https://cybercolin.com/posts/Recent content in posts on cybercolin.comHugoen-usTue, 11 Aug 2026 00:00:00 +0000https://cybercolin.com/posts/qemu_tcg_execution_traces/Tue, 11 Aug 2026 00:00:00 +0000https://cybercolin.com/posts/qemu_tcg_execution_traces/<h2 id="overview">overview</h2> <p>While researching record/replay systems for malware analysis, I came across <a href="https://panda.re">panda.re</a>, a platform built on top of QEMU that enables deterministic replay of virtual machines.</p> <p>PANDA is currently built for QEMU version 2.9.1 (with ongoing efforts to update to later versions), while the latest QEMU version is 11.0.3 as of the time of this post being written. Along with this, PANDA is primarily designed around recording and replaying individual virtual machines.</p>https://cybercolin.com/posts/network_artifacts_process_memory/Fri, 22 May 2026 00:00:00 +0000https://cybercolin.com/posts/network_artifacts_process_memory/<h2 id="overview">overview</h2> <p>It seems that in Windows forensics, historical network connection data is incredibly short lived once a socket closes, and unless additional logging like Sysmon is configured beforehand, native OS-level evidence of past connections is very sparse.</p> <p>While IR environments regularly analyze live memory, traditional disk focused analysis often skips memory forensics entirely. Although memory forensics is typically the only way to obtain volatile kernel structures, remnants of connection metadata can absolutely be found in user mode memory, long after a socket has been closed.</p>https://cybercolin.com/posts/hello_world/Tue, 12 May 2026 00:00:00 +0000https://cybercolin.com/posts/hello_world/<p>This is the first post on my new site. I look forward to sharing about cybersecurity, digital forensics, programming, reverse engineering, and any other topics that interest me.</p>