1. De-coupled Information Flow Tracking (DIFT)
   It is also known as taint analysis.
   Leveraging the DIFT feature, the contamination 
   conducted by malware to the guest OS can be identified.

   We would like to thank Chi-Wei, Wang, who developed the 
   initial version of DIFT, for sharing his source code. The
   original DIFT is mainly for x86 platform. In this project,
   the DIFT is upgraded to support modern x86_64 platform.

   For the academic paper published by Chi-Wei, Wang, please cite
   C. W. Wang and S. P. Shieh, "SWIFT: Decoupled System-Wide 
   Information Flow Tracking and its Optimizations," Journal of 
   Information Science and Engineering, JISE, 2015.
   http://www.iis.sinica.edu.tw/page/jise/2015/201507_15.pdf

2. Disk Forensics (Tsk)
   The tsk extension supports the translation between the
   disk sector address and the corresponding file in the
   Windows guest OS.

3. Memory Forensics (MemFrs)
   The memfrs extension performs the virtual machine introspection
   on the guest physical/virtual memory. The high-level semantics
   of the memory data (e.g. process list) can be interpreted without
   the assistence of the guest OS. 

4. Windows in-VM Agent (Agent)
   The agent extension provides a convenient communication between 
   the QEMU console and the guest OS. An agent program is needed 
   to be pre-installed inside the Windows guest to support the 
   operations such as ...
     > execute a command in the guest w/wo return output expected
     > import/export a file into/from the guest

$ git clone https://github.com/GlacierW/MBA
$ cd MBA/

$ ./configure --target-list=x86_64-softmmu --enable-mba-all

$ make

$ ./x86_64-softmmu/qemu-system-x86_64 \
  -m 2048 \
  -hda <YOUR_IMAGE> \
  -net nic,model=rtl8139 -net user \
  -k en-us -usb \
  -monitor stdio \
  -vnc :1