RESim是一种动态系统分析工具，可深入洞察联网计算机内部的进程、程序和数据流。RESim利用Simics平台的高保真处理器、外围设备（例如网络接口卡）和磁盘模型来模拟计算机网络。网络计算机平台模型加载并运行从被模拟物理系统提取的镜像中复制的目标软件。
RESim通过盘点进程所执行的程序和所消耗的数据，帮助对基于Linux和Windows的系统网络进行逆向工程和漏洞分析。数据源包括文件、设备接口和进程间通信机制。通过对正在运行的模拟系统进行动态分析，记录进程执行和数据消耗情况，无需在模拟系统中安装或注入软件，也无需详细了解承载进程的内核。
RESim还通过使用IDA Pro和Ghidra反汇编器/调试器的插件，为单个正在执行的程序提供交互式可视性。反汇编器/调试器允许设置断点，使模拟在未来时间或过去时间[2]的选定事件处暂停。例如，RESim可以指导模拟状态逆向执行，直到所选内存地址最近一次被修改。
可在系统执行的任意时刻生成可重加载的检查点。 RESim模拟可以在指定进程被调度执行时暂停以便检查，随后继续，可能带有更改后的内存或寄存器状态。分析人员可以显式修改内存或寄存器内容，还可以根据系统事件动态扩充内存，例如当su程序读取密码文件时更改其条目。
分析完全通过观察模拟目标系统的内存和处理器状态来进行，无需shell、软件注入或内核符号表。这种分析被称为外部分析，因为观察函数对模拟系统的状态没有任何影响。
RESim已与American Fuzzing Loop（AFL）模糊测试器集成。该模糊测试系统将模糊数据直接注入应用程序的读取缓冲区，简化了模糊测试的设置和工作流程。RESim自动重放和分析任何检测到的崩溃，识别崩溃原因，例如执行控制损坏。
更多信息请参阅RESim用户指南。此处可观看RESim的简要演示： (https://nps.box.com/s/rf3n104ualg38pon6b7fm6m6wqk9zz50)
示例磁盘镜像描述见该readme
RESim源自为DARPA网络大挑战赛创建的软件审查和取证分析平台。该仓库地址为： https://github.com/mfthomps/cgc-monitor。描述该工作的论文位于 https://www.sciencedirect.com/science/article/pii/S1742287618301920 关于Simics在CGC Monitor中使用的精彩总结位于 https://software.intel.com/content/www/us/en/develop/blogs/simics-software-automates-cyber-grand-challenge-validation.html
[1]Simics是由Intel开发的全系统模拟器，Intel拥有所有相关商标。 [2]Simics 7已弃用"逆向执行"，但RESim将其重新加入。
This software was created by United States Government employees
and may not be copyrighted.
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions
are met:
1. Redistributions of source code must retain the above copyright
notice, this list of conditions and the following disclaimer.
2. Redistributions in binary form must reproduce the above copyright
notice, this list of conditions and the following disclaimer in the
documentation and/or other materials provided with the distribution.
THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
POSSIBILITY OF SUCH DAMAGE.