Limitations

Antinomie is honest about its gaps: missing bytes, loss and unsupported values stay visible in the app. This page gathers the limits that apply to every run. The per-call details are in Known gaps.

Platform

• Linux x86-64 only. The host and the guests are x86-64 Linux. Windows and macOS programs do not run, and arm64 or RISC-V guests are roadmap candidates.
• Only the native x86-64 system call table is decoded; 32-bit and x32 calls are not.
• One VM runs at a time, with at most 64 program launches per boot.
• KVM is strongly recommended. TCG works but is slower and not performance-qualified.
• Only Debian 13 and Ubuntu 24.04 hosts are tested, and the host needs glibc 2.39 or newer.

What the recorder cannot see

• Work that makes no system call: computation, CPUID and RDTSC checks, and stores to memory. Writes through shared file mappings are seen only when the kernel writes the pages back or drops them, and only from a revision-18 base 0.8.0.
• Memory that was not resident when the recorder read it, and memory that changed while it was read: a record is not an atomic snapshot of the guest. See Capture statuses.
• Telemetry can be lost under very heavy load. Never drop waits only up to its deadline and can change the guest’s timing; every loss is counted. See Loss counters.
• A sample with guest root or a guest kernel exploit runs at the recorder’s level and can stop, blind or falsify what the guest reports.
• Encrypted traffic is not decrypted. Captures show TLS metadata, not the content.

Stealth

A stealth profile changes what the guest can read of its hardware identity, and current bases hide the kernel’s own traces, but some things stay visible: timing, the display, the chipset and QEMU’s firmware tables among them. The Still visible list in the stealth window names them for each profile and base. Software breakpoints are 0xCC bytes a sample can read; hardware breakpoints avoid that. A Cloud VPS profile 0.8.0 leaves the hypervisor flag and kvm-clock visible on purpose, as on the provider’s machines, and its canary credentials name themselves. Assume a sample can tell it is being analysed. See Stealth profile.

Network

• Routes carry TCP and DNS only. Other UDP is dropped on the Tor, VPN and SOCKS5 routes (the capture still shows the attempts), and IPv6 is not carried on any route.
• A VM has one route at a time, so runs that overlap use the same one.
• OpenVPN is not supported, because it needs a TUN device and so root.
• The capture is VM-wide: a packet is not attributed to a process.
• The built-in InetSim services have no TLS; HTTPS needs your own INetSim.

See Network routes.

Analysis

• Static analysis covers the initial executable, not later executables or descendants. Only UPX is unpacked; other packers need the program to run.
• The Disks tab reads a stopped VM’s disk only, and only ext2, ext3 and ext4 filesystems.
• The debugger covers x86-64 programs, with four hardware breakpoints and watchpoints in all.
• Desktop launch modes need the run’s user logged in on the VM display. Core Dump on Exit and Debug on start need Run in: App terminal.
• Volatility 3, the gdb console and Wireshark run outside the analysis sandbox.
• Detections are leads, not verdicts, and No match in IOC matching is not a clean result: the datasets list only what their publishers have seen.

File evidence 0.8.0

• Written content is kept up to 64 MiB per file and 1 GiB per run by default; later ranges are listed as not captured.
• Earlier bytes of a changed file are not available when the file is on tmpfs or another mount, or a snapshot restore replaced the disk while the run used the file. A file over the cap (64 MiB per file, 1 GiB per run by default) keeps only its size and SHA-256. The window says why when bytes are missing.
• A page of a shared mapping is known only as it was when the kernel wrote it back, not every store before it.

See File Reconstruction.

Reports and custody 0.8.0

• Each Triage table keeps at most 2,000 rows per tab in a report, and HTML and PDF show at most 1,000 rows per table. PDF prints characters outside Latin-1 as ?; JSON keeps them.
• STIX has no standard pattern for JA3 and JA4, so they are left out of STIX bundles.
• The custody log is tamper-evident, not tamper-proof: someone who can rewrite the whole library can rewrite its chains.
• The outer evidence bundle .zip is not encrypted, and the inner archive’s password is the well-known infected.

See Report export and Custody log.

Snapshots

A snapshot taken with other hardware may not restore after the stealth profile changes, and a full memory snapshot needs the original host, QEMU, kernel and hardware configuration.