# panda-re/panda

Platform for Architecture-Neutral Dynamic Analysis

Repository: https://github.com/panda-re/panda
Canonical: https://ross.abutalabs.com/products/panda-re-panda
Homepage: https://panda.re
Language: C
License: NOASSERTION
License Family: other
Topics: reverse-engineering, dynamic-analysis, qemu, pandare, pypanda
Last push: 2026-07-29T03:11:37+00:00

## Health v2 (maintenance only)
Score: 93/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 95, release rhythm 87, longevity 100
- inputs: {"age_days": 4758, "days_push": 35, "days_rel": 86, "gap_med": 2, "n_releases_24m": 44}
- flags: no_license
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 2778, forks 503 (observed 2026-08-28T04:07:21.488036+00:00)

## What it is
PANDA is an open-source Platform for Architecture-Neutral Dynamic Analysis built on the QEMU whole-system emulator, supporting record and replay of full guest executions across thirteen CPU architectures. Analyses are written as C plugins or via the PyPANDA Python interface, with features like byte-level taint tracking and OS introspection.

## Use cases
- record and replay whole-system executions for repeatable malware analysis
- write dynamic analysis plugins in Python with PyPANDA
- perform architecture-neutral taint tracking across many CPU instruction sets
- introspect guest OS state like active processes on Linux and Windows
- analyze firmware or embedded systems in an emulated environment
- count executed basic blocks or trace instructions in a running VM
- share compact replay logs for reproducible security experiments

## When to choose
- you need whole-system dynamic analysis with record/replay semantics
- you want to analyze binaries for architectures QEMU supports without native hardware
- you need taint tracking or OS introspection during emulation
- you want to script VM-driven analyses from Python or Jupyter

## When to avoid
- you only need static analysis of a single binary without emulation
- you need low-overhead production monitoring rather than deep offline analysis
- you want a lightweight debugger rather than a full-system emulator
- you cannot tolerate the performance cost of taint analysis on live execution

## Facets
- artifact type: framework
- maturity: active
- function: reverse-engineering, simulation, security, sdk, developer-tools
- domain: security, reverse-engineering, developer-tools, operating-systems
- platform: python, cpp, c
- tags: qemu, dynamic-analysis, record-and-replay, taint-tracking, whole-system-emulation, pypanda, malware-analysis, plugin-architecture, linux, docker

## Member repositories
- panda-re/panda (main) score 93

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:07:21.488036+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T08:16:30.366538+00:00, confidence not recorded.
  - readme: https://github.com/panda-re/panda (fetched 2026-08-28T04:07:21.488036+00:00, sha 7c810580bc9b)
  - homepage: https://panda.re (fetched 2026-08-29T09:55:39.010680+00:00, sha bae6bba44d8b)
  - site_page: https://docs.panda.re (fetched 2026-08-29T09:55:39.020133+00:00, sha ff0fb6bd249c)
- Data as of 2026-08-30T08:39:29.467469+00:00.