Skip to content
Go to file
Cannot retrieve contributors at this time
213 lines (175 sloc) 6.03 KB

Compiling PANDA

WARNING: This document is slightly out of date. Look at panda_install.bash instead.

In order to build PANDA, you should use the script in the QEMU directory. The script comes with some default options. But first, the prerequisites need to be taken care of. It is recommended to build LLVM and QEMU with the same compiler. In order to build some of the PANDA plugins inside of the QEMU directory, a compiler that supports C++11 is required.

PANDA is known to build on debian wheezy and jessie with the following steps. Some parts of the installation require root privileges. We assume that sudo has been setup and enabled for the user installing PANDA. If you prefer to have these instructions printed, you can use gitprint to render them into a printable PDF file.

Prepackaged prerequisites

Use the following commands to install the prerequisites that can be used as-is from the Debian repositories. Some of the prerequisite libraries are not directly used by PANDA, but are required by the plugins shipping with it. Subversion is used to retrieve the source of LLVM.

sudo apt-get install build-essential 
sudo apt-get build-dep qemu
sudo apt-get install nasm
sudo apt-get install libssl-dev
sudo apt-get install libpcap-dev
sudo apt-get install subversion
sudo apt-get -y install curl
sudo apt-get -y install autoconf
sudo apt-get -y install libtool
sudo apt-get -y install python-pip
sudo apt-get -y install libelf-dev

Compiled prerequisites


Download the source for LLVM 3.3 and Clang 3.3. Make sure you get these specific versions! Clang source must be extracted in directory tools/clang directory of the LLVM source tree. The required source trees can be directly checked out from the LLVM subversion repositories.

cd panda
svn checkout llvm
cd llvm/tools
svn checkout clang
cd -
cd llvm/tools/clang/tools
svn checkout extra
cd -

If you are working with g++-4.9, you will also need to patch clang to provide max_align_t. Otherwise building of some plugins will fail.

cd llvm/tools/clang
wget -O - "$CLANG_PATCH" | patch -p2 -F3
cd -

Now, compile LLVM. For a debug build (REALLY slow), use the following command:

cd llvm
./configure --disable-optimized --enable-assertions --enable-debug-symbols --enable-debug-runtime --enable-targets=x86 && REQUIRES_RTTI=1 make -j $(nproc)
cd -

For a release build, use the following commands:

cd llvm
./configure --enable-optimized --disable-assertions --enable-targets=x86 && REQUIRES_RTTI=1 make -j $(nproc)
cd -


diStorm is a binary disassembler library. It is used by some of the PANDA plugins, and may also come handy when writing your own plugins. The following commands will download, build and install diStorm on your system.

cd ~/software
svn checkout distorm
cd distorm/make/linux
sudo make install
cd -
cd distorm/include
sudo cp * /usr/local/include


libdwarf is a DWARF producer and consumer. It is used by dwarfp in order to provide source level introspection to PANDA plugins.

wget --no-check-certificate 
tar -xzvf libdwarf-20151114.tar.gz
cd dwarf-20160507
progress "Installing libdwarf..."
./configure --enable-shared
sudo cp libdwarf/libdwarf.h /usr/local/include
sudo cp libdwarf/dwarf.h /usr/local/include
sudo cp libdwarf/ /usr/local/lib/
cd ../

Protocol buffers C style

Protocol buffers are used by pandalog. You want it. This is how I built things and installed them.

cd ~/software
git clone
cd protobuf
sh ./
./configure --disable-shared
sudo make install

cd ~/software
git clone
cd protobuf-c
sh ./
./configure --disable-shared
sudo make install


The new version of PPP, which permits api functions that have fn pointers as arguments, uses a c parser written in python: pycparser. You can directly install pycparser using pip:

sudo pip install git+

Building the QEMU part and the PANDA plugins

After successfully installing all the prerequisites, you can go on and build the QEMU part of PANDA. This is most conveniently done by invoking

cd qemu

Overriding LLVM location

The script will attempt to use the Release build of the LLVM we compiled for PANDA. You can specify some other LLVM directory and build type by setting the PANDA_LLVM_ROOT and PANDA_LLVM_BUILD environment variables. E.g.,

export PANDA_LLVM_ROOT="/opt/llvm"
export PANDA_LLVM_BUILD="Debug+Asserts"
cd qemu

If LLVM is not found in the specified locations, will attempt to use any other version of LLVM 3.3 found in your path.

Overriding default C/C++ compiler

The default C and C++ compilers will be used for the compilation. In case you want to use a specific version of gcc/g++, the script respects the CC/CXX environment variables. E.g.,

cd qemu
CC=gcc-4.8 CXX=g++-4.8 ./
You can’t perform that action at this time.