-04-01 00:00:00 UTC000
Apr 20152015-04-01 00:00:00 UTC2015-05-01 00:00:00 UTC101
May 20152015-05-01 00:00:00 UTC2015-06-01 00:00:00 UTC000
Jun 20152015-06-01 00:00:00 UTC2015-07-01 00:00:00 UTC101
Jul 20152015-07-01 00:00:00 UTC2015-08-01 00:00:00 UTC101
Aug 20152015-08-01 00:00:00 UTC2015-09-01 00:00:00 UTC000
Sep 20152015-09-01 00:00:00 UTC2015-10-01 00:00:00 UTC000
Oct 20152015-10-01 00:00:00 UTC2015-11-01 00:00:00 UTC000
Nov 20152015-11-01 00:00:00 UTC2015-12-01 00:00:00 UTC101
Dec 20152015-12-01 00:00:00 UTC2016-01-01 00:00:00 UTC000
Jan 20162016-01-01 00:00:00 UTC2016-02-01 00:00:00 UTC000
Feb 20162016-02-01 00:00:00 UTC2016-03-01 00:00:00 UTC000
Mar 20162016-03-01 00:00:00 UTC2016-04-01 00:00:00 UTC000
Apr 20162016-04-01 00:00:00 UTC2016-05-01 00:00:00 UTC000
May 20162016-05-01 00:00:00 UTC2016-06-01 00:00:00 UTC000
Jun 20162016-06-01 00:00:00 UTC2016-07-01 00:00:00 UTC000
Jul 20162016-07-01 00:00:00 UTC2016-08-01 00:00:00 UTC000
Aug 20162016-08-01 00:00:00 UTC2016-09-01 00:00:00 UTC000
Sep 20162016-09-01 00:00:00 UTC2016-10-01 00:00:00 UTC000
Oct 20162016-10-01 00:00:00 UTC2016-11-01 00:00:00 UTC101

What Hacker News says

9 sources
moyix·Oct 1, 2016
This is totally doable. PANDA [1], e.g., takes recordings of full-system execution by recording non-deterministic hardware inputs in a modified QEMU. This is much more compact than a full instruction trace, but you can then replay the recording to produce instruction traces, memory traces, whatever. We recently added some machinery [2] for using debug symbols to map each instruction back to its source line. So, assuming you can get debug symbols installed for every userspace program, every library, and the kernel, I think you could come very close to tying every instruction back to a source line. There are caveats, though – the overhead of QEMU and the recording infrastructure mean you only end up getting around 200 million instructions / second, which is nothing compared to modern bare metal. You could capture a longer trace, though, and
Read the rest
do the same thing to get up to the same amount of code executed as on real hardware. If someone wants to try this I'd be very interested to see the results and happy to help answer any questions that come up! [1] https://github.com/moyix/panda [2] https://github.com/moyix/panda/blob/master/qemu/panda_plugin...
In Knuth's Challenge: Analyze everything your computer does in one second
kragen·Nov 2, 2015
Michael Elizabeth Chastain became the maintainer of the Linux ioctl list in the early days because he wanted his mec-replay tool to be able to work, and ioctls were a fly in the ointment — each ioctl has its own idea of how to interpret the arguments, and may end up accessing user memory in some complicated way. Record-and-replay tools like mec-replay, rr, https://github.com/moyix/panda, and http://velvetpulse.com/2012/11/27/scribe-the-deterministic-t... need to be able to intercept that access in order to record the relevant data. Edit: of course, I should have mentioned that doesn't apply to PANDA — by recording events at a non-system-call interface, PANDA avoids the problems of system-call emulation and instead has the problems of hardware emulation. I imagine PANDA will be a heck of a lot more useful for debugging new bare-metal oper
Read the rest
ating systems. The publisher regrets the error. Time-travel debugging and deterministic replay is such a fundamentally important feature, and it can expand our capabilities in many different ways that we're only starting to explore. Debugging is just one possible application; consider also exhaustive testing of error conditions, re-execution of optimistic transactions that hit a write conflict, temporal backtracking search over executions, data prevalence (though it doesn't solve the schema upgrade problem), and deterministic building. And remember that the hardest problem for reverse-mode automatic differentiation is figuring out how to "run the program backwards" in order to find the gradient of the output; deterministic replay strategies are directly applicable to this problem and therefore to generalized gradient descent. It's a shame that mec-replay fell by the wayside 20 years ago. Surely we won't let that happen this time. http://www.boutell.com/lsm/lsmbyid.cgi/001191 https://static.lwn.net/1999/0121/a/mec.html Much to my surprise, you can still download mec-replay 0.3 from 1995, although you'd probably need to build a Linux 1.3 kernel to run it with: ftp://ftp.shout.net/pub/users/mec/misc/mec-0.3.tar.gz
In Back to the Futu-Rr-e: Deterministic Debugging with Rr
moyix·Jun 25, 2015
It's based on dynamic taint analysis. We assign each byte the input file a unique label and then track the propagation of those labels throughout a computation. Additionally, we track the "compute number"; basically, if you have an operation in involving tainted data like A = B + C Where at least one of B or C is tainted, the compute number is: TCN(A) = max(TCN(B),TCN(C)) + 1 So if you track the propagation of tainted data and the associated compute number, you can make a map between the byte label and compute number. Then the only remaining step is to map back from bytes in the file to pixels in the image; I used an input file in BMP format so that the correspondence between pixels <-> bytes would be fairly direct. All this is implemented using PANDA [1], which has nice facilities for dynamic taint analysis. I just recorded Pai
Read the rest
nt Shop Pro opening the currency image, and then replayed with the taint analysis to generate the raw data used for that image. The limitation currently is that the granularity is not great (you can see that there are relatively large rectangular sections of the image with the same compute number). My guess is that this is because a lot of image processing algorithms at the lowest level end up being "multiply the image data matrix by this other matrix and pick out the nonzero entries" or some such -- so all the data there has the same amount of computation done on it. But apparently there is some sort of multi-pass algorithm at work here, which gives rise to the differing amounts of computation done on each region. I'm looking at ways to improve the granularity right now, possibly by incorporating the magnitude of the transformation on the data somehow. [1] https://github.com/moyix/panda
In The secret codes of British banknotes
galapago·Apr 9, 2015
> Is it possible to backtrack using this framework? (I.e., execute code, stop it, go back a bit, continue, etc.) In the develop branch we have a fully integrated debugger (using python-ptrace), so this should be doable. > Is it possible to save/restore the machine state to a file? Nop. If you want to do this, you should try to find a more VM-oriented framework (pyqemu maybe?) > And can it deterministically (re)run multi-threaded code? And other (normally non-deterministic) OS functions? Not yet, but if you instrument some functions using the debugger in the develop branch, you could do it. edit: PANDAS is also a very good option (https://github.com/moyix/panda)
In BARF – A Binary Analysis and Reverse Engineering Framework

MAKE YOURSELF AT HOME

A few shortcuts

/
Search the collection
?
Open this guide
Esc
Close dialogs and navigation

Your saved repositories and interests stay in this browser.