Note: Please use the following citation if you use this work on some kind of research publication:

LluĂ­s Vilanova. QEMU Dynamic Binary Instrumentation.

A paper is still in preparation, and citations would be very welcome to sustain researchonomics.



The purpose of this project is to provide a simple yet featureful and architecture-agnostic API to develop libraries to dynamically instrument guest binary code running in QEMU.

This includes QEMU in both user-mode (e.g., linux applications) and full-system mode (aka Virtual Machine).


The system is built on top of QEMU's tracing infrastucture, which is described in source:docs/tracing.txt.

For some initial instructions on how to use it, please have a look at source:docs/instrumentation.txt.

You can see the list of supported events in source:trace-events (look for the "### Guest events" line at the bottom).


To get the latest changes, get a fresh checkout of the project:

git clone

Part of this work is still being upstreamed into QEMU, and I'm managing my changes by rewriting the repository's history with StGit, so a typical git pull will simply not get you the latest changes. The longer route (instead of a fresh checkout) is to fetch the changes, delete the local branches (i.e., master, devel-*), and check them out again from the upstream remote.