P.M. Dovgalyuk - Ph.D., Assistant professor in Yaroslav-the-Wise Novgorod State University. E-mail: Pavel.Dovgaluk@ispras.ru
N.I. Fursova - Student of Yaroslav-the-Wise Novgorod State University. E-mail: Natalia.Fursova@ispras.ru
D.S. Dmitriev - Student of Yaroslav-the-Wise Novgorod State University. E-mail: Denis.Dmitriev@ispras.ru

Deterministic replay of software Deterministic replay of software is a technology which can replay previously recorded execution of a program. It preserves input data and environment of the program to make it replaying deterministically. Our solution is based on open source QEMU simulator (1.0 version) and supports deterministic replay of the whole virtual machine. Workflow of the deterministic replay consists of two steps: recording and replaying. In recording mode user has to execute the scenario which has to be recorded in the log. After that this scenario can be replayed. Behavior of the system will be the same in replaying mode. It means that all the instruction will be executed in the same order and states of the peripheral devices (including HDD) will be the same as in recording mode. Supported platforms Deterministic replay currently supports x86/64 and ARM hardware platforms. It supports all virtual devices and also microphone, network, serial port, keyboard, and mouse input devices. Tracing Our deterministic replay implementation was originally made for the tracing of software. Traces consist of sequence of processor states saved after execution of every instruction and require huge amount of memory to store them. This also leads to slowdown of trace capturing compared to non-traced execution. This slowdown makes using of the trace inconvenient and also can affect on behavior of the programs. Execution time overhead of replay log recording process varies from 0 to 90 %. Such small overhead makes possible convenient execution of the program to be analyzed or debugged. Slow trace capturing process may be performed in replay mode when interaction with user is not needed. Reverse debugging Reverse debugging is a process of debugging of the program using it-s «backward» execution. Backward execution means stopping at breakpoints or watchpoints that were hit just before bug in the program became visible to developer. Backward execution uses virtual machine snapshots captured with the replay log recording process. Deterministic replay of the program allows replaying debug scenarios for multiple times. It is particularly useful when debugged program is not stable and it-s behavior differs from one execution to another. Malware analysis Deterministic replay may be used not only for debugging of the own programs, but also for analysis of malware. User can setup the environment (including network) and run the malware once inside the virtual machine. After that he can analyze the malware without any setup of the complex environment and network settings. Honeypot Honeypot - is a trap set to detect unauthorized using of a computer. Virtual machine working in recording mode may be used as a honeypot. When unauthorized access happened recorded log may be used for post-mortem analysis of this case. Future work We plan to extend our work in two directions. First one is extending dynamic analysis methods (e.g. adding taint analysis to simulator). Second one is extending number of supported platforms and devices (support of mobile platforms, host USB-devices, etc).