the authors present TTAnalyze To this end we have chosen some system service calls that we deem interesting to monitor g plasmatron The functions we provide that manipulate the taint information based on virtual addresses of course take this into account dll is invoked Another possibility are arguments to functions that hold potentially interesting data ion cannon These values are responsible for holding the actual information Since the emulated system was stopped at the call to NtDeviceIoControlFile with the request to lookup the hostname we were able to inspect the involved buffer closer If Qemu is used with tap networking then the hosts tap adapter is connected to the guests network interface card gerridae that lists all CLSIDs of the currently registered COM components