Features of the deterministic replay in the case of a minimum device set

Abstract

A technology of the deterministic replay of an execution process in virtual machines can be used for debugging, improving reliability and robustness, software development and incident investigation (including reverse engineering of malware). The paper describes an implementation of deterministic replay for guest machines based on IA-32 in the emulator QEMU. This implementation minimizes the list of replayed devices. The organization of QEMU is discussed in detail, and the techniques used in the implementation are thoroughly explained. The key performance characteristics, such as the size of log of nondeterministic events and slowdown are experimentally measured.