QEMU, a Fast and Portable Dynamic Translator

By Fabrice Bellard. USENIX ATC, FREENIX Track, 2005

3,052 citations recorded by the source corpus.

View Paper: https://www.semanticscholar.org/paper/93e591fe251b3eacba89a3ff4a8c503ddc54c617

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

Citations in the corpus

CopperDroid: Automatic Reconstruction of Android Malware Behaviors (2015, methodology): “In our framework, an unmodified Android system runs on top of a modified Android emulator (CopperDroid emulator), which is built on top of QEMU [6], as shown in Figure 1.”
DroidScope: Seamlessly Reconstructing the OS and Dalvik Semantic Views for Dynamic Android Malware Analysis (2012, methodology): “The Android guest is a Gingerbread build configured as " user-eng " for ARM with the Linux 2.6.29 kernel and uses the QEMU default memory size of 96 MB.”
AFL++ : Combining Incremental Steps of Fuzzing Research (2020, methodology): “Recently, our QEMU mode was extended by Fioraldi, with QAsan [16], to support sanitization against heap violations incorporating a Dynamic Binary Translation based implementation of AddressSanitizer [38].”
Cracking Classifiers for Evasion: A Case Study on the Google's Phishing Pages Filter (2016, methodology): “However, it is not enough when the adversary leverages some modern analysis techniques, e.g., [11][24][51][56], to extract exploitable knowledge from binary-format software.”
HHVM JIT: a profile-guided, region-based compiler for PHP and Hack (2018, methodology): “This granularity can range from basic blocks (e.g. QEMU [6] and the first-generation HHVM JIT [1]), to traces (e.g. Dynamo [4], TraceMonkey [18]), to functions or methods (e.g.”
ThinkAir: Dynamic resource allocation and parallel execution in the cloud for mobile code offloading (2012, unknown): “There are many suitable virtualization platforms available, e.g., Xen [17], QEMU [18], and Oracle’s VirtualBox.”
Argos: an emulator for fingerprinting zero-day attacks for advertised honeypots with automatic signature generation (2006, background): “Argos extends the Qemu [5] emulator by providing it with the means to taint and track memory, and generate memory footprints in case of a detected violation.”
Ether: malware analysis via hardware virtualization extensions (2008, methodology): “System call tracing using out-of-guest environments has been previously implemented in VMScope [30] and TTAnalyze [19], both of which are based on QEMU [20].”
The Turtles Project: Design and Implementation of Nested Virtualization (2010, background): “The hypervisor was forced to re-sort to on-the-ﬂy binary translation of privileged instructions [3], slow machine emulation [8], or changes to guest operating systems at the source code level [6] or during compilation [32].”
Paranoid Android: versatile protection for smartphones (2010, methodology): “We do not perform a security evaluation of our taint analysis implemention on QEMU, as it has been su.ciently demonstrated by [35].”
Guest-Transparent Prevention of Kernel Rootkits with VMM-Based Memory Shadowing (2008, methodology): “We have implemented NICKLE in three VMMs: QEMU[8] with the KQEMU accelerator, VirtualBox [9], and VMware Workstation.”
Coverage-Based Greybox Fuzzing as Markov Chain (2016, methodology): “While QEMU does the instrumentation during interpretation at runtime, AFLDynInst [18] injects the instrumentation shown in Figure 1 directly into the binary.”
A Survey of Mobile Device Virtualization (2016, background): “Moreover, several ARM instruction set emulators also exist, such as Qemu [Bellard 2005] and gem5 [Binkert et al. 2011].”
Dynamic Analysis of Malicious Code (2006, methodology): “Because TTAnalyze uses emulation to run the test subject, it is easy to insert additional instructions (such as read instructions) into Qemu’s translation blocks.”
The structural simulation toolkit (2011, unknown): “QSim is a front-end for execute-at-fetch microarchitectural simulations that extends and instruments the QEMU[ 7 ] processor emulator.”
Classification of malware using structured control flow (2010, methodology): “Condition Codes: The x86 condition codes are another point of optimisation and the prototype defers to lazy evaluation of these at the time of their use, similar to QEMU (Bellard 2005).”