panda

There's also panda[1], but I never got it working myself. I share your frustration, as it would help greatly with debugging, especially with nondeterminstic bugs. I likewise never got QEMU's record/replay to work. [1] https://github.com/panda-re/panda

It's great to see new projects in this space! I wonder if you have compared Cannoli to panda [0]. If so, what was the outcome - especially regarding the performance? [0] https://github.com/panda-re/panda

AFL automates this to a large degree. It doesn't do it with the type of machine control and monitoring you are asking for, but if you can instrument it with AFL, this is a perfect use case for it. It will do the hard work for you. If you want to control the computer, you have options. Qemu can give you fine grained CPU level logging you want: http://moyix.blogspot.jp/2014/07/breaking-spotify-drm-with-p... -- this is an article that walks through logging them instructions. (https://github.com/panda-re/panda) Finally there are RE frameworks where you can instrument (hook) function calls (Frida being a good cross platform option). I would try AFL first. But playing with Panda can be really fun too. (edit: and a colleague just pointed out -- https://github.com/angr, which will also let you work right at the level you want to, I think).