[panda-users] How to create patches from memory snapshot

aicardi@eurecom.fr aicardi at eurecom.fr
Mon Nov 6 04:32:04 EST 2017


Hello Brendan,

I am writing a script to apply my panda plugin on a large number of  
recordings.
To do so I need to take a lot of recordings starting from the same  
qemu snapshot.
My problem is that I don't have enough space to save all the *-rr-snp  
files on disk. I saw on this article  
(https://irfanulhaq.info/2015/12/09/replay-panda-malware-recordings/)  
that it's possible to save just a "patch" file containing only the  
differences from the original snapshot and then generate the actual  
*-rr-snp file only when it's needed.

How can I produce such "patch" file?

Thank you in advance,

Samuele

-------------------------------------------------------------------------------
This message was sent using EURECOM Webmail: http://webmail.eurecom.fr



More information about the panda-users mailing list