Known issues and limitations

These are items we want to let you know about:

• Symbol information being swapped to disk prevents OSSI resolution:: In some cases, memory pages required by REVEN to resolve the OSSI are swapped to disk before a scenario is recorded, which leads to missing information about some modules (e.g. ntoskrnl.exe) in the replayed scenario. To mitigate this issue you can create VMs with more RAM so that swap is less used.

• The Axion layout is not fully saved: When starting Axion after an upgrade, changes made to the size of the left and right columns of widgets may not be saved. If this happens, then remove the $HOME/.config/tetrane/reven2.conf file. The layout will be reset to default on the next Axion startup and changes will be saved as expected on future launches of Axion.

• In case Axion is unresponsive on some scenarios, try to delete the strings resource and restart the REVEN server on this scenario.

• Only a single taint can run concurrently per REVEN scenario: currently, starting a second taint, even from a different Axion or the Python API, will cancel the first running taint. Besides, if two clients (such as two Axion sessions) are involved, the first client may display mixed taint results.

• If a taint generates many changes, the taint widget may slow down Axion. Cancelling the current taint operation will revert Axion's slowdown.

• When using the auto-record functionality, the replay operation may fail at the start of the trace with the following error: detect_infinite_loops: Assertion 'false' failed. Performing a new scenario recording usually fixes the issue.