Re: [Qemu-devel] Argos: qemu-based honeypot

[Mulyadi Santosa]

Dear Dr Bos..

First, congratulations for the Argos release. Looks interesting for 
me..I'll give it a try ASAP.

> We have extended QEMU to enable it to detect remote attempts to
> compromise the emulated guest operating system. Using dynamic taint
> analysis Argos tracks network data throughout the processor's
> execution and detects any attempts to use them in a malicious way.
> When an attack is detected the memory footprint of the attack is
> logged and the emulators exits.

Pardon me, can you explain what dynamic taint means? Is it somekind of 
code instrumentation similar with Bochs? If yes, I'd love to study on 
how you do it since I am planning to do something like that since long 
time ago but still unable to dig deeper about Qemu internals...

regards

Mulyadi