From f9e7f4f0b454849e9ed2419fb6a4bdfc6c75d006 Mon Sep 17 00:00:00 2001
From: Andrew Fasano <fasano@mit.edu>
Date: Fri, 12 Nov 2021 10:49:56 -0500
Subject: [PATCH 001/140] Syscalls2: clear TCG cache on load, fixes #1076

---
 panda/plugins/syscalls2/syscalls2.cpp | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/panda/plugins/syscalls2/syscalls2.cpp b/panda/plugins/syscalls2/syscalls2.cpp
index 2554a3c81e0..d253a0693de 100644
--- a/panda/plugins/syscalls2/syscalls2.cpp
+++ b/panda/plugins/syscalls2/syscalls2.cpp
@@ -1113,6 +1113,11 @@ bool init_plugin(void *self) {
     fprintf(stderr,"The syscalls plugin is not currently supported on this platform.\n");
     return false;
 #endif // x86/arm/mips
+
+    // Plugin is good to load - now let's clear the cache to make
+    // sure there aren't any previously-translated TCG blocks
+    // which already have (uninstrumented) syscalls.
+    panda_do_flush_tb();
     return true;
 }
 

From 4ffdb5709b6376a6bc43018ef1a9ad23d53624b5 Mon Sep 17 00:00:00 2001
From: Andrew Fasano <fasano@mit.edu>
Date: Fri, 12 Nov 2021 12:03:09 -0500
Subject: [PATCH 002/140] Syscalls2: pass a NULL syscall_info_t when unknown

In the on_all_sys_{enter,return}2 callbacks we pass a syscall_info_t
with information about the current syscall or a NULL pointer if the
syscall cannot be identified. However, if the syscall number is below
the maximum but not defined in the os/arch-specific DSO file, we were
passing a non-null but zeroed object which would lead to unexpected
crashes in syscalls2 consumers (e.g., syscalls_logger didn't expect a
non-NULL call object but a null pointer for the syscall name) and make
it difficult to distinguish syscall #0 from an error case.
---
 .../syscalls2/generated-tpl/syscall_switch_enter.tpl   | 10 +++++++++-
 .../syscalls2/generated-tpl/syscall_switch_return.tpl  | 10 +++++++++-
 .../generated/syscall_switch_enter_freebsd_x64.cpp     | 10 +++++++++-
 .../generated/syscall_switch_enter_linux_arm.cpp       | 10 +++++++++-
 .../generated/syscall_switch_enter_linux_arm64.cpp     | 10 +++++++++-
 .../generated/syscall_switch_enter_linux_mips.cpp      | 10 +++++++++-
 .../generated/syscall_switch_enter_linux_x64.cpp       | 10 +++++++++-
 .../generated/syscall_switch_enter_linux_x86.cpp       | 10 +++++++++-
 .../syscall_switch_enter_windows_2000_x86.cpp          | 10 +++++++++-
 .../generated/syscall_switch_enter_windows_7_x86.cpp   | 10 +++++++++-
 .../syscall_switch_enter_windows_xpsp2_x86.cpp         | 10 +++++++++-
 .../syscall_switch_enter_windows_xpsp3_x86.cpp         | 10 +++++++++-
 .../generated/syscall_switch_return_freebsd_x64.cpp    | 10 +++++++++-
 .../generated/syscall_switch_return_linux_arm.cpp      | 10 +++++++++-
 .../generated/syscall_switch_return_linux_arm64.cpp    | 10 +++++++++-
 .../generated/syscall_switch_return_linux_mips.cpp     | 10 +++++++++-
 .../generated/syscall_switch_return_linux_x64.cpp      | 10 +++++++++-
 .../generated/syscall_switch_return_linux_x86.cpp      | 10 +++++++++-
 .../syscall_switch_return_windows_2000_x86.cpp         | 10 +++++++++-
 .../generated/syscall_switch_return_windows_7_x86.cpp  | 10 +++++++++-
 .../syscall_switch_return_windows_xpsp2_x86.cpp        | 10 +++++++++-
 .../syscall_switch_return_windows_xpsp3_x86.cpp        | 10 +++++++++-
 22 files changed, 198 insertions(+), 22 deletions(-)

diff --git a/panda/plugins/syscalls2/generated-tpl/syscall_switch_enter.tpl b/panda/plugins/syscalls2/generated-tpl/syscall_switch_enter.tpl
index f0c9043a834..dfab86f2d9b 100644
--- a/panda/plugins/syscalls2/generated-tpl/syscall_switch_enter.tpl
+++ b/panda/plugins/syscalls2/generated-tpl/syscall_switch_enter.tpl
@@ -34,7 +34,15 @@ void syscall_enter_switch_{{os}}_{{arch}}(CPUState *cpu, target_ptr_t pc, int st
 	ctx.asid = panda_current_asid(cpu);
 	ctx.retaddr = calc_retaddr(cpu, pc);
 	bool panda_noreturn;	// true if PANDA should not track the return of this system call
-	const syscall_info_t *call = (syscall_meta == NULL || ctx.no > syscall_meta->max_generic) ? NULL : &syscall_info[ctx.no];
+	const syscall_info_t *call = NULL;
+	syscall_info_t zero = {0};
+	if (syscall_meta != NULL && ctx.no <= syscall_meta->max_generic) {
+	  // If the syscall_info object from dso_info_....c doesn't have an entry
+	  // for this syscall, we want to leave it as a NULL pointer
+	  if (memcmp(&syscall_info[ctx.no], &zero, sizeof(syscall_info_t)) != 0) {
+		call = &syscall_info[ctx.no];
+	  }
+	}
 
 	switch (ctx.no) {
 	{%- for syscall in syscalls %}
diff --git a/panda/plugins/syscalls2/generated-tpl/syscall_switch_return.tpl b/panda/plugins/syscalls2/generated-tpl/syscall_switch_return.tpl
index 6d29def04f8..04e6b68361d 100644
--- a/panda/plugins/syscalls2/generated-tpl/syscall_switch_return.tpl
+++ b/panda/plugins/syscalls2/generated-tpl/syscall_switch_return.tpl
@@ -14,7 +14,15 @@ extern "C" {
 
 void syscall_return_switch_{{os}}_{{arch}}(CPUState *cpu, target_ptr_t pc, const syscall_ctx_t *ctx) {
 #if {{arch_conf.qemu_target}}
-	const syscall_info_t *call = (syscall_meta == NULL || ctx->no > syscall_meta->max_generic) ? NULL : &syscall_info[ctx->no];
+	const syscall_info_t *call = NULL;
+	syscall_info_t zero = {0};
+	if (syscall_meta != NULL && ctx->no <= syscall_meta->max_generic) {
+	  // If the syscall_info object from dso_info_....c doesn't have an entry
+	  // for this syscall, we want to leave it as a NULL pointer
+	  if (memcmp(&syscall_info[ctx->no], &zero, sizeof(syscall_info_t)) != 0) {
+		call = &syscall_info[ctx->no];
+	  }
+	}
 	switch (ctx->no) {
 		{%- for syscall in syscalls %}
 		// {{syscall.no}} {{syscall.rettype}} {{syscall.name}} {{syscall.args_raw}}
diff --git a/panda/plugins/syscalls2/generated/syscall_switch_enter_freebsd_x64.cpp b/panda/plugins/syscalls2/generated/syscall_switch_enter_freebsd_x64.cpp
index 6cdfa2a83e0..834719ab51d 100644
--- a/panda/plugins/syscalls2/generated/syscall_switch_enter_freebsd_x64.cpp
+++ b/panda/plugins/syscalls2/generated/syscall_switch_enter_freebsd_x64.cpp
@@ -34,7 +34,15 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	ctx.asid = panda_current_asid(cpu);
 	ctx.retaddr = calc_retaddr(cpu, pc);
 	bool panda_noreturn;	// true if PANDA should not track the return of this system call
-	const syscall_info_t *call = (syscall_meta == NULL || ctx.no > syscall_meta->max_generic) ? NULL : &syscall_info[ctx.no];
+	const syscall_info_t *call = NULL;
+	syscall_info_t zero = {0};
+	if (syscall_meta != NULL && ctx.no <= syscall_meta->max_generic) {
+	  // If the syscall_info object from dso_info_....c doesn't have an entry
+	  // for this syscall, we want to leave it as a NULL pointer
+	  if (memcmp(&syscall_info[ctx.no], &zero, sizeof(syscall_info_t)) != 0) {
+		call = &syscall_info[ctx.no];
+	  }
+	}
 
 	switch (ctx.no) {
 	// 0 int nosys ['void']
diff --git a/panda/plugins/syscalls2/generated/syscall_switch_enter_linux_arm.cpp b/panda/plugins/syscalls2/generated/syscall_switch_enter_linux_arm.cpp
index d6eb91912a1..f9051ed8d2b 100644
--- a/panda/plugins/syscalls2/generated/syscall_switch_enter_linux_arm.cpp
+++ b/panda/plugins/syscalls2/generated/syscall_switch_enter_linux_arm.cpp
@@ -34,7 +34,15 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	ctx.asid = panda_current_asid(cpu);
 	ctx.retaddr = calc_retaddr(cpu, pc);
 	bool panda_noreturn;	// true if PANDA should not track the return of this system call
-	const syscall_info_t *call = (syscall_meta == NULL || ctx.no > syscall_meta->max_generic) ? NULL : &syscall_info[ctx.no];
+	const syscall_info_t *call = NULL;
+	syscall_info_t zero = {0};
+	if (syscall_meta != NULL && ctx.no <= syscall_meta->max_generic) {
+	  // If the syscall_info object from dso_info_....c doesn't have an entry
+	  // for this syscall, we want to leave it as a NULL pointer
+	  if (memcmp(&syscall_info[ctx.no], &zero, sizeof(syscall_info_t)) != 0) {
+		call = &syscall_info[ctx.no];
+	  }
+	}
 
 	switch (ctx.no) {
 	// 0 long sys_restart_syscall ['void']
diff --git a/panda/plugins/syscalls2/generated/syscall_switch_enter_linux_arm64.cpp b/panda/plugins/syscalls2/generated/syscall_switch_enter_linux_arm64.cpp
index 3fe4028bf4b..85987b17391 100644
--- a/panda/plugins/syscalls2/generated/syscall_switch_enter_linux_arm64.cpp
+++ b/panda/plugins/syscalls2/generated/syscall_switch_enter_linux_arm64.cpp
@@ -34,7 +34,15 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	ctx.asid = panda_current_asid(cpu);
 	ctx.retaddr = calc_retaddr(cpu, pc);
 	bool panda_noreturn;	// true if PANDA should not track the return of this system call
-	const syscall_info_t *call = (syscall_meta == NULL || ctx.no > syscall_meta->max_generic) ? NULL : &syscall_info[ctx.no];
+	const syscall_info_t *call = NULL;
+	syscall_info_t zero = {0};
+	if (syscall_meta != NULL && ctx.no <= syscall_meta->max_generic) {
+	  // If the syscall_info object from dso_info_....c doesn't have an entry
+	  // for this syscall, we want to leave it as a NULL pointer
+	  if (memcmp(&syscall_info[ctx.no], &zero, sizeof(syscall_info_t)) != 0) {
+		call = &syscall_info[ctx.no];
+	  }
+	}
 
 	switch (ctx.no) {
 	// 0 long sys_io_setup ['unsigned nr_reqs', 'aio_context_t __user *ctx']
diff --git a/panda/plugins/syscalls2/generated/syscall_switch_enter_linux_mips.cpp b/panda/plugins/syscalls2/generated/syscall_switch_enter_linux_mips.cpp
index f14de80276a..bc46abf03a2 100644
--- a/panda/plugins/syscalls2/generated/syscall_switch_enter_linux_mips.cpp
+++ b/panda/plugins/syscalls2/generated/syscall_switch_enter_linux_mips.cpp
@@ -34,7 +34,15 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	ctx.asid = panda_current_asid(cpu);
 	ctx.retaddr = calc_retaddr(cpu, pc);
 	bool panda_noreturn;	// true if PANDA should not track the return of this system call
-	const syscall_info_t *call = (syscall_meta == NULL || ctx.no > syscall_meta->max_generic) ? NULL : &syscall_info[ctx.no];
+	const syscall_info_t *call = NULL;
+	syscall_info_t zero = {0};
+	if (syscall_meta != NULL && ctx.no <= syscall_meta->max_generic) {
+	  // If the syscall_info object from dso_info_....c doesn't have an entry
+	  // for this syscall, we want to leave it as a NULL pointer
+	  if (memcmp(&syscall_info[ctx.no], &zero, sizeof(syscall_info_t)) != 0) {
+		call = &syscall_info[ctx.no];
+	  }
+	}
 
 	switch (ctx.no) {
 	// 4001 long sys_exit ['int error_code']
diff --git a/panda/plugins/syscalls2/generated/syscall_switch_enter_linux_x64.cpp b/panda/plugins/syscalls2/generated/syscall_switch_enter_linux_x64.cpp
index 2b5f0488195..7b06fc8ceaa 100644
--- a/panda/plugins/syscalls2/generated/syscall_switch_enter_linux_x64.cpp
+++ b/panda/plugins/syscalls2/generated/syscall_switch_enter_linux_x64.cpp
@@ -34,7 +34,15 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	ctx.asid = panda_current_asid(cpu);
 	ctx.retaddr = calc_retaddr(cpu, pc);
 	bool panda_noreturn;	// true if PANDA should not track the return of this system call
-	const syscall_info_t *call = (syscall_meta == NULL || ctx.no > syscall_meta->max_generic) ? NULL : &syscall_info[ctx.no];
+	const syscall_info_t *call = NULL;
+	syscall_info_t zero = {0};
+	if (syscall_meta != NULL && ctx.no <= syscall_meta->max_generic) {
+	  // If the syscall_info object from dso_info_....c doesn't have an entry
+	  // for this syscall, we want to leave it as a NULL pointer
+	  if (memcmp(&syscall_info[ctx.no], &zero, sizeof(syscall_info_t)) != 0) {
+		call = &syscall_info[ctx.no];
+	  }
+	}
 
 	switch (ctx.no) {
 	// 0 long sys_read ['unsigned int fd', 'char __user *buf', 'size_t count']
diff --git a/panda/plugins/syscalls2/generated/syscall_switch_enter_linux_x86.cpp b/panda/plugins/syscalls2/generated/syscall_switch_enter_linux_x86.cpp
index ea8bc97c731..b0875ac3850 100644
--- a/panda/plugins/syscalls2/generated/syscall_switch_enter_linux_x86.cpp
+++ b/panda/plugins/syscalls2/generated/syscall_switch_enter_linux_x86.cpp
@@ -34,7 +34,15 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	ctx.asid = panda_current_asid(cpu);
 	ctx.retaddr = calc_retaddr(cpu, pc);
 	bool panda_noreturn;	// true if PANDA should not track the return of this system call
-	const syscall_info_t *call = (syscall_meta == NULL || ctx.no > syscall_meta->max_generic) ? NULL : &syscall_info[ctx.no];
+	const syscall_info_t *call = NULL;
+	syscall_info_t zero = {0};
+	if (syscall_meta != NULL && ctx.no <= syscall_meta->max_generic) {
+	  // If the syscall_info object from dso_info_....c doesn't have an entry
+	  // for this syscall, we want to leave it as a NULL pointer
+	  if (memcmp(&syscall_info[ctx.no], &zero, sizeof(syscall_info_t)) != 0) {
+		call = &syscall_info[ctx.no];
+	  }
+	}
 
 	switch (ctx.no) {
 	// 0 long sys_restart_syscall ['void']
diff --git a/panda/plugins/syscalls2/generated/syscall_switch_enter_windows_2000_x86.cpp b/panda/plugins/syscalls2/generated/syscall_switch_enter_windows_2000_x86.cpp
index acdfbea1c37..b14adc5dde3 100644
--- a/panda/plugins/syscalls2/generated/syscall_switch_enter_windows_2000_x86.cpp
+++ b/panda/plugins/syscalls2/generated/syscall_switch_enter_windows_2000_x86.cpp
@@ -34,7 +34,15 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	ctx.asid = panda_current_asid(cpu);
 	ctx.retaddr = calc_retaddr(cpu, pc);
 	bool panda_noreturn;	// true if PANDA should not track the return of this system call
-	const syscall_info_t *call = (syscall_meta == NULL || ctx.no > syscall_meta->max_generic) ? NULL : &syscall_info[ctx.no];
+	const syscall_info_t *call = NULL;
+	syscall_info_t zero = {0};
+	if (syscall_meta != NULL && ctx.no <= syscall_meta->max_generic) {
+	  // If the syscall_info object from dso_info_....c doesn't have an entry
+	  // for this syscall, we want to leave it as a NULL pointer
+	  if (memcmp(&syscall_info[ctx.no], &zero, sizeof(syscall_info_t)) != 0) {
+		call = &syscall_info[ctx.no];
+	  }
+	}
 
 	switch (ctx.no) {
 	// 0 NTSTATUS NtAcceptConnectPort ['PHANDLE PortHandle', 'PVOID PortContext', 'PPORT_MESSAGE ConnectionRequest', 'BOOLEAN AcceptConnection', 'PPORT_VIEW ServerView', 'PREMOTE_PORT_VIEW ClientView']
diff --git a/panda/plugins/syscalls2/generated/syscall_switch_enter_windows_7_x86.cpp b/panda/plugins/syscalls2/generated/syscall_switch_enter_windows_7_x86.cpp
index e31b4914249..8017d607bc1 100644
--- a/panda/plugins/syscalls2/generated/syscall_switch_enter_windows_7_x86.cpp
+++ b/panda/plugins/syscalls2/generated/syscall_switch_enter_windows_7_x86.cpp
@@ -34,7 +34,15 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	ctx.asid = panda_current_asid(cpu);
 	ctx.retaddr = calc_retaddr(cpu, pc);
 	bool panda_noreturn;	// true if PANDA should not track the return of this system call
-	const syscall_info_t *call = (syscall_meta == NULL || ctx.no > syscall_meta->max_generic) ? NULL : &syscall_info[ctx.no];
+	const syscall_info_t *call = NULL;
+	syscall_info_t zero = {0};
+	if (syscall_meta != NULL && ctx.no <= syscall_meta->max_generic) {
+	  // If the syscall_info object from dso_info_....c doesn't have an entry
+	  // for this syscall, we want to leave it as a NULL pointer
+	  if (memcmp(&syscall_info[ctx.no], &zero, sizeof(syscall_info_t)) != 0) {
+		call = &syscall_info[ctx.no];
+	  }
+	}
 
 	switch (ctx.no) {
 	// 0 NTSTATUS NtAcceptConnectPort ['PHANDLE PortHandle', 'PVOID PortContext', 'PPORT_MESSAGE ConnectionRequest', 'BOOLEAN AcceptConnection', 'PPORT_VIEW ServerView', 'PREMOTE_PORT_VIEW ClientView']
diff --git a/panda/plugins/syscalls2/generated/syscall_switch_enter_windows_xpsp2_x86.cpp b/panda/plugins/syscalls2/generated/syscall_switch_enter_windows_xpsp2_x86.cpp
index 495d9828ac2..32704662189 100644
--- a/panda/plugins/syscalls2/generated/syscall_switch_enter_windows_xpsp2_x86.cpp
+++ b/panda/plugins/syscalls2/generated/syscall_switch_enter_windows_xpsp2_x86.cpp
@@ -34,7 +34,15 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	ctx.asid = panda_current_asid(cpu);
 	ctx.retaddr = calc_retaddr(cpu, pc);
 	bool panda_noreturn;	// true if PANDA should not track the return of this system call
-	const syscall_info_t *call = (syscall_meta == NULL || ctx.no > syscall_meta->max_generic) ? NULL : &syscall_info[ctx.no];
+	const syscall_info_t *call = NULL;
+	syscall_info_t zero = {0};
+	if (syscall_meta != NULL && ctx.no <= syscall_meta->max_generic) {
+	  // If the syscall_info object from dso_info_....c doesn't have an entry
+	  // for this syscall, we want to leave it as a NULL pointer
+	  if (memcmp(&syscall_info[ctx.no], &zero, sizeof(syscall_info_t)) != 0) {
+		call = &syscall_info[ctx.no];
+	  }
+	}
 
 	switch (ctx.no) {
 	// 0 NTSTATUS NtAcceptConnectPort ['PHANDLE PortHandle', 'PVOID PortContext', 'PPORT_MESSAGE ConnectionRequest', 'BOOLEAN AcceptConnection', 'PPORT_VIEW ServerView', 'PREMOTE_PORT_VIEW ClientView']
diff --git a/panda/plugins/syscalls2/generated/syscall_switch_enter_windows_xpsp3_x86.cpp b/panda/plugins/syscalls2/generated/syscall_switch_enter_windows_xpsp3_x86.cpp
index 86581dab8bd..ca7e79ac45d 100644
--- a/panda/plugins/syscalls2/generated/syscall_switch_enter_windows_xpsp3_x86.cpp
+++ b/panda/plugins/syscalls2/generated/syscall_switch_enter_windows_xpsp3_x86.cpp
@@ -34,7 +34,15 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	ctx.asid = panda_current_asid(cpu);
 	ctx.retaddr = calc_retaddr(cpu, pc);
 	bool panda_noreturn;	// true if PANDA should not track the return of this system call
-	const syscall_info_t *call = (syscall_meta == NULL || ctx.no > syscall_meta->max_generic) ? NULL : &syscall_info[ctx.no];
+	const syscall_info_t *call = NULL;
+	syscall_info_t zero = {0};
+	if (syscall_meta != NULL && ctx.no <= syscall_meta->max_generic) {
+	  // If the syscall_info object from dso_info_....c doesn't have an entry
+	  // for this syscall, we want to leave it as a NULL pointer
+	  if (memcmp(&syscall_info[ctx.no], &zero, sizeof(syscall_info_t)) != 0) {
+		call = &syscall_info[ctx.no];
+	  }
+	}
 
 	switch (ctx.no) {
 	// 0 NTSTATUS NtAcceptConnectPort ['PHANDLE PortHandle', 'PVOID PortContext', 'PPORT_MESSAGE ConnectionRequest', 'BOOLEAN AcceptConnection', 'PPORT_VIEW ServerView', 'PREMOTE_PORT_VIEW ClientView']
diff --git a/panda/plugins/syscalls2/generated/syscall_switch_return_freebsd_x64.cpp b/panda/plugins/syscalls2/generated/syscall_switch_return_freebsd_x64.cpp
index 9d1c85d4da3..160809d9a58 100644
--- a/panda/plugins/syscalls2/generated/syscall_switch_return_freebsd_x64.cpp
+++ b/panda/plugins/syscalls2/generated/syscall_switch_return_freebsd_x64.cpp
@@ -14,7 +14,15 @@ extern "C" {
 
 void syscall_return_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, const syscall_ctx_t *ctx) {
 #if defined(TARGET_X86_64)
-	const syscall_info_t *call = (syscall_meta == NULL || ctx->no > syscall_meta->max_generic) ? NULL : &syscall_info[ctx->no];
+	const syscall_info_t *call = NULL;
+	syscall_info_t zero = {0};
+	if (syscall_meta != NULL && ctx->no <= syscall_meta->max_generic) {
+	  // If the syscall_info object from dso_info_....c doesn't have an entry
+	  // for this syscall, we want to leave it as a NULL pointer
+	  if (memcmp(&syscall_info[ctx->no], &zero, sizeof(syscall_info_t)) != 0) {
+		call = &syscall_info[ctx->no];
+	  }
+	}
 	switch (ctx->no) {
 		// 0 int nosys ['void']
 		case 0: {
diff --git a/panda/plugins/syscalls2/generated/syscall_switch_return_linux_arm.cpp b/panda/plugins/syscalls2/generated/syscall_switch_return_linux_arm.cpp
index b68cecff4e3..3a68fa3f9ac 100644
--- a/panda/plugins/syscalls2/generated/syscall_switch_return_linux_arm.cpp
+++ b/panda/plugins/syscalls2/generated/syscall_switch_return_linux_arm.cpp
@@ -14,7 +14,15 @@ extern "C" {
 
 void syscall_return_switch_linux_arm(CPUState *cpu, target_ptr_t pc, const syscall_ctx_t *ctx) {
 #if defined(TARGET_ARM) && !defined(TARGET_AARCH64)
-	const syscall_info_t *call = (syscall_meta == NULL || ctx->no > syscall_meta->max_generic) ? NULL : &syscall_info[ctx->no];
+	const syscall_info_t *call = NULL;
+	syscall_info_t zero = {0};
+	if (syscall_meta != NULL && ctx->no <= syscall_meta->max_generic) {
+	  // If the syscall_info object from dso_info_....c doesn't have an entry
+	  // for this syscall, we want to leave it as a NULL pointer
+	  if (memcmp(&syscall_info[ctx->no], &zero, sizeof(syscall_info_t)) != 0) {
+		call = &syscall_info[ctx->no];
+	  }
+	}
 	switch (ctx->no) {
 		// 0 long sys_restart_syscall ['void']
 		case 0: {
diff --git a/panda/plugins/syscalls2/generated/syscall_switch_return_linux_arm64.cpp b/panda/plugins/syscalls2/generated/syscall_switch_return_linux_arm64.cpp
index 6cb5e097d4b..8567d863669 100644
--- a/panda/plugins/syscalls2/generated/syscall_switch_return_linux_arm64.cpp
+++ b/panda/plugins/syscalls2/generated/syscall_switch_return_linux_arm64.cpp
@@ -14,7 +14,15 @@ extern "C" {
 
 void syscall_return_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, const syscall_ctx_t *ctx) {
 #if defined(TARGET_ARM) && defined(TARGET_AARCH64)
-	const syscall_info_t *call = (syscall_meta == NULL || ctx->no > syscall_meta->max_generic) ? NULL : &syscall_info[ctx->no];
+	const syscall_info_t *call = NULL;
+	syscall_info_t zero = {0};
+	if (syscall_meta != NULL && ctx->no <= syscall_meta->max_generic) {
+	  // If the syscall_info object from dso_info_....c doesn't have an entry
+	  // for this syscall, we want to leave it as a NULL pointer
+	  if (memcmp(&syscall_info[ctx->no], &zero, sizeof(syscall_info_t)) != 0) {
+		call = &syscall_info[ctx->no];
+	  }
+	}
 	switch (ctx->no) {
 		// 0 long sys_io_setup ['unsigned nr_reqs', 'aio_context_t __user *ctx']
 		case 0: {
diff --git a/panda/plugins/syscalls2/generated/syscall_switch_return_linux_mips.cpp b/panda/plugins/syscalls2/generated/syscall_switch_return_linux_mips.cpp
index 1e0ab8a9770..a31264e656c 100644
--- a/panda/plugins/syscalls2/generated/syscall_switch_return_linux_mips.cpp
+++ b/panda/plugins/syscalls2/generated/syscall_switch_return_linux_mips.cpp
@@ -14,7 +14,15 @@ extern "C" {
 
 void syscall_return_switch_linux_mips(CPUState *cpu, target_ptr_t pc, const syscall_ctx_t *ctx) {
 #if defined(TARGET_MIPS)
-	const syscall_info_t *call = (syscall_meta == NULL || ctx->no > syscall_meta->max_generic) ? NULL : &syscall_info[ctx->no];
+	const syscall_info_t *call = NULL;
+	syscall_info_t zero = {0};
+	if (syscall_meta != NULL && ctx->no <= syscall_meta->max_generic) {
+	  // If the syscall_info object from dso_info_....c doesn't have an entry
+	  // for this syscall, we want to leave it as a NULL pointer
+	  if (memcmp(&syscall_info[ctx->no], &zero, sizeof(syscall_info_t)) != 0) {
+		call = &syscall_info[ctx->no];
+	  }
+	}
 	switch (ctx->no) {
 		// 4001 long sys_exit ['int error_code']
 		case 4001: {
diff --git a/panda/plugins/syscalls2/generated/syscall_switch_return_linux_x64.cpp b/panda/plugins/syscalls2/generated/syscall_switch_return_linux_x64.cpp
index 7013467e013..76713ab804d 100644
--- a/panda/plugins/syscalls2/generated/syscall_switch_return_linux_x64.cpp
+++ b/panda/plugins/syscalls2/generated/syscall_switch_return_linux_x64.cpp
@@ -14,7 +14,15 @@ extern "C" {
 
 void syscall_return_switch_linux_x64(CPUState *cpu, target_ptr_t pc, const syscall_ctx_t *ctx) {
 #if defined(TARGET_X86_64)
-	const syscall_info_t *call = (syscall_meta == NULL || ctx->no > syscall_meta->max_generic) ? NULL : &syscall_info[ctx->no];
+	const syscall_info_t *call = NULL;
+	syscall_info_t zero = {0};
+	if (syscall_meta != NULL && ctx->no <= syscall_meta->max_generic) {
+	  // If the syscall_info object from dso_info_....c doesn't have an entry
+	  // for this syscall, we want to leave it as a NULL pointer
+	  if (memcmp(&syscall_info[ctx->no], &zero, sizeof(syscall_info_t)) != 0) {
+		call = &syscall_info[ctx->no];
+	  }
+	}
 	switch (ctx->no) {
 		// 0 long sys_read ['unsigned int fd', 'char __user *buf', 'size_t count']
 		case 0: {
diff --git a/panda/plugins/syscalls2/generated/syscall_switch_return_linux_x86.cpp b/panda/plugins/syscalls2/generated/syscall_switch_return_linux_x86.cpp
index d80d1bfcd57..0e2b92d8240 100644
--- a/panda/plugins/syscalls2/generated/syscall_switch_return_linux_x86.cpp
+++ b/panda/plugins/syscalls2/generated/syscall_switch_return_linux_x86.cpp
@@ -14,7 +14,15 @@ extern "C" {
 
 void syscall_return_switch_linux_x86(CPUState *cpu, target_ptr_t pc, const syscall_ctx_t *ctx) {
 #if defined(TARGET_I386) && !defined(TARGET_X86_64)
-	const syscall_info_t *call = (syscall_meta == NULL || ctx->no > syscall_meta->max_generic) ? NULL : &syscall_info[ctx->no];
+	const syscall_info_t *call = NULL;
+	syscall_info_t zero = {0};
+	if (syscall_meta != NULL && ctx->no <= syscall_meta->max_generic) {
+	  // If the syscall_info object from dso_info_....c doesn't have an entry
+	  // for this syscall, we want to leave it as a NULL pointer
+	  if (memcmp(&syscall_info[ctx->no], &zero, sizeof(syscall_info_t)) != 0) {
+		call = &syscall_info[ctx->no];
+	  }
+	}
 	switch (ctx->no) {
 		// 0 long sys_restart_syscall ['void']
 		case 0: {
diff --git a/panda/plugins/syscalls2/generated/syscall_switch_return_windows_2000_x86.cpp b/panda/plugins/syscalls2/generated/syscall_switch_return_windows_2000_x86.cpp
index c4c2c2f7ebf..50919e1d64b 100644
--- a/panda/plugins/syscalls2/generated/syscall_switch_return_windows_2000_x86.cpp
+++ b/panda/plugins/syscalls2/generated/syscall_switch_return_windows_2000_x86.cpp
@@ -14,7 +14,15 @@ extern "C" {
 
 void syscall_return_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, const syscall_ctx_t *ctx) {
 #if defined(TARGET_I386) && !defined(TARGET_X86_64)
-	const syscall_info_t *call = (syscall_meta == NULL || ctx->no > syscall_meta->max_generic) ? NULL : &syscall_info[ctx->no];
+	const syscall_info_t *call = NULL;
+	syscall_info_t zero = {0};
+	if (syscall_meta != NULL && ctx->no <= syscall_meta->max_generic) {
+	  // If the syscall_info object from dso_info_....c doesn't have an entry
+	  // for this syscall, we want to leave it as a NULL pointer
+	  if (memcmp(&syscall_info[ctx->no], &zero, sizeof(syscall_info_t)) != 0) {
+		call = &syscall_info[ctx->no];
+	  }
+	}
 	switch (ctx->no) {
 		// 0 NTSTATUS NtAcceptConnectPort ['PHANDLE PortHandle', 'PVOID PortContext', 'PPORT_MESSAGE ConnectionRequest', 'BOOLEAN AcceptConnection', 'PPORT_VIEW ServerView', 'PREMOTE_PORT_VIEW ClientView']
 		case 0: {
diff --git a/panda/plugins/syscalls2/generated/syscall_switch_return_windows_7_x86.cpp b/panda/plugins/syscalls2/generated/syscall_switch_return_windows_7_x86.cpp
index 67a66976cdf..1d5cbedc271 100644
--- a/panda/plugins/syscalls2/generated/syscall_switch_return_windows_7_x86.cpp
+++ b/panda/plugins/syscalls2/generated/syscall_switch_return_windows_7_x86.cpp
@@ -14,7 +14,15 @@ extern "C" {
 
 void syscall_return_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, const syscall_ctx_t *ctx) {
 #if defined(TARGET_I386) && !defined(TARGET_X86_64)
-	const syscall_info_t *call = (syscall_meta == NULL || ctx->no > syscall_meta->max_generic) ? NULL : &syscall_info[ctx->no];
+	const syscall_info_t *call = NULL;
+	syscall_info_t zero = {0};
+	if (syscall_meta != NULL && ctx->no <= syscall_meta->max_generic) {
+	  // If the syscall_info object from dso_info_....c doesn't have an entry
+	  // for this syscall, we want to leave it as a NULL pointer
+	  if (memcmp(&syscall_info[ctx->no], &zero, sizeof(syscall_info_t)) != 0) {
+		call = &syscall_info[ctx->no];
+	  }
+	}
 	switch (ctx->no) {
 		// 0 NTSTATUS NtAcceptConnectPort ['PHANDLE PortHandle', 'PVOID PortContext', 'PPORT_MESSAGE ConnectionRequest', 'BOOLEAN AcceptConnection', 'PPORT_VIEW ServerView', 'PREMOTE_PORT_VIEW ClientView']
 		case 0: {
diff --git a/panda/plugins/syscalls2/generated/syscall_switch_return_windows_xpsp2_x86.cpp b/panda/plugins/syscalls2/generated/syscall_switch_return_windows_xpsp2_x86.cpp
index b668d6b71d1..fea2edd1586 100644
--- a/panda/plugins/syscalls2/generated/syscall_switch_return_windows_xpsp2_x86.cpp
+++ b/panda/plugins/syscalls2/generated/syscall_switch_return_windows_xpsp2_x86.cpp
@@ -14,7 +14,15 @@ extern "C" {
 
 void syscall_return_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, const syscall_ctx_t *ctx) {
 #if defined(TARGET_I386) && !defined(TARGET_X86_64)
-	const syscall_info_t *call = (syscall_meta == NULL || ctx->no > syscall_meta->max_generic) ? NULL : &syscall_info[ctx->no];
+	const syscall_info_t *call = NULL;
+	syscall_info_t zero = {0};
+	if (syscall_meta != NULL && ctx->no <= syscall_meta->max_generic) {
+	  // If the syscall_info object from dso_info_....c doesn't have an entry
+	  // for this syscall, we want to leave it as a NULL pointer
+	  if (memcmp(&syscall_info[ctx->no], &zero, sizeof(syscall_info_t)) != 0) {
+		call = &syscall_info[ctx->no];
+	  }
+	}
 	switch (ctx->no) {
 		// 0 NTSTATUS NtAcceptConnectPort ['PHANDLE PortHandle', 'PVOID PortContext', 'PPORT_MESSAGE ConnectionRequest', 'BOOLEAN AcceptConnection', 'PPORT_VIEW ServerView', 'PREMOTE_PORT_VIEW ClientView']
 		case 0: {
diff --git a/panda/plugins/syscalls2/generated/syscall_switch_return_windows_xpsp3_x86.cpp b/panda/plugins/syscalls2/generated/syscall_switch_return_windows_xpsp3_x86.cpp
index 9ad16e55a53..b34e774ee0a 100644
--- a/panda/plugins/syscalls2/generated/syscall_switch_return_windows_xpsp3_x86.cpp
+++ b/panda/plugins/syscalls2/generated/syscall_switch_return_windows_xpsp3_x86.cpp
@@ -14,7 +14,15 @@ extern "C" {
 
 void syscall_return_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, const syscall_ctx_t *ctx) {
 #if defined(TARGET_I386) && !defined(TARGET_X86_64)
-	const syscall_info_t *call = (syscall_meta == NULL || ctx->no > syscall_meta->max_generic) ? NULL : &syscall_info[ctx->no];
+	const syscall_info_t *call = NULL;
+	syscall_info_t zero = {0};
+	if (syscall_meta != NULL && ctx->no <= syscall_meta->max_generic) {
+	  // If the syscall_info object from dso_info_....c doesn't have an entry
+	  // for this syscall, we want to leave it as a NULL pointer
+	  if (memcmp(&syscall_info[ctx->no], &zero, sizeof(syscall_info_t)) != 0) {
+		call = &syscall_info[ctx->no];
+	  }
+	}
 	switch (ctx->no) {
 		// 0 NTSTATUS NtAcceptConnectPort ['PHANDLE PortHandle', 'PVOID PortContext', 'PPORT_MESSAGE ConnectionRequest', 'BOOLEAN AcceptConnection', 'PPORT_VIEW ServerView', 'PREMOTE_PORT_VIEW ClientView']
 		case 0: {

From 7429f49f712701f8928dcef28054009a9c95dde8 Mon Sep 17 00:00:00 2001
From: Andrew Fasano <fasano@mit.edu>
Date: Wed, 10 Nov 2021 11:03:21 -0500
Subject: [PATCH 003/140] Modify pandare.qcows to generate CLI commands for
 generic images

Example: python3 -m pandare.qcows arm

If the output is not a TTY, it will just print the actual command so you
can pipe it directly to bash.
---
 panda/python/core/pandare/panda.py | 11 +++----
 panda/python/core/pandare/qcows.py | 47 ++++++++++++++++++++++++++++--
 2 files changed, 51 insertions(+), 7 deletions(-)

diff --git a/panda/python/core/pandare/panda.py b/panda/python/core/pandare/panda.py
index d06acf58135..e3dea00a62f 100755
--- a/panda/python/core/pandare/panda.py
+++ b/panda/python/core/pandare/panda.py
@@ -144,7 +144,7 @@ def __init__(self, arch="i386", mem="128M",
             raise ValueError(f"Unsupported architecture {self.arch_name}")
         self.bits, self.endianness, self.register_size = self.arch._determine_bits()
 
-        self.build_dir  = self._find_build_dir()
+        self.build_dir  = self._find_build_dir(self.arch_name)
         environ["PANDA_DIR"] = self.build_dir
 
         if libpanda_path:
@@ -316,7 +316,8 @@ def __main_loop_wait_cb(self):
         except KeyboardInterrupt:
             self.end_analysis()
 
-    def _find_build_dir(self):
+    @staticmethod
+    def _find_build_dir(arch_name):
         '''
         Find build directory containing ARCH-softmmu/libpanda-ARCH.so and ARCH-softmmu/panda/plugins/
         1) check relative to file (in the case of installed packages)
@@ -326,19 +327,19 @@ def _find_build_dir(self):
         archs = ['i386', 'x86_64', 'arm', 'ppc']
         python_package = pjoin(*[dirname(__file__), "data"])
         local_build = realpath(pjoin(dirname(__file__), "../../../../build"))
-        path_end = "{0}-softmmu/libpanda-{0}.so".format(self.arch_name)
+        path_end = "{0}-softmmu/libpanda-{0}.so".format(arch_name)
 
         pot_paths = [python_package, local_build]
         for potential_path in pot_paths:
             if isfile(pjoin(potential_path, path_end)):
-                print("Loading libpanda from {}".format(potential_path))
+                #print("Loading libpanda from {}".format(potential_path))
                 return potential_path
 
         searched_paths = "\n".join(["\t"+p for p in  pot_paths])
         raise RuntimeError(("Couldn't find libpanda-{}.so.\n"
                             "Did you built PANDA for this architecture?\n"
                             "Searched paths:\n{}"
-                           ).format(self.arch_name, searched_paths))
+                           ).format(arch_name, searched_paths))
 
 
     def queue_main_loop_wait_fn(self, fn, args=[]):
diff --git a/panda/python/core/pandare/qcows.py b/panda/python/core/pandare/qcows.py
index 1ddc918a744..62d9f6b3c55 100644
--- a/panda/python/core/pandare/qcows.py
+++ b/panda/python/core/pandare/qcows.py
@@ -3,12 +3,12 @@
 Module for fetching generic PANDA images and managing their metadata.
 '''
 
-from os import path, remove, makedirs
 import logging
+from os import path, remove, makedirs
 from sys import argv
 from subprocess import check_call
 from collections import namedtuple
-
+from shlex import split as shlex_split
 
 logger = logging.getLogger(__name__)
 logger.setLevel(logging.DEBUG)
@@ -314,3 +314,46 @@ def qcow_from_arg(idx=1):
             return Qcows.get_qcow(argv[idx])
         else:
             return Qcows.get_qcow()
+
+    @staticmethod
+    def cli(target):
+        from .panda import Panda
+        q = Qcows.get_qcow_info(target)
+        qcow = Qcows.get_qcow(target)
+        arch = q.arch
+        build_dir = Panda._find_build_dir(arch)
+        panda_args = [build_dir + f"/{arch}-softmmu/panda-system-{arch}"]
+        biospath = path.realpath(path.join(build_dir, "pc-bios"))
+        panda_args.extend(["-L", biospath])
+
+        if arch == 'mips64':
+            panda_args.extend(["-drive", f"file={qcow},if=virtio"])
+        else:
+            panda_args.append(qcow)
+
+        panda_args.extend(['-m', q.default_mem])
+
+        if q.extra_args:
+            extra_args = shlex_split(q.extra_args)
+            for x in extra_args:
+                if " " in x:
+                    panda_args.append(repr(x))
+                else:
+                    panda_args.append(x)
+
+        panda_args.extend(['-loadvm', q.snapshot])
+
+        return " ".join(panda_args)
+
+if __name__ == "__main__":
+    from sys import argv, stdout
+    valid_names = ", ".join(SUPPORTED_IMAGES.keys())
+
+    if len(argv) != 2 or argv[1] not in SUPPORTED_IMAGES:
+        raise ValueError(f"USAGE: {argv[0]}: target_arch where name is one of " + valid_names)
+
+    cmd = Qcows.cli(argv[1])
+    if stdout.isatty():
+        print(f"\nRun panda for {argv[1]} with:\n{cmd}")
+    else:
+        print(cmd)

From b2331ea1f13ce86c984f2f77dada96fe9251d1d3 Mon Sep 17 00:00:00 2001
From: Andrew Fasano <fasano@mit.edu>
Date: Mon, 15 Nov 2021 12:04:40 -0500
Subject: [PATCH 004/140] PyPlugin bugfix: get_arg_bool needs to bool-ify
 strings

---
 panda/python/core/pandare/pyplugin.py | 23 +++++++++++++++++++++--
 1 file changed, 21 insertions(+), 2 deletions(-)

diff --git a/panda/python/core/pandare/pyplugin.py b/panda/python/core/pandare/pyplugin.py
index cb620cddb58..eeb0035141f 100644
--- a/panda/python/core/pandare/pyplugin.py
+++ b/panda/python/core/pandare/pyplugin.py
@@ -96,9 +96,28 @@ def get_arg(self, arg_name):
 
     def get_arg_bool(self, arg_name):
         '''
-        Returns True if the argument is set and has a value of True
+        Returns True if the argument is set and has a truthy value
         '''
-        return arg_name in self.args and self.args[arg_name]==True
+
+        if arg_name not in self.args:
+            # Argument name unset - it's false
+            return False
+
+        arg_val = self.args[arg_name]
+        if isinstance(arg_val, bool):
+            # If it's a python bol already, just return it
+            return arg_val
+
+        if isinstance(arg_val, str):
+            # string of true/y/1  is True
+            return arg_val.lower() in ['true', 'y', '1']
+
+        if isinstance(arg_val, int):
+            # Nonzero is True
+            return arg_val != 0
+
+        # If it's not a string, int, or bool something is weird
+        raise ValueError(f"Unsupported arg type: {type(arg_val)}")
 
     # Callback definition / registration / use. Note these functions mirror the behavior of the macros used
     # in C plugin, check out docs/readme.md for additional details.

From 62ce70f9c9c81a0f2d87ba4d6c61e21a0f502772 Mon Sep 17 00:00:00 2001
From: Andrew Fasano <fasano@mit.edu>
Date: Tue, 16 Nov 2021 12:23:20 -0500
Subject: [PATCH 005/140] PyPlugins: use uninit method over del

---
 panda/docs/pyplugins.md                      |  2 +-
 panda/python/core/pandare/pypluginmanager.py | 15 +++++++--------
 2 files changed, 8 insertions(+), 9 deletions(-)

diff --git a/panda/docs/pyplugins.md b/panda/docs/pyplugins.md
index 633f192922b..42d786b8520 100644
--- a/panda/docs/pyplugins.md
+++ b/panda/docs/pyplugins.md
@@ -4,7 +4,7 @@ PyPlugins are Python3 classes which implement some reusable PANDA capability.
 
 The anatomy of a PANDA PyPlugin in its current form is one or more types which subclass `PyPlugin`. The constructor takes a `panda` object, which is of type [pandare.Panda](https://docs.panda.re/panda.html#pandare.panda.Panda).
 
-From there, you can add hooks and declare initial state for your plugin. The destructor (`__del__`) is optional, but can be used to perform cleanup when your plugin is unloaded.
+From there, you can add hooks and declare initial state for your plugin. An `uninit` method can optionally be defined which will run prior to your plugin being unloaded (often due to the end of the guest execution or replay).
 
 ## Relevant API Docs
 
diff --git a/panda/python/core/pandare/pypluginmanager.py b/panda/python/core/pandare/pypluginmanager.py
index b1dc272d157..a6aff653dde 100644
--- a/panda/python/core/pandare/pypluginmanager.py
+++ b/panda/python/core/pandare/pypluginmanager.py
@@ -213,22 +213,21 @@ def load_all(self, plugin_file, args=None, template_dir=None):
         for name, cls in inspect.getmembers(module, lambda x: inspect.isclass(x) and x.__module__ == "snake_hook"): # matches module set above
             self.load(cls, args, template_dir)
 
-    def unload(self, pluginclass):
+    def unload(self, pluginclass, do_del=True):
         if isinstance(pluginclass, str):
             name = pluginclass
         else:
             name = pluginclass.__name__
 
-        del self.plugins[name]
+        if callable(getattr(self.plugins[name], "uninit", None)):
+            self.plugins[name].uninit()
+
+        if do_del:
+            del self.plugins[name]
 
     def unload_all(self):
-        # XXX: Why don't we just clear the plugin list? The refcount isn't
-        # dropping to zero after the clear and I can't figure out why. So
-        # we'll explicitly call __del__ if it exists on unload as per
-        # the PyPlugin API
         for instance in self.plugins.values():
-            if callable(getattr(instance, "__del__", None)):
-                instance.__del__()
+            self.unload(instance, do_del=False)
         self.plugins.clear()
 
     def is_loaded(self, pluginclass):

From 713ebc39178c1d77b040037d35a2ac8d6d57fab1 Mon Sep 17 00:00:00 2001
From: Andrew Fasano <fasano@mit.edu>
Date: Tue, 16 Nov 2021 13:36:40 -0500
Subject: [PATCH 006/140] PyPlugin bugfix: load_all should only load classes
 which subclass PyPlugin

---
 panda/python/core/pandare/pypluginmanager.py | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/panda/python/core/pandare/pypluginmanager.py b/panda/python/core/pandare/pypluginmanager.py
index a6aff653dde..7c2c08b6d8c 100644
--- a/panda/python/core/pandare/pypluginmanager.py
+++ b/panda/python/core/pandare/pypluginmanager.py
@@ -206,11 +206,14 @@ def load_all(self, plugin_file, args=None, template_dir=None):
         all classes that subclass PyPlugin and passing them to self.load()
         '''
         import inspect, importlib
-        spec = importlib.util.spec_from_file_location("snake_hook", plugin_file)
+        spec = importlib.util.spec_from_file_location("plugin_file", plugin_file)
         module = importlib.util.module_from_spec(spec)
         spec.loader.exec_module(module)
 
-        for name, cls in inspect.getmembers(module, lambda x: inspect.isclass(x) and x.__module__ == "snake_hook"): # matches module set above
+        for name, cls in inspect.getmembers(module, lambda x: inspect.isclass(x)):
+            if not issubclass(cls, PyPlugin):
+                continue
+            cls.__name__ = name
             self.load(cls, args, template_dir)
 
     def unload(self, pluginclass, do_del=True):
@@ -226,8 +229,8 @@ def unload(self, pluginclass, do_del=True):
             del self.plugins[name]
 
     def unload_all(self):
-        for instance in self.plugins.values():
-            self.unload(instance, do_del=False)
+        for name in self.plugins.keys():
+            self.unload(name, do_del=False)
         self.plugins.clear()
 
     def is_loaded(self, pluginclass):

From 5f16b3632e9f7249b53d059ccbdf384578592cfa Mon Sep 17 00:00:00 2001
From: jamcleod <Jordan.McLeod@ll.mit.edu>
Date: Thu, 18 Nov 2021 16:25:02 -0500
Subject: [PATCH 007/140] Fix webserver for snake_hook

---
 panda/plugins/snake_hook/src/loader.rs       | 9 +++++++++
 panda/python/core/pandare/pypluginmanager.py | 4 ++++
 2 files changed, 13 insertions(+)

diff --git a/panda/plugins/snake_hook/src/loader.rs b/panda/plugins/snake_hook/src/loader.rs
index 93e8f4f20bb..5ecc5e6e939 100644
--- a/panda/plugins/snake_hook/src/loader.rs
+++ b/panda/plugins/snake_hook/src/loader.rs
@@ -119,6 +119,15 @@ pub(crate) fn initialize_pyplugins(args: Args) {
         .unwrap();
     };
 
+    if use_flask {
+        let panda_obj = &panda_obj;
+        context.run(python! {
+            'panda_obj.pyplugins.serve()
+        });
+
+        println!("[snake_hook] flask server has started up");
+    }
+
     // hold onto the Panda object to allow for deleting callbacks on uninit
     PANDA_OBJ.set(panda_obj).unwrap();
 }
diff --git a/panda/python/core/pandare/pypluginmanager.py b/panda/python/core/pandare/pypluginmanager.py
index 7c2c08b6d8c..bf7de729933 100644
--- a/panda/python/core/pandare/pypluginmanager.py
+++ b/panda/python/core/pandare/pypluginmanager.py
@@ -175,6 +175,10 @@ def load(self, pluginclasses, args=None, template_dir=None):
             if not isinstance(pluginclass, type) or not issubclass(pluginclass, PyPlugin):
                 raise ValueError(f"pluginclass must be an uninstantiated subclass of PyPlugin")
 
+            # If PyPlugin is in scope it should not be treated as a plugin
+            if pluginclass is PyPlugin:
+                continue
+
             name = pluginclass.__name__
 
             self.plugins[name] = pluginclass.__new__(pluginclass)

From cf5c85a20a6cfa0805c2942a9dc2062abb9feb8e Mon Sep 17 00:00:00 2001
From: ryandmaggio <31520162+ryandmaggio@users.noreply.github.com>
Date: Fri, 19 Nov 2021 10:49:25 -0500
Subject: [PATCH 008/140] Merge pull request #1132 from ryandmaggio/dev

Expose OSI's get_file_struct_ptr
---
 panda/plugins/osi_linux/osi_linux.cpp       | 9 +++++++++
 panda/plugins/osi_linux/osi_linux_int_fns.h | 2 ++
 2 files changed, 11 insertions(+)

diff --git a/panda/plugins/osi_linux/osi_linux.cpp b/panda/plugins/osi_linux/osi_linux.cpp
index f3fe2ca56a8..3c8c27d2804 100644
--- a/panda/plugins/osi_linux/osi_linux.cpp
+++ b/panda/plugins/osi_linux/osi_linux.cpp
@@ -558,6 +558,15 @@ char *osi_linux_fd_to_filename(CPUState *env, OsiProc *p, int fd) {
 }
 
 
+target_ptr_t ext_get_file_dentry(CPUState *env, target_ptr_t file_struct) {
+	return get_file_dentry(env, file_struct);
+} 
+
+target_ptr_t ext_get_file_struct_ptr(CPUState *env, target_ptr_t task_struct, int fd) {
+	return get_file_struct_ptr(env, task_struct, fd);
+}
+
+
 unsigned long long  osi_linux_fd_to_pos(CPUState *env, OsiProc *p, int fd) {
     //    target_ulong asid = panda_current_asid(env);
     target_ptr_t ts_current = 0;
diff --git a/panda/plugins/osi_linux/osi_linux_int_fns.h b/panda/plugins/osi_linux/osi_linux_int_fns.h
index 0f241e9e047..780b3510dba 100644
--- a/panda/plugins/osi_linux/osi_linux_int_fns.h
+++ b/panda/plugins/osi_linux/osi_linux_int_fns.h
@@ -16,6 +16,8 @@ char *osi_linux_fd_to_filename(CPUState *env, OsiProc *p, int fd);
 // returns pos in a file 
 unsigned long long osi_linux_fd_to_pos(CPUState *env, OsiProc *p, int fd);
 
+target_ptr_t ext_get_file_struct_ptr(CPUState *env, target_ptr_t task_struct, int fd);
+target_ptr_t ext_get_file_dentry(CPUState *env, target_ptr_t file_struct);
 // END_PYPANDA_NEEDS_THIS -- do not delete this comment!
 
 /* vim:set tabstop=4 softtabstop=4 expandtab: */

From 0e04ebdba7250f6a148d7a89eb85e5cab8438f1a Mon Sep 17 00:00:00 2001
From: jamcleod <Jordan.McLeod@ll.mit.edu>
Date: Fri, 19 Nov 2021 13:00:47 -0500
Subject: [PATCH 009/140] Make snake_hook flask plugin links relative

---
 .gitignore                                   | 1 +
 panda/python/core/pandare/pypluginmanager.py | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/.gitignore b/.gitignore
index c42a5c80359..4bf6bdb67ba 100644
--- a/.gitignore
+++ b/.gitignore
@@ -113,6 +113,7 @@ venv
 /docs/qemu-qmp-ref.txt
 /docs/version.texi
 /panda/plugins/*/docs/
+**/target
 *.tps
 .stgit-*
 .git-submodule-status
diff --git a/panda/python/core/pandare/pypluginmanager.py b/panda/python/core/pandare/pypluginmanager.py
index bf7de729933..d02e650030a 100644
--- a/panda/python/core/pandare/pypluginmanager.py
+++ b/panda/python/core/pandare/pypluginmanager.py
@@ -268,7 +268,7 @@ def _do_serve(self):
         @self.app.route("/")
         def index():
             return "PANDA PyPlugin web interface. Available plugins:" + "<br\>".join( \
-                    [f"<li><a href='/{name}'>{name}</a></li>" \
+                    [f"<li><a href='./{name}'>{name}</a></li>" \
                             for name in self.plugins.keys() \
                             if hasattr(self.plugins[name], 'flask')])
 

From a41492db26a356b069f7570826c94ece849efeb3 Mon Sep 17 00:00:00 2001
From: Andrew Fasano <fasano@mit.edu>
Date: Tue, 30 Nov 2021 11:19:48 -0500
Subject: [PATCH 010/140] Documentation bugfix for pyplugins

---
 panda/docs/pyplugins.md | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/panda/docs/pyplugins.md b/panda/docs/pyplugins.md
index 42d786b8520..ad416bdba51 100644
--- a/panda/docs/pyplugins.md
+++ b/panda/docs/pyplugins.md
@@ -117,7 +117,7 @@ class Server(PyPlugin):
       self.counter = 0
 
     @PyPlugin.ppp_export
-    def do_add(x):
+    def do_add(self, x):
         self.counter += x
         return self.counter
 
@@ -128,6 +128,8 @@ class Consumer(PyPlugin):
     def __init__(self, panda):
         print(f"Calling Server's do_add(1): ", self.ppp.Server.do_add(1))
   ```
+  
+The `Server.do_add` function could also be called directly from outside of a PyPlugin throught the panda object's pyplugin.ppp interface: e.g., `panda.pyplugins.ppp.Server.do_add(1)`.
 
 # Example Usage:
 

From 99de4e6947851e217554af4e5d0be835f318fb76 Mon Sep 17 00:00:00 2001
From: Andrew Fasano <fasano@mit.edu>
Date: Tue, 30 Nov 2021 19:21:50 -0500
Subject: [PATCH 011/140] Minor pyplugin bugfixes: doc links, only call
 webserver_init if it's callable

---
 panda/docs/pyplugins.md                      | 6 +++---
 panda/python/core/pandare/pypluginmanager.py | 3 ++-
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/panda/docs/pyplugins.md b/panda/docs/pyplugins.md
index ad416bdba51..81245f7d8ce 100644
--- a/panda/docs/pyplugins.md
+++ b/panda/docs/pyplugins.md
@@ -8,7 +8,7 @@ From there, you can add hooks and declare initial state for your plugin. An `uni
 
 ## Relevant API Docs
 
-PyPlugin class which PyPlugins should subclass: [auto generated documentation](https://docs.panda.re/panda_plugin.html).
+PyPlugin class which PyPlugins should subclass: [auto generated documentation](https://docs.panda.re/pyplugin.html).
 * `class PyPlugin`:
   * `get_arg(name)` - returns either the argument value as a string or `None` if the argument is not present
   * `get_arg_bool(name)` - returns `True` if the argument is present and truthy.
@@ -20,7 +20,7 @@ PyPlugin class which PyPlugins should subclass: [auto generated documentation](h
   * `ppp.TargetPlugin.ppp_reg_cb('ppp_cb_name', self.my_func)`: Register the local function `self.my_func` with the PyPlugin `TargetPlugin`'s `ppp_cb_name` ppp-style callback. Note that the target plugin must have previously been loaded.
   * `ppp.TargetPlugin.some_function(*args)`: Call the ppp-exported `some_function` defined in `TargetPlugin`. Note that the target plugin must have previously been loaded.
 
-PyPluginManager: Interface to load/unload PyPlugins with an instance of the `pandare` class, accessable via the `.pyplugin` field of a panda object: [documentation](https://docs.panda.re/pyplugin.html#pandare.PyPluginManager).
+PyPluginManager: Interface to load/unload PyPlugins with an instance of the `pandare` class, accessable via the `.pyplugin` field of a panda object: [documentation](https://docs.panda.re/pypluginmanager.html).
 
 # Example Plugins
 
@@ -41,7 +41,7 @@ class TestPlugin(PyPlugin):
         print("Uninitialized test plugin")
 ```
 
-## Basic block counter
+## Basic block counter with webserver
 ```python
 from pandare import PyPlugin
 
diff --git a/panda/python/core/pandare/pypluginmanager.py b/panda/python/core/pandare/pypluginmanager.py
index d02e650030a..e003fc28714 100644
--- a/panda/python/core/pandare/pypluginmanager.py
+++ b/panda/python/core/pandare/pypluginmanager.py
@@ -187,7 +187,8 @@ def load(self, pluginclasses, args=None, template_dir=None):
             self.get_ppp_funcs(self.plugins[name])
 
             # Setup webserver if necessary
-            if self.flask:
+            if self.flask and hasattr(self.plugins[name], 'webserver_init') and \
+                    callable(self.plugins[name].webserver_init):
                 self.plugins[name].flask = self.app
 
                 # If no template_dir was provided, try using ./templates in the dir of the plugin

From 3ee4695a737eb7c2689256814b4673bd92efc896 Mon Sep 17 00:00:00 2001
From: Mark Mankins <Mark.Mankins@ngc.com>
Date: Fri, 3 Dec 2021 08:22:22 -0500
Subject: [PATCH 012/140] Update hexrays_ida_taint2.py so that it can process
 newer format ida taint2 csv files that contain metadata before the csv
 header.

---
 panda/plugins/ida_taint2/hexrays_ida_taint2.py | 17 ++++++++++++++---
 1 file changed, 14 insertions(+), 3 deletions(-)

diff --git a/panda/plugins/ida_taint2/hexrays_ida_taint2.py b/panda/plugins/ida_taint2/hexrays_ida_taint2.py
index 2f141d728fa..f78ebb1f6c8 100644
--- a/panda/plugins/ida_taint2/hexrays_ida_taint2.py
+++ b/panda/plugins/ida_taint2/hexrays_ida_taint2.py
@@ -196,7 +196,17 @@ def color_eas(self, cfunc, tainted_pcs):
                                 if (address in tainted_pcs):
                                     sv[i].bgcolor = INST_COLOR
                     curline = curline[skipcode_index:]
-        
+
+    def skip_csv_header(self, reader, show_metadata):
+        # newer ida_taint2 output files have some metadata before the header
+        line1 = next(reader, None)
+        if (line1[0].startswith("PANDA Build Date")):
+            exec_time = next(reader, None)
+            if (show_metadata):
+                idaapi.msg(line1[0] + ":  " + line1[1] + "\n")
+                idaapi.msg(exec_time[0] + ":  " + exec_time[1] + "\n")
+            next(reader, None)
+
     def color_pseudocode(self, widget, clear_old):
         global filename
         global selected_pid
@@ -222,7 +232,8 @@ def color_pseudocode(self, widget, clear_old):
             processes = set()
             input_file = open(filename, "r")
             reader = csv.reader(input_file)
-            next(reader, None)
+            self.skip_csv_header(reader, True)
+
             for row in reader:
                 processes.add((row[0], int(row[1])))
             input_file.close()
@@ -236,7 +247,7 @@ def color_pseudocode(self, widget, clear_old):
             reader = csv.reader(input_file)
             tainted_pcs = set()
             # skip header
-            next(reader, None)
+            self.skip_csv_header(reader, True)
             for row in reader:
                 pid = int(row[1])
                 pc = int(row[2], 16)

From 98bb5cf85ac01f4f68889eef81211b7f307ecf08 Mon Sep 17 00:00:00 2001
From: Andrew Fasano <fasano@mit.edu>
Date: Tue, 7 Dec 2021 10:43:15 -0500
Subject: [PATCH 013/140] callstack_instr: runtime test for capstone version +
 fix in container

---
 Dockerfile                                        | 5 +++--
 panda/dependencies/ubuntu:20.04_build.txt         | 2 +-
 panda/plugins/callstack_instr/callstack_instr.cpp | 9 +++++----
 3 files changed, 9 insertions(+), 7 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 926babd76c1..1b6ded13dab 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -26,13 +26,14 @@ RUN [ -e /tmp/${BASE_IMAGE}_build.txt ] && \
     apt-get clean && \
     python3 -m pip install --upgrade --no-cache-dir pip && \
     python3 -m pip install --upgrade --no-cache-dir "cffi>1.14.3" && \
+    python3 -m pip install --upgrade --no-cache-dir "capstone" && \
     curl https://sh.rustup.rs -sSf | sh -s -- -y --profile minimal
 
 # Then install capstone from source
 RUN cd /tmp && \
     curl -o cap.tgz -L https://github.com/aquynh/capstone/archive/4.0.2.tar.gz && \
     tar xvf cap.tgz && cd capstone-4.0.2/ && ./make.sh && make install && cd /tmp && \
-    rm -rf /tmp/capstone-4.0.2
+    rm -rf /tmp/capstone-4.0.2 && ldconfig
 
 ENV PATH="/root/.cargo/bin:${PATH}"
 
@@ -76,7 +77,7 @@ FROM base as panda
 
 # Copy panda + libcapstone.so*
 COPY --from=installer /usr/local /usr/local
-COPY --from=installer /lib/x86_64-linux-gnu/libcapstone* /lib/x86_64-linux-gnu/
+COPY --from=installer /usr/lib/libcapstone* /usr/lib/
 
 # Workaround issue #901 - ensure LD_LIBRARY_PATH contains the panda plugins directories
 #ARG TARGET_LIST="x86_64-softmmu,i386-softmmu,arm-softmmu,ppc-softmmu,mips-softmmu,mipsel-softmmu"
diff --git a/panda/dependencies/ubuntu:20.04_build.txt b/panda/dependencies/ubuntu:20.04_build.txt
index e9588bdab3f..c9bd9e14bbf 100644
--- a/panda/dependencies/ubuntu:20.04_build.txt
+++ b/panda/dependencies/ubuntu:20.04_build.txt
@@ -7,11 +7,11 @@ lsb-core
 zip
 
 # panda build deps
+# Note libcapstone-dev is required, but we need v4 + which isn't in apt
 build-essential
 chrpath
 clang-11
 gcc
-libcapstone-dev
 libdwarf-dev
 libprotoc-dev
 llvm-11-dev
diff --git a/panda/plugins/callstack_instr/callstack_instr.cpp b/panda/plugins/callstack_instr/callstack_instr.cpp
index 1b61b968d2c..743b175aea0 100644
--- a/panda/plugins/callstack_instr/callstack_instr.cpp
+++ b/panda/plugins/callstack_instr/callstack_instr.cpp
@@ -527,10 +527,11 @@ bool init_plugin(void *self) {
     if (cs_open(CS_ARCH_ARM, CS_MODE_ARM, &cs_handle_32) != CS_ERR_OK)
         return false;
 
-#if CS_VERSION_MAJOR < 4
-        printf("\n[ERROR] Capstone versions prior to 4.0.1 are unusable with ARM so callstack instr will fail! Please upgrade your libcapstone install to use this plugin\n\n");
-        return false;
-#endif
+    // Run-time check
+    if (cs_version < CS_MAKE_VERSION(4, 0)) {
+      printf("\n[ERROR] Capstone versions prior to 4.0.1 are unusable with ARM so callstack instr will fail! Please upgrade your libcapstone install and rebuild to use this plugin\n\n");
+      return false;
+    }
 
 
 #elif defined(TARGET_PPC)

From c98f8161a2cc401e38d0d6e1c05dda738758287a Mon Sep 17 00:00:00 2001
From: Luke Craig <lacraig3@gmail.com>
Date: Tue, 7 Dec 2021 13:58:04 -0500
Subject: [PATCH 014/140] Change Before Handle Exception (#1139)

---
 cpu-exec.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/cpu-exec.c b/cpu-exec.c
index 6672f2c6fe5..11e44d13bf9 100644
--- a/cpu-exec.c
+++ b/cpu-exec.c
@@ -523,9 +523,14 @@ static inline bool cpu_handle_exception(CPUState *cpu, int *ret)
             cpu->exception_index = -1;
             return true;
         } else {
+            int32_t exception = cpu->exception_index;
 
             cpu->exception_index = panda_callbacks_before_handle_exception(cpu, cpu->exception_index);
 
+            if (exception != cpu->exception_index){
+                return cpu_handle_exception(cpu, ret);
+            }
+
 #if defined(CONFIG_USER_ONLY)
             /* if user mode only, we simulate a fake exception
                which will be handled outside the cpu execution

From b176dcfdd3f0bd2f49d28572e8eacac68685d931 Mon Sep 17 00:00:00 2001
From: Andrew Fasano <fasano@mit.edu>
Date: Tue, 7 Dec 2021 17:15:35 -0500
Subject: [PATCH 015/140] Add missing registers for pandare.arch.ArmArch
 syscall args

---
 panda/python/core/pandare/arch.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/panda/python/core/pandare/arch.py b/panda/python/core/pandare/arch.py
index 1a2860d3611..771008325e1 100644
--- a/panda/python/core/pandare/arch.py
+++ b/panda/python/core/pandare/arch.py
@@ -258,7 +258,7 @@ def __init__(self, panda):
         self.reg_sp = regnames.index("SP")
         self.reg_retaddr = regnames.index("LR")
         self.call_conventions = {"arm32":         ["R0", "R1", "R2", "R3"],
-                                 "syscall": ["R7", "R0", "R1", "R2", "R3"], # EABI
+                                 "syscall": ["R7", "R0", "R1", "R2", "R3", "R4", "R5"], # EABI
                                  }
         self.call_conventions['default'] = self.call_conventions['arm32']
 

From 21fdb7fda84c28529d3ed2afcc6d74a707f094d2 Mon Sep 17 00:00:00 2001
From: Andrew Fasano <fasano@mit.edu>
Date: Tue, 7 Dec 2021 17:59:43 -0500
Subject: [PATCH 016/140] Minor fixes for pypanda release 0.1.1.5 to pypi

---
 panda/python/core/README.md | 7 +++----
 panda/python/core/setup.py  | 8 ++++----
 2 files changed, 7 insertions(+), 8 deletions(-)

diff --git a/panda/python/core/README.md b/panda/python/core/README.md
index a3116ae0242..246c7ba169b 100644
--- a/panda/python/core/README.md
+++ b/panda/python/core/README.md
@@ -10,10 +10,9 @@ Autogenerated documentation is available at [docs.panda.re](https://docs.panda.r
 
 Installation
 --
-Note the PANDARE package provided on pypi only a binray distribution and will certainly only work on `x86_64` hosts as pre-built PANDA libraries from Ubuntu 18.04 are included.
+Note the PANDARE package provided on pypi only a binary distribution and will certainly only work on `x86_64` hosts as pre-built PANDA libraries from Ubuntu 20.04 are included.
 
-
-Prior to using pandare **you must install some dependencies**:
+Prior to using pandare **you must install some dependencies**, these are fully described in the code's dependencies folder, i.e., [the list for ubuntu:20.04 is here](https://github.com/panda-re/panda/blob/dev/panda/dependencies/ubuntu:20.04_base.txt). On our development systems, we typically find we just need to install:
 ```
 apt install libvdeplug-dev libpng16-16 libsdl2-2.0-0
 ```
@@ -28,7 +27,7 @@ panda = Panda(generic='i386')
 ```
 
 
-This is a beta release
+This is a beta release - Last updated Dec 2021.
 ---
 * Although PANDA is fairly stable, this interface is new and subject to change significantly prior to version 1.0.
 
diff --git a/panda/python/core/setup.py b/panda/python/core/setup.py
index 1bea78e8c6e..602d05d4de9 100644
--- a/panda/python/core/setup.py
+++ b/panda/python/core/setup.py
@@ -54,8 +54,8 @@ def copy_objs():
     # For each arch, copy library, plugins, plog_pb2.py and llvm-helpers
     arches = ['arm', 'aarch64', 'i386', 'x86_64', 'ppc', 'mips', 'mipsel', 'mips64']
     if pypi_build:
-        # XXX need to drop aarch64/mipsel/ppc to fit into pypi
-        arches = ['arm', 'i386', 'x86_64', 'mipsel']
+        # Nobody really wants mips32 anymore, shrink our distribution size by dropping
+        arches = ['arm', 'aarch64', 'i386', 'x86_64', 'ppc', 'mips64']
 
     for arch in arches:
         libname = "libpanda-"+arch+".so"
@@ -126,7 +126,7 @@ def run(self):
             create_datatypes(install=True)
             copy_objs()
         except ImportError:
-            assert(os.path.isfile("pandare/data/pypanda/include/panda_datatypes.h")), \
+            assert(os.path.isfile("pandare/include/panda_datatypes.h")), \
                             "panda_datatypes.h missing and can't be generated"
             assert(os.path.isfile("pandare/autogen/panda_datatypes.py")), \
                             "panda_datatypes.py missing and can't be generated"
@@ -150,7 +150,7 @@ def run(self):
     raise
 
 setup(name='pandare',
-      version='0.1.1.2',
+      version='0.1.1.5',
       description='Python Interface to PANDA',
       long_description=long_description,
       long_description_content_type="text/markdown",

From ab4826388fdd5ce11ae552eed4f6b372311c1c43 Mon Sep 17 00:00:00 2001
From: Andrew Fasano <fasano@mit.edu>
Date: Wed, 8 Dec 2021 15:55:06 -0500
Subject: [PATCH 017/140] CI: test pypanda with flake8 - for now just errors

---
 .github/workflows/parallel_tests.yml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/.github/workflows/parallel_tests.yml b/.github/workflows/parallel_tests.yml
index 4edb7895c01..7555671ab63 100644
--- a/.github/workflows/parallel_tests.yml
+++ b/.github/workflows/parallel_tests.yml
@@ -20,6 +20,12 @@ jobs:
     runs-on: ubuntu-20.04
     steps:
     - uses: actions/checkout@v2 # Clones to $GITHUB_WORKSPACE. NOTE: this requires git > 2.18 (not on ubuntu 18.04 by default) to get .git directory
+    - name: Lint PyPANDA with flake8
+      run: |
+       python -m pip install --upgrade pip
+       python -m pip install flake8
+       python -m flake8 $GITHUB_WORKSPACE/panda/python/core/pandare/ --count --select=E9,F63,F7,F82 --show-source --statistics
+       # python -m flake8 $GITHUB_WORKSPACE/panda/python/core/pandare/ --count --exit-zero --max-complexity=10 --max-line-length=127 --statistics
     - name: Run install_ubuntu.sh
       run: cd $GITHUB_WORKSPACE && ./panda/scripts/install_ubuntu.sh
 

From 6f7d4196c3f002e84236c9e1be35f76c63e60c4f Mon Sep 17 00:00:00 2001
From: Andrew Fasano <fasano@mit.edu>
Date: Wed, 8 Dec 2021 15:55:22 -0500
Subject: [PATCH 018/140] PyPANDA bugfixes identified by flake8

---
 panda/python/core/pandare/asyncthread.py      |  4 +-
 panda/python/core/pandare/panda.py            |  4 +-
 .../core/pandare/volatility_cli_classes.py    | 38 +++++++++----------
 3 files changed, 23 insertions(+), 23 deletions(-)

diff --git a/panda/python/core/pandare/asyncthread.py b/panda/python/core/pandare/asyncthread.py
index 196c9b203f5..dcf6fc84158 100644
--- a/panda/python/core/pandare/asyncthread.py
+++ b/panda/python/core/pandare/asyncthread.py
@@ -169,9 +169,9 @@ def slow_func():
         print("Main slow_func sleeping")
         sleep(10)
         print("Main done")
-    hang_func.__blocking__ = "placeholder" # Hack to pretend it's decorated
+    slow_func.__blocking__ = "placeholder" # Hack to pretend it's decorated
 
-    b.queue(hang_func)
+    b.queue(slow_func)
 
     # Make sure we have time to run both fns
     started.set()
diff --git a/panda/python/core/pandare/panda.py b/panda/python/core/pandare/panda.py
index e3dea00a62f..bfe7f0b90b7 100755
--- a/panda/python/core/pandare/panda.py
+++ b/panda/python/core/pandare/panda.py
@@ -1373,7 +1373,7 @@ def sysbus_create_varargs(self, name, addr):
         Returns:
             DeviceState struct
         '''
-        return self.libpanda.sysbus_create_varargs(name,addr,ffi.NULL)
+        return self.libpanda.sysbus_create_varargs(name,addr, self.ffi.NULL)
 
     def cpu_class_by_name(self, name, cpu_model):
         '''
@@ -1531,7 +1531,7 @@ def object_property_find(self, obj, name):
         Returns:
             struct ObjectProperty pointer
         '''
-        return self.libpanda.object_property_find(obj,name,ffi.NULL)
+        return self.libpanda.object_property_find(obj,name, self.ffi.NULL)
 
     def memory_region_allocate_system_memory(self, mr, obj, name, ram_size):
         '''
diff --git a/panda/python/core/pandare/volatility_cli_classes.py b/panda/python/core/pandare/volatility_cli_classes.py
index 4a7efbce5d3..f86926603d5 100644
--- a/panda/python/core/pandare/volatility_cli_classes.py
+++ b/panda/python/core/pandare/volatility_cli_classes.py
@@ -75,15 +75,15 @@ def __init__(self):
 
     def run(self):
         # we aren't really doing logging, but you can change these numbers to get more details
-        vollog = logging.getLogger(__name__)
-        vollog = logging.getLogger()
-       # vollog.setLevel(1000)
+        self.vollog = logging.getLogger(__name__)
+        self.vollog = logging.getLogger()
+       # self.vollog.setLevel(1000)
         console = logging.StreamHandler()
         #console.setLevel(logging.WARNING)
         formatter = logging.Formatter(
             '%(levelname)-8s %(name)-12s: %(message)s')
         console.setFormatter(formatter)
-        vollog.addHandler(console)
+        self.vollog.addHandler(console)
         volatility.framework.require_interface_version(1, 0, 0)
         # also change here for log level
         #console.setLevel(1000)
@@ -127,25 +127,25 @@ def __init__(self):
     def run(self, argstring):
         # Make sure we log everything
 
-        vollog = logging.getLogger()
-        #vollog.setLevel(1)
+        self.vollog = logging.getLogger()
+        #self.vollog.setLevel(1)
         # Trim the console down by default
         console = logging.StreamHandler()
         #console.setLevel(logging.FATAL)
         formatter = logging.Formatter(
             '%(levelname)-8s %(name)-12s: %(message)s')
         console.setFormatter(formatter)
-        vollog.addHandler(console)
+        self.vollog.addHandler(console)
         # Make sure we log everything
-        vollog = logging.getLogger()
-        #vollog.setLevel(1)
+        self.vollog = logging.getLogger()
+        #self.vollog.setLevel(1)
         # Trim the console down by default
         console = logging.StreamHandler()
         #console.setLevel(logging.WARNING)
         formatter = logging.Formatter(
             '%(levelname)-8s %(name)-12s: %(message)s')
         console.setFormatter(formatter)
-        vollog.addHandler(console)
+        self.vollog.addHandler(console)
         arg_arr = shlex.split(argstring)
         """Executes the command line module, taking the system arguments,
             determining the plugin to run and then running it."""
@@ -238,17 +238,17 @@ def run(self, argstring):
             file_formatter = logging.Formatter(datefmt='%y-%m-%d %H:%M:%S',
                                                fmt='%(asctime)s %(name)-12s %(levelname)-8s %(message)s')
             file_logger.setFormatter(file_formatter)
-            vollog.addHandler(file_logger)
-            vollog.info("Logging started")
+            self.vollog.addHandler(file_logger)
+            self.vollog.info("Logging started")
         if partial_args.verbosity < 3:
             console.setLevel(30 - (partial_args.verbosity * 10))
         else:
             console.setLevel(10 - (partial_args.verbosity - 2))
         #console.setLevel(0)
 
-        vollog.info("Volatility plugins path: {}".format(
+        self.vollog.info("Volatility plugins path: {}".format(
             volatility.plugins.__path__))
-        vollog.info("Volatility symbols path: {}".format(
+        self.vollog.info("Volatility symbols path: {}".format(
             volatility.symbols.__path__))
 
         # Set the PARALLELISM
@@ -266,7 +266,7 @@ def run(self, argstring):
         if failures:
             parser.epilog = "The following plugins could not be loaded (use -vv to see why): " + \
                 ", ".join(sorted(failures))
-            vollog.info(parser.epilog)
+            self.vollog.info(parser.epilog)
         automagics = automagic.available(ctx)
 
         plugin_list = framework.list_plugins()
@@ -302,7 +302,7 @@ def run(self, argstring):
         if args.plugin is None:
             parser.error("Please select a plugin to run")
 
-        vollog.log(constants.LOGLEVEL_VVV,
+        self.vollog.log(constants.LOGLEVEL_VVV,
                    "Cache directory used: {}".format(constants.CACHE_PATH))
 
         plugin = plugin_list[args.plugin]
@@ -357,7 +357,7 @@ def run(self, argstring):
         #	return (ctx, automagics, plugin, base_config_path, progress_callback, self)
 
             if args.write_config:
-                vollog.debug("Writing out configuration data to config.json")
+                self.vollog.debug("Writing out configuration data to config.json")
                 with open("config.json", "w") as f:
                     json.dump(dict(constructed.build_configuration()),
                               f, sort_keys=True, indent=2)
@@ -451,10 +451,10 @@ def consume_file(self, filedata: interfaces.plugins.FileInterface):
         if not os.path.exists(output_filename):
             with open(output_filename, "wb") as current_file:
                 current_file.write(filedata.data.getvalue())
-                vollog.log(
+                self.vollog.log(
                     logging.INFO, "Saved stored plugin file: {}".format(output_filename))
         else:
-            vollog.warning(
+            self.vollog.warning(
                 "Refusing to overwrite an existing file: {}".format(output_filename))
 
     def populate_requirements_argparse(self, parser: Union[argparse.ArgumentParser, argparse._ArgumentGroup],

From 9705a142507aa95add605fe9e5949adb5614cc3f Mon Sep 17 00:00:00 2001
From: Andrew Fasano <fasano@mit.edu>
Date: Thu, 18 Nov 2021 09:26:50 -0500
Subject: [PATCH 019/140] Add scgen helper to convert syscalls2 prototypes to
 json

---
 panda/scripts/scgen.py | 63 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 63 insertions(+)
 create mode 100644 panda/scripts/scgen.py

diff --git a/panda/scripts/scgen.py b/panda/scripts/scgen.py
new file mode 100644
index 00000000000..bf94289cf76
--- /dev/null
+++ b/panda/scripts/scgen.py
@@ -0,0 +1,63 @@
+#!/usr/bin/env python3
+
+'''
+Reformat the syscalls2 prototypes to a mapping from callno to syscall name
+and store the results in syscalls.json in the following format:
+    {
+        'linux_arm':
+            {
+              '0': 'some_syscall',
+              '1': 'another_syscall'
+            },
+        'linux_mips':
+            {
+              ...
+            }
+    }
+
+Unfortunately syscall number keys are stored as strings
+'''
+
+
+import glob
+import json
+from os import path
+
+base = path.join(path.dirname(__file__), "../plugins/syscalls2/generated-in/")
+
+def gen_syscalls(os_arch):
+    syscalls = {}
+    num_sc = {}
+
+    fname = f"{os_arch}_prototypes.txt"
+    target = path.join(base, fname)
+    if not path.isfile(target):
+        raise ValueError(f"Unsupported os_arch: {os_arch} - could not find {target}")
+
+    with open(target) as f:
+        for line in f.readlines():
+            if not len(line):
+                continue
+
+            # num type name(args
+            try:
+                sys_no = int(line.split(" ")[0])
+            except:
+                continue
+            sys_name = line.split(" ")[2].split("(")[0]
+
+            sys_name = sys_name.replace("sys_", "")
+            if sys_name.startswith("do_"):
+                sys_name.replace("do_", "")
+            syscalls[sys_name] = sys_no
+            num_sc[sys_no] = sys_name
+
+    #return syscalls
+    return num_sc
+
+if __name__ == '__main__':
+    results = {}
+    for arch in ['linux_arm', 'linux_mips', 'linux_x64', 'linux_x86']:
+        results[arch] = gen_syscalls(arch)
+    with open("syscalls.json", 'w') as f:
+        json.dump(results, f)

From 5f412753bf7a98058a015da6cc586faaa7c53e3b Mon Sep 17 00:00:00 2001
From: Andrew Fasano <fasano@mit.edu>
Date: Mon, 29 Nov 2021 16:00:35 -0500
Subject: [PATCH 020/140] PyPlugin: improve error handling

---
 panda/python/core/pandare/pypluginmanager.py | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/panda/python/core/pandare/pypluginmanager.py b/panda/python/core/pandare/pypluginmanager.py
index e003fc28714..b425ce600bf 100644
--- a/panda/python/core/pandare/pypluginmanager.py
+++ b/panda/python/core/pandare/pypluginmanager.py
@@ -212,6 +212,10 @@ def load_all(self, plugin_file, args=None, template_dir=None):
         '''
         import inspect, importlib
         spec = importlib.util.spec_from_file_location("plugin_file", plugin_file)
+        if spec is None:
+            # Likely an invalid path
+            raise ValueError(f"Unable to load {plugin_file}")
+
         module = importlib.util.module_from_spec(spec)
         spec.loader.exec_module(module)
 

From 14c32d99a1cc9c0451034d6240f622260976198f Mon Sep 17 00:00:00 2001
From: Andrew Fasano <fasano@mit.edu>
Date: Sat, 27 Nov 2021 12:24:26 -0500
Subject: [PATCH 021/140] pandare.arch: support mix of register and stack based
 args

---
 panda/python/core/pandare/arch.py | 63 +++++++++++++++++++++----------
 1 file changed, 44 insertions(+), 19 deletions(-)

diff --git a/panda/python/core/pandare/arch.py b/panda/python/core/pandare/arch.py
index 771008325e1..5e56f60b167 100644
--- a/panda/python/core/pandare/arch.py
+++ b/panda/python/core/pandare/arch.py
@@ -114,7 +114,7 @@ def get_pc(self, cpu):
         else:
             raise RuntimeError(f"get_pc unsupported for {self.panda.arch_name}")
 
-    def _get_arg_reg(self, idx, convention):
+    def _get_arg_loc(self, idx, convention):
         '''
         return the name of the argument [idx] for the given arch with calling [convention]
         '''
@@ -137,7 +137,7 @@ def set_arg(self, cpu, idx, val, convention='default'):
 
         Note for syscalls we define arg[0] as syscall number and then 1-index the actual args
         '''
-        reg = self._get_arg_reg(idx, convention)
+        reg = self._get_arg_loc(idx, convention)
         return self.set_reg(cpu, reg, val)
 
     def get_arg(self, cpu, idx, convention='default'):
@@ -145,15 +145,47 @@ def get_arg(self, cpu, idx, convention='default'):
         Return arg [idx] for given calling convention. This only works right as the guest
         is calling or has called a function before register values are clobbered.
 
+        If arg[idx] should be stack-based, name it stack_0, stack_1... this allows mixed
+        conventions where some args are in registers and others are on the stack (i.e.,
+        mips32 syscalls).
+
+        When doing a stack-based read, this function may raise a ValueError if the memory
+        read fails (i.e., paged out, invalid address).
+
         Note for syscalls we define arg[0] as syscall number and then 1-index the actual args
         '''
         
-        # i386 is stack based and so the convention wont work
-        if self.call_conventions[convention] == "stack":
-            return self.get_arg_stack(cpu, idx)
-        reg = self._get_arg_reg(idx, convention)
-        return self.get_reg(cpu, reg)
+        argloc = self._get_arg_loc(idx, convention)
+
+        if self._is_stack_loc(argloc):
+            return self._read_stack(cpu, argloc)
+        else:
+            return self.get_reg(cpu, argloc)
+
+    @staticmethod
+    def _is_stack_loc(argloc):
+        '''
+        Given a name returned by self._get_arg_loc
+        check if it's the name of a stack offset
+        '''
+        return argloc.startswith("stack_")
 
+    def _read_stack(self, cpu, argloc):
+        '''
+        Given a name like stack_X, calculate where
+        the X-th value on the stack is, then read it out of
+        memory and return it.
+
+        May raise a ValueError if the memory read fails
+        '''
+        # Stack based - get stack base, calculate offset, then try to read it
+        assert(self._is_stack_loc(argloc)), f"Can't get stack offset of {argloc}"
+
+        stack_idx = int(argloc.split("stack_")[1])
+        stack_base = self.get_reg(cpu, self.reg_sp)
+        arg_sz = self.panda.bits // 8
+        offset = arg_sz * (stack_idx+1)
+        return self.panda.virtual_memory_read(cpu, stack_base + offset, arg_sz, fmt='int')
 
     def set_retval(self, cpu, val, convention='default', failure=False):
         '''
@@ -362,7 +394,7 @@ def get_return_address(self, cpu):
 
 class MipsArch(PandaArch):
     '''
-    Register names and accessors for MIPS
+    Register names and accessors for MIPS. Handles 32el, 32eb, and mips64
     '''
 
     # Registers are:
@@ -391,8 +423,9 @@ def __init__(self, panda):
 
         self.reg_sp = regnames.index('sp')
         self.reg_retaddr = regnames.index("ra")
+        # Default syscall/args are for mips o32
         self.call_conventions = {"mips":          ["A0", "A1", "A2", "A3"],
-                                 "syscall": ["V0", "A0", "A1", "A2", "A3"]}
+                                 "syscall": ["V0", "A0", "A1", "A2", "A3", "stack_1", "stack_2", "stack_3", "stack_4"]}
         self.call_conventions['default'] = self.call_conventions['mips']
 
         self.reg_retval =  {"default":    "V0",
@@ -496,9 +529,9 @@ def __init__(self, panda):
         self.reg_retval = {"default":    "EAX",
                            "syscall":    "EAX"}
         
-        self.call_conventions = {"stack": "stack",
+        self.call_conventions = {"cdecl": ["stack_{x}" for x in range(20)], # 20: arbitrary but big
                                  "syscall": ["EAX", "EBX", "ECX", "EDX", "ESI", "EDI", "EBP"]}
-        self.call_conventions['default'] = self.call_conventions['stack']
+        self.call_conventions['default'] = self.call_conventions['cdecl']
 
         self.reg_sp = regnames.index('ESP')
         self.registers = {regnames[idx]: idx for idx in range(len(regnames)) }
@@ -541,14 +574,6 @@ def get_return_address(self,cpu):
         esp = self.get_reg(cpu,"ESP")
         return self.panda.virtual_memory_read(cpu,esp,4,fmt='int')
     
-    # we need this because X86 is stack based
-    def get_arg_stack(self, cpu, num, kernel=False):
-        '''
-        Gets arguments based on the number. Supports kernel and usermode.
-        '''
-        esp = self.get_reg(cpu, "ESP")
-        return self.panda.virtual_memory_read(cpu, esp+(4*(num+1)),4,fmt='int')
-
 class X86_64Arch(PandaArch):
     '''
     Register names and accessors for x86_64

From ce8c08a8a03b45cc85de07fb6a662f3bc53f061b Mon Sep 17 00:00:00 2001
From: Andrew Fasano <fasano@mit.edu>
Date: Sat, 27 Nov 2021 12:27:49 -0500
Subject: [PATCH 022/140] Bugfix: typo in pandare.arch.MipsArch.get_call_return

---
 panda/python/core/pandare/arch.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/panda/python/core/pandare/arch.py b/panda/python/core/pandare/arch.py
index 5e56f60b167..fd0cae1580e 100644
--- a/panda/python/core/pandare/arch.py
+++ b/panda/python/core/pandare/arch.py
@@ -485,7 +485,7 @@ def get_call_return(self, cpu):
         '''
         .. Deprecated:: use get_return_address
         '''
-        return self.get_return_addess(cpu)
+        return self.get_return_address(cpu)
 
     def get_return_address(self,cpu):
         '''

From b1cbebc994a1350f25c4697c2f500705e6d5fea1 Mon Sep 17 00:00:00 2001
From: Andrew Fasano <fasano@mit.edu>
Date: Mon, 29 Nov 2021 16:01:26 -0500
Subject: [PATCH 023/140] pandare.arch support mips64

---
 panda/python/core/pandare/arch.py  | 29 ++++++++++++++++++++++++++++-
 panda/python/core/pandare/panda.py |  4 ++--
 2 files changed, 30 insertions(+), 3 deletions(-)

diff --git a/panda/python/core/pandare/arch.py b/panda/python/core/pandare/arch.py
index fd0cae1580e..ad3563fa063 100644
--- a/panda/python/core/pandare/arch.py
+++ b/panda/python/core/pandare/arch.py
@@ -394,7 +394,7 @@ def get_return_address(self, cpu):
 
 class MipsArch(PandaArch):
     '''
-    Register names and accessors for MIPS. Handles 32el, 32eb, and mips64
+    Register names and accessors for 32-bit MIPS
     '''
 
     # Registers are:
@@ -514,6 +514,33 @@ def set_retval(self, cpu, val, convention='default', failure=False):
 
         return super().set_retval(cpu, val, convention)
 
+class Mips64Arch(MipsArch):
+    '''
+    Register names and accessors for MIPS64. Inherits from MipsArch for everything
+    except the register name and call conventions.
+    '''
+
+    def __init__(self, panda):
+        super().__init__(panda)
+        regnames = ["zero", "at",   "v0",   "v1",   "a0",   "a1",   "a2",   "a3",
+                    "a4",   "a5",   "a6",   "a7",   "t0",   "t1",   "t2",   "t3",
+                    "s0",   "s1",   "s2",   "s3",   "s4",   "s5",   "s6",   "s7",
+                    "t8",   "t9",   "k0",   "k1",   "gp",   "sp",   "s8",   "ra"]
+
+        self.reg_sp = regnames.index('sp')
+        self.reg_retaddr = regnames.index("ra")
+        # Default syscall/args are for mips 64/n32 - note the registers are different than 32
+        self.call_conventions = {"mips":          ["A0", "A1", "A2", "A3"], # XXX Unsure?
+                                 "syscall": ["V0", "A0", "A1", "A2", "A3", "A4", "A5"]}
+        self.call_conventions['default'] = self.call_conventions['mips']
+
+        self.reg_retval =  {"default":    "V0",
+                            "syscall":    'V0'}
+
+
+        # note names must be stored uppercase for get/set reg to work case-insensitively
+        self.registers = {regnames[idx].upper(): idx for idx in range(len(regnames)) }
+
 class X86Arch(PandaArch):
     '''
     Register names and accessors for x86
diff --git a/panda/python/core/pandare/panda.py b/panda/python/core/pandare/panda.py
index bfe7f0b90b7..93ea3d72952 100755
--- a/panda/python/core/pandare/panda.py
+++ b/panda/python/core/pandare/panda.py
@@ -37,7 +37,7 @@
 from .panda_expect import Expect
 from .asyncthread import AsyncThread
 from .qcows import Qcows
-from .arch import ArmArch, Aarch64Arch, MipsArch, X86Arch, X86_64Arch
+from .arch import ArmArch, Aarch64Arch, MipsArch, Mips64Arch, X86Arch, X86_64Arch
 
 # Might be worth importing and auto-initilizing a PLogReader
 # object within Panda for the current architecture?
@@ -139,7 +139,7 @@ def __init__(self, arch="i386", mem="128M",
         elif self.arch_name in ["mips", "mipsel"]:
             self.arch = MipsArch(self)
         elif self.arch_name in ["mips64"]:
-            self.arch = MipsArch(self) # XXX: We probably need a different class?
+            self.arch = Mips64Arch(self)
         else:
             raise ValueError(f"Unsupported architecture {self.arch_name}")
         self.bits, self.endianness, self.register_size = self.arch._determine_bits()

From d4c6508d0b0e39bec20b32429cbdfa9836ded2fe Mon Sep 17 00:00:00 2001
From: Luke Craig <lacraig3@gmail.com>
Date: Thu, 16 Dec 2021 14:43:02 -0500
Subject: [PATCH 024/140] double return for syscalls2 (#1146)

---
 .../generated-in/context_target.json          |  16 +-
 .../generated-tpl/syscall_switch_enter.tpl    |   2 +
 .../generated-tpl/syscalls_ext_typedefs.tpl   |   1 +
 .../syscalls2/generated/dso_info_linux_mips.c |   2 +-
 .../syscall_switch_enter_freebsd_x64.cpp      | 455 ++++++++++++++++++
 .../syscall_switch_enter_linux_arm.cpp        | 356 ++++++++++++++
 .../syscall_switch_enter_linux_arm64.cpp      | 284 +++++++++++
 .../syscall_switch_enter_linux_mips.cpp       | 396 ++++++++++++++-
 .../syscall_switch_enter_linux_x64.cpp        | 319 ++++++++++++
 .../syscall_switch_enter_linux_x86.cpp        | 364 ++++++++++++++
 .../syscall_switch_enter_windows_2000_x86.cpp | 239 +++++++++
 .../syscall_switch_enter_windows_7_x86.cpp    | 402 ++++++++++++++++
 ...syscall_switch_enter_windows_xpsp2_x86.cpp | 282 +++++++++++
 ...syscall_switch_enter_windows_xpsp3_x86.cpp | 282 +++++++++++
 .../generated/syscalls_ext_typedefs.h         |   1 +
 .../syscalls2/scripts/syscall_parser.py       |   2 +
 panda/plugins/syscalls2/syscalls2.cpp         |  11 +-
 17 files changed, 3407 insertions(+), 7 deletions(-)

diff --git a/panda/plugins/syscalls2/generated-in/context_target.json b/panda/plugins/syscalls2/generated-in/context_target.json
index 78e4b5f9061..b5005d48681 100644
--- a/panda/plugins/syscalls2/generated-in/context_target.json
+++ b/panda/plugins/syscalls2/generated-in/context_target.json
@@ -1,14 +1,22 @@
 {
 	"linux:x86": {
-		"panda_noreturn": ["sys_execve", "sys_exit_group", "sys_sigreturn"]
+		"panda_noreturn": ["sys_execve", "sys_exit_group", "sys_sigreturn"],
+		"panda_doublereturn": ["sys_fork"]
 	},
 	"linux:arm": {
-		"panda_noreturn": ["sys_execve", "sys_exit_group", "sys_sigreturn"]
+		"panda_noreturn": ["sys_execve", "sys_exit_group", "sys_sigreturn"],
+		"panda_doublereturn": ["sys_fork"]
 	},
 	"linux:x64": {
-		"panda_noreturn": ["sys_exit_group"]
+		"panda_noreturn": ["sys_exit_group"],
+		"panda_doublereturn": ["sys_fork"]
+	},
+	"linux:mips": {
+		"panda_noreturn": ["sys_exit_group"],
+		"panda_doublereturn": ["sys_fork"]
 	},
 	"freebsd:x64": {
-		"panda_noreturn": ["execve", "fexecve", "__mac_execve", "sys_exit", "thr_exit"]
+		"panda_noreturn": ["execve", "fexecve", "__mac_execve", "sys_exit", "thr_exit"],
+		"panda_doublereturn": ["fork"]
 	}
 }
diff --git a/panda/plugins/syscalls2/generated-tpl/syscall_switch_enter.tpl b/panda/plugins/syscalls2/generated-tpl/syscall_switch_enter.tpl
index dfab86f2d9b..cebf71dd356 100644
--- a/panda/plugins/syscalls2/generated-tpl/syscall_switch_enter.tpl
+++ b/panda/plugins/syscalls2/generated-tpl/syscall_switch_enter.tpl
@@ -33,6 +33,7 @@ void syscall_enter_switch_{{os}}_{{arch}}(CPUState *cpu, target_ptr_t pc, int st
 	}
 	ctx.asid = panda_current_asid(cpu);
 	ctx.retaddr = calc_retaddr(cpu, pc);
+	ctx.double_return = false;
 	bool panda_noreturn;	// true if PANDA should not track the return of this system call
 	const syscall_info_t *call = NULL;
 	syscall_info_t zero = {0};
@@ -49,6 +50,7 @@ void syscall_enter_switch_{{os}}_{{arch}}(CPUState *cpu, target_ptr_t pc, int st
 	// {{syscall.no}} {{syscall.rettype}} {{syscall.name}} {{syscall.args_raw}}
 	case {{syscall.no}}: {
 		panda_noreturn = {{ 'true' if syscall.panda_noreturn else 'false' }};
+		ctx.double_return = {{ 'true' if syscall.panda_double_return else 'false' }};
 		{%- if syscall.args|length > 0 %}
 		{%- for arg in syscall.args %}
 		{{arg.emit_temp_assignment()}}
diff --git a/panda/plugins/syscalls2/generated-tpl/syscalls_ext_typedefs.tpl b/panda/plugins/syscalls2/generated-tpl/syscalls_ext_typedefs.tpl
index 73ddbe7d7e7..6dbab3ced52 100644
--- a/panda/plugins/syscalls2/generated-tpl/syscalls_ext_typedefs.tpl
+++ b/panda/plugins/syscalls2/generated-tpl/syscalls_ext_typedefs.tpl
@@ -43,6 +43,7 @@ struct syscall_ctx {
     target_ptr_t retaddr; /**< return address */
     uint8_t args[GLOBAL_MAX_SYSCALL_ARGS]
                 [GLOBAL_MAX_SYSCALL_ARG_SIZE]; /**< arguments */
+    bool double_return;
 };
 typedef struct syscall_ctx syscall_ctx_t;
 
diff --git a/panda/plugins/syscalls2/generated/dso_info_linux_mips.c b/panda/plugins/syscalls2/generated/dso_info_linux_mips.c
index c1a6fa2f8ce..2dc634aaec4 100644
--- a/panda/plugins/syscalls2/generated/dso_info_linux_mips.c
+++ b/panda/plugins/syscalls2/generated/dso_info_linux_mips.c
@@ -3882,7 +3882,7 @@ syscall_info_t __syscall_info_a[] = {
 		.argsz = argsz_4246,
 		.argn = argn_4246,
 		.argtn = argtn_4246,
-		.noreturn = false
+		.noreturn = true
 	},
 	[4247] = {
 		.no = 4247,
diff --git a/panda/plugins/syscalls2/generated/syscall_switch_enter_freebsd_x64.cpp b/panda/plugins/syscalls2/generated/syscall_switch_enter_freebsd_x64.cpp
index 834719ab51d..f396ed13afe 100644
--- a/panda/plugins/syscalls2/generated/syscall_switch_enter_freebsd_x64.cpp
+++ b/panda/plugins/syscalls2/generated/syscall_switch_enter_freebsd_x64.cpp
@@ -33,6 +33,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	}
 	ctx.asid = panda_current_asid(cpu);
 	ctx.retaddr = calc_retaddr(cpu, pc);
+	ctx.double_return = false;
 	bool panda_noreturn;	// true if PANDA should not track the return of this system call
 	const syscall_info_t *call = NULL;
 	syscall_info_t zero = {0};
@@ -48,11 +49,13 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 0 int nosys ['void']
 	case 0: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_nosys_enter, cpu, pc);
 	}; break;
 	// 1 void sys_exit ['int rval']
 	case 1: {
 		panda_noreturn = true;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -64,11 +67,13 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 2 int fork ['void']
 	case 2: {
 		panda_noreturn = false;
+		ctx.double_return = true;
 		PPP_RUN_CB(on_fork_enter, cpu, pc);
 	}; break;
 	// 3 ssize_t read ['int fd', 'void *buf', 'size_t nbyte']
 	case 3: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -84,6 +89,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 4 ssize_t write ['int fd', 'const void *buf', 'size_t nbyte']
 	case 4: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -99,6 +105,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 5 int open ['const char *path', 'int flags', 'mode_t mode']
 	case 5: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -114,6 +121,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 6 int close ['int fd']
 	case 6: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -125,6 +133,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 7 int wait4 ['int pid', 'int *status', 'int options', 'struct rusage *rusage']
 	case 7: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -142,6 +151,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 8 int creat ['const char *path', 'int mode']
 	case 8: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -155,6 +165,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 9 int link ['const char *path', 'const char *link']
 	case 9: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -168,6 +179,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 10 int unlink ['const char *path']
 	case 10: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -179,6 +191,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 12 int chdir ['const char *path']
 	case 12: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -190,6 +203,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 13 int fchdir ['int fd']
 	case 13: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -201,6 +215,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 14 int mknod ['const char *path', 'int mode', 'uint32_t dev']
 	case 14: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -216,6 +231,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 15 int chmod ['const char *path', 'mode_t mode']
 	case 15: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -229,6 +245,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 16 int chown ['const char *path', 'int uid', 'int gid']
 	case 16: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -244,6 +261,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 18 int getfsstat ['struct ostatfs *buf', 'long bufsize', 'int mode']
 	case 18: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		int64_t arg1 = get_s64(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -259,11 +277,13 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 20 pid_t getpid ['void']
 	case 20: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_getpid_enter, cpu, pc);
 	}; break;
 	// 21 int mount ['const char *type', 'const char *path', 'int flags', 'void *data']
 	case 21: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -281,6 +301,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 22 int unmount ['const char *path', 'int flags']
 	case 22: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -294,6 +315,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 23 int setuid ['uid_t uid']
 	case 23: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -305,16 +327,19 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 24 uid_t getuid ['void']
 	case 24: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_getuid_enter, cpu, pc);
 	}; break;
 	// 25 uid_t geteuid ['void']
 	case 25: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_geteuid_enter, cpu, pc);
 	}; break;
 	// 26 int ptrace ['int req', 'pid_t pid', 'caddr_t addr', 'int data']
 	case 26: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -332,6 +357,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 27 int recvmsg ['int s', 'struct msghdr *msg', 'int flags']
 	case 27: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -347,6 +373,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 28 int sendmsg ['int s', 'struct msghdr *msg', 'int flags']
 	case 28: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -362,6 +389,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 29 int recvfrom ['int s', 'void *buf', 'size_t len', 'int flags', 'struct sockaddr *from', '__socklen_t *fromlenaddr']
 	case 29: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -383,6 +411,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 30 int accept ['int s', 'struct sockaddr *name', '__socklen_t *anamelen']
 	case 30: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -398,6 +427,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 31 int getpeername ['int fdes', 'struct sockaddr *asa', '__socklen_t *alen']
 	case 31: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -413,6 +443,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 32 int getsockname ['int fdes', 'struct sockaddr *asa', '__socklen_t *alen']
 	case 32: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -428,6 +459,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 33 int access ['const char *path', 'int amode']
 	case 33: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -441,6 +473,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 34 int chflags ['const char *path', 'u_long flags']
 	case 34: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		int64_t arg1 = get_s64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -454,6 +487,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 35 int fchflags ['int fd', 'u_long flags']
 	case 35: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int64_t arg1 = get_s64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -467,11 +501,13 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 36 int sync ['void']
 	case 36: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sync_enter, cpu, pc);
 	}; break;
 	// 37 int kill ['int pid', 'int signum']
 	case 37: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -485,6 +521,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 38 int stat ['const char *path', 'struct ostat *ub']
 	case 38: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -498,11 +535,13 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 39 pid_t getppid ['void']
 	case 39: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_getppid_enter, cpu, pc);
 	}; break;
 	// 40 int lstat ['const char *path', 'struct ostat *ub']
 	case 40: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -516,6 +555,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 41 int dup ['unsigned fd']
 	case 41: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -527,16 +567,19 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 42 int pipe ['void']
 	case 42: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_pipe_enter, cpu, pc);
 	}; break;
 	// 43 gid_t getegid ['void']
 	case 43: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_getegid_enter, cpu, pc);
 	}; break;
 	// 44 int profil ['char *samples', 'size_t size', 'size_t offset', 'unsigned scale']
 	case 44: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -554,6 +597,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 45 int ktrace ['const char *fname', 'int ops', 'int facs', 'int pid']
 	case 45: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -571,6 +615,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 46 int sigaction ['int signum', 'struct osigaction *nsa', 'struct osigaction *osa']
 	case 46: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -586,11 +631,13 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 47 gid_t getgid ['void']
 	case 47: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_getgid_enter, cpu, pc);
 	}; break;
 	// 49 int getlogin ['char *namebuf', 'unsigned namelen']
 	case 49: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -604,6 +651,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 50 int setlogin ['const char *namebuf']
 	case 50: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -615,6 +663,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 51 int acct ['const char *path']
 	case 51: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -626,6 +675,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 53 int sigaltstack ['stack_t *ss', 'stack_t *oss']
 	case 53: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -639,6 +689,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 54 int ioctl ['int fd', 'u_long com', 'char *data']
 	case 54: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int64_t arg1 = get_s64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -654,6 +705,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 55 int reboot ['int opt']
 	case 55: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -665,6 +717,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 56 int revoke ['const char *path']
 	case 56: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -676,6 +729,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 57 int symlink ['const char *path', 'const char *link']
 	case 57: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -689,6 +743,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 58 ssize_t readlink ['const char *path', 'char *buf', 'size_t count']
 	case 58: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -704,6 +759,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 59 int execve ['const char *fname', 'char **argv', 'char **envv']
 	case 59: {
 		panda_noreturn = true;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -719,6 +775,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 60 int umask ['mode_t newmask']
 	case 60: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -730,6 +787,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 61 int chroot ['const char *path']
 	case 61: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -741,6 +799,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 62 int fstat ['int fd', 'struct ostat *sb']
 	case 62: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -754,6 +813,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 63 int getkerninfo ['int op', 'char *where', 'size_t *size', 'int arg']
 	case 63: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -771,11 +831,13 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 64 int getpagesize ['void']
 	case 64: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_getpagesize_enter, cpu, pc);
 	}; break;
 	// 65 int msync ['void *addr', 'size_t len', 'int flags']
 	case 65: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -791,11 +853,13 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 66 int vfork ['void']
 	case 66: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_vfork_enter, cpu, pc);
 	}; break;
 	// 69 int sbrk ['int incr']
 	case 69: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -807,6 +871,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 70 int sstk ['int incr']
 	case 70: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -818,6 +883,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 72 int vadvise ['int anom']
 	case 72: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -829,6 +895,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 73 int munmap ['void *addr', 'size_t len']
 	case 73: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -842,6 +909,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 74 int mprotect ['void *addr', 'size_t len', 'int prot']
 	case 74: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -857,6 +925,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 75 int madvise ['void *addr', 'size_t len', 'int behav']
 	case 75: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -872,6 +941,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 78 int mincore ['const void *addr', 'size_t len', 'char *vec']
 	case 78: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -887,6 +957,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 79 int getgroups ['unsigned gidsetsize', 'gid_t *gidset']
 	case 79: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -900,6 +971,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 80 int setgroups ['unsigned gidsetsize', 'gid_t *gidset']
 	case 80: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -913,11 +985,13 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 81 int getpgrp ['void']
 	case 81: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_getpgrp_enter, cpu, pc);
 	}; break;
 	// 82 int setpgid ['int pid', 'int pgid']
 	case 82: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -931,6 +1005,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 83 int setitimer ['unsigned which', 'struct itimerval *itv', 'struct itimerval *oitv']
 	case 83: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -946,11 +1021,13 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 84 int wait ['void']
 	case 84: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_wait_enter, cpu, pc);
 	}; break;
 	// 85 int swapon ['const char *name']
 	case 85: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -962,6 +1039,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 86 int getitimer ['unsigned which', 'struct itimerval *itv']
 	case 86: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -975,6 +1053,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 87 int gethostname ['char *hostname', 'unsigned len']
 	case 87: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -988,6 +1067,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 88 int sethostname ['char *hostname', 'unsigned len']
 	case 88: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1001,11 +1081,13 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 89 int getdtablesize ['void']
 	case 89: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_getdtablesize_enter, cpu, pc);
 	}; break;
 	// 90 int dup2 ['unsigned from', 'unsigned to']
 	case 90: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1019,6 +1101,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 92 int fcntl ['int fd', 'int cmd', 'long arg']
 	case 92: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		int64_t arg2 = get_s64(cpu, 2);
@@ -1034,6 +1117,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 93 int select ['int nd', 'fd_set *in', 'fd_set *ou', 'fd_set *ex', 'struct timeval *tv']
 	case 93: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -1053,6 +1137,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 95 int fsync ['int fd']
 	case 95: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1064,6 +1149,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 96 int setpriority ['int which', 'int who', 'int prio']
 	case 96: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -1079,6 +1165,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 97 int socket ['int domain', 'int type', 'int protocol']
 	case 97: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -1094,6 +1181,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 98 int connect ['int s', 'const struct sockaddr *name', 'int namelen']
 	case 98: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -1109,6 +1197,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 99 int accept ['int s', 'struct sockaddr *name', 'int *anamelen']
 	case 99: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -1124,6 +1213,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 100 int getpriority ['int which', 'int who']
 	case 100: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1137,6 +1227,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 101 int send ['int s', 'const void *buf', 'int len', 'int flags']
 	case 101: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -1154,6 +1245,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 102 int recv ['int s', 'void *buf', 'int len', 'int flags']
 	case 102: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -1171,6 +1263,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 103 int sigreturn ['struct osigcontext *sigcntxp']
 	case 103: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1182,6 +1275,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 104 int bind ['int s', 'const struct sockaddr *name', 'int namelen']
 	case 104: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -1197,6 +1291,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 105 int setsockopt ['int s', 'int level', 'int name', 'const void *val', 'int valsize']
 	case 105: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -1216,6 +1311,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 106 int listen ['int s', 'int backlog']
 	case 106: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1229,6 +1325,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 108 int sigvec ['int signum', 'struct sigvec *nsv', 'struct sigvec *osv']
 	case 108: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -1244,6 +1341,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 109 int sigblock ['int mask']
 	case 109: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1255,6 +1353,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 110 int sigsetmask ['int mask']
 	case 110: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1266,6 +1365,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 111 int sigsuspend ['osigset_t mask']
 	case 111: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1277,6 +1377,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 112 int sigstack ['struct sigstack *nss', 'struct sigstack *oss']
 	case 112: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1290,6 +1391,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 113 int recvmsg ['int s', 'struct omsghdr *msg', 'int flags']
 	case 113: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -1305,6 +1407,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 114 int sendmsg ['int s', 'const void *msg', 'int flags']
 	case 114: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -1320,6 +1423,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 116 int gettimeofday ['struct timeval *tp', 'struct timezone *tzp']
 	case 116: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1333,6 +1437,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 117 int getrusage ['int who', 'struct rusage *rusage']
 	case 117: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1346,6 +1451,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 118 int getsockopt ['int s', 'int level', 'int name', 'void *val', 'int *avalsize']
 	case 118: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -1365,6 +1471,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 120 int readv ['int fd', 'struct iovec *iovp', 'unsigned iovcnt']
 	case 120: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1380,6 +1487,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 121 int writev ['int fd', 'struct iovec *iovp', 'unsigned iovcnt']
 	case 121: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1395,6 +1503,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 122 int settimeofday ['struct timeval *tv', 'struct timezone *tzp']
 	case 122: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1408,6 +1517,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 123 int fchown ['int fd', 'int uid', 'int gid']
 	case 123: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -1423,6 +1533,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 124 int fchmod ['int fd', 'mode_t mode']
 	case 124: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1436,6 +1547,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 125 int recvfrom ['int s', 'void *buf', 'size_t len', 'int flags', 'struct sockaddr *from', 'int *fromlenaddr']
 	case 125: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1457,6 +1569,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 126 int setreuid ['int ruid', 'int euid']
 	case 126: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1470,6 +1583,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 127 int setregid ['int rgid', 'int egid']
 	case 127: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1483,6 +1597,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 128 int rename ['const char *from', 'const char *to']
 	case 128: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1496,6 +1611,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 131 int flock ['int fd', 'int how']
 	case 131: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1509,6 +1625,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 132 int mkfifo ['const char *path', 'mode_t mode']
 	case 132: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1522,6 +1639,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 133 int sendto ['int s', 'const void *buf', 'size_t len', 'int flags', 'const struct sockaddr *to', 'int tolen']
 	case 133: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1543,6 +1661,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 134 int shutdown ['int s', 'int how']
 	case 134: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1556,6 +1675,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 135 int socketpair ['int domain', 'int type', 'int protocol', 'int *rsv']
 	case 135: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -1573,6 +1693,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 136 int mkdir ['const char *path', 'mode_t mode']
 	case 136: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1586,6 +1707,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 137 int rmdir ['const char *path']
 	case 137: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1597,6 +1719,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 138 int utimes ['const char *path', 'struct timeval *tptr']
 	case 138: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1610,6 +1733,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 140 int adjtime ['struct timeval *delta', 'struct timeval *olddelta']
 	case 140: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1623,6 +1747,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 141 int getpeername ['int fdes', 'struct sockaddr *asa', 'int *alen']
 	case 141: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -1638,11 +1763,13 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 142 long gethostid ['void']
 	case 142: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_gethostid_enter, cpu, pc);
 	}; break;
 	// 143 int sethostid ['long hostid']
 	case 143: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int64_t arg0 = get_s64(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1654,6 +1781,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 144 int getrlimit ['unsigned which', 'struct orlimit *rlp']
 	case 144: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1667,6 +1795,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 145 int setrlimit ['unsigned which', 'struct orlimit *rlp']
 	case 145: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1680,6 +1809,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 146 int killpg ['int pgid', 'int signum']
 	case 146: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1693,11 +1823,13 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 147 int setsid ['void']
 	case 147: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_setsid_enter, cpu, pc);
 	}; break;
 	// 148 int quotactl ['const char *path', 'int cmd', 'int uid', 'void *arg']
 	case 148: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -1715,11 +1847,13 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 149 int quota ['void']
 	case 149: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_quota_enter, cpu, pc);
 	}; break;
 	// 150 int getsockname ['int fdec', 'struct sockaddr *asa', 'int *alen']
 	case 150: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -1735,6 +1869,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 154 int nlm_syscall ['int debug_level', 'int grace_period', 'int addr_count', 'char **addrs']
 	case 154: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -1752,6 +1887,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 155 int nfssvc ['int flag', 'void *argp']
 	case 155: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1765,6 +1901,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 156 int getdirentries ['int fd', 'char *buf', 'unsigned count', 'long *basep']
 	case 156: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1782,6 +1919,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 157 int statfs ['const char *path', 'struct ostatfs *buf']
 	case 157: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1795,6 +1933,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 158 int fstatfs ['int fd', 'struct ostatfs *buf']
 	case 158: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1808,6 +1947,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 160 int lgetfh ['const char *fname', 'struct fhandle *fhp']
 	case 160: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1821,6 +1961,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 161 int getfh ['const char *fname', 'struct fhandle *fhp']
 	case 161: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1834,6 +1975,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 162 int getdomainname ['char *domainname', 'int len']
 	case 162: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1847,6 +1989,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 163 int setdomainname ['char *domainname', 'int len']
 	case 163: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1860,6 +2003,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 164 int uname ['struct utsname *name']
 	case 164: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1871,6 +2015,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 165 int sysarch ['int op', 'char *parms']
 	case 165: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1884,6 +2029,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 166 int rtprio ['int function', 'pid_t pid', 'struct rtprio *rtp']
 	case 166: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -1899,6 +2045,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 169 int semsys ['int which', 'int a2', 'int a3', 'int a4', 'int a5']
 	case 169: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -1918,6 +2065,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 175 int setfib ['int fibnum']
 	case 175: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1929,6 +2077,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 176 int ntp_adjtime ['struct timex *tp']
 	case 176: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1940,6 +2089,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 181 int setgid ['gid_t gid']
 	case 181: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1951,6 +2101,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 182 int setegid ['gid_t egid']
 	case 182: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1962,6 +2113,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 183 int seteuid ['uid_t euid']
 	case 183: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1973,6 +2125,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 188 int stat ['const char *path', 'struct freebsd11_stat *ub']
 	case 188: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1986,6 +2139,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 189 int fstat ['int fd', 'struct freebsd11_stat *sb']
 	case 189: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1999,6 +2153,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 190 int lstat ['const char *path', 'struct freebsd11_stat *ub']
 	case 190: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2012,6 +2167,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 191 int pathconf ['const char *path', 'int name']
 	case 191: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2025,6 +2181,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 192 int fpathconf ['int fd', 'int name']
 	case 192: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2038,6 +2195,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 194 int getrlimit ['unsigned which', 'struct rlimit *rlp']
 	case 194: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2051,6 +2209,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 195 int setrlimit ['unsigned which', 'struct rlimit *rlp']
 	case 195: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2064,6 +2223,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 196 int getdirentries ['int fd', 'char *buf', 'unsigned count', 'long *basep']
 	case 196: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2081,11 +2241,13 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 198 int nosys ['void']
 	case 198: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_nosys_enter, cpu, pc);
 	}; break;
 	// 202 int __sysctl ['int *name', 'unsigned namelen', 'void *old', 'size_t *oldlenp', 'const void *new', 'size_t newlen']
 	case 202: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -2107,6 +2269,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 203 int mlock ['const void *addr', 'size_t len']
 	case 203: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2120,6 +2283,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 204 int munlock ['const void *addr', 'size_t len']
 	case 204: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2133,6 +2297,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 205 int undelete ['const char *path']
 	case 205: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -2144,6 +2309,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 206 int futimes ['int fd', 'struct timeval *tptr']
 	case 206: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2157,6 +2323,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 207 int getpgid ['pid_t pid']
 	case 207: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -2168,6 +2335,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 209 int poll ['struct pollfd *fds', 'unsigned nfds', 'int timeout']
 	case 209: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -2183,6 +2351,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 220 int __semctl ['int semid', 'int semnum', 'int cmd', 'union semun_old *arg']
 	case 220: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -2200,6 +2369,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 221 int semget ['key_t key', 'int nsems', 'int semflg']
 	case 221: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -2215,6 +2385,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 222 int semop ['int semid', 'struct sembuf *sops', 'size_t nsops']
 	case 222: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2230,6 +2401,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 224 int msgctl ['int msqid', 'int cmd', 'struct msqid_ds_old *buf']
 	case 224: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -2245,6 +2417,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 225 int msgget ['key_t key', 'int msgflg']
 	case 225: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2258,6 +2431,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 226 int msgsnd ['int msqid', 'const void *msgp', 'size_t msgsz', 'int msgflg']
 	case 226: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2275,6 +2449,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 227 ssize_t msgrcv ['int msqid', 'void *msgp', 'size_t msgsz', 'long msgtyp', 'int msgflg']
 	case 227: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2294,6 +2469,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 229 int shmctl ['int shmid', 'int cmd', 'struct shmid_ds_old *buf']
 	case 229: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -2309,6 +2485,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 230 int shmdt ['const void *shmaddr']
 	case 230: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -2320,6 +2497,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 231 int shmget ['key_t key', 'size_t size', 'int shmflg']
 	case 231: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -2335,6 +2513,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 232 int clock_gettime ['clockid_t clock_id', 'struct timespec *tp']
 	case 232: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2348,6 +2527,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 233 int clock_settime ['clockid_t clock_id', 'const struct timespec *tp']
 	case 233: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2361,6 +2541,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 234 int clock_getres ['clockid_t clock_id', 'struct timespec *tp']
 	case 234: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2374,6 +2555,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 235 int ktimer_create ['clockid_t clock_id', 'struct sigevent *evp', 'int *timerid']
 	case 235: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -2389,6 +2571,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 236 int ktimer_delete ['int timerid']
 	case 236: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -2400,6 +2583,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 237 int ktimer_settime ['int timerid', 'int flags', 'const struct itimerspec *value', 'struct itimerspec *ovalue']
 	case 237: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -2417,6 +2601,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 238 int ktimer_gettime ['int timerid', 'struct itimerspec *value']
 	case 238: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2430,6 +2615,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 239 int ktimer_getoverrun ['int timerid']
 	case 239: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -2441,6 +2627,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 240 int nanosleep ['const struct timespec *rqtp', 'struct timespec *rmtp']
 	case 240: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2454,6 +2641,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 241 int ffclock_getcounter ['ffcounter *ffcount']
 	case 241: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -2465,6 +2653,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 242 int ffclock_setestimate ['struct ffclock_estimate *cest']
 	case 242: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -2476,6 +2665,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 243 int ffclock_getestimate ['struct ffclock_estimate *cest']
 	case 243: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -2487,6 +2677,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 244 int clock_nanosleep ['clockid_t clock_id', 'int flags', 'const struct timespec *rqtp', 'struct timespec *rmtp']
 	case 244: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -2504,6 +2695,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 247 int clock_getcpuclockid2 ['id_t id', 'int which', 'clockid_t *clock_id']
 	case 247: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -2519,6 +2711,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 248 int ntp_gettime ['struct ntptimeval *ntvp']
 	case 248: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -2530,6 +2723,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 250 int minherit ['void *addr', 'size_t len', 'int inherit']
 	case 250: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -2545,6 +2739,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 251 int rfork ['int flags']
 	case 251: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -2556,11 +2751,13 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 253 int issetugid ['void']
 	case 253: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_issetugid_enter, cpu, pc);
 	}; break;
 	// 254 int lchown ['const char *path', 'int uid', 'int gid']
 	case 254: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -2576,6 +2773,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 255 int aio_read ['struct aiocb *aiocbp']
 	case 255: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -2587,6 +2785,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 256 int aio_write ['struct aiocb *aiocbp']
 	case 256: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -2598,6 +2797,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 257 int lio_listio ['int mode', 'struct aiocb * const *acb_list', 'int nent', 'struct sigevent *sig']
 	case 257: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -2615,6 +2815,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 272 int getdents ['int fd', 'char *buf', 'size_t count']
 	case 272: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2630,6 +2831,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 274 int lchmod ['const char *path', 'mode_t mode']
 	case 274: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2643,6 +2845,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 276 int lutimes ['const char *path', 'struct timeval *tptr']
 	case 276: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2656,6 +2859,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 278 int nstat ['const char *path', 'struct nstat *ub']
 	case 278: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2669,6 +2873,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 279 int nfstat ['int fd', 'struct nstat *sb']
 	case 279: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2682,6 +2887,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 280 int nlstat ['const char *path', 'struct nstat *ub']
 	case 280: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2695,6 +2901,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 289 ssize_t preadv ['int fd', 'struct iovec *iovp', 'unsigned iovcnt', 'off_t offset']
 	case 289: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2712,6 +2919,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 290 ssize_t pwritev ['int fd', 'struct iovec *iovp', 'unsigned iovcnt', 'off_t offset']
 	case 290: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2729,6 +2937,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 297 int fhstatfs ['const struct fhandle *u_fhp', 'struct ostatfs *buf']
 	case 297: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2742,6 +2951,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 298 int fhopen ['const struct fhandle *u_fhp', 'int flags']
 	case 298: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2755,6 +2965,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 299 int fhstat ['const struct fhandle *u_fhp', 'struct freebsd11_stat *sb']
 	case 299: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2768,6 +2979,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 300 int modnext ['int modid']
 	case 300: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -2779,6 +2991,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 301 int modstat ['int modid', 'struct module_stat *stat']
 	case 301: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2792,6 +3005,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 302 int modfnext ['int modid']
 	case 302: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -2803,6 +3017,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 303 int modfind ['const char *name']
 	case 303: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -2814,6 +3029,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 304 int kldload ['const char *file']
 	case 304: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -2825,6 +3041,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 305 int kldunload ['int fileid']
 	case 305: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -2836,6 +3053,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 306 int kldfind ['const char *file']
 	case 306: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -2847,6 +3065,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 307 int kldnext ['int fileid']
 	case 307: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -2858,6 +3077,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 308 int kldstat ['int fileid', 'struct kld_file_stat *stat']
 	case 308: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2871,6 +3091,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 309 int kldfirstmod ['int fileid']
 	case 309: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -2882,6 +3103,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 310 int getsid ['pid_t pid']
 	case 310: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -2893,6 +3115,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 311 int setresuid ['uid_t ruid', 'uid_t euid', 'uid_t suid']
 	case 311: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2908,6 +3131,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 312 int setresgid ['gid_t rgid', 'gid_t egid', 'gid_t sgid']
 	case 312: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2923,6 +3147,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 314 ssize_t aio_return ['struct aiocb *aiocbp']
 	case 314: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -2934,6 +3159,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 315 int aio_suspend ['struct aiocb * const * aiocbp', 'int nent', 'const struct timespec *timeout']
 	case 315: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -2949,6 +3175,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 316 int aio_cancel ['int fd', 'struct aiocb *aiocbp']
 	case 316: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2962,6 +3189,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 317 int aio_error ['struct aiocb *aiocbp']
 	case 317: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -2973,6 +3201,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 318 int aio_read ['struct oaiocb *aiocbp']
 	case 318: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -2984,6 +3213,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 319 int aio_write ['struct oaiocb *aiocbp']
 	case 319: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -2995,6 +3225,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 320 int lio_listio ['int mode', 'struct oaiocb * const *acb_list', 'int nent', 'struct osigevent *sig']
 	case 320: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -3012,11 +3243,13 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 321 int yield ['void']
 	case 321: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_yield_enter, cpu, pc);
 	}; break;
 	// 324 int mlockall ['int how']
 	case 324: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -3028,6 +3261,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 325 int munlockall(void); 326 int __getcwd ['char *buf', 'size_t buflen']
 	case 325: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3041,6 +3275,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 327 int sched_setparam ['pid_t pid', 'const struct sched_param *param']
 	case 327: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3054,6 +3289,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 328 int sched_getparam ['pid_t pid', 'struct sched_param *param']
 	case 328: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3067,6 +3303,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 329 int sched_setscheduler ['pid_t pid', 'int policy', 'const struct sched_param *param']
 	case 329: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -3082,6 +3319,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 330 int sched_getscheduler ['pid_t pid']
 	case 330: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -3093,11 +3331,13 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 331 int sched_yield ['void']
 	case 331: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sched_yield_enter, cpu, pc);
 	}; break;
 	// 332 int sched_get_priority_max ['int policy']
 	case 332: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -3109,6 +3349,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 333 int sched_get_priority_min ['int policy']
 	case 333: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -3120,6 +3361,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 334 int sched_rr_get_interval ['pid_t pid', 'struct timespec *interval']
 	case 334: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3133,6 +3375,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 335 int utrace ['const void *addr', 'size_t len']
 	case 335: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3146,6 +3389,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 336 int sendfile ['int fd', 'int s', 'off_t offset', 'size_t nbytes', 'struct sf_hdtr *hdtr', 'off_t *sbytes', 'int flags']
 	case 336: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -3169,6 +3413,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 337 int kldsym ['int fileid', 'int cmd', 'void *data']
 	case 337: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -3184,6 +3429,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 338 int jail ['struct jail *jail']
 	case 338: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -3195,6 +3441,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 339 int nnpfs_syscall ['int operation', 'char *a_pathP', 'int a_opcode', 'void *a_paramsP', 'int a_followSymlinks']
 	case 339: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -3214,6 +3461,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 340 int sigprocmask ['int how', 'const sigset_t *set', 'sigset_t *oset']
 	case 340: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -3229,6 +3477,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 341 int sigsuspend ['const sigset_t *sigmask']
 	case 341: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -3240,6 +3489,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 342 int sigaction ['int sig', 'const struct sigaction *act', 'struct sigaction *oact']
 	case 342: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -3255,6 +3505,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 343 int sigpending ['sigset_t *set']
 	case 343: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -3266,6 +3517,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 344 int sigreturn ['const struct ucontext4 *sigcntxp']
 	case 344: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -3277,6 +3529,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 345 int sigtimedwait ['const sigset_t *set', 'siginfo_t *info', 'const struct timespec *timeout']
 	case 345: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -3292,6 +3545,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 346 int sigwaitinfo ['const sigset_t *set', 'siginfo_t *info']
 	case 346: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3305,6 +3559,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 347 int __acl_get_file ['const char *path', 'acl_type_t type', 'struct acl *aclp']
 	case 347: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -3320,6 +3575,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 348 int __acl_set_file ['const char *path', 'acl_type_t type', 'struct acl *aclp']
 	case 348: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -3335,6 +3591,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 349 int __acl_get_fd ['int filedes', 'acl_type_t type', 'struct acl *aclp']
 	case 349: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -3350,6 +3607,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 350 int __acl_set_fd ['int filedes', 'acl_type_t type', 'struct acl *aclp']
 	case 350: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -3365,6 +3623,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 351 int __acl_delete_file ['const char *path', 'acl_type_t type']
 	case 351: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3378,6 +3637,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 352 int __acl_delete_fd ['int filedes', 'acl_type_t type']
 	case 352: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3391,6 +3651,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 353 int __acl_aclcheck_file ['const char *path', 'acl_type_t type', 'struct acl *aclp']
 	case 353: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -3406,6 +3667,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 354 int __acl_aclcheck_fd ['int filedes', 'acl_type_t type', 'struct acl *aclp']
 	case 354: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -3421,6 +3683,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 355 int extattrctl ['const char *path', 'int cmd', 'const char *filename', 'int attrnamespace', 'const char *attrname']
 	case 355: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -3440,6 +3703,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 356 ssize_t extattr_set_file ['const char *path', 'int attrnamespace', 'const char *attrname', 'void *data', 'size_t nbytes']
 	case 356: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -3459,6 +3723,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 357 ssize_t extattr_get_file ['const char *path', 'int attrnamespace', 'const char *attrname', 'void *data', 'size_t nbytes']
 	case 357: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -3478,6 +3743,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 358 int extattr_delete_file ['const char *path', 'int attrnamespace', 'const char *attrname']
 	case 358: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -3493,6 +3759,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 359 ssize_t aio_waitcomplete ['struct aiocb **aiocbp', 'struct timespec *timeout']
 	case 359: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3506,6 +3773,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 360 int getresuid ['uid_t *ruid', 'uid_t *euid', 'uid_t *suid']
 	case 360: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -3521,6 +3789,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 361 int getresgid ['gid_t *rgid', 'gid_t *egid', 'gid_t *sgid']
 	case 361: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -3536,11 +3805,13 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 362 int kqueue ['void']
 	case 362: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_kqueue_enter, cpu, pc);
 	}; break;
 	// 363 int kevent ['int fd', 'struct kevent_freebsd11 *changelist', 'int nchanges', 'struct kevent_freebsd11 *eventlist', 'int nevents', 'const struct timespec *timeout']
 	case 363: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -3562,6 +3833,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 371 ssize_t extattr_set_fd ['int fd', 'int attrnamespace', 'const char *attrname', 'void *data', 'size_t nbytes']
 	case 371: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -3581,6 +3853,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 372 ssize_t extattr_get_fd ['int fd', 'int attrnamespace', 'const char *attrname', 'void *data', 'size_t nbytes']
 	case 372: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -3600,6 +3873,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 373 int extattr_delete_fd ['int fd', 'int attrnamespace', 'const char *attrname']
 	case 373: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -3615,6 +3889,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 374 int __setugid ['int flag']
 	case 374: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -3626,6 +3901,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 376 int eaccess ['const char *path', 'int amode']
 	case 376: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3639,6 +3915,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 377 int afs3_syscall ['long syscall', 'long parm1', 'long parm2', 'long parm3', 'long parm4', 'long parm5', 'long parm6']
 	case 377: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int64_t arg0 = get_s64(cpu, 0);
 		int64_t arg1 = get_s64(cpu, 1);
 		int64_t arg2 = get_s64(cpu, 2);
@@ -3662,6 +3939,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 378 int nmount ['struct iovec *iovp', 'unsigned int iovcnt', 'int flags']
 	case 378: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -3677,6 +3955,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 384 int __mac_get_proc ['struct mac *mac_p']
 	case 384: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -3688,6 +3967,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 385 int __mac_set_proc ['struct mac *mac_p']
 	case 385: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -3699,6 +3979,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 386 int __mac_get_fd ['int fd', 'struct mac *mac_p']
 	case 386: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3712,6 +3993,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 387 int __mac_get_file ['const char *path_p', 'struct mac *mac_p']
 	case 387: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3725,6 +4007,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 388 int __mac_set_fd ['int fd', 'struct mac *mac_p']
 	case 388: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3738,6 +4021,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 389 int __mac_set_file ['const char *path_p', 'struct mac *mac_p']
 	case 389: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3751,6 +4035,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 390 int kenv ['int what', 'const char *name', 'char *value', 'int len']
 	case 390: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -3768,6 +4053,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 391 int lchflags ['const char *path', 'u_long flags']
 	case 391: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		int64_t arg1 = get_s64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3781,6 +4067,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 392 int uuidgen ['struct uuid *store', 'int count']
 	case 392: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3794,6 +4081,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 393 int sendfile ['int fd', 'int s', 'off_t offset', 'size_t nbytes', 'struct sf_hdtr *hdtr', 'off_t *sbytes', 'int flags']
 	case 393: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -3817,6 +4105,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 394 int mac_syscall ['const char *policy', 'int call', 'void *arg']
 	case 394: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -3832,6 +4121,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 395 int getfsstat ['struct freebsd11_statfs *buf', 'long bufsize', 'int mode']
 	case 395: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		int64_t arg1 = get_s64(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -3847,6 +4137,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 396 int statfs ['const char *path', 'struct freebsd11_statfs *buf']
 	case 396: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3860,6 +4151,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 397 int fstatfs ['int fd', 'struct freebsd11_statfs *buf']
 	case 397: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3873,6 +4165,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 398 int fhstatfs ['const struct fhandle *u_fhp', 'struct freebsd11_statfs *buf']
 	case 398: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3886,6 +4179,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 400 int ksem_close ['semid_t id']
 	case 400: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -3897,6 +4191,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 401 int ksem_post ['semid_t id']
 	case 401: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -3908,6 +4203,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 402 int ksem_wait ['semid_t id']
 	case 402: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -3919,6 +4215,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 403 int ksem_trywait ['semid_t id']
 	case 403: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -3930,6 +4227,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 404 int ksem_init ['semid_t *idp', 'unsigned int value']
 	case 404: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3943,6 +4241,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 405 int ksem_open ['semid_t *idp', 'const char *name', 'int oflag', 'mode_t mode', 'unsigned int value']
 	case 405: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -3962,6 +4261,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 406 int ksem_unlink ['const char *name']
 	case 406: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -3973,6 +4273,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 407 int ksem_getvalue ['semid_t id', 'int *val']
 	case 407: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3986,6 +4287,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 408 int ksem_destroy ['semid_t id']
 	case 408: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -3997,6 +4299,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 409 int __mac_get_pid ['pid_t pid', 'struct mac *mac_p']
 	case 409: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -4010,6 +4313,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 410 int __mac_get_link ['const char *path_p', 'struct mac *mac_p']
 	case 410: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -4023,6 +4327,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 411 int __mac_set_link ['const char *path_p', 'struct mac *mac_p']
 	case 411: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -4036,6 +4341,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 412 ssize_t extattr_set_link ['const char *path', 'int attrnamespace', 'const char *attrname', 'void *data', 'size_t nbytes']
 	case 412: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -4055,6 +4361,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 413 ssize_t extattr_get_link ['const char *path', 'int attrnamespace', 'const char *attrname', 'void *data', 'size_t nbytes']
 	case 413: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -4074,6 +4381,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 414 int extattr_delete_link ['const char *path', 'int attrnamespace', 'const char *attrname']
 	case 414: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -4089,6 +4397,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 415 int __mac_execve ['const char *fname', 'char **argv', 'char **envv', 'struct mac *mac_p']
 	case 415: {
 		panda_noreturn = true;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -4106,6 +4415,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 416 int sigaction ['int sig', 'const struct sigaction *act', 'struct sigaction *oact']
 	case 416: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -4121,6 +4431,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 417 int sigreturn ['const struct __ucontext *sigcntxp']
 	case 417: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -4132,6 +4443,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 421 int getcontext ['struct __ucontext *ucp']
 	case 421: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -4143,6 +4455,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 422 int setcontext ['const struct __ucontext *ucp']
 	case 422: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -4154,6 +4467,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 423 int swapcontext ['struct __ucontext *oucp', 'const struct __ucontext *ucp']
 	case 423: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -4167,6 +4481,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 424 int swapoff ['const char *name']
 	case 424: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -4178,6 +4493,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 425 int __acl_get_link ['const char *path', 'acl_type_t type', 'struct acl *aclp']
 	case 425: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -4193,6 +4509,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 426 int __acl_set_link ['const char *path', 'acl_type_t type', 'struct acl *aclp']
 	case 426: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -4208,6 +4525,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 427 int __acl_delete_link ['const char *path', 'acl_type_t type']
 	case 427: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -4221,6 +4539,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 428 int __acl_aclcheck_link ['const char *path', 'acl_type_t type', 'struct acl *aclp']
 	case 428: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -4236,6 +4555,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 429 int sigwait ['const sigset_t *set', 'int *sig']
 	case 429: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -4249,6 +4569,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 430 int thr_create ['ucontext_t *ctx', 'long *id', 'int flags']
 	case 430: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -4264,6 +4585,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 431 void thr_exit ['long *state']
 	case 431: {
 		panda_noreturn = true;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -4275,6 +4597,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 432 int thr_self ['long *id']
 	case 432: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -4286,6 +4609,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 433 int thr_kill ['long id', 'int sig']
 	case 433: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int64_t arg0 = get_s64(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -4299,6 +4623,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 436 int jail_attach ['int jid']
 	case 436: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -4310,6 +4635,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 437 ssize_t extattr_list_fd ['int fd', 'int attrnamespace', 'void *data', 'size_t nbytes']
 	case 437: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -4327,6 +4653,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 438 ssize_t extattr_list_file ['const char *path', 'int attrnamespace', 'void *data', 'size_t nbytes']
 	case 438: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -4344,6 +4671,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 439 ssize_t extattr_list_link ['const char *path', 'int attrnamespace', 'void *data', 'size_t nbytes']
 	case 439: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -4361,6 +4689,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 441 int ksem_timedwait ['semid_t id', 'const struct timespec *abstime']
 	case 441: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -4374,6 +4703,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 442 int thr_suspend ['const struct timespec *timeout']
 	case 442: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -4385,6 +4715,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 443 int thr_wake ['long id']
 	case 443: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int64_t arg0 = get_s64(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -4396,6 +4727,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 444 int kldunloadf ['int fileid', 'int flags']
 	case 444: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -4409,6 +4741,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 445 int audit ['const void *record', 'unsigned length']
 	case 445: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -4422,6 +4755,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 446 int auditon ['int cmd', 'void *data', 'unsigned length']
 	case 446: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4437,6 +4771,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 447 int getauid ['uid_t *auid']
 	case 447: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -4448,6 +4783,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 448 int setauid ['uid_t *auid']
 	case 448: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -4459,6 +4795,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 449 int getaudit ['struct auditinfo *auditinfo']
 	case 449: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -4470,6 +4807,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 450 int setaudit ['struct auditinfo *auditinfo']
 	case 450: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -4481,6 +4819,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 451 int getaudit_addr ['struct auditinfo_addr *auditinfo_addr', 'unsigned length']
 	case 451: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -4494,6 +4833,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 452 int setaudit_addr ['struct auditinfo_addr *auditinfo_addr', 'unsigned length']
 	case 452: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -4507,6 +4847,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 453 int auditctl ['const char *path']
 	case 453: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -4518,6 +4859,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 454 int _umtx_op ['void *obj', 'int op', 'u_long val', 'void *uaddr1', 'void *uaddr2']
 	case 454: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		int64_t arg2 = get_s64(cpu, 2);
@@ -4537,6 +4879,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 455 int thr_new ['struct thr_param *param', 'int param_size']
 	case 455: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -4550,6 +4893,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 456 int sigqueue ['pid_t pid', 'int signum', 'void *value']
 	case 456: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -4565,6 +4909,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 457 int kmq_open ['const char *path', 'int flags', 'mode_t mode', 'const struct mq_attr *attr']
 	case 457: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4582,6 +4927,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 458 int kmq_setattr ['int mqd', 'const struct mq_attr *attr', 'struct mq_attr *oattr']
 	case 458: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -4597,6 +4943,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 459 int kmq_timedreceive ['int mqd', 'char *msg_ptr', 'size_t msg_len', 'unsigned *msg_prio', 'const struct timespec *abs_timeout']
 	case 459: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4616,6 +4963,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 460 int kmq_timedsend ['int mqd', 'const char *msg_ptr', 'size_t msg_len', 'unsigned msg_prio', 'const struct timespec *abs_timeout']
 	case 460: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4635,6 +4983,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 461 int kmq_notify ['int mqd', 'const struct sigevent *sigev']
 	case 461: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -4648,6 +4997,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 462 int kmq_unlink ['const char *path']
 	case 462: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -4659,6 +5009,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 463 int abort2 ['const char *why', 'int nargs', 'void **args']
 	case 463: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -4674,6 +5025,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 464 int thr_set_name ['long id', 'const char *name']
 	case 464: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int64_t arg0 = get_s64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -4687,6 +5039,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 465 int aio_fsync ['int op', 'struct aiocb *aiocbp']
 	case 465: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -4700,6 +5053,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 466 int rtprio_thread ['int function', 'lwpid_t lwpid', 'struct rtprio *rtp']
 	case 466: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -4715,6 +5069,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 471 int sctp_peeloff ['int sd', 'uint32_t name']
 	case 471: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -4728,6 +5083,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 472 int sctp_generic_sendmsg ['int sd', 'void *msg', 'int mlen', 'struct sockaddr *to', '__socklen_t tolen', 'struct sctp_sndrcvinfo *sinfo', 'int flags']
 	case 472: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -4751,6 +5107,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 473 int sctp_generic_sendmsg_iov ['int sd', 'struct iovec *iov', 'int iovlen', 'struct sockaddr *to', '__socklen_t tolen', 'struct sctp_sndrcvinfo *sinfo', 'int flags']
 	case 473: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -4774,6 +5131,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 474 int sctp_generic_recvmsg ['int sd', 'struct iovec *iov', 'int iovlen', 'struct sockaddr *from', '__socklen_t *fromlenaddr', 'struct sctp_sndrcvinfo *sinfo', 'int *msg_flags']
 	case 474: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -4797,6 +5155,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 475 ssize_t pread ['int fd', 'void *buf', 'size_t nbyte', 'off_t offset']
 	case 475: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4814,6 +5173,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 476 ssize_t pwrite ['int fd', 'const void *buf', 'size_t nbyte', 'off_t offset']
 	case 476: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4831,6 +5191,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 478 off_t lseek ['int fd', 'off_t offset', 'int whence']
 	case 478: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -4846,6 +5207,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 479 int truncate ['const char *path', 'off_t length']
 	case 479: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -4859,6 +5221,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 480 int ftruncate ['int fd', 'off_t length']
 	case 480: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -4872,6 +5235,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 481 int thr_kill2 ['pid_t pid', 'long id', 'int sig']
 	case 481: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int64_t arg1 = get_s64(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -4887,6 +5251,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 482 int shm_open ['const char *path', 'int flags', 'mode_t mode']
 	case 482: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4902,6 +5267,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 483 int shm_unlink ['const char *path']
 	case 483: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -4913,6 +5279,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 484 int cpuset ['cpusetid_t *setid']
 	case 484: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -4924,6 +5291,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 485 int cpuset_setid ['cpuwhich_t which', 'id_t id', 'cpusetid_t setid']
 	case 485: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4939,6 +5307,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 486 int cpuset_getid ['cpulevel_t level', 'cpuwhich_t which', 'id_t id', 'cpusetid_t *setid']
 	case 486: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4956,6 +5325,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 487 int cpuset_getaffinity ['cpulevel_t level', 'cpuwhich_t which', 'id_t id', 'size_t cpusetsize', 'cpuset_t *mask']
 	case 487: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4975,6 +5345,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 488 int cpuset_setaffinity ['cpulevel_t level', 'cpuwhich_t which', 'id_t id', 'size_t cpusetsize', 'const cpuset_t *mask']
 	case 488: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4994,6 +5365,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 489 int faccessat ['int fd', 'const char *path', 'int amode', 'int flag']
 	case 489: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -5011,6 +5383,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 490 int fchmodat ['int fd', 'const char *path', 'mode_t mode', 'int flag']
 	case 490: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -5028,6 +5401,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 491 int fchownat ['int fd', 'const char *path', 'uid_t uid', 'gid_t gid', 'int flag']
 	case 491: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -5047,6 +5421,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 492 int fexecve ['int fd', 'char **argv', 'char **envv']
 	case 492: {
 		panda_noreturn = true;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -5062,6 +5437,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 493 int fstatat ['int fd', 'const char *path', 'struct freebsd11_stat *buf', 'int flag']
 	case 493: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -5079,6 +5455,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 494 int futimesat ['int fd', 'const char *path', 'struct timeval *times']
 	case 494: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -5094,6 +5471,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 495 int linkat ['int fd1', 'const char *path1', 'int fd2', 'const char *path2', 'int flag']
 	case 495: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -5113,6 +5491,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 496 int mkdirat ['int fd', 'const char *path', 'mode_t mode']
 	case 496: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -5128,6 +5507,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 497 int mkfifoat ['int fd', 'const char *path', 'mode_t mode']
 	case 497: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -5143,6 +5523,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 498 int mknodat ['int fd', 'const char *path', 'mode_t mode', 'uint32_t dev']
 	case 498: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -5160,6 +5541,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 499 int openat ['int fd', 'const char *path', 'int flag', 'mode_t mode']
 	case 499: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -5177,6 +5559,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 500 ssize_t readlinkat ['int fd', 'const char *path', 'char *buf', 'size_t bufsize']
 	case 500: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -5194,6 +5577,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 501 int renameat ['int oldfd', 'const char *old', 'int newfd', 'const char *new']
 	case 501: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -5211,6 +5595,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 502 int symlinkat ['const char *path1', 'int fd', 'const char *path2']
 	case 502: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -5226,6 +5611,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 503 int unlinkat ['int fd', 'const char *path', 'int flag']
 	case 503: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -5241,6 +5627,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 504 int posix_openpt ['int flags']
 	case 504: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -5252,6 +5639,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 505 int gssd_syscall ['const char *path']
 	case 505: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -5263,6 +5651,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 506 int jail_get ['struct iovec *iovp', 'unsigned int iovcnt', 'int flags']
 	case 506: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -5278,6 +5667,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 507 int jail_set ['struct iovec *iovp', 'unsigned int iovcnt', 'int flags']
 	case 507: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -5293,6 +5683,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 508 int jail_remove ['int jid']
 	case 508: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -5304,6 +5695,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 509 int closefrom ['int lowfd']
 	case 509: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -5315,6 +5707,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 510 int __semctl ['int semid', 'int semnum', 'int cmd', 'union semun *arg']
 	case 510: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -5332,6 +5725,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 511 int msgctl ['int msqid', 'int cmd', 'struct msqid_ds *buf']
 	case 511: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -5347,6 +5741,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 512 int shmctl ['int shmid', 'int cmd', 'struct shmid_ds *buf']
 	case 512: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -5362,6 +5757,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 513 int lpathconf ['const char *path', 'int name']
 	case 513: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -5375,6 +5771,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 515 int __cap_rights_get ['int version', 'int fd', 'cap_rights_t *rightsp']
 	case 515: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -5390,11 +5787,13 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 516 int cap_enter ['void']
 	case 516: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_cap_enter_enter, cpu, pc);
 	}; break;
 	// 517 int cap_getmode ['unsigned *modep']
 	case 517: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -5406,6 +5805,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 518 int pdfork ['int *fdp', 'int flags']
 	case 518: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -5419,6 +5819,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 519 int pdkill ['int fd', 'int signum']
 	case 519: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -5432,6 +5833,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 520 int pdgetpid ['int fd', 'pid_t *pidp']
 	case 520: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -5445,6 +5847,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 522 int pselect ['int nd', 'fd_set *in', 'fd_set *ou', 'fd_set *ex', 'const struct timespec *ts', 'const sigset_t *sm']
 	case 522: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -5466,6 +5869,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 523 int getloginclass ['char *namebuf', 'size_t namelen']
 	case 523: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -5479,6 +5883,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 524 int setloginclass ['const char *namebuf']
 	case 524: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -5490,6 +5895,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 525 int rctl_get_racct ['const void *inbufp', 'size_t inbuflen', 'void *outbufp', 'size_t outbuflen']
 	case 525: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -5507,6 +5913,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 526 int rctl_get_rules ['const void *inbufp', 'size_t inbuflen', 'void *outbufp', 'size_t outbuflen']
 	case 526: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -5524,6 +5931,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 527 int rctl_get_limits ['const void *inbufp', 'size_t inbuflen', 'void *outbufp', 'size_t outbuflen']
 	case 527: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -5541,6 +5949,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 528 int rctl_add_rule ['const void *inbufp', 'size_t inbuflen', 'void *outbufp', 'size_t outbuflen']
 	case 528: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -5558,6 +5967,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 529 int rctl_remove_rule ['const void *inbufp', 'size_t inbuflen', 'void *outbufp', 'size_t outbuflen']
 	case 529: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -5575,6 +5985,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 530 int posix_fallocate ['int fd', 'off_t offset', 'off_t len']
 	case 530: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -5590,6 +6001,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 531 int posix_fadvise ['int fd', 'off_t offset', 'off_t len', 'int advice']
 	case 531: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -5607,6 +6019,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 532 int wait6 ['idtype_t idtype', 'id_t id', 'int *status', 'int options', 'struct __wrusage *wrusage', 'siginfo_t *info']
 	case 532: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -5628,6 +6041,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 533 int cap_rights_limit ['int fd', 'cap_rights_t *rightsp']
 	case 533: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -5641,6 +6055,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 534 int cap_ioctls_limit ['int fd', 'const u_long *cmds', 'size_t ncmds']
 	case 534: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -5656,6 +6071,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 535 ssize_t cap_ioctls_get ['int fd', 'u_long *cmds', 'size_t maxcmds']
 	case 535: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -5671,6 +6087,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 536 int cap_fcntls_limit ['int fd', 'uint32_t fcntlrights']
 	case 536: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -5684,6 +6101,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 537 int cap_fcntls_get ['int fd', 'uint32_t *fcntlrightsp']
 	case 537: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -5697,6 +6115,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 538 int bindat ['int fd', 'int s', 'const struct sockaddr *name', 'int namelen']
 	case 538: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -5714,6 +6133,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 539 int connectat ['int fd', 'int s', 'const struct sockaddr *name', 'int namelen']
 	case 539: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -5731,6 +6151,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 540 int chflagsat ['int fd', 'const char *path', 'u_long flags', 'int atflag']
 	case 540: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		int64_t arg2 = get_s64(cpu, 2);
@@ -5748,6 +6169,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 541 int accept4 ['int s', 'struct sockaddr *name', '__socklen_t *anamelen', 'int flags']
 	case 541: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -5765,6 +6187,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 542 int pipe2 ['int *fildes', 'int flags']
 	case 542: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -5778,6 +6201,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 543 int aio_mlock ['struct aiocb *aiocbp']
 	case 543: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -5789,6 +6213,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 544 int procctl ['idtype_t idtype', 'id_t id', 'int com', 'void *data']
 	case 544: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -5806,6 +6231,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 545 int ppoll ['struct pollfd *fds', 'unsigned nfds', 'const struct timespec *ts', 'const sigset_t *set']
 	case 545: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -5823,6 +6249,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 546 int futimens ['int fd', 'struct timespec *times']
 	case 546: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -5836,6 +6263,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 547 int utimensat ['int fd', 'const char *path', 'struct timespec *times', 'int flag']
 	case 547: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -5853,6 +6281,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 550 int fdatasync ['int fd']
 	case 550: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -5864,6 +6293,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 551 int fstat ['int fd', 'struct stat *sb']
 	case 551: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -5877,6 +6307,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 552 int fstatat ['int fd', 'const char *path', 'struct stat *buf', 'int flag']
 	case 552: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -5894,6 +6325,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 553 int fhstat ['const struct fhandle *u_fhp', 'struct stat *sb']
 	case 553: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -5907,6 +6339,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 554 ssize_t getdirentries ['int fd', 'char *buf', 'size_t count', 'off_t *basep']
 	case 554: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -5924,6 +6357,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 555 int statfs ['const char *path', 'struct statfs *buf']
 	case 555: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -5937,6 +6371,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 556 int fstatfs ['int fd', 'struct statfs *buf']
 	case 556: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -5950,6 +6385,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 557 int getfsstat ['struct statfs *buf', 'long bufsize', 'int mode']
 	case 557: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		int64_t arg1 = get_s64(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -5965,6 +6401,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 558 int fhstatfs ['const struct fhandle *u_fhp', 'struct statfs *buf']
 	case 558: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -5978,6 +6415,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 559 int mknodat ['int fd', 'const char *path', 'mode_t mode', 'dev_t dev']
 	case 559: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -5995,6 +6433,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 560 int kevent ['int fd', 'struct kevent *changelist', 'int nchanges', 'struct kevent *eventlist', 'int nevents', 'const struct timespec *timeout']
 	case 560: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -6016,6 +6455,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 561 int cpuset_getdomain ['cpulevel_t level', 'cpuwhich_t which', 'id_t id', 'size_t domainsetsize', 'domainset_t *mask', 'int *policy']
 	case 561: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -6037,6 +6477,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 562 int cpuset_setdomain ['cpulevel_t level', 'cpuwhich_t which', 'id_t id', 'size_t domainsetsize', 'domainset_t *mask', 'int policy']
 	case 562: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -6058,6 +6499,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 563 int getrandom ['void *buf', 'size_t buflen', 'unsigned int flags']
 	case 563: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -6073,6 +6515,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 564 int getfhat ['int fd', 'char *path', 'struct fhandle *fhp', 'int flags']
 	case 564: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -6090,6 +6533,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 565 int fhlink ['struct fhandle *fhp', 'const char *to']
 	case 565: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -6103,6 +6547,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 566 int fhlinkat ['struct fhandle *fhp', 'int tofd', 'const char *to', '']
 	case 566: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -6118,6 +6563,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 567 int fhreadlink ['struct fhandle *fhp', 'char *buf', 'size_t bufsize']
 	case 567: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -6133,6 +6579,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 568 int funlinkat ['int dfd', 'const char *path', 'int fd', 'int flag']
 	case 568: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -6150,6 +6597,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 569 ssize_t copy_file_range ['int infd', 'off_t *inoffp', 'int outfd', 'off_t *outoffp', 'size_t len', 'unsigned int flags']
 	case 569: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -6171,6 +6619,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 570 int __sysctlbyname ['const char *name', 'size_t namelen', 'void *old', 'size_t *oldlenp', 'void *new', 'size_t newlen']
 	case 570: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -6192,6 +6641,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 571 int shm_open2 ['const char *path', 'int flags', 'mode_t mode', 'int shmflags', 'const char *name']
 	case 571: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -6211,6 +6661,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 572 int shm_rename ['const char *path_from', 'const char *path_to', 'int flags']
 	case 572: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -6226,6 +6677,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 573 int sigfastblock ['int cmd', 'uint32_t *ptr']
 	case 573: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -6239,6 +6691,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 574 int __realpathat ['int fd', 'const char *path', 'char *buf', 'size_t size', 'int flags']
 	case 574: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -6258,6 +6711,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 575 int close_range ['unsigned lowfd', 'unsigned highfd', 'int flags']
 	case 575: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -6273,6 +6727,7 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 	// 576 int rpctls_syscall ['int op', 'const char *path']
 	case 576: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
diff --git a/panda/plugins/syscalls2/generated/syscall_switch_enter_linux_arm.cpp b/panda/plugins/syscalls2/generated/syscall_switch_enter_linux_arm.cpp
index f9051ed8d2b..117d4fa92bf 100644
--- a/panda/plugins/syscalls2/generated/syscall_switch_enter_linux_arm.cpp
+++ b/panda/plugins/syscalls2/generated/syscall_switch_enter_linux_arm.cpp
@@ -33,6 +33,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	}
 	ctx.asid = panda_current_asid(cpu);
 	ctx.retaddr = calc_retaddr(cpu, pc);
+	ctx.double_return = false;
 	bool panda_noreturn;	// true if PANDA should not track the return of this system call
 	const syscall_info_t *call = NULL;
 	syscall_info_t zero = {0};
@@ -48,11 +49,13 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 0 long sys_restart_syscall ['void']
 	case 0: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_restart_syscall_enter, cpu, pc);
 	}; break;
 	// 1 long sys_exit ['int error_code']
 	case 1: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -64,11 +67,13 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 2 long sys_fork ['void']
 	case 2: {
 		panda_noreturn = false;
+		ctx.double_return = true;
 		PPP_RUN_CB(on_sys_fork_enter, cpu, pc);
 	}; break;
 	// 3 long sys_read ['unsigned int fd', 'char __user *buf', 'size_t count']
 	case 3: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -84,6 +89,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 4 long sys_write ['unsigned int fd', 'const char __user *buf', 'size_t count']
 	case 4: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -99,6 +105,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 5 long sys_open ['const char __user *filename', 'int flags', 'umode_t mode']
 	case 5: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -114,6 +121,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 6 long sys_close ['unsigned int fd']
 	case 6: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -125,6 +133,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 8 long sys_creat ['const char __user *pathname', 'umode_t mode']
 	case 8: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -138,6 +147,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 9 long sys_link ['const char __user *oldname', 'const char __user *newname']
 	case 9: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -151,6 +161,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 10 long sys_unlink ['const char __user *pathname']
 	case 10: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -162,6 +173,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 11 long sys_execve ['const char __user *filename', 'const char __user *const __user *argv', 'const char __user *const __user *envp']
 	case 11: {
 		panda_noreturn = true;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -177,6 +189,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 12 long sys_chdir ['const char __user *filename']
 	case 12: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -188,6 +201,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 13 long sys_time ['time_t __user *tloc']
 	case 13: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -199,6 +213,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 14 long sys_mknod ['const char __user *filename', 'umode_t mode', 'unsigned dev']
 	case 14: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -214,6 +229,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 15 long sys_chmod ['const char __user *filename', 'umode_t mode']
 	case 15: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -227,6 +243,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 16 long sys_lchown16 ['const char __user *filename', 'old_uid_t user', 'old_gid_t group']
 	case 16: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -242,6 +259,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 19 long sys_lseek ['unsigned int fd', 'off_t offset', 'unsigned int whence']
 	case 19: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -257,11 +275,13 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 20 long sys_getpid ['void']
 	case 20: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_getpid_enter, cpu, pc);
 	}; break;
 	// 21 long sys_mount ['char __user *dev_name', 'char __user *dir_name', 'char __user *type', 'unsigned long flags', 'void __user *data']
 	case 21: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -281,6 +301,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 23 long sys_setuid16 ['old_uid_t uid']
 	case 23: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -292,11 +313,13 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 24 long sys_getuid16 ['void']
 	case 24: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_getuid16_enter, cpu, pc);
 	}; break;
 	// 25 long sys_stime ['time_t __user *tptr']
 	case 25: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -308,6 +331,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 26 long sys_ptrace ['long request', 'long pid', 'unsigned long addr', 'unsigned long data']
 	case 26: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -325,6 +349,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 27 long sys_alarm ['unsigned int seconds']
 	case 27: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -336,11 +361,13 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 29 long sys_pause ['void']
 	case 29: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_pause_enter, cpu, pc);
 	}; break;
 	// 30 long sys_utime ['char __user *filename', 'struct utimbuf __user *times']
 	case 30: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -354,6 +381,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 33 long sys_access ['const char __user *filename', 'int mode']
 	case 33: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -367,6 +395,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 34 long sys_nice ['int increment']
 	case 34: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -378,11 +407,13 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 36 long sys_sync ['void']
 	case 36: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_sync_enter, cpu, pc);
 	}; break;
 	// 37 long sys_kill ['int pid', 'int sig']
 	case 37: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -396,6 +427,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 38 long sys_rename ['const char __user *oldname', 'const char __user *newname']
 	case 38: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -409,6 +441,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 39 long sys_mkdir ['const char __user *pathname', 'umode_t mode']
 	case 39: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -422,6 +455,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 40 long sys_rmdir ['const char __user *pathname']
 	case 40: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -433,6 +467,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 41 long sys_dup ['unsigned int fildes']
 	case 41: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -444,6 +479,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 42 long sys_pipe ['int __user *fildes']
 	case 42: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -455,6 +491,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 43 long sys_times ['struct tms __user *tbuf']
 	case 43: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -466,6 +503,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 45 long sys_brk ['unsigned long brk']
 	case 45: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -477,6 +515,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 46 long sys_setgid16 ['old_gid_t gid']
 	case 46: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -488,21 +527,25 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 47 long sys_getgid16 ['void']
 	case 47: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_getgid16_enter, cpu, pc);
 	}; break;
 	// 49 long sys_geteuid16 ['void']
 	case 49: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_geteuid16_enter, cpu, pc);
 	}; break;
 	// 50 long sys_getegid16 ['void']
 	case 50: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_getegid16_enter, cpu, pc);
 	}; break;
 	// 51 long sys_acct ['const char __user *name']
 	case 51: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -514,6 +557,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 52 long sys_umount ['char __user *name', 'int flags']
 	case 52: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -527,6 +571,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 54 long sys_ioctl ['unsigned int fd', 'unsigned int cmd', 'unsigned long arg']
 	case 54: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -542,6 +587,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 55 long sys_fcntl ['unsigned int fd', 'unsigned int cmd', 'unsigned long arg']
 	case 55: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -557,6 +603,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 57 long sys_setpgid ['pid_t pid', 'pid_t pgid']
 	case 57: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -570,6 +617,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 60 long sys_umask ['int mask']
 	case 60: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -581,6 +629,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 61 long sys_chroot ['const char __user *filename']
 	case 61: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -592,6 +641,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 62 long sys_ustat ['unsigned dev', 'struct ustat __user *ubuf']
 	case 62: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -605,6 +655,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 63 long sys_dup2 ['unsigned int oldfd', 'unsigned int newfd']
 	case 63: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -618,21 +669,25 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 64 long sys_getppid ['void']
 	case 64: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_getppid_enter, cpu, pc);
 	}; break;
 	// 65 long sys_getpgrp ['void']
 	case 65: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_getpgrp_enter, cpu, pc);
 	}; break;
 	// 66 long sys_setsid ['void']
 	case 66: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_setsid_enter, cpu, pc);
 	}; break;
 	// 67 long sys_sigaction ['int', 'const struct old_sigaction __user *', 'struct old_sigaction __user *']
 	case 67: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -648,6 +703,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 70 long sys_setreuid16 ['old_uid_t ruid', 'old_uid_t euid']
 	case 70: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -661,6 +717,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 71 long sys_setregid16 ['old_gid_t rgid', 'old_gid_t egid']
 	case 71: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -674,6 +731,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 72 long sys_sigsuspend ['int unused1', 'int unused2', 'old_sigset_t mask']
 	case 72: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -689,6 +747,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 73 long sys_sigpending ['old_sigset_t __user *set']
 	case 73: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -700,6 +759,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 74 long sys_sethostname ['char __user *name', 'int len']
 	case 74: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -713,6 +773,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 75 long sys_setrlimit ['unsigned int resource', 'struct rlimit __user *rlim']
 	case 75: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -726,6 +787,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 77 long sys_getrusage ['int who', 'struct rusage __user *ru']
 	case 77: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -739,6 +801,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 78 long sys_gettimeofday ['struct timeval __user *tv', 'struct timezone __user *tz']
 	case 78: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -752,6 +815,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 79 long sys_settimeofday ['struct timeval __user *tv', 'struct timezone __user *tz']
 	case 79: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -765,6 +829,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 80 long sys_getgroups16 ['int gidsetsize', 'old_gid_t __user *grouplist']
 	case 80: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -778,6 +843,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 81 long sys_setgroups16 ['int gidsetsize', 'old_gid_t __user *grouplist']
 	case 81: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -791,6 +857,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 83 long sys_symlink ['const char __user *old', 'const char __user *new']
 	case 83: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -804,6 +871,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 85 long sys_readlink ['const char __user *path', 'char __user *buf', 'int bufsiz']
 	case 85: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -819,6 +887,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 86 long sys_uselib ['const char __user *library']
 	case 86: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -830,6 +899,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 87 long sys_swapon ['const char __user *specialfile', 'int swap_flags']
 	case 87: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -843,6 +913,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 88 long sys_reboot ['int magic1', 'int magic2', 'unsigned int cmd', 'void __user *arg']
 	case 88: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -860,6 +931,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 91 long sys_munmap ['unsigned long addr', 'size_t len']
 	case 91: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -873,6 +945,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 92 long sys_truncate ['const char __user *path', 'long length']
 	case 92: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -886,6 +959,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 93 long sys_ftruncate ['unsigned int fd', 'unsigned long length']
 	case 93: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -899,6 +973,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 94 long sys_fchmod ['unsigned int fd', 'umode_t mode']
 	case 94: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -912,6 +987,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 95 long sys_fchown16 ['unsigned int fd', 'old_uid_t user', 'old_gid_t group']
 	case 95: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -927,6 +1003,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 96 long sys_getpriority ['int which', 'int who']
 	case 96: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -940,6 +1017,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 97 long sys_setpriority ['int which', 'int who', 'int niceval']
 	case 97: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -955,6 +1033,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 99 long sys_statfs ['const char __user *path', 'struct statfs __user *buf']
 	case 99: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -968,6 +1047,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 100 long sys_fstatfs ['unsigned int fd', 'struct statfs __user *buf']
 	case 100: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -981,6 +1061,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 102 long sys_socketcall ['int call', 'unsigned long __user *args']
 	case 102: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -994,6 +1075,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 103 long sys_syslog ['int type', 'char __user *buf', 'int len']
 	case 103: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -1009,6 +1091,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 104 long sys_setitimer ['int which', 'struct itimerval __user *value', 'struct itimerval __user *ovalue']
 	case 104: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1024,6 +1107,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 105 long sys_getitimer ['int which', 'struct itimerval __user *value']
 	case 105: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1037,6 +1121,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 106 long sys_newstat ['const char __user *filename', 'struct stat __user *statbuf']
 	case 106: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1050,6 +1135,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 107 long sys_newlstat ['const char __user *filename', 'struct stat __user *statbuf']
 	case 107: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1063,6 +1149,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 108 long sys_newfstat ['unsigned int fd', 'struct stat __user *statbuf']
 	case 108: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1076,11 +1163,13 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 111 long sys_vhangup ['void']
 	case 111: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_vhangup_enter, cpu, pc);
 	}; break;
 	// 114 long sys_wait4 ['pid_t pid', 'int __user *stat_addr', 'int options', 'struct rusage __user *ru']
 	case 114: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -1098,6 +1187,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 115 long sys_swapoff ['const char __user *specialfile']
 	case 115: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1109,6 +1199,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 116 long sys_sysinfo ['struct sysinfo __user *info']
 	case 116: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1120,6 +1211,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 117 long sys_ipc ['unsigned int call', 'int first', 'unsigned long second', 'unsigned long third', 'void __user *ptr', 'long fifth']
 	case 117: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1141,6 +1233,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 118 long sys_fsync ['unsigned int fd']
 	case 118: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1152,6 +1245,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 119 int sys_sigreturn ['struct pt_regs *regs']
 	case 119: {
 		panda_noreturn = true;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1163,6 +1257,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 120 long sys_clone ['unsigned long', 'unsigned long', 'int __user *', 'int __user *', 'unsigned long']
 	case 120: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1182,6 +1277,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 121 long sys_setdomainname ['char __user *name', 'int len']
 	case 121: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1195,6 +1291,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 122 long sys_newuname ['struct new_utsname __user *name']
 	case 122: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1206,6 +1303,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 124 long sys_adjtimex ['struct timex __user *txc_p']
 	case 124: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1217,6 +1315,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 125 long sys_mprotect ['unsigned long start', 'size_t len', 'unsigned long prot']
 	case 125: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1232,6 +1331,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 126 long sys_sigprocmask ['int how', 'old_sigset_t __user *set', 'old_sigset_t __user *oset']
 	case 126: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1247,6 +1347,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 128 long sys_init_module ['void __user *umod', 'unsigned long len', 'const char __user *uargs']
 	case 128: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1262,6 +1363,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 129 long sys_delete_module ['const char __user *name_user', 'unsigned int flags']
 	case 129: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1275,6 +1377,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 131 long sys_quotactl ['unsigned int cmd', 'const char __user *special', 'qid_t id', 'void __user *addr']
 	case 131: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1292,6 +1395,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 132 long sys_getpgid ['pid_t pid']
 	case 132: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1303,6 +1407,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 133 long sys_fchdir ['unsigned int fd']
 	case 133: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1314,6 +1419,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 134 long sys_bdflush ['int func', 'long data']
 	case 134: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1327,6 +1433,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 135 long sys_sysfs ['int option', 'unsigned long arg1', 'unsigned long arg2']
 	case 135: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1342,6 +1449,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 136 long sys_personality ['unsigned int personality']
 	case 136: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1353,6 +1461,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 138 long sys_setfsuid16 ['old_uid_t uid']
 	case 138: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1364,6 +1473,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 139 long sys_setfsgid16 ['old_gid_t gid']
 	case 139: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1375,6 +1485,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 140 long sys_llseek ['unsigned int fd', 'unsigned long offset_high', 'unsigned long offset_low', 'loff_t __user *result', 'unsigned int whence']
 	case 140: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1394,6 +1505,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 141 long sys_getdents ['unsigned int fd', 'struct linux_dirent __user *dirent', 'unsigned int count']
 	case 141: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1409,6 +1521,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 142 long sys_select ['int n', 'fd_set __user *inp', 'fd_set __user *outp', 'fd_set __user *exp', 'struct timeval __user *tvp']
 	case 142: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1428,6 +1541,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 143 long sys_flock ['unsigned int fd', 'unsigned int cmd']
 	case 143: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1441,6 +1555,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 144 long sys_msync ['unsigned long start', 'size_t len', 'int flags']
 	case 144: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -1456,6 +1571,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 145 long sys_readv ['unsigned long fd', 'const struct iovec __user *vec', 'unsigned long vlen']
 	case 145: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1471,6 +1587,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 146 long sys_writev ['unsigned long fd', 'const struct iovec __user *vec', 'unsigned long vlen']
 	case 146: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1486,6 +1603,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 147 long sys_getsid ['pid_t pid']
 	case 147: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1497,6 +1615,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 148 long sys_fdatasync ['unsigned int fd']
 	case 148: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1508,6 +1627,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 149 long sys_sysctl ['struct __sysctl_args __user *args']
 	case 149: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1519,6 +1639,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 150 long sys_mlock ['unsigned long start', 'size_t len']
 	case 150: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1532,6 +1653,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 151 long sys_munlock ['unsigned long start', 'size_t len']
 	case 151: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1545,6 +1667,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 152 long sys_mlockall ['int flags']
 	case 152: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1556,11 +1679,13 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 153 long sys_munlockall ['void']
 	case 153: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_munlockall_enter, cpu, pc);
 	}; break;
 	// 154 long sys_sched_setparam ['pid_t pid', 'struct sched_param __user *param']
 	case 154: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1574,6 +1699,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 155 long sys_sched_getparam ['pid_t pid', 'struct sched_param __user *param']
 	case 155: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1587,6 +1713,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 156 long sys_sched_setscheduler ['pid_t pid', 'int policy', 'struct sched_param __user *param']
 	case 156: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1602,6 +1729,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 157 long sys_sched_getscheduler ['pid_t pid']
 	case 157: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1613,11 +1741,13 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 158 long sys_sched_yield ['void']
 	case 158: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_sched_yield_enter, cpu, pc);
 	}; break;
 	// 159 long sys_sched_get_priority_max ['int policy']
 	case 159: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1629,6 +1759,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 160 long sys_sched_get_priority_min ['int policy']
 	case 160: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1640,6 +1771,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 161 long sys_sched_rr_get_interval ['pid_t pid', 'struct timespec __user *interval']
 	case 161: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1653,6 +1785,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 162 long sys_nanosleep ['struct timespec __user *rqtp', 'struct timespec __user *rmtp']
 	case 162: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1666,6 +1799,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 163 long sys_mremap ['unsigned long addr', 'unsigned long old_len', 'unsigned long new_len', 'unsigned long flags', 'unsigned long new_addr']
 	case 163: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1685,6 +1819,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 164 long sys_setresuid16 ['old_uid_t ruid', 'old_uid_t euid', 'old_uid_t suid']
 	case 164: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1700,6 +1835,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 165 long sys_getresuid16 ['old_uid_t __user *ruid', 'old_uid_t __user *euid', 'old_uid_t __user *suid']
 	case 165: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1715,6 +1851,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 168 long sys_poll ['struct pollfd __user *ufds', 'unsigned int nfds', 'int timeout']
 	case 168: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -1730,6 +1867,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 170 long sys_setresgid16 ['old_gid_t rgid', 'old_gid_t egid', 'old_gid_t sgid']
 	case 170: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1745,6 +1883,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 171 long sys_getresgid16 ['old_gid_t __user *rgid', 'old_gid_t __user *egid', 'old_gid_t __user *sgid']
 	case 171: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1760,6 +1899,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 172 long sys_prctl ['int option', 'unsigned long arg2', 'unsigned long arg3', 'unsigned long arg4', 'unsigned long arg5']
 	case 172: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1779,6 +1919,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 173 int sys_rt_sigreturn ['struct pt_regs *regs']
 	case 173: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1790,6 +1931,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 174 long sys_rt_sigaction ['int', 'const struct sigaction __user *', 'struct sigaction __user *', 'size_t']
 	case 174: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1807,6 +1949,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 175 long sys_rt_sigprocmask ['int how', 'sigset_t __user *set', 'sigset_t __user *oset', 'size_t sigsetsize']
 	case 175: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1824,6 +1967,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 176 long sys_rt_sigpending ['sigset_t __user *set', 'size_t sigsetsize']
 	case 176: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1837,6 +1981,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 177 long sys_rt_sigtimedwait ['const sigset_t __user *uthese', 'siginfo_t __user *uinfo', 'const struct timespec __user *uts', 'size_t sigsetsize']
 	case 177: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1854,6 +1999,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 178 long sys_rt_sigqueueinfo ['int pid', 'int sig', 'siginfo_t __user *uinfo']
 	case 178: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1869,6 +2015,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 179 long sys_rt_sigsuspend ['sigset_t __user *unewset', 'size_t sigsetsize']
 	case 179: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1882,6 +2029,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 180 long sys_pread64 ['unsigned int fd', 'char __user *buf', 'size_t count', 'loff_t pos']
 	case 180: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1899,6 +2047,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 181 long sys_pwrite64 ['unsigned int fd', 'const char __user *buf', 'size_t count', 'loff_t pos']
 	case 181: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1916,6 +2065,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 182 long sys_chown16 ['const char __user *filename', 'old_uid_t user', 'old_gid_t group']
 	case 182: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1931,6 +2081,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 183 long sys_getcwd ['char __user *buf', 'unsigned long size']
 	case 183: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1944,6 +2095,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 184 long sys_capget ['cap_user_header_t header', 'cap_user_data_t dataptr']
 	case 184: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1957,6 +2109,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 185 long sys_capset ['cap_user_header_t header', 'const cap_user_data_t data']
 	case 185: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1970,6 +2123,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 186 long sys_sigaltstack ['const struct sigaltstack __user *uss', 'struct sigaltstack __user *uoss']
 	case 186: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1983,6 +2137,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 187 long sys_sendfile ['int out_fd', 'int in_fd', 'off_t __user *offset', 'size_t count']
 	case 187: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2000,11 +2155,13 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 190 long sys_vfork ['void']
 	case 190: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_vfork_enter, cpu, pc);
 	}; break;
 	// 191 long sys_getrlimit ['unsigned int resource', 'struct rlimit __user *rlim']
 	case 191: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2018,6 +2175,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 192 long do_mmap2 ['unsigned long addr', 'unsigned long len', 'unsigned long prot', 'unsigned long flags', 'unsigned long fd', 'unsigned long pgoff']
 	case 192: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2039,6 +2197,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 193 long sys_truncate64 ['const char __user *path', 'loff_t length']
 	case 193: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2052,6 +2211,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 194 long sys_ftruncate64 ['unsigned int fd', 'loff_t length']
 	case 194: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2065,6 +2225,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 195 long sys_stat64 ['const char __user *filename', 'struct stat64 __user *statbuf']
 	case 195: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2078,6 +2239,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 196 long sys_lstat64 ['const char __user *filename', 'struct stat64 __user *statbuf']
 	case 196: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2091,6 +2253,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 197 long sys_fstat64 ['unsigned long fd', 'struct stat64 __user *statbuf']
 	case 197: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2104,6 +2267,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 198 long sys_lchown ['const char __user *filename', 'uid_t user', 'gid_t group']
 	case 198: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2119,26 +2283,31 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 199 long sys_getuid ['void']
 	case 199: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_getuid_enter, cpu, pc);
 	}; break;
 	// 200 long sys_getgid ['void']
 	case 200: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_getgid_enter, cpu, pc);
 	}; break;
 	// 201 long sys_geteuid ['void']
 	case 201: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_geteuid_enter, cpu, pc);
 	}; break;
 	// 202 long sys_getegid ['void']
 	case 202: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_getegid_enter, cpu, pc);
 	}; break;
 	// 203 long sys_setreuid ['uid_t ruid', 'uid_t euid']
 	case 203: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2152,6 +2321,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 204 long sys_setregid ['gid_t rgid', 'gid_t egid']
 	case 204: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2165,6 +2335,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 205 long sys_getgroups ['int gidsetsize', 'gid_t __user *grouplist']
 	case 205: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2178,6 +2349,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 206 long sys_setgroups ['int gidsetsize', 'gid_t __user *grouplist']
 	case 206: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2191,6 +2363,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 207 long sys_fchown ['unsigned int fd', 'uid_t user', 'gid_t group']
 	case 207: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2206,6 +2379,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 208 long sys_setresuid ['uid_t ruid', 'uid_t euid', 'uid_t suid']
 	case 208: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2221,6 +2395,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 209 long sys_getresuid ['uid_t __user *ruid', 'uid_t __user *euid', 'uid_t __user *suid']
 	case 209: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2236,6 +2411,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 210 long sys_setresgid ['gid_t rgid', 'gid_t egid', 'gid_t sgid']
 	case 210: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2251,6 +2427,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 211 long sys_getresgid ['gid_t __user *rgid', 'gid_t __user *egid', 'gid_t __user *sgid']
 	case 211: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2266,6 +2443,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 212 long sys_chown ['const char __user *filename', 'uid_t user', 'gid_t group']
 	case 212: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2281,6 +2459,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 213 long sys_setuid ['uid_t uid']
 	case 213: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -2292,6 +2471,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 214 long sys_setgid ['gid_t gid']
 	case 214: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -2303,6 +2483,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 215 long sys_setfsuid ['uid_t uid']
 	case 215: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -2314,6 +2495,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 216 long sys_setfsgid ['gid_t gid']
 	case 216: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -2325,6 +2507,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 217 long sys_getdents64 ['unsigned int fd', 'struct linux_dirent64 __user *dirent', 'unsigned int count']
 	case 217: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2340,6 +2523,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 218 long sys_pivot_root ['const char __user *new_root', 'const char __user *put_old']
 	case 218: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2353,6 +2537,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 219 long sys_mincore ['unsigned long start', 'size_t len', 'unsigned char __user *vec']
 	case 219: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2368,6 +2553,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 220 long sys_madvise ['unsigned long start', 'size_t len', 'int behavior']
 	case 220: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -2383,6 +2569,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 221 long sys_fcntl64 ['unsigned int fd', 'unsigned int cmd', 'unsigned long arg']
 	case 221: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2398,11 +2585,13 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 224 long sys_gettid ['void']
 	case 224: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_gettid_enter, cpu, pc);
 	}; break;
 	// 225 long sys_readahead ['int fd', 'loff_t offset', 'size_t count']
 	case 225: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2418,6 +2607,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 226 long sys_setxattr ['const char __user *path', 'const char __user *name', 'const void __user *value', 'size_t size', 'int flags']
 	case 226: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2437,6 +2627,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 227 long sys_lsetxattr ['const char __user *path', 'const char __user *name', 'const void __user *value', 'size_t size', 'int flags']
 	case 227: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2456,6 +2647,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 228 long sys_fsetxattr ['int fd', 'const char __user *name', 'const void __user *value', 'size_t size', 'int flags']
 	case 228: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2475,6 +2667,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 229 long sys_getxattr ['const char __user *path', 'const char __user *name', 'void __user *value', 'size_t size']
 	case 229: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2492,6 +2685,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 230 long sys_lgetxattr ['const char __user *path', 'const char __user *name', 'void __user *value', 'size_t size']
 	case 230: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2509,6 +2703,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 231 long sys_fgetxattr ['int fd', 'const char __user *name', 'void __user *value', 'size_t size']
 	case 231: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2526,6 +2721,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 232 long sys_listxattr ['const char __user *path', 'char __user *list', 'size_t size']
 	case 232: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2541,6 +2737,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 233 long sys_llistxattr ['const char __user *path', 'char __user *list', 'size_t size']
 	case 233: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2556,6 +2753,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 234 long sys_flistxattr ['int fd', 'char __user *list', 'size_t size']
 	case 234: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2571,6 +2769,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 235 long sys_removexattr ['const char __user *path', 'const char __user *name']
 	case 235: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2584,6 +2783,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 236 long sys_lremovexattr ['const char __user *path', 'const char __user *name']
 	case 236: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2597,6 +2797,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 237 long sys_fremovexattr ['int fd', 'const char __user *name']
 	case 237: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2610,6 +2811,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 238 long sys_tkill ['int pid', 'int sig']
 	case 238: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2623,6 +2825,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 239 long sys_sendfile64 ['int out_fd', 'int in_fd', 'loff_t __user *offset', 'size_t count']
 	case 239: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2640,6 +2843,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 240 long sys_futex ['u32 __user *uaddr', 'int op', 'u32 val', 'struct timespec __user *utime', 'u32 __user *uaddr2', 'u32 val3']
 	case 240: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2661,6 +2865,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 241 long sys_sched_setaffinity ['pid_t pid', 'unsigned int len', 'unsigned long __user *user_mask_ptr']
 	case 241: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2676,6 +2881,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 242 long sys_sched_getaffinity ['pid_t pid', 'unsigned int len', 'unsigned long __user *user_mask_ptr']
 	case 242: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2691,6 +2897,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 243 long sys_io_setup ['unsigned nr_reqs', 'aio_context_t __user *ctx']
 	case 243: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2704,6 +2911,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 244 long sys_io_destroy ['aio_context_t ctx']
 	case 244: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -2715,6 +2923,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 245 long sys_io_getevents ['aio_context_t ctx_id', 'long min_nr', 'long nr', 'struct io_event __user *events', 'struct timespec __user *timeout']
 	case 245: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -2734,6 +2943,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 246 long sys_io_submit ['aio_context_t', 'long', 'struct iocb __user * __user *']
 	case 246: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2749,6 +2959,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 247 long sys_io_cancel ['aio_context_t ctx_id', 'struct iocb __user *iocb', 'struct io_event __user *result']
 	case 247: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2764,6 +2975,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 248 long sys_exit_group ['int error_code']
 	case 248: {
 		panda_noreturn = true;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -2775,6 +2987,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 249 long sys_lookup_dcookie ['u64 cookie64', 'char __user *buf', 'size_t len']
 	case 249: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2790,6 +3003,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 250 long sys_epoll_create ['int size']
 	case 250: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -2801,6 +3015,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 251 long sys_epoll_ctl ['int epfd', 'int op', 'int fd', 'struct epoll_event __user *event']
 	case 251: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -2818,6 +3033,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 252 long sys_epoll_wait ['int epfd', 'struct epoll_event __user *events', 'int maxevents', 'int timeout']
 	case 252: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -2835,6 +3051,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 253 long sys_remap_file_pages ['unsigned long start', 'unsigned long size', 'unsigned long prot', 'unsigned long pgoff', 'unsigned long flags']
 	case 253: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2854,6 +3071,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 256 long sys_set_tid_address ['int __user *tidptr']
 	case 256: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -2865,6 +3083,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 257 long sys_timer_create ['clockid_t which_clock', 'struct sigevent __user *timer_event_spec', 'timer_t __user *created_timer_id']
 	case 257: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2880,6 +3099,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 258 long sys_timer_settime ['timer_t timer_id', 'int flags', 'const struct itimerspec __user *new_setting', 'struct itimerspec __user *old_setting']
 	case 258: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2897,6 +3117,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 259 long sys_timer_gettime ['timer_t timer_id', 'struct itimerspec __user *setting']
 	case 259: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2910,6 +3131,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 260 long sys_timer_getoverrun ['timer_t timer_id']
 	case 260: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -2921,6 +3143,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 261 long sys_timer_delete ['timer_t timer_id']
 	case 261: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -2932,6 +3155,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 262 long sys_clock_settime ['clockid_t which_clock', 'const struct timespec __user *tp']
 	case 262: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2945,6 +3169,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 263 long sys_clock_gettime ['clockid_t which_clock', 'struct timespec __user *tp']
 	case 263: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2958,6 +3183,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 264 long sys_clock_getres ['clockid_t which_clock', 'struct timespec __user *tp']
 	case 264: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2971,6 +3197,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 265 long sys_clock_nanosleep ['clockid_t which_clock', 'int flags', 'const struct timespec __user *rqtp', 'struct timespec __user *rmtp']
 	case 265: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2988,6 +3215,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 266 long sys_statfs64 ['const char __user *path', 'size_t sz', 'struct statfs64 __user *buf']
 	case 266: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3003,6 +3231,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 267 long sys_fstatfs64 ['unsigned int fd', 'size_t sz', 'struct statfs64 __user *buf']
 	case 267: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3018,6 +3247,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 268 long sys_tgkill ['int tgid', 'int pid', 'int sig']
 	case 268: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -3033,6 +3263,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 269 long sys_utimes ['char __user *filename', 'struct timeval __user *utimes']
 	case 269: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3046,6 +3277,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 270 long sys_arm_fadvise64_64 ['int fd', 'int advice', 'loff_t offset', 'loff_t len']
 	case 270: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -3063,6 +3295,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 271 long sys_pciconfig_iobase ['long which', 'unsigned long bus', 'unsigned long devfn']
 	case 271: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3078,6 +3311,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 272 long sys_pciconfig_read ['unsigned long bus', 'unsigned long dfn', 'unsigned long off', 'unsigned long len', 'void __user *buf']
 	case 272: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3097,6 +3331,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 273 long sys_pciconfig_write ['unsigned long bus', 'unsigned long dfn', 'unsigned long off', 'unsigned long len', 'void __user *buf']
 	case 273: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3116,6 +3351,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 274 long sys_mq_open ['const char __user *name', 'int oflag', 'umode_t mode', 'struct mq_attr __user *attr']
 	case 274: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3133,6 +3369,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 275 long sys_mq_unlink ['const char __user *name']
 	case 275: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -3144,6 +3381,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 276 long sys_mq_timedsend ['mqd_t mqdes', 'const char __user *msg_ptr', 'size_t msg_len', 'unsigned int msg_prio', 'const struct timespec __user *abs_timeout']
 	case 276: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3163,6 +3401,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 277 long sys_mq_timedreceive ['mqd_t mqdes', 'char __user *msg_ptr', 'size_t msg_len', 'unsigned int __user *msg_prio', 'const struct timespec __user *abs_timeout']
 	case 277: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3182,6 +3421,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 278 long sys_mq_notify ['mqd_t mqdes', 'const struct sigevent __user *notification']
 	case 278: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3195,6 +3435,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 279 long sys_mq_getsetattr ['mqd_t mqdes', 'const struct mq_attr __user *mqstat', 'struct mq_attr __user *omqstat']
 	case 279: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3210,6 +3451,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 280 long sys_waitid ['int which', 'pid_t pid', 'struct siginfo __user *infop', 'int options', 'struct rusage __user *ru']
 	case 280: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3229,6 +3471,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 281 long sys_socket ['int', 'int', 'int']
 	case 281: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -3244,6 +3487,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 282 long sys_bind ['int', 'struct sockaddr __user *', 'int']
 	case 282: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -3259,6 +3503,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 283 long sys_connect ['int', 'struct sockaddr __user *', 'int']
 	case 283: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -3274,6 +3519,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 284 long sys_listen ['int', 'int']
 	case 284: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3287,6 +3533,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 285 long sys_accept ['int', 'struct sockaddr __user *', 'int __user *']
 	case 285: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3302,6 +3549,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 286 long sys_getsockname ['int', 'struct sockaddr __user *', 'int __user *']
 	case 286: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3317,6 +3565,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 287 long sys_getpeername ['int', 'struct sockaddr __user *', 'int __user *']
 	case 287: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3332,6 +3581,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 288 long sys_socketpair ['int', 'int', 'int', 'int __user *']
 	case 288: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -3349,6 +3599,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 289 long sys_send ['int', 'void __user *', 'size_t', 'unsigned']
 	case 289: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3366,6 +3617,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 290 long sys_sendto ['int', 'void __user *', 'size_t', 'unsigned', 'struct sockaddr __user *', 'int']
 	case 290: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3387,6 +3639,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 291 long sys_recv ['int', 'void __user *', 'size_t', 'unsigned']
 	case 291: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3404,6 +3657,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 292 long sys_recvfrom ['int', 'void __user *', 'size_t', 'unsigned', 'struct sockaddr __user *', 'int __user *']
 	case 292: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3425,6 +3679,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 293 long sys_shutdown ['int', 'int']
 	case 293: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3438,6 +3693,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 294 long sys_setsockopt ['int fd', 'int level', 'int optname', 'char __user *optval', 'int optlen']
 	case 294: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -3457,6 +3713,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 295 long sys_getsockopt ['int fd', 'int level', 'int optname', 'char __user *optval', 'int __user *optlen']
 	case 295: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -3476,6 +3733,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 296 long sys_sendmsg ['int fd', 'struct user_msghdr __user *msg', 'unsigned flags']
 	case 296: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3491,6 +3749,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 297 long sys_recvmsg ['int fd', 'struct user_msghdr __user *msg', 'unsigned flags']
 	case 297: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3506,6 +3765,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 298 long sys_semop ['int semid', 'struct sembuf __user *sops', 'unsigned nsops']
 	case 298: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3521,6 +3781,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 299 long sys_semget ['key_t key', 'int nsems', 'int semflg']
 	case 299: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -3536,6 +3797,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 300 long sys_semctl ['int semid', 'int semnum', 'int cmd', 'unsigned long arg']
 	case 300: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -3553,6 +3815,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 301 long sys_msgsnd ['int msqid', 'struct msgbuf __user *msgp', 'size_t msgsz', 'int msgflg']
 	case 301: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3570,6 +3833,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 302 long sys_msgrcv ['int msqid', 'struct msgbuf __user *msgp', 'size_t msgsz', 'long msgtyp', 'int msgflg']
 	case 302: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3589,6 +3853,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 303 long sys_msgget ['key_t key', 'int msgflg']
 	case 303: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3602,6 +3867,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 304 long sys_msgctl ['int msqid', 'int cmd', 'struct msqid_ds __user *buf']
 	case 304: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3617,6 +3883,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 305 long sys_shmat ['int shmid', 'char __user *shmaddr', 'int shmflg']
 	case 305: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -3632,6 +3899,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 306 long sys_shmdt ['char __user *shmaddr']
 	case 306: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -3643,6 +3911,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 307 long sys_shmget ['key_t key', 'size_t size', 'int flag']
 	case 307: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -3658,6 +3927,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 308 long sys_shmctl ['int shmid', 'int cmd', 'struct shmid_ds __user *buf']
 	case 308: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3673,6 +3943,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 309 long sys_add_key ['const char __user *_type', 'const char __user *_description', 'const void __user *_payload', 'size_t plen', 'key_serial_t destringid']
 	case 309: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3692,6 +3963,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 310 long sys_request_key ['const char __user *_type', 'const char __user *_description', 'const char __user *_callout_info', 'key_serial_t destringid']
 	case 310: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3709,6 +3981,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 311 long sys_keyctl ['int cmd', 'unsigned long arg2', 'unsigned long arg3', 'unsigned long arg4', 'unsigned long arg5']
 	case 311: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3728,6 +4001,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 312 long sys_semtimedop ['int semid', 'struct sembuf __user *sops', 'unsigned nsops', 'const struct timespec __user *timeout']
 	case 312: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3745,6 +4019,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 314 long sys_ioprio_set ['int which', 'int who', 'int ioprio']
 	case 314: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -3760,6 +4035,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 315 long sys_ioprio_get ['int which', 'int who']
 	case 315: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3773,11 +4049,13 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 316 long sys_inotify_init ['void']
 	case 316: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_inotify_init_enter, cpu, pc);
 	}; break;
 	// 317 long sys_inotify_add_watch ['int fd', 'const char __user *path', 'u32 mask']
 	case 317: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3793,6 +4071,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 318 long sys_inotify_rm_watch ['int fd', '__s32 wd']
 	case 318: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3806,6 +4085,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 319 long sys_mbind ['unsigned long start', 'unsigned long len', 'unsigned long mode', 'const unsigned long __user *nmask', 'unsigned long maxnode', 'unsigned flags']
 	case 319: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3827,6 +4107,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 320 long sys_get_mempolicy ['int __user *policy', 'unsigned long __user *nmask', 'unsigned long maxnode', 'unsigned long addr', 'unsigned long flags']
 	case 320: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3846,6 +4127,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 321 long sys_set_mempolicy ['int mode', 'const unsigned long __user *nmask', 'unsigned long maxnode']
 	case 321: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3861,6 +4143,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 322 long sys_openat ['int dfd', 'const char __user *filename', 'int flags', 'umode_t mode']
 	case 322: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -3878,6 +4161,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 323 long sys_mkdirat ['int dfd', 'const char __user *pathname', 'umode_t mode']
 	case 323: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3893,6 +4177,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 324 long sys_mknodat ['int dfd', 'const char __user *filename', 'umode_t mode', 'unsigned dev']
 	case 324: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3910,6 +4195,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 325 long sys_fchownat ['int dfd', 'const char __user *filename', 'uid_t user', 'gid_t group', 'int flag']
 	case 325: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3929,6 +4215,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 326 long sys_futimesat ['int dfd', 'const char __user *filename', 'struct timeval __user *utimes']
 	case 326: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3944,6 +4231,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 327 long sys_fstatat64 ['int dfd', 'const char __user *filename', 'struct stat64 __user *statbuf', 'int flag']
 	case 327: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3961,6 +4249,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 328 long sys_unlinkat ['int dfd', 'const char __user *pathname', 'int flag']
 	case 328: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -3976,6 +4265,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 329 long sys_renameat ['int olddfd', 'const char __user *oldname', 'int newdfd', 'const char __user *newname']
 	case 329: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -3993,6 +4283,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 330 long sys_linkat ['int olddfd', 'const char __user *oldname', 'int newdfd', 'const char __user *newname', 'int flags']
 	case 330: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -4012,6 +4303,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 331 long sys_symlinkat ['const char __user *oldname', 'int newdfd', 'const char __user *newname']
 	case 331: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4027,6 +4319,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 332 long sys_readlinkat ['int dfd', 'const char __user *path', 'char __user *buf', 'int bufsiz']
 	case 332: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4044,6 +4337,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 333 long sys_fchmodat ['int dfd', 'const char __user *filename', 'umode_t mode']
 	case 333: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4059,6 +4353,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 334 long sys_faccessat ['int dfd', 'const char __user *filename', 'int mode']
 	case 334: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -4074,6 +4369,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 335 long sys_pselect6 ['int', 'fd_set __user *', 'fd_set __user *', 'fd_set __user *', 'struct timespec __user *', 'void __user *']
 	case 335: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4095,6 +4391,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 336 long sys_ppoll ['struct pollfd __user *', 'unsigned int', 'struct timespec __user *', 'const sigset_t __user *', 'size_t']
 	case 336: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4114,6 +4411,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 337 long sys_unshare ['unsigned long unshare_flags']
 	case 337: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -4125,6 +4423,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 338 long sys_set_robust_list ['struct robust_list_head __user *head', 'size_t len']
 	case 338: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -4138,6 +4437,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 339 long sys_get_robust_list ['int pid', 'struct robust_list_head __user * __user *head_ptr', 'size_t __user *len_ptr']
 	case 339: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4153,6 +4453,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 340 long sys_splice ['int fd_in', 'loff_t __user *off_in', 'int fd_out', 'loff_t __user *off_out', 'size_t len', 'unsigned int flags']
 	case 340: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -4174,6 +4475,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 341 long sys_sync_file_range2 ['int fd', 'unsigned int flags', 'loff_t offset', 'loff_t nbytes']
 	case 341: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -4191,6 +4493,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 342 long sys_tee ['int fdin', 'int fdout', 'size_t len', 'unsigned int flags']
 	case 342: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4208,6 +4511,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 343 long sys_vmsplice ['int fd', 'const struct iovec __user *iov', 'unsigned long nr_segs', 'unsigned int flags']
 	case 343: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4225,6 +4529,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 344 long sys_move_pages ['pid_t pid', 'unsigned long nr_pages', 'const void __user * __user *pages', 'const int __user *nodes', 'int __user *status', 'int flags']
 	case 344: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4246,6 +4551,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 345 long sys_getcpu ['unsigned __user *cpu', 'unsigned __user *node', 'struct getcpu_cache __user *cache']
 	case 345: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4261,6 +4567,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 346 long sys_epoll_pwait ['int epfd', 'struct epoll_event __user *events', 'int maxevents', 'int timeout', 'const sigset_t __user *sigmask', 'size_t sigsetsize']
 	case 346: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -4282,6 +4589,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 347 long sys_kexec_load ['unsigned long entry', 'unsigned long nr_segments', 'struct kexec_segment __user *segments', 'unsigned long flags']
 	case 347: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4299,6 +4607,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 348 long sys_utimensat ['int dfd', 'const char __user *filename', 'struct timespec __user *utimes', 'int flags']
 	case 348: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4316,6 +4625,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 349 long sys_signalfd ['int ufd', 'sigset_t __user *user_mask', 'size_t sizemask']
 	case 349: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4331,6 +4641,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 350 long sys_timerfd_create ['int clockid', 'int flags']
 	case 350: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -4344,6 +4655,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 351 long sys_eventfd ['unsigned int count']
 	case 351: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -4355,6 +4667,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 352 long sys_fallocate ['int fd', 'int mode', 'loff_t offset', 'loff_t len']
 	case 352: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -4372,6 +4685,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 353 long sys_timerfd_settime ['int ufd', 'int flags', 'const struct itimerspec __user *utmr', 'struct itimerspec __user *otmr']
 	case 353: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4389,6 +4703,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 354 long sys_timerfd_gettime ['int ufd', 'struct itimerspec __user *otmr']
 	case 354: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -4402,6 +4717,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 355 long sys_signalfd4 ['int ufd', 'sigset_t __user *user_mask', 'size_t sizemask', 'int flags']
 	case 355: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4419,6 +4735,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 356 long sys_eventfd2 ['unsigned int count', 'int flags']
 	case 356: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -4432,6 +4749,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 357 long sys_epoll_create1 ['int flags']
 	case 357: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -4443,6 +4761,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 358 long sys_dup3 ['unsigned int oldfd', 'unsigned int newfd', 'int flags']
 	case 358: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -4458,6 +4777,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 359 long sys_pipe2 ['int __user *fildes', 'int flags']
 	case 359: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -4471,6 +4791,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 360 long sys_inotify_init1 ['int flags']
 	case 360: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -4482,6 +4803,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 361 long sys_preadv ['unsigned long fd', 'const struct iovec __user *vec', 'unsigned long vlen', 'unsigned long pos_l', 'unsigned long pos_h']
 	case 361: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4501,6 +4823,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 362 long sys_pwritev ['unsigned long fd', 'const struct iovec __user *vec', 'unsigned long vlen', 'unsigned long pos_l', 'unsigned long pos_h']
 	case 362: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4520,6 +4843,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 363 long sys_rt_tgsigqueueinfo ['pid_t tgid', 'pid_t pid', 'int sig', 'siginfo_t __user *uinfo']
 	case 363: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -4537,6 +4861,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 364 long sys_perf_event_open ['struct perf_event_attr __user *attr_uptr', 'pid_t pid', 'int cpu', 'int group_fd', 'unsigned long flags']
 	case 364: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -4556,6 +4881,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 365 long sys_recvmmsg ['int fd', 'struct mmsghdr __user *msg', 'unsigned int vlen', 'unsigned flags', 'struct timespec __user *timeout']
 	case 365: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4575,6 +4901,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 366 long sys_accept4 ['int', 'struct sockaddr __user *', 'int __user *', 'int']
 	case 366: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4592,6 +4919,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 367 long sys_fanotify_init ['unsigned int flags', 'unsigned int event_f_flags']
 	case 367: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -4605,6 +4933,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 368 long sys_fanotify_mark ['int fanotify_fd', 'unsigned int flags', 'u64 mask', 'int fd', 'const char __user *pathname']
 	case 368: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -4624,6 +4953,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 369 long sys_prlimit64 ['pid_t pid', 'unsigned int resource', 'const struct rlimit64 __user *new_rlim', 'struct rlimit64 __user *old_rlim']
 	case 369: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4641,6 +4971,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 370 long sys_name_to_handle_at ['int dfd', 'const char __user *name', 'struct file_handle __user *handle', 'int __user *mnt_id', 'int flag']
 	case 370: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4660,6 +4991,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 371 long sys_open_by_handle_at ['int mountdirfd', 'struct file_handle __user *handle', 'int flags']
 	case 371: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -4675,6 +5007,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 372 long sys_clock_adjtime ['clockid_t which_clock', 'struct timex __user *tx']
 	case 372: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -4688,6 +5021,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 373 long sys_syncfs ['int fd']
 	case 373: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -4699,6 +5033,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 374 long sys_sendmmsg ['int fd', 'struct mmsghdr __user *msg', 'unsigned int vlen', 'unsigned flags']
 	case 374: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4716,6 +5051,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 375 long sys_setns ['int fd', 'int nstype']
 	case 375: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -4729,6 +5065,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 376 long sys_process_vm_readv ['pid_t pid', 'const struct iovec __user *lvec', 'unsigned long liovcnt', 'const struct iovec __user *rvec', 'unsigned long riovcnt', 'unsigned long flags']
 	case 376: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4750,6 +5087,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 377 long sys_process_vm_writev ['pid_t pid', 'const struct iovec __user *lvec', 'unsigned long liovcnt', 'const struct iovec __user *rvec', 'unsigned long riovcnt', 'unsigned long flags']
 	case 377: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4771,6 +5109,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 378 long sys_kcmp ['pid_t pid1', 'pid_t pid2', 'int type', 'unsigned long idx1', 'unsigned long idx2']
 	case 378: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -4790,6 +5129,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 379 long sys_finit_module ['int fd', 'const char __user *uargs', 'int flags']
 	case 379: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -4805,6 +5145,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 380 long sys_sched_setattr ['pid_t pid', 'struct sched_attr __user *attr', 'unsigned int flags']
 	case 380: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4820,6 +5161,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 381 long sys_sched_getattr ['pid_t pid', 'struct sched_attr __user *attr', 'unsigned int size', 'unsigned int flags']
 	case 381: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4837,6 +5179,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 382 long sys_renameat2 ['int olddfd', 'const char __user *oldname', 'int newdfd', 'const char __user *newname', 'unsigned int flags']
 	case 382: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -4856,6 +5199,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 383 long sys_seccomp ['unsigned int op', 'unsigned int flags', 'const char __user *uargs']
 	case 383: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4871,6 +5215,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 384 long sys_getrandom ['char __user *buf', 'size_t count', 'unsigned int flags']
 	case 384: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4886,6 +5231,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 385 long sys_memfd_create ['const char __user *uname_ptr', 'unsigned int flags']
 	case 385: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -4899,6 +5245,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 386 long sys_bpf ['int cmd', 'union bpf_attr *attr', 'unsigned int size']
 	case 386: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4914,6 +5261,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 387 long sys_execveat ['int dfd', 'const char __user *filename', 'const char __user *const __user *argv', 'const char __user *const __user *envp', 'int flags']
 	case 387: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4933,6 +5281,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 388 long sys_userfaultfd ['int flags']
 	case 388: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -4944,6 +5293,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 389 long sys_membarrier ['int cmd', 'int flags']
 	case 389: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -4957,6 +5307,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 390 long sys_mlock2 ['unsigned long start', 'size_t len', 'int flags']
 	case 390: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -4972,11 +5323,13 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 983041 long ARM_breakpoint ['void']
 	case 983041: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_ARM_breakpoint_enter, cpu, pc);
 	}; break;
 	// 983042 long ARM_cacheflush ['unsigned long start', 'unsigned long end', 'unsigned long flags']
 	case 983042: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4992,16 +5345,19 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	// 983043 long ARM_user26_mode ['void']
 	case 983043: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_ARM_user26_mode_enter, cpu, pc);
 	}; break;
 	// 983044 long ARM_usr32_mode ['void']
 	case 983044: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_ARM_usr32_mode_enter, cpu, pc);
 	}; break;
 	// 983045 long ARM_set_tls ['unsigned long arg']
 	case 983045: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
diff --git a/panda/plugins/syscalls2/generated/syscall_switch_enter_linux_arm64.cpp b/panda/plugins/syscalls2/generated/syscall_switch_enter_linux_arm64.cpp
index 85987b17391..416a191e366 100644
--- a/panda/plugins/syscalls2/generated/syscall_switch_enter_linux_arm64.cpp
+++ b/panda/plugins/syscalls2/generated/syscall_switch_enter_linux_arm64.cpp
@@ -33,6 +33,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	}
 	ctx.asid = panda_current_asid(cpu);
 	ctx.retaddr = calc_retaddr(cpu, pc);
+	ctx.double_return = false;
 	bool panda_noreturn;	// true if PANDA should not track the return of this system call
 	const syscall_info_t *call = NULL;
 	syscall_info_t zero = {0};
@@ -48,6 +49,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 0 long sys_io_setup ['unsigned nr_reqs', 'aio_context_t __user *ctx']
 	case 0: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -61,6 +63,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 1 long sys_io_destroy ['aio_context_t ctx']
 	case 1: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -72,6 +75,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 2 long sys_io_submit ['aio_context_t', 'long', 'struct iocb __user * __user *']
 	case 2: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		int64_t arg1 = get_s64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -87,6 +91,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 3 long sys_io_cancel ['aio_context_t ctx_id', 'struct iocb __user *iocb', 'struct io_event __user *result']
 	case 3: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -102,6 +107,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 4 long sys_io_getevents ['aio_context_t ctx_id', 'long min_nr', 'long nr', 'struct io_event __user *events', 'struct timespec __user *timeout']
 	case 4: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		int64_t arg1 = get_s64(cpu, 1);
 		int64_t arg2 = get_s64(cpu, 2);
@@ -121,6 +127,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 5 long sys_setxattr ['const char __user *path', 'const char __user *name', 'const void __user *value', 'size_t size', 'int flags']
 	case 5: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -140,6 +147,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 6 long sys_lsetxattr ['const char __user *path', 'const char __user *name', 'const void __user *value', 'size_t size', 'int flags']
 	case 6: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -159,6 +167,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 7 long sys_fsetxattr ['int fd', 'const char __user *name', 'const void __user *value', 'size_t size', 'int flags']
 	case 7: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -178,6 +187,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 8 long sys_getxattr ['const char __user *path', 'const char __user *name', 'void __user *value', 'size_t size']
 	case 8: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -195,6 +205,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 9 long sys_lgetxattr ['const char __user *path', 'const char __user *name', 'void __user *value', 'size_t size']
 	case 9: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -212,6 +223,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 10 long sys_fgetxattr ['int fd', 'const char __user *name', 'void __user *value', 'size_t size']
 	case 10: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -229,6 +241,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 11 long sys_listxattr ['const char __user *path', 'char __user *list', 'size_t size']
 	case 11: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -244,6 +257,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 12 long sys_llistxattr ['const char __user *path', 'char __user *list', 'size_t size']
 	case 12: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -259,6 +273,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 13 long sys_flistxattr ['int fd', 'char __user *list', 'size_t size']
 	case 13: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -274,6 +289,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 14 long sys_removexattr ['const char __user *path', 'const char __user *name']
 	case 14: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -287,6 +303,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 15 long sys_lremovexattr ['const char __user *path', 'const char __user *name']
 	case 15: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -300,6 +317,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 16 long sys_fremovexattr ['int fd', 'const char __user *name']
 	case 16: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -313,6 +331,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 17 long sys_getcwd ['char __user *buf', 'unsigned long size']
 	case 17: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -326,6 +345,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 18 long sys_lookup_dcookie ['u64 cookie64', 'char __user *buf', 'size_t len']
 	case 18: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -341,6 +361,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 19 long sys_eventfd2 ['unsigned int count', 'int flags']
 	case 19: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -354,6 +375,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 20 long sys_epoll_create1 ['int flags']
 	case 20: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -365,6 +387,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 21 long sys_epoll_ctl ['int epfd', 'int op', 'int fd', 'struct epoll_event __user *event']
 	case 21: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -382,6 +405,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 22 long sys_epoll_pwait ['int epfd', 'struct epoll_event __user *events', 'int maxevents', 'int timeout', 'const sigset_t __user *sigmask', 'size_t sigsetsize']
 	case 22: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -403,6 +427,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 23 long sys_dup ['unsigned int fildes']
 	case 23: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -414,6 +439,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 24 long sys_dup3 ['unsigned int oldfd', 'unsigned int newfd', 'int flags']
 	case 24: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -429,6 +455,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 25 long sys_fcntl ['unsigned int fd', 'unsigned int cmd', 'unsigned long arg']
 	case 25: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -444,6 +471,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 26 long sys_inotify_init1 ['int flags']
 	case 26: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -455,6 +483,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 27 long sys_inotify_add_watch ['int fd', 'const char __user *path', 'u32 mask']
 	case 27: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -470,6 +499,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 28 long sys_inotify_rm_watch ['int fd', '__s32 wd']
 	case 28: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -483,6 +513,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 29 long sys_ioctl ['unsigned int fd', 'unsigned int cmd', 'unsigned long arg']
 	case 29: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -498,6 +529,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 30 long sys_ioprio_set ['int which', 'int who', 'int ioprio']
 	case 30: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -513,6 +545,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 31 long sys_ioprio_get ['int which', 'int who']
 	case 31: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -526,6 +559,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 32 long sys_flock ['unsigned int fd', 'unsigned int cmd']
 	case 32: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -539,6 +573,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 33 long sys_mknodat ['int dfd', 'const char __user *filename', 'umode_t mode', 'unsigned dev']
 	case 33: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -556,6 +591,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 34 long sys_mkdirat ['int dfd', 'const char __user *pathname', 'umode_t mode']
 	case 34: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -571,6 +607,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 35 long sys_unlinkat ['int dfd', 'const char __user *pathname', 'int flag']
 	case 35: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -586,6 +623,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 36 long sys_symlinkat ['const char __user *oldname', 'int newdfd', 'const char __user *newname']
 	case 36: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -601,6 +639,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 37 long sys_linkat ['int olddfd', 'const char __user *oldname', 'int newdfd', 'const char __user *newname', 'int flags']
 	case 37: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -620,6 +659,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 38 long sys_renameat ['int olddfd', 'const char __user *oldname', 'int newdfd', 'const char __user *newname']
 	case 38: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -637,6 +677,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 39 long sys_umount2 ['const char* target', 'int flags']
 	case 39: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -650,6 +691,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 40 long sys_mount ['char __user *dev_name', 'char __user *dir_name', 'char __user *type', 'unsigned long flags', 'void __user *data']
 	case 40: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -669,6 +711,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 41 long sys_pivot_root ['const char __user *new_root', 'const char __user *put_old']
 	case 41: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -682,6 +725,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 42 long sys_nfsservctl ['int cmd', 'struct nfsctl_arg *argp', 'union nfsctl_res *resp']
 	case 42: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -697,6 +741,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 43 long sys_statfs ['const char * path', 'struct statfs *buf']
 	case 43: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -710,6 +755,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 44 long sys_fstatfs ['unsigned int fd', 'struct statfs *buf']
 	case 44: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -723,6 +769,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 45 long sys_truncate ['const char *path', 'long length']
 	case 45: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		int64_t arg1 = get_s64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -736,6 +783,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 46 long sys_ftruncate ['unsigned int fd', 'unsigned long length']
 	case 46: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -749,6 +797,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 47 long sys_fallocate ['int fd', 'int mode', 'loff_t offset', 'loff_t len']
 	case 47: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -766,6 +815,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 48 long sys_faccessat ['int dfd', 'const char __user *filename', 'int mode']
 	case 48: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -781,6 +831,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 49 long sys_chdir ['const char __user *filename']
 	case 49: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -792,6 +843,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 50 long sys_fchdir ['unsigned int fd']
 	case 50: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -803,6 +855,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 51 long sys_chroot ['const char __user *filename']
 	case 51: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -814,6 +867,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 52 long sys_fchmod ['unsigned int fd', 'umode_t mode']
 	case 52: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -827,6 +881,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 53 long sys_fchmodat ['int dfd', 'const char __user *filename', 'umode_t mode']
 	case 53: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -842,6 +897,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 54 long sys_fchownat ['int dfd', 'const char __user *filename', 'uid_t user', 'gid_t group', 'int flag']
 	case 54: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -861,6 +917,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 55 long sys_fchown ['unsigned int fd', 'uid_t user', 'gid_t group']
 	case 55: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -876,6 +933,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 56 long sys_openat ['int dfd', 'const char __user *filename', 'int flags', 'umode_t mode']
 	case 56: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -893,6 +951,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 57 long sys_close ['unsigned int fd']
 	case 57: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -904,11 +963,13 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 58 long sys_vhangup ['void']
 	case 58: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_vhangup_enter, cpu, pc);
 	}; break;
 	// 59 long sys_pipe2 ['int *fildes', 'int flags']
 	case 59: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -922,6 +983,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 60 long sys_quotactl ['unsigned int cmd', 'const char __user *special', 'qid_t id', 'void __user *addr']
 	case 60: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -939,6 +1001,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 61 long sys_getdents64 ['unsigned int fd', 'struct linux_dirent64 *dirent', 'unsigned int count']
 	case 61: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -954,6 +1017,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 62 long sys_lseek ['unsigned int fd', 'off_t offset', 'unsigned int whence']
 	case 62: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -969,6 +1033,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 63 long sys_read ['unsigned int fd', 'char __user *buf', 'size_t count']
 	case 63: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -984,6 +1049,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 64 long sys_write ['unsigned int fd', 'const char __user *buf', 'size_t count']
 	case 64: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -999,6 +1065,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 65 long sys_readv ['unsigned long fd', 'const struct iovec __user *vec', 'unsigned long vlen']
 	case 65: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -1014,6 +1081,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 66 long sys_writev ['unsigned long fd', 'const struct iovec __user *vec', 'unsigned long vlen']
 	case 66: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -1029,6 +1097,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 67 long sys_pread64 ['unsigned int fd', 'char *buf', 'size_t count', 'loff_t pos']
 	case 67: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1046,6 +1115,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 68 long sys_pwrite64 ['unsigned int fd', 'const char *buf', 'size_t count', 'loff_t pos']
 	case 68: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1063,6 +1133,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 69 long sys_preadv ['unsigned long fd', 'const struct iovec __user *vec', 'unsigned long vlen', 'unsigned long pos_l', 'unsigned long pos_h']
 	case 69: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -1082,6 +1153,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 70 long sys_pwritev ['unsigned long fd', 'const struct iovec __user *vec', 'unsigned long vlen', 'unsigned long pos_l', 'unsigned long pos_h']
 	case 70: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -1101,6 +1173,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 71 long sys_sendfile ['int out_fd', 'int in_fd', 'off_t *offset', 'size_t count']
 	case 71: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -1118,6 +1191,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 72 long sys_pselect6 ['int', 'fd_set *', 'fd_set *', 'fd_set *', 'struct __kernel_timespec *', 'void *']
 	case 72: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -1139,6 +1213,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 73 long sys_ppoll ['struct pollfd __user *', 'unsigned int', 'struct timespec __user *', 'const sigset_t __user *', 'size_t']
 	case 73: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -1158,6 +1233,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 74 long sys_signalfd4 ['int ufd', 'sigset_t *user_mask', 'size_t sizemask', 'int flags']
 	case 74: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1175,6 +1251,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 75 long sys_vmsplice ['int fd', 'const struct iovec __user *iov', 'unsigned long nr_segs', 'unsigned int flags']
 	case 75: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -1192,6 +1269,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 76 long sys_splice ['int fd_in', 'loff_t __user *off_in', 'int fd_out', 'loff_t __user *off_out', 'size_t len', 'unsigned int flags']
 	case 76: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -1213,6 +1291,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 77 long sys_tee ['int fdin', 'int fdout', 'size_t len', 'unsigned int flags']
 	case 77: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1230,6 +1309,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 78 long sys_readlinkat ['int dfd', 'const char __user *path', 'char __user *buf', 'int bufsiz']
 	case 78: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -1247,6 +1327,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 79 long sys_newfstatat ['int dfd', 'const char *filename', 'struct stat *statbuf', 'int flag']
 	case 79: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -1264,6 +1345,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 80 long sys_fstat ['unsigned int fd', 'struct __old_kernel_stat *statbuf']
 	case 80: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1277,11 +1359,13 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 81 long sys_sync ['void']
 	case 81: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_sync_enter, cpu, pc);
 	}; break;
 	// 82 long sys_fsync ['unsigned int fd']
 	case 82: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1293,6 +1377,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 83 long sys_fdatasync ['unsigned int fd']
 	case 83: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1304,6 +1389,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 84 long sys_sync_file_range ['int fd', 'loff_t offset', 'loff_t nbytes', 'unsigned int flags']
 	case 84: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -1321,6 +1407,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 85 long sys_timerfd_create ['int clockid', 'int flags']
 	case 85: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1334,6 +1421,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 86 long sys_timerfd_settime ['int ufd', 'int flags', 'const struct itimerspec __user *utmr', 'struct itimerspec __user *otmr']
 	case 86: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -1351,6 +1439,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 87 long sys_timerfd_gettime ['int ufd', 'struct itimerspec __user *otmr']
 	case 87: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1364,6 +1453,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 88 long sys_utimensat ['int dfd', 'const char __user *filename', 'struct timespec __user *utimes', 'int flags']
 	case 88: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -1381,6 +1471,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 89 long sys_acct ['const char __user *name']
 	case 89: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1392,6 +1483,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 90 long sys_capget ['cap_user_header_t header', 'cap_user_data_t dataptr']
 	case 90: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1405,6 +1497,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 91 long sys_capset ['cap_user_header_t header', 'const cap_user_data_t data']
 	case 91: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1418,6 +1511,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 92 long sys_personality ['unsigned int personality']
 	case 92: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1429,6 +1523,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 93 long sys_exit ['int error_code']
 	case 93: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1440,6 +1535,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 94 long sys_exit_group ['int error_code']
 	case 94: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1451,6 +1547,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 95 long sys_waitid ['int which', 'pid_t pid', 'struct siginfo __user *infop', 'int options', 'struct rusage __user *ru']
 	case 95: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -1470,6 +1567,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 96 long sys_set_tid_address ['int __user *tidptr']
 	case 96: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1481,6 +1579,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 97 long sys_unshare ['unsigned long unshare_flags']
 	case 97: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1492,6 +1591,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 98 long sys_futex ['u32 __user *uaddr', 'int op', 'u32 val', 'struct timespec __user *utime', 'u32 __user *uaddr2', 'u32 val3']
 	case 98: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1513,6 +1613,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 99 long sys_set_robust_list ['struct robust_list_head __user *head', 'size_t len']
 	case 99: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1526,6 +1627,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 100 long sys_get_robust_list ['int pid', 'struct robust_list_head __user * __user *head_ptr', 'size_t __user *len_ptr']
 	case 100: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -1541,6 +1643,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 101 long sys_nanosleep ['struct timespec __user *rqtp', 'struct timespec __user *rmtp']
 	case 101: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1554,6 +1657,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 102 long sys_getitimer ['int which', 'struct itimerval __user *value']
 	case 102: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1567,6 +1671,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 103 long sys_setitimer ['int which', 'struct itimerval __user *value', 'struct itimerval __user *ovalue']
 	case 103: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -1582,6 +1687,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 104 long sys_kexec_load ['unsigned long entry', 'unsigned long nr_segments', 'struct kexec_segment __user *segments', 'unsigned long flags']
 	case 104: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -1599,6 +1705,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 105 long sys_init_module ['void __user *umod', 'unsigned long len', 'const char __user *uargs']
 	case 105: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -1614,6 +1721,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 106 long sys_delete_module ['const char __user *name_user', 'unsigned int flags']
 	case 106: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1627,6 +1735,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 107 long sys_timer_create ['clockid_t which_clock', 'struct sigevent __user *timer_event_spec', 'timer_t __user *created_timer_id']
 	case 107: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -1642,6 +1751,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 108 long sys_timer_gettime ['timer_t timer_id', 'struct itimerspec __user *setting']
 	case 108: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1655,6 +1765,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 109 long sys_timer_getoverrun ['timer_t timer_id']
 	case 109: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1666,6 +1777,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 110 long sys_timer_settime ['timer_t timer_id', 'int flags', 'const struct itimerspec __user *new_setting', 'struct itimerspec __user *old_setting']
 	case 110: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -1683,6 +1795,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 111 long sys_timer_delete ['timer_t timer_id']
 	case 111: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1694,6 +1807,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 112 long sys_clock_settime ['clockid_t which_clock', 'const struct timespec __user *tp']
 	case 112: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1707,6 +1821,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 113 long sys_clock_gettime ['clockid_t which_clock', 'struct timespec __user *tp']
 	case 113: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1720,6 +1835,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 114 long sys_clock_getres ['clockid_t which_clock', 'struct timespec __user *tp']
 	case 114: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1733,6 +1849,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 115 long sys_clock_nanosleep ['clockid_t which_clock', 'int flags', 'const struct timespec __user *rqtp', 'struct timespec __user *rmtp']
 	case 115: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -1750,6 +1867,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 116 long sys_syslog ['int type', 'char __user *buf', 'int len']
 	case 116: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -1765,6 +1883,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 117 long sys_ptrace ['long request', 'long pid', 'unsigned long addr', 'unsigned long data']
 	case 117: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int64_t arg0 = get_s64(cpu, 0);
 		int64_t arg1 = get_s64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -1782,6 +1901,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 118 long sys_sched_setparam ['pid_t pid', 'struct sched_param __user *param']
 	case 118: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1795,6 +1915,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 119 long sys_sched_setscheduler ['pid_t pid', 'int policy', 'struct sched_param __user *param']
 	case 119: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -1810,6 +1931,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 120 long sys_sched_getscheduler ['pid_t pid']
 	case 120: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1821,6 +1943,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 121 long sys_sched_getparam ['pid_t pid', 'struct sched_param __user *param']
 	case 121: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1834,6 +1957,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 122 long sys_sched_setaffinity ['pid_t pid', 'unsigned int len', 'unsigned long __user *user_mask_ptr']
 	case 122: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -1849,6 +1973,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 123 long sys_sched_getaffinity ['pid_t pid', 'unsigned int len', 'unsigned long __user *user_mask_ptr']
 	case 123: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -1864,11 +1989,13 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 124 long sys_sched_yield ['void']
 	case 124: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_sched_yield_enter, cpu, pc);
 	}; break;
 	// 125 long sys_sched_get_priority_max ['int policy']
 	case 125: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1880,6 +2007,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 126 long sys_sched_get_priority_min ['int policy']
 	case 126: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1891,6 +2019,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 127 long sys_sched_rr_get_interval ['pid_t pid', 'struct timespec __user *interval']
 	case 127: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1904,11 +2033,13 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 128 long sys_restart_syscall ['void']
 	case 128: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_restart_syscall_enter, cpu, pc);
 	}; break;
 	// 129 long sys_kill ['pid_t pid', 'int sig']
 	case 129: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1922,6 +2053,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 130 long sys_tkill ['pid_t pid', 'int sig']
 	case 130: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1935,6 +2067,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 131 long sys_tgkill ['pid_t tgid', 'pid_t pid', 'int sig']
 	case 131: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -1950,6 +2083,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 132 long sys_sigaltstack ['const struct sigaltstack __user *uss', 'struct sigaltstack __user *uoss']
 	case 132: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1963,6 +2097,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 133 long sys_rt_sigsuspend ['sigset_t __user *unewset', 'size_t sigsetsize']
 	case 133: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1976,6 +2111,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 134 long sys_rt_sigaction ['int', 'const struct sigaction __user *', 'struct sigaction __user *', 'size_t']
 	case 134: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -1993,6 +2129,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 135 long sys_rt_sigprocmask ['int how', 'sigset_t __user *set', 'sigset_t __user *oset', 'size_t sigsetsize']
 	case 135: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -2010,6 +2147,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 136 long sys_rt_sigpending ['sigset_t __user *set', 'size_t sigsetsize']
 	case 136: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2023,6 +2161,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 137 long sys_rt_sigtimedwait ['const sigset_t __user *uthese', 'siginfo_t __user *uinfo', 'const struct timespec __user *uts', 'size_t sigsetsize']
 	case 137: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -2040,6 +2179,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 138 long sys_rt_sigqueueinfo ['pid_t pid', 'int sig', 'siginfo_t __user *uinfo']
 	case 138: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -2055,6 +2195,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 139 long sys_rt_sigreturn ['struct pt_regs *regs']
 	case 139: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -2066,6 +2207,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 140 long sys_setpriority ['int which', 'int who', 'int niceval']
 	case 140: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -2081,6 +2223,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 141 long sys_getpriority ['int which', 'int who']
 	case 141: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2094,6 +2237,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 142 long sys_reboot ['int magic1', 'int magic2', 'unsigned int cmd', 'void __user *arg']
 	case 142: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2111,6 +2255,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 143 long sys_setregid ['gid_t rgid', 'gid_t egid']
 	case 143: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2124,6 +2269,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 144 long sys_setgid ['gid_t gid']
 	case 144: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -2135,6 +2281,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 145 long sys_setreuid ['uid_t ruid', 'uid_t euid']
 	case 145: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2148,6 +2295,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 146 long sys_setuid ['uid_t uid']
 	case 146: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -2159,6 +2307,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 147 long sys_setresuid ['uid_t ruid', 'uid_t euid', 'uid_t suid']
 	case 147: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2174,6 +2323,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 148 long sys_getresuid ['uid_t __user *ruid', 'uid_t __user *euid', 'uid_t __user *suid']
 	case 148: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -2189,6 +2339,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 149 long sys_setresgid ['gid_t rgid', 'gid_t egid', 'gid_t sgid']
 	case 149: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2204,6 +2355,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 150 long sys_getresgid ['gid_t __user *rgid', 'gid_t __user *egid', 'gid_t __user *sgid']
 	case 150: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -2219,6 +2371,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 151 long sys_setfsuid ['uid_t uid']
 	case 151: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -2230,6 +2383,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 152 long sys_setfsgid ['gid_t gid']
 	case 152: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -2241,6 +2395,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 153 long sys_times ['struct tms __user *tbuf']
 	case 153: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -2252,6 +2407,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 154 long sys_setpgid ['pid_t pid', 'pid_t pgid']
 	case 154: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2265,6 +2421,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 155 long sys_getpgid ['pid_t pid']
 	case 155: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -2276,6 +2433,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 156 long sys_getsid ['pid_t pid']
 	case 156: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -2287,11 +2445,13 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 157 long sys_setsid ['void']
 	case 157: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_setsid_enter, cpu, pc);
 	}; break;
 	// 158 long sys_getgroups ['int gidsetsize', 'gid_t __user *grouplist']
 	case 158: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2305,6 +2465,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 159 long sys_setgroups ['int gidsetsize', 'gid_t __user *grouplist']
 	case 159: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2318,6 +2479,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 160 long sys_uname ['struct new_utsname __user *name']
 	case 160: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -2329,6 +2491,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 161 long sys_sethostname ['char __user *name', 'int len']
 	case 161: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2342,6 +2505,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 162 long sys_setdomainname ['char __user *name', 'int len']
 	case 162: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2355,6 +2519,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 163 long sys_getrlimit ['unsigned int resource', 'struct rlimit __user *rlim']
 	case 163: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2368,6 +2533,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 164 long sys_setrlimit ['unsigned int resource', 'struct rlimit __user *rlim']
 	case 164: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2381,6 +2547,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 165 long sys_getrusage ['int who', 'struct rusage __user *ru']
 	case 165: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2394,6 +2561,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 166 long sys_umask ['int mask']
 	case 166: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -2405,6 +2573,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 167 long sys_prctl ['int option', 'unsigned long arg2', 'unsigned long arg3', 'unsigned long arg4', 'unsigned long arg5']
 	case 167: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -2424,6 +2593,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 168 long sys_getcpu ['unsigned __user *cpu', 'unsigned __user *node', 'struct getcpu_cache __user *cache']
 	case 168: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -2439,6 +2609,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 169 long sys_gettimeofday ['struct timeval __user *tv', 'struct timezone __user *tz']
 	case 169: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2452,6 +2623,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 170 long sys_settimeofday ['struct timeval __user *tv', 'struct timezone __user *tz']
 	case 170: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2465,6 +2637,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 171 long sys_adjtimex ['struct timex __user *txc_p']
 	case 171: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -2476,41 +2649,49 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 172 long sys_getpid ['void']
 	case 172: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_getpid_enter, cpu, pc);
 	}; break;
 	// 173 long sys_getppid ['void']
 	case 173: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_getppid_enter, cpu, pc);
 	}; break;
 	// 174 long sys_getuid ['void']
 	case 174: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_getuid_enter, cpu, pc);
 	}; break;
 	// 175 long sys_geteuid ['void']
 	case 175: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_geteuid_enter, cpu, pc);
 	}; break;
 	// 176 long sys_getgid ['void']
 	case 176: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_getgid_enter, cpu, pc);
 	}; break;
 	// 177 long sys_getegid ['void']
 	case 177: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_getegid_enter, cpu, pc);
 	}; break;
 	// 178 long sys_gettid ['void']
 	case 178: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_gettid_enter, cpu, pc);
 	}; break;
 	// 179 long sys_sysinfo ['struct sysinfo __user *info']
 	case 179: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -2522,6 +2703,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 180 long sys_mq_open ['const char __user *name', 'int oflag', 'umode_t mode', 'struct mq_attr __user *attr']
 	case 180: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2539,6 +2721,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 181 long sys_mq_unlink ['const char __user *name']
 	case 181: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -2550,6 +2733,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 182 long sys_mq_timedsend ['mqd_t mqdes', 'const char __user *msg_ptr', 'size_t msg_len', 'unsigned int msg_prio', 'const struct timespec __user *abs_timeout']
 	case 182: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2569,6 +2753,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 183 long sys_mq_timedreceive ['mqd_t mqdes', 'char __user *msg_ptr', 'size_t msg_len', 'unsigned int __user *msg_prio', 'const struct timespec __user *abs_timeout']
 	case 183: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2588,6 +2773,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 184 long sys_mq_notify ['mqd_t mqdes', 'const struct sigevent __user *notification']
 	case 184: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2601,6 +2787,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 185 long sys_mq_getsetattr ['mqd_t mqdes', 'const struct mq_attr __user *mqstat', 'struct mq_attr __user *omqstat']
 	case 185: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -2616,6 +2803,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 186 long sys_msgget ['key_t key', 'int msgflg']
 	case 186: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2629,6 +2817,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 187 long sys_msgctl ['int msqid', 'int cmd', 'struct msqid_ds __user *buf']
 	case 187: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -2644,6 +2833,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 188 long sys_msgrcv ['int msqid', 'struct msgbuf __user *msgp', 'size_t msgsz', 'long msgtyp', 'int msgflg']
 	case 188: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2663,6 +2853,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 189 long sys_msgsnd ['int msqid', 'struct msgbuf __user *msgp', 'size_t msgsz', 'int msgflg']
 	case 189: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2680,6 +2871,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 190 long sys_semget ['key_t key', 'int nsems', 'int semflg']
 	case 190: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -2695,6 +2887,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 191 long sys_semctl ['int semid', 'int semnum', 'int cmd', 'unsigned long arg']
 	case 191: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -2712,6 +2905,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 192 long sys_semtimedop ['int semid', 'struct sembuf __user *sops', 'unsigned nsops', 'const struct timespec __user *timeout']
 	case 192: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2729,6 +2923,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 193 long sys_semop ['int semid', 'struct sembuf __user *sops', 'unsigned nsops']
 	case 193: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2744,6 +2939,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 194 long sys_shmget ['key_t key', 'size_t size', 'int flag']
 	case 194: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -2759,6 +2955,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 195 long sys_shmctl ['int shmid', 'int cmd', 'struct shmid_ds __user *buf']
 	case 195: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -2774,6 +2971,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 196 long sys_shmat ['int shmid', 'char __user *shmaddr', 'int shmflg']
 	case 196: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -2789,6 +2987,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 197 long sys_shmdt ['char __user *shmaddr']
 	case 197: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -2800,6 +2999,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 198 long sys_socket ['int', 'int', 'int']
 	case 198: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -2815,6 +3015,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 199 long sys_socketpair ['int', 'int', 'int', 'int __user *']
 	case 199: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -2832,6 +3033,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 200 long sys_bind ['int', 'struct sockaddr __user *', 'int']
 	case 200: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -2847,6 +3049,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 201 long sys_listen ['int', 'int']
 	case 201: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2860,6 +3063,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 202 long sys_accept ['int', 'struct sockaddr __user *', 'int __user *']
 	case 202: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -2875,6 +3079,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 203 long sys_connect ['int', 'struct sockaddr __user *', 'int']
 	case 203: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -2890,6 +3095,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 204 long sys_getsockname ['int', 'struct sockaddr __user *', 'int __user *']
 	case 204: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -2905,6 +3111,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 205 long sys_getpeername ['int', 'struct sockaddr __user *', 'int __user *']
 	case 205: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -2920,6 +3127,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 206 long sys_sendto ['int', 'void __user *', 'size_t', 'unsigned', 'struct sockaddr __user *', 'int']
 	case 206: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2941,6 +3149,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 207 long sys_recvfrom ['int', 'void __user *', 'size_t', 'unsigned', 'struct sockaddr __user *', 'int __user *']
 	case 207: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2962,6 +3171,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 208 long sys_setsockopt ['int fd', 'int level', 'int optname', 'char __user *optval', 'int optlen']
 	case 208: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -2981,6 +3191,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 209 long sys_getsockopt ['int fd', 'int level', 'int optname', 'char __user *optval', 'int __user *optlen']
 	case 209: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -3000,6 +3211,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 210 long sys_shutdown ['int', 'int']
 	case 210: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3013,6 +3225,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 211 long sys_sendmsg ['int fd', 'struct user_msghdr __user *msg', 'unsigned flags']
 	case 211: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3028,6 +3241,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 212 long sys_recvmsg ['int fd', 'struct user_msghdr __user *msg', 'unsigned flags']
 	case 212: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3043,6 +3257,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 213 long sys_readahead ['int fd', 'loff_t offset', 'size_t count']
 	case 213: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3058,6 +3273,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 214 long sys_brk ['unsigned long brk']
 	case 214: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -3069,6 +3285,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 215 long sys_munmap ['unsigned long addr', 'size_t len']
 	case 215: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3082,6 +3299,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 216 long sys_mremap ['unsigned long addr', 'unsigned long old_len', 'unsigned long new_len', 'unsigned long flags', 'unsigned long new_addr']
 	case 216: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -3101,6 +3319,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 217 long sys_add_key ['const char __user *_type', 'const char __user *_description', 'const void __user *_payload', 'size_t plen', 'key_serial_t destringid']
 	case 217: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -3120,6 +3339,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 218 long sys_request_key ['const char __user *_type', 'const char __user *_description', 'const char __user *_callout_info', 'key_serial_t destringid']
 	case 218: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -3137,6 +3357,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 219 long sys_keyctl ['int cmd', 'unsigned long arg2', 'unsigned long arg3', 'unsigned long arg4', 'unsigned long arg5']
 	case 219: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -3156,6 +3377,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 220 long sys_clone ['unsigned long', 'unsigned long', 'int __user *', 'int __user *', 'unsigned long']
 	case 220: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -3175,6 +3397,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 221 long sys_execve ['const char __user *filename', 'const char __user *const __user *argv', 'const char __user *const __user *envp']
 	case 221: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -3190,6 +3413,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 222 long sys_mmap ['void *addr', 'size_t length', 'int prot', 'int flags', 'int fd', 'off_t offset']
 	case 222: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -3211,6 +3435,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 223 long sys_fadvise64 ['int fd', 'loff_t offset', 'size_t len', 'int advice']
 	case 223: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3228,6 +3453,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 224 long sys_swapon ['const char __user *specialfile', 'int swap_flags']
 	case 224: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3241,6 +3467,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 225 long sys_swapoff ['const char __user *specialfile']
 	case 225: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -3252,6 +3479,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 226 long sys_mprotect ['unsigned long start', 'size_t len', 'unsigned long prot']
 	case 226: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -3267,6 +3495,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 227 long sys_msync ['unsigned long start', 'size_t len', 'int flags']
 	case 227: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -3282,6 +3511,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 228 long sys_mlock ['unsigned long start', 'size_t len']
 	case 228: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3295,6 +3525,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 229 long sys_munlock ['unsigned long start', 'size_t len']
 	case 229: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3308,6 +3539,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 230 long sys_mlockall ['int flags']
 	case 230: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -3319,11 +3551,13 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 231 long sys_munlockall ['void']
 	case 231: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_munlockall_enter, cpu, pc);
 	}; break;
 	// 232 long sys_mincore ['unsigned long start', 'size_t len', 'unsigned char __user *vec']
 	case 232: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -3339,6 +3573,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 233 long sys_madvise ['unsigned long start', 'size_t len', 'int behavior']
 	case 233: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -3354,6 +3589,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 234 long sys_remap_file_pages ['unsigned long start', 'unsigned long size', 'unsigned long prot', 'unsigned long pgoff', 'unsigned long flags']
 	case 234: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -3373,6 +3609,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 235 long sys_mbind ['unsigned long start', 'unsigned long len', 'unsigned long mode', 'const unsigned long __user *nmask', 'unsigned long maxnode', 'unsigned flags']
 	case 235: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -3394,6 +3631,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 236 long sys_get_mempolicy ['int __user *policy', 'unsigned long __user *nmask', 'unsigned long maxnode', 'unsigned long addr', 'unsigned long flags']
 	case 236: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -3413,6 +3651,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 237 long sys_set_mempolicy ['int mode', 'const unsigned long __user *nmask', 'unsigned long maxnode']
 	case 237: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -3428,6 +3667,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 238 long sys_migrate_pages ['pid_t pid', 'unsigned long maxnode', 'const unsigned long __user *from', 'const unsigned long __user *to']
 	case 238: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -3445,6 +3685,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 239 long sys_move_pages ['pid_t pid', 'unsigned long nr_pages', 'const void __user * __user *pages', 'const int __user *nodes', 'int __user *status', 'int flags']
 	case 239: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -3466,6 +3707,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 240 long sys_rt_tgsigqueueinfo ['pid_t tgid', 'pid_t pid', 'int sig', 'siginfo_t __user *uinfo']
 	case 240: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -3483,6 +3725,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 241 long sys_perf_event_open ['struct perf_event_attr __user *attr_uptr', 'pid_t pid', 'int cpu', 'int group_fd', 'unsigned long flags']
 	case 241: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -3502,6 +3745,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 242 long sys_accept4 ['int', 'struct sockaddr *', 'int *', 'int']
 	case 242: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -3519,6 +3763,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 243 long sys_recvmmsg ['int fd', 'struct mmsghdr __user *msg', 'unsigned int vlen', 'unsigned flags', 'struct timespec __user *timeout']
 	case 243: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3538,6 +3783,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 260 long sys_wait4 ['pid_t pid', 'int *stat_addr', 'int options', 'struct rusage *ru']
 	case 260: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -3555,6 +3801,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 261 long sys_prlimit64 ['pid_t pid', 'unsigned int resource', 'const struct rlimit64 *new_rlim', 'struct rlimit64 *old_rlim']
 	case 261: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -3572,6 +3819,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 262 long sys_fanotify_init ['unsigned int flags', 'unsigned int event_f_flags']
 	case 262: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3585,6 +3833,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 263 long sys_fanotify_mark ['int fanotify_fd', 'unsigned int flags', 'u64 mask', 'int fd', 'const char __user *pathname']
 	case 263: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -3604,6 +3853,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 264 long sys_name_to_handle_at ['int dfd', 'const char __user *name', 'struct file_handle __user *handle', 'int __user *mnt_id', 'int flag']
 	case 264: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -3623,6 +3873,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 265 long sys_open_by_handle_at ['int mountdirfd', 'struct file_handle __user *handle', 'int flags']
 	case 265: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -3638,6 +3889,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 266 long sys_clock_adjtime ['clockid_t which_clock', 'struct timex __user *tx']
 	case 266: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3651,6 +3903,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 267 long sys_syncfs ['int fd']
 	case 267: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -3662,6 +3915,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 268 long sys_setns ['int fd', 'int nstype']
 	case 268: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3675,6 +3929,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 269 long sys_sendmmsg ['int fd', 'struct mmsghdr __user *msg', 'unsigned int vlen', 'unsigned flags']
 	case 269: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3692,6 +3947,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 270 long sys_process_vm_readv ['pid_t pid', 'const struct iovec __user *lvec', 'unsigned long liovcnt', 'const struct iovec __user *rvec', 'unsigned long riovcnt', 'unsigned long flags']
 	case 270: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -3713,6 +3969,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 271 long sys_process_vm_writev ['pid_t pid', 'const struct iovec __user *lvec', 'unsigned long liovcnt', 'const struct iovec __user *rvec', 'unsigned long riovcnt', 'unsigned long flags']
 	case 271: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -3734,6 +3991,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 272 long sys_kcmp ['pid_t pid1', 'pid_t pid2', 'int type', 'unsigned long idx1', 'unsigned long idx2']
 	case 272: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -3753,6 +4011,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 273 long sys_finit_module ['int fd', 'const char __user *uargs', 'int flags']
 	case 273: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -3768,6 +4027,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 274 long sys_sched_setattr ['pid_t pid', 'struct sched_attr __user *attr', 'unsigned int flags']
 	case 274: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3783,6 +4043,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 275 long sys_sched_getattr ['pid_t pid', 'struct sched_attr __user *attr', 'unsigned int size', 'unsigned int flags']
 	case 275: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3800,6 +4061,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 276 long sys_renameat2 ['int olddfd', 'const char *oldname', 'int newdfd', 'const char *newname', 'unsigned int flags']
 	case 276: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -3819,6 +4081,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 277 long sys_seccomp ['unsigned int op', 'unsigned int flags', 'const char __user *uargs']
 	case 277: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -3834,6 +4097,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 278 long sys_getrandom ['char __user *buf', 'size_t count', 'unsigned int flags']
 	case 278: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3849,6 +4113,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 279 long sys_memfd_create ['const char __user *uname_ptr', 'unsigned int flags']
 	case 279: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3862,6 +4127,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 280 long sys_bpf ['int cmd', 'union bpf_attr *attr', 'unsigned int size']
 	case 280: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3877,6 +4143,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 281 long sys_execveat ['int dfd', 'const char __user *filename', 'const char __user *const __user *argv', 'const char __user *const __user *envp', 'int flags']
 	case 281: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -3896,6 +4163,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 282 long sys_userfaultfd ['int flags']
 	case 282: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -3907,6 +4175,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 283 long sys_membarrier ['int cmd', 'int flags']
 	case 283: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3920,6 +4189,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 284 long sys_mlock2 ['unsigned long start', 'size_t len', 'int flags']
 	case 284: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -3935,6 +4205,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 285 long sys_copy_file_range ['int fd_in', 'loff_t __user *off_in', 'int fd_out', 'loff_t __user *off_out', 'size_t len', 'unsigned int flags']
 	case 285: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -3956,6 +4227,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 286 long sys_preadv2 ['unsigned long fd', 'const struct iovec *vec', 'unsigned long vlen', 'unsigned long pos_l', 'unsigned long pos_h', 'rwf_t flags']
 	case 286: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -3977,6 +4249,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 287 long sys_pwritev2 ['unsigned long fd', 'const struct iovec *vec', 'unsigned long vlen', 'unsigned long pos_l', 'unsigned long pos_h', 'rwf_t flags']
 	case 287: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -3998,6 +4271,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 288 long sys_pkey_mprotect ['unsigned long start', 'size_t len', 'unsigned long prot', 'int pkey']
 	case 288: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -4015,6 +4289,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 289 long sys_pkey_alloc ['unsigned long flags', 'unsigned long init_val']
 	case 289: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -4028,6 +4303,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 290 long sys_pkey_free ['int pkey']
 	case 290: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -4039,6 +4315,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 291 long sys_statx ['int dfd', 'const char *path', 'unsigned flags', 'unsigned mask', 'struct statx *buffer']
 	case 291: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4058,6 +4335,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 294 long sys_kexec_file_load ['int kernel_fd', 'int initrd_fd', 'unsigned long cmdline_len', 'const char *cmdline', 'unsigned long flags']
 	case 294: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -4077,6 +4355,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 424 long sys_pidfd_send_signal ['int pidfd', 'int sig', 'siginfo_t *info', 'unsigned int flags']
 	case 424: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -4094,6 +4373,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 434 long sys_pidfd_open ['pid_t pid', 'unsigned int flags']
 	case 434: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -4107,6 +4387,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 435 long sys_clone3 ['struct clone_args *cl_args', 'size_t size']
 	case 435: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -4120,6 +4401,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 437 long sys_openat2 ['int dirfd', 'const char *pathname', 'struct open_how *how', 'size_t size']
 	case 437: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -4137,6 +4419,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 438 long sys_pidfd_getfd ['int pidfd', 'int targetfd', 'unsigned int flags']
 	case 438: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4152,6 +4435,7 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 	// 439 long sys_faccessat2 ['int dirfd', 'const char *pathname', 'int mode', 'int flags']
 	case 439: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
diff --git a/panda/plugins/syscalls2/generated/syscall_switch_enter_linux_mips.cpp b/panda/plugins/syscalls2/generated/syscall_switch_enter_linux_mips.cpp
index bc46abf03a2..11ff95c2cc5 100644
--- a/panda/plugins/syscalls2/generated/syscall_switch_enter_linux_mips.cpp
+++ b/panda/plugins/syscalls2/generated/syscall_switch_enter_linux_mips.cpp
@@ -33,6 +33,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	}
 	ctx.asid = panda_current_asid(cpu);
 	ctx.retaddr = calc_retaddr(cpu, pc);
+	ctx.double_return = false;
 	bool panda_noreturn;	// true if PANDA should not track the return of this system call
 	const syscall_info_t *call = NULL;
 	syscall_info_t zero = {0};
@@ -48,6 +49,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4001 long sys_exit ['int error_code']
 	case 4001: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -59,11 +61,13 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4002 pid_t sys_fork ['void']
 	case 4002: {
 		panda_noreturn = false;
+		ctx.double_return = true;
 		PPP_RUN_CB(on_sys_fork_enter, cpu, pc);
 	}; break;
 	// 4003 long sys_read ['unsigned int fd', 'char __user *buf', 'size_t count']
 	case 4003: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -79,6 +83,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4004 long sys_write ['unsigned int fd', 'const char __user *buf', 'size_t count']
 	case 4004: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -94,6 +99,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4005 long sys_open ['const char __user *filename', 'int flags', 'umode_t mode']
 	case 4005: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -109,6 +115,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4006 long sys_close ['unsigned int fd']
 	case 4006: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -120,6 +127,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4007 long sys_waitpid ['pid_t pid', 'int __user *stat_addr', 'int options']
 	case 4007: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -135,6 +143,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4008 long sys_creat ['const char __user *pathname', 'umode_t mode']
 	case 4008: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -148,6 +157,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4009 long sys_link ['const char __user *oldname', 'const char __user *newname']
 	case 4009: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -161,6 +171,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4010 long sys_unlink ['const char __user *pathname']
 	case 4010: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -172,6 +183,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4011 long sys_execve ['const char __user *filename', 'const char __user *const __user *argv', 'const char __user *const __user *envp']
 	case 4011: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -187,6 +199,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4012 long sys_chdir ['const char __user *filename']
 	case 4012: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -198,6 +211,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4013 long sys_time32 ['old_time32_t __user *tloc']
 	case 4013: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -209,6 +223,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4014 long sys_mknod ['const char __user *filename', 'umode_t mode', 'unsigned dev']
 	case 4014: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -224,6 +239,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4015 long sys_chmod ['const char __user *filename', 'umode_t mode']
 	case 4015: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -237,6 +253,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4016 long sys_lchown ['const char __user *filename', 'uid_t user', 'gid_t group']
 	case 4016: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -252,6 +269,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4018 long sys_stat ['const char __user *filename', 'struct __old_kernel_stat __user *statbuf']
 	case 4018: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -265,6 +283,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4019 long sys_lseek ['unsigned int fd', 'off_t offset', 'unsigned int whence']
 	case 4019: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -280,11 +299,13 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4020 long sys_getpid ['void']
 	case 4020: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_getpid_enter, cpu, pc);
 	}; break;
 	// 4021 long sys_mount ['char __user *dev_name', 'char __user *dir_name', 'char __user *type', 'unsigned long flags', 'void __user *data']
 	case 4021: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -304,6 +325,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4022 long sys_oldumount ['char __user *name']
 	case 4022: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -315,6 +337,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4023 long sys_setuid ['uid_t uid']
 	case 4023: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -326,11 +349,13 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4024 long sys_getuid ['void']
 	case 4024: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_getuid_enter, cpu, pc);
 	}; break;
 	// 4025 long sys_stime32 ['old_time32_t __user *tptr']
 	case 4025: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -342,6 +367,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4026 long sys_ptrace ['long request', 'long pid', 'unsigned long addr', 'unsigned long data']
 	case 4026: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -359,6 +385,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4027 long sys_alarm ['unsigned int seconds']
 	case 4027: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -370,6 +397,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4028 long sys_fstat ['unsigned int fd', 'struct __old_kernel_stat __user *statbuf']
 	case 4028: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -383,11 +411,13 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4029 long sys_pause ['void']
 	case 4029: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_pause_enter, cpu, pc);
 	}; break;
 	// 4030 long sys_utime32 ['const char __user *filename', 'struct old_utimbuf32 __user *t']
 	case 4030: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -401,6 +431,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4033 long sys_access ['const char __user *filename', 'int mode']
 	case 4033: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -414,6 +445,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4034 long sys_nice ['int increment']
 	case 4034: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -425,11 +457,13 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4036 long sys_sync ['void']
 	case 4036: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_sync_enter, cpu, pc);
 	}; break;
 	// 4037 long sys_kill ['pid_t pid', 'int sig']
 	case 4037: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -443,6 +477,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4038 long sys_rename ['const char __user *oldname', 'const char __user *newname']
 	case 4038: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -456,6 +491,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4039 long sys_mkdir ['const char __user *pathname', 'umode_t mode']
 	case 4039: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -469,6 +505,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4040 long sys_rmdir ['const char __user *pathname']
 	case 4040: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -480,6 +517,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4041 long sys_dup ['unsigned int fildes']
 	case 4041: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -491,6 +529,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4042 long sys_pipe ['int __user *fildes']
 	case 4042: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -502,6 +541,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4043 long sys_times ['struct tms __user *tbuf']
 	case 4043: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -513,6 +553,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4045 long sys_brk ['unsigned long brk']
 	case 4045: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -524,6 +565,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4046 long sys_setgid ['gid_t gid']
 	case 4046: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -535,11 +577,13 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4047 long sys_getgid ['void']
 	case 4047: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_getgid_enter, cpu, pc);
 	}; break;
 	// 4048 long sys_signal ['int sig', '__sighandler_t handler']
 	case 4048: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -553,16 +597,19 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4049 long sys_geteuid ['void']
 	case 4049: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_geteuid_enter, cpu, pc);
 	}; break;
 	// 4050 long sys_getegid ['void']
 	case 4050: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_getegid_enter, cpu, pc);
 	}; break;
 	// 4051 long sys_acct ['const char __user *name']
 	case 4051: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -574,6 +621,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4052 long sys_umount ['char __user *name', 'int flags']
 	case 4052: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -587,6 +635,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4054 long sys_ioctl ['unsigned int fd', 'unsigned int cmd', 'unsigned long arg']
 	case 4054: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -602,6 +651,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4055 long sys_fcntl ['unsigned int fd', 'unsigned int cmd', 'unsigned long arg']
 	case 4055: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -617,6 +667,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4057 long sys_setpgid ['pid_t pid', 'pid_t pgid']
 	case 4057: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -630,6 +681,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4059 long sys_olduname ['struct oldold_utsname __user *']
 	case 4059: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -641,6 +693,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4060 long sys_umask ['int mask']
 	case 4060: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -652,6 +705,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4061 long sys_chroot ['const char __user *filename']
 	case 4061: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -663,6 +717,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4062 long sys_ustat ['unsigned dev', 'struct ustat __user *ubuf']
 	case 4062: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -676,6 +731,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4063 long sys_dup2 ['unsigned int oldfd', 'unsigned int newfd']
 	case 4063: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -689,21 +745,25 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4064 long sys_getppid ['void']
 	case 4064: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_getppid_enter, cpu, pc);
 	}; break;
 	// 4065 long sys_getpgrp ['void']
 	case 4065: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_getpgrp_enter, cpu, pc);
 	}; break;
 	// 4066 long sys_setsid ['void']
 	case 4066: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_setsid_enter, cpu, pc);
 	}; break;
 	// 4067 long sys_sigaction ['int', 'const struct old_sigaction __user *', 'struct old_sigaction __user *']
 	case 4067: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -719,11 +779,13 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4068 long sys_sgetmask ['void']
 	case 4068: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_sgetmask_enter, cpu, pc);
 	}; break;
 	// 4069 long sys_ssetmask ['int newmask']
 	case 4069: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -735,6 +797,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4070 long sys_setreuid ['uid_t ruid', 'uid_t euid']
 	case 4070: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -748,6 +811,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4071 long sys_setregid ['gid_t rgid', 'gid_t egid']
 	case 4071: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -761,6 +825,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4072 long sys_sigsuspend ['int unused1', 'int unused2', 'old_sigset_t mask']
 	case 4072: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -776,6 +841,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4073 long sys_sigpending ['old_sigset_t __user *uset']
 	case 4073: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -787,6 +853,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4074 long sys_sethostname ['char __user *name', 'int len']
 	case 4074: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -800,6 +867,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4075 long sys_setrlimit ['unsigned int resource', 'struct rlimit __user *rlim']
 	case 4075: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -813,6 +881,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4076 long sys_getrlimit ['unsigned int resource', 'struct rlimit __user *rlim']
 	case 4076: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -826,6 +895,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4077 long sys_getrusage ['int who', 'struct rusage __user *ru']
 	case 4077: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -839,6 +909,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4078 long sys_gettimeofday ['struct __kernel_old_timeval __user *tv', 'struct timezone __user *tz']
 	case 4078: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -852,6 +923,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4079 long sys_settimeofday ['struct __kernel_old_timeval __user *tv', 'struct timezone __user *tz']
 	case 4079: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -865,6 +937,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4080 long sys_getgroups ['int gidsetsize', 'gid_t __user *grouplist']
 	case 4080: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -878,6 +951,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4081 long sys_setgroups ['int gidsetsize', 'gid_t __user *grouplist']
 	case 4081: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -891,6 +965,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4083 long sys_symlink ['const char __user *old', 'const char __user *new']
 	case 4083: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -904,6 +979,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4084 long sys_lstat ['const char __user *filename', 'struct __old_kernel_stat __user *statbuf']
 	case 4084: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -917,6 +993,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4085 long sys_readlink ['const char __user *path', 'char __user *buf', 'int bufsiz']
 	case 4085: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -932,6 +1009,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4086 long sys_uselib ['const char __user *library']
 	case 4086: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -943,6 +1021,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4087 long sys_swapon ['const char __user *specialfile', 'int swap_flags']
 	case 4087: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -956,6 +1035,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4088 long sys_reboot ['int magic1', 'int magic2', 'unsigned int cmd', 'void __user *arg']
 	case 4088: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -973,6 +1053,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4089 long sys_old_readdir ['unsigned int', 'struct old_linux_dirent __user *', 'unsigned int']
 	case 4089: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -988,6 +1069,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4090 long sys_mmap ['unsigned long addr', 'unsigned long len', 'unsigned long prot', 'unsigned long flags', 'unsigned long fd', 'unsigned long pgoff']
 	case 4090: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1009,6 +1091,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4091 long sys_munmap ['unsigned long addr', 'size_t len']
 	case 4091: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1022,6 +1105,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4092 long sys_truncate ['const char __user *path', 'long length']
 	case 4092: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1035,6 +1119,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4093 long sys_ftruncate ['unsigned int fd', 'unsigned long length']
 	case 4093: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1048,6 +1133,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4094 long sys_fchmod ['unsigned int fd', 'umode_t mode']
 	case 4094: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1061,6 +1147,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4095 long sys_fchown ['unsigned int fd', 'uid_t user', 'gid_t group']
 	case 4095: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1076,6 +1163,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4096 long sys_getpriority ['int which', 'int who']
 	case 4096: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1089,6 +1177,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4097 long sys_setpriority ['int which', 'int who', 'int niceval']
 	case 4097: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -1104,6 +1193,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4099 long sys_statfs ['const char __user *path', 'struct statfs __user *buf']
 	case 4099: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1117,6 +1207,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4100 long sys_fstatfs ['unsigned int fd', 'struct statfs __user *buf']
 	case 4100: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1130,6 +1221,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4101 long sys_ioperm ['unsigned long from', 'unsigned long num', 'int on']
 	case 4101: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -1145,6 +1237,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4102 long sys_socketcall ['int call', 'unsigned long __user *args']
 	case 4102: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1158,6 +1251,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4103 long sys_syslog ['int type', 'char __user *buf', 'int len']
 	case 4103: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -1173,6 +1267,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4104 long sys_setitimer ['int which', 'struct __kernel_old_itimerval __user *value', 'struct __kernel_old_itimerval __user *ovalue']
 	case 4104: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1188,6 +1283,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4105 long sys_getitimer ['int which', 'struct __kernel_old_itimerval __user *value']
 	case 4105: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1201,6 +1297,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4106 long sys_newstat ['const char __user *filename', 'struct stat __user *statbuf']
 	case 4106: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1214,6 +1311,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4107 long sys_newlstat ['const char __user *filename', 'struct stat __user *statbuf']
 	case 4107: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1227,6 +1325,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4108 long sys_newfstat ['unsigned int fd', 'struct stat __user *statbuf']
 	case 4108: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1240,6 +1339,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4109 long sys_uname ['struct old_utsname __user *']
 	case 4109: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1251,6 +1351,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4110 long sys_iopl ['int level']
 	case 4110: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1262,16 +1363,19 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4111 long sys_vhangup ['void']
 	case 4111: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_vhangup_enter, cpu, pc);
 	}; break;
 	// 4112 long sys_idle ['void']
 	case 4112: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_idle_enter, cpu, pc);
 	}; break;
 	// 4114 long sys_wait4 ['pid_t pid', 'int __user *stat_addr', 'int options', 'struct rusage __user *ru']
 	case 4114: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -1289,6 +1393,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4115 long sys_swapoff ['const char __user *specialfile']
 	case 4115: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1300,6 +1405,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4116 long sys_sysinfo ['struct sysinfo __user *info']
 	case 4116: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1311,6 +1417,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4117 long sys_ipc ['unsigned int call', 'int first', 'unsigned long second', 'unsigned long third', 'void __user *ptr', 'long fifth']
 	case 4117: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1332,6 +1439,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4118 long sys_fsync ['unsigned int fd']
 	case 4118: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1343,11 +1451,13 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4119 void sys_sigreturn ['void']
 	case 4119: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_sigreturn_enter, cpu, pc);
 	}; break;
 	// 4120 long sys_clone ['unsigned long', 'unsigned long', 'int __user *', 'unsigned long', 'int __user *']
 	case 4120: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1367,6 +1477,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4121 long sys_setdomainname ['char __user *name', 'int len']
 	case 4121: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1380,6 +1491,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4122 long sys_newuname ['struct new_utsname __user *name']
 	case 4122: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1391,6 +1503,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4123 long modify_ldt ['int func', 'void *ptr', 'unsigned long bytecount']
 	case 4123: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1406,6 +1519,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4124 long sys_adjtimex_time32 ['struct old_timex32 __user *txc_p']
 	case 4124: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1417,6 +1531,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4125 long sys_mprotect ['unsigned long start', 'size_t len', 'unsigned long prot']
 	case 4125: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1432,6 +1547,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4126 long sys_sigprocmask ['int how', 'old_sigset_t __user *set', 'old_sigset_t __user *oset']
 	case 4126: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1447,6 +1563,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4127 caddr_t create_module ['const char *name', 'size_t size']
 	case 4127: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1460,6 +1577,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4128 long sys_init_module ['void __user *umod', 'unsigned long len', 'const char __user *uargs']
 	case 4128: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1475,6 +1593,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4129 long sys_delete_module ['const char __user *name_user', 'unsigned int flags']
 	case 4129: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1488,6 +1607,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4130 long get_kernel_syms ['struct kernel_sym *table']
 	case 4130: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1499,6 +1619,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4131 long sys_quotactl ['unsigned int cmd', 'const char __user *special', 'qid_t id', 'void __user *addr']
 	case 4131: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1516,6 +1637,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4132 long sys_getpgid ['pid_t pid']
 	case 4132: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1527,6 +1649,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4133 long sys_fchdir ['unsigned int fd']
 	case 4133: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1538,6 +1661,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4134 long sys_bdflush ['int func', 'long data']
 	case 4134: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1551,6 +1675,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4135 long sys_sysfs ['int option', 'unsigned long arg1', 'unsigned long arg2']
 	case 4135: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1566,6 +1691,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4136 long sys_personality ['unsigned int personality']
 	case 4136: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1577,6 +1703,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4138 long sys_setfsuid ['uid_t uid']
 	case 4138: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1588,6 +1715,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4139 long sys_setfsgid ['gid_t gid']
 	case 4139: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1599,6 +1727,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4140 long sys_llseek ['unsigned int fd', 'unsigned long offset_high', 'unsigned long offset_low', 'loff_t __user *result', 'unsigned int whence']
 	case 4140: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1618,6 +1747,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4141 long sys_getdents ['unsigned int fd', 'struct linux_dirent __user *dirent', 'unsigned int count']
 	case 4141: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1633,6 +1763,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4142 long sys_select ['int n', 'fd_set __user *inp', 'fd_set __user *outp', 'fd_set __user *exp', 'struct __kernel_old_timeval __user *tvp']
 	case 4142: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1652,6 +1783,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4143 long sys_flock ['unsigned int fd', 'unsigned int cmd']
 	case 4143: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1665,6 +1797,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4144 long sys_msync ['unsigned long start', 'size_t len', 'int flags']
 	case 4144: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -1680,6 +1813,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4145 long sys_readv ['unsigned long fd', 'const struct iovec __user *vec', 'unsigned long vlen']
 	case 4145: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1695,6 +1829,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4146 long sys_writev ['unsigned long fd', 'const struct iovec __user *vec', 'unsigned long vlen']
 	case 4146: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1710,6 +1845,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4147 long sys_cacheflush ['char *addr', 'int nbytes', 'int cache']
 	case 4147: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -1725,11 +1861,13 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4150 long sys_setup ['void']
 	case 4150: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_setup_enter, cpu, pc);
 	}; break;
 	// 4151 long sys_getsid ['pid_t pid']
 	case 4151: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1741,6 +1879,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4152 long sys_fdatasync ['unsigned int fd']
 	case 4152: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1752,6 +1891,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4153 long sys_sysctl ['struct __sysctl_args __user *args']
 	case 4153: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1763,6 +1903,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4154 long sys_mlock ['unsigned long start', 'size_t len']
 	case 4154: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1776,6 +1917,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4155 long sys_munlock ['unsigned long start', 'size_t len']
 	case 4155: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1789,6 +1931,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4156 long sys_mlockall ['int flags']
 	case 4156: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1800,11 +1943,13 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4157 long sys_munlockall ['void']
 	case 4157: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_munlockall_enter, cpu, pc);
 	}; break;
 	// 4158 long sys_sched_setparam ['pid_t pid', 'struct sched_param __user *param']
 	case 4158: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1818,6 +1963,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4159 long sys_sched_getparam ['pid_t pid', 'struct sched_param __user *param']
 	case 4159: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1831,6 +1977,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4160 long sys_sched_setscheduler ['pid_t pid', 'int policy', 'struct sched_param __user *param']
 	case 4160: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1846,6 +1993,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4161 long sys_sched_getscheduler ['pid_t pid']
 	case 4161: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1857,11 +2005,13 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4162 long sys_sched_yield ['void']
 	case 4162: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_sched_yield_enter, cpu, pc);
 	}; break;
 	// 4163 long sys_sched_get_priority_max ['int policy']
 	case 4163: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1873,6 +2023,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4164 long sys_sched_get_priority_min ['int policy']
 	case 4164: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1884,6 +2035,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4165 long sys_sched_rr_get_interval_time32 ['pid_t pid', 'struct old_timespec32 __user *interval']
 	case 4165: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1897,6 +2049,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4166 long sys_nanosleep_time32 ['struct old_timespec32 __user *rqtp', 'struct old_timespec32 __user *rmtp']
 	case 4166: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1910,6 +2063,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4167 long sys_mremap ['unsigned long addr', 'unsigned long old_len', 'unsigned long new_len', 'unsigned long flags', 'unsigned long new_addr']
 	case 4167: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1929,6 +2083,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4168 long sys_accept ['int', 'struct sockaddr __user *', 'int __user *']
 	case 4168: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1944,6 +2099,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4169 long sys_bind ['int', 'struct sockaddr __user *', 'int']
 	case 4169: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -1959,6 +2115,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4170 long sys_connect ['int', 'struct sockaddr __user *', 'int']
 	case 4170: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -1974,6 +2131,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4171 long sys_getpeername ['int', 'struct sockaddr __user *', 'int __user *']
 	case 4171: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1989,6 +2147,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4172 long sys_getsockname ['int', 'struct sockaddr __user *', 'int __user *']
 	case 4172: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2004,6 +2163,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4173 long sys_getsockopt ['int fd', 'int level', 'int optname', 'char __user *optval', 'int __user *optlen']
 	case 4173: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -2023,6 +2183,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4174 long sys_listen ['int', 'int']
 	case 4174: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2036,6 +2197,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4175 long sys_recv ['int', 'void __user *', 'size_t', 'unsigned']
 	case 4175: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2053,6 +2215,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4176 long sys_recvfrom ['int', 'void __user *', 'size_t', 'unsigned', 'struct sockaddr __user *', 'int __user *']
 	case 4176: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2074,6 +2237,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4177 long sys_recvmsg ['int fd', 'struct user_msghdr __user *msg', 'unsigned flags']
 	case 4177: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2089,6 +2253,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4178 long sys_send ['int', 'void __user *', 'size_t', 'unsigned']
 	case 4178: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2106,6 +2271,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4179 long sys_sendmsg ['int fd', 'struct user_msghdr __user *msg', 'unsigned flags']
 	case 4179: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2121,6 +2287,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4180 long sys_sendto ['int', 'void __user *', 'size_t', 'unsigned', 'struct sockaddr __user *', 'int']
 	case 4180: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2142,6 +2309,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4181 long sys_setsockopt ['int fd', 'int level', 'int optname', 'char __user *optval', 'int optlen']
 	case 4181: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -2161,6 +2329,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4182 long sys_shutdown ['int', 'int']
 	case 4182: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2174,6 +2343,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4183 long sys_socket ['int', 'int', 'int']
 	case 4183: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -2189,6 +2359,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4184 long sys_socketpair ['int', 'int', 'int', 'int __user *']
 	case 4184: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -2206,6 +2377,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4185 long sys_setresuid ['uid_t ruid', 'uid_t euid', 'uid_t suid']
 	case 4185: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2221,6 +2393,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4186 long sys_getresuid ['uid_t __user *ruid', 'uid_t __user *euid', 'uid_t __user *suid']
 	case 4186: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2236,6 +2409,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4187 long sys_query_module ['const char *name', 'int which', 'void *buf', 'size_t bufsize', 'size_t *ret']
 	case 4187: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2255,6 +2429,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4188 long sys_poll ['struct pollfd __user *ufds', 'unsigned int nfds', 'int timeout']
 	case 4188: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -2270,6 +2445,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4189 long sys_nfsservctl ['int cmd', 'struct nfsctl_arg *argp', 'union nfsctl_res *resp']
 	case 4189: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2285,6 +2461,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4190 long sys_setresgid ['gid_t rgid', 'gid_t egid', 'gid_t sgid']
 	case 4190: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2300,6 +2477,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4191 long sys_getresgid ['gid_t __user *rgid', 'gid_t __user *egid', 'gid_t __user *sgid']
 	case 4191: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2315,6 +2493,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4192 long sys_prctl ['int option', 'unsigned long arg2', 'unsigned long arg3', 'unsigned long arg4', 'unsigned long arg5']
 	case 4192: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2334,11 +2513,13 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4193 void sys_rt_sigreturn ['void']
 	case 4193: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_rt_sigreturn_enter, cpu, pc);
 	}; break;
 	// 4194 long sys_rt_sigaction ['int', 'const struct sigaction __user *', 'struct sigaction __user *', 'size_t']
 	case 4194: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2356,6 +2537,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4195 long sys_rt_sigprocmask ['int how', 'sigset_t __user *set', 'sigset_t __user *oset', 'size_t sigsetsize']
 	case 4195: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2373,6 +2555,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4196 long sys_rt_sigpending ['sigset_t __user *set', 'size_t sigsetsize']
 	case 4196: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2386,6 +2569,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4197 long sys_rt_sigtimedwait_time32 ['const sigset_t __user *uthese', 'siginfo_t __user *uinfo', 'const struct old_timespec32 __user *uts', 'size_t sigsetsize']
 	case 4197: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2403,6 +2587,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4198 long sys_rt_sigqueueinfo ['pid_t pid', 'int sig', 'siginfo_t __user *uinfo']
 	case 4198: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2418,6 +2603,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4199 long sys_rt_sigsuspend ['sigset_t __user *unewset', 'size_t sigsetsize']
 	case 4199: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2431,6 +2617,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4200 long sys_pread64 ['unsigned int fd', 'char __user *buf', 'size_t count', 'loff_t pos']
 	case 4200: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2448,6 +2635,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4201 long sys_pwrite64 ['unsigned int fd', 'const char __user *buf', 'size_t count', 'loff_t pos']
 	case 4201: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2465,6 +2653,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4202 long sys_chown ['const char __user *filename', 'uid_t user', 'gid_t group']
 	case 4202: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2480,6 +2669,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4203 long sys_getcwd ['char __user *buf', 'unsigned long size']
 	case 4203: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2493,6 +2683,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4204 long sys_capget ['cap_user_header_t header', 'cap_user_data_t dataptr']
 	case 4204: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2506,6 +2697,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4205 long sys_capset ['cap_user_header_t header', 'const cap_user_data_t data']
 	case 4205: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2519,6 +2711,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4206 long sys_sigaltstack ['const struct sigaltstack __user *uss', 'struct sigaltstack __user *uoss']
 	case 4206: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2532,6 +2725,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4207 long sys_sendfile ['int out_fd', 'int in_fd', 'off_t __user *offset', 'size_t count']
 	case 4207: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2549,6 +2743,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4210 void* mmap2 ['void *addr', 'size_t length', 'int prot', 'int flags', 'int fd', 'off_t pgoffset']
 	case 4210: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -2570,6 +2765,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4211 long sys_truncate64 ['const char __user *path', 'loff_t length']
 	case 4211: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2583,6 +2779,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4212 long sys_ftruncate64 ['unsigned int fd', 'loff_t length']
 	case 4212: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2596,6 +2793,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4213 long sys_stat64 ['const char __user *filename', 'struct stat64 __user *statbuf']
 	case 4213: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2609,6 +2807,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4214 long sys_lstat64 ['const char __user *filename', 'struct stat64 __user *statbuf']
 	case 4214: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2622,6 +2821,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4215 long sys_fstat64 ['unsigned long fd', 'struct stat64 __user *statbuf']
 	case 4215: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2635,6 +2835,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4216 long sys_pivot_root ['const char __user *new_root', 'const char __user *put_old']
 	case 4216: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2648,6 +2849,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4217 long sys_mincore ['unsigned long start', 'size_t len', 'unsigned char __user *vec']
 	case 4217: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2663,6 +2865,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4218 long sys_madvise ['unsigned long start', 'size_t len', 'int behavior']
 	case 4218: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -2678,6 +2881,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4219 long sys_getdents64 ['unsigned int fd', 'struct linux_dirent64 __user *dirent', 'unsigned int count']
 	case 4219: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2693,6 +2897,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4220 long sys_fcntl64 ['unsigned int fd', 'unsigned int cmd', 'unsigned long arg']
 	case 4220: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2708,11 +2913,13 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4222 long sys_gettid ['void']
 	case 4222: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_gettid_enter, cpu, pc);
 	}; break;
 	// 4223 long sys_readahead ['int fd', 'loff_t offset', 'size_t count']
 	case 4223: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2728,6 +2935,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4224 long sys_setxattr ['const char __user *path', 'const char __user *name', 'const void __user *value', 'size_t size', 'int flags']
 	case 4224: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2747,6 +2955,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4225 long sys_lsetxattr ['const char __user *path', 'const char __user *name', 'const void __user *value', 'size_t size', 'int flags']
 	case 4225: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2766,6 +2975,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4226 long sys_fsetxattr ['int fd', 'const char __user *name', 'const void __user *value', 'size_t size', 'int flags']
 	case 4226: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2785,6 +2995,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4227 long sys_getxattr ['const char __user *path', 'const char __user *name', 'void __user *value', 'size_t size']
 	case 4227: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2802,6 +3013,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4228 long sys_lgetxattr ['const char __user *path', 'const char __user *name', 'void __user *value', 'size_t size']
 	case 4228: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2819,6 +3031,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4229 long sys_fgetxattr ['int fd', 'const char __user *name', 'void __user *value', 'size_t size']
 	case 4229: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2836,6 +3049,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4230 long sys_listxattr ['const char __user *path', 'char __user *list', 'size_t size']
 	case 4230: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2851,6 +3065,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4231 long sys_llistxattr ['const char __user *path', 'char __user *list', 'size_t size']
 	case 4231: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2866,6 +3081,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4232 long sys_flistxattr ['int fd', 'char __user *list', 'size_t size']
 	case 4232: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2881,6 +3097,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4233 long sys_removexattr ['const char __user *path', 'const char __user *name']
 	case 4233: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2894,6 +3111,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4234 long sys_lremovexattr ['const char __user *path', 'const char __user *name']
 	case 4234: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2907,6 +3125,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4235 long sys_fremovexattr ['int fd', 'const char __user *name']
 	case 4235: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2920,6 +3139,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4236 long sys_tkill ['pid_t pid', 'int sig']
 	case 4236: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2933,6 +3153,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4237 long sys_sendfile64 ['int out_fd', 'int in_fd', 'loff_t __user *offset', 'size_t count']
 	case 4237: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2950,6 +3171,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4238 long sys_futex_time32 ['u32 __user *uaddr', 'int op', 'u32 val', 'struct old_timespec32 __user *utime', 'u32 __user *uaddr2', 'u32 val3']
 	case 4238: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2971,6 +3193,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4239 long sys_sched_setaffinity ['pid_t pid', 'unsigned int len', 'unsigned long __user *user_mask_ptr']
 	case 4239: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2986,6 +3209,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4240 long sys_sched_getaffinity ['pid_t pid', 'unsigned int len', 'unsigned long __user *user_mask_ptr']
 	case 4240: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3001,6 +3225,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4241 long sys_io_setup ['unsigned nr_reqs', 'aio_context_t __user *ctx']
 	case 4241: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3014,6 +3239,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4242 long sys_io_destroy ['aio_context_t ctx']
 	case 4242: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -3025,6 +3251,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4243 long sys_io_getevents_time32 ['__u32 ctx_id', '__s32 min_nr', '__s32 nr', 'struct io_event __user *events', 'struct old_timespec32 __user *timeout']
 	case 4243: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -3044,6 +3271,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4244 long sys_io_submit ['aio_context_t', 'long', 'struct iocb __user * __user *']
 	case 4244: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3059,6 +3287,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4245 long sys_io_cancel ['aio_context_t ctx_id', 'struct iocb __user *iocb', 'struct io_event __user *result']
 	case 4245: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3073,7 +3302,8 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	}; break;
 	// 4246 long sys_exit_group ['int error_code']
 	case 4246: {
-		panda_noreturn = false;
+		panda_noreturn = true;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -3085,6 +3315,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4247 long sys_lookup_dcookie ['u64 cookie64', 'char __user *buf', 'size_t len']
 	case 4247: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3100,6 +3331,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4248 long sys_epoll_create ['int size']
 	case 4248: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -3111,6 +3343,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4249 long sys_epoll_ctl ['int epfd', 'int op', 'int fd', 'struct epoll_event __user *event']
 	case 4249: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -3128,6 +3361,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4250 long sys_epoll_wait ['int epfd', 'struct epoll_event __user *events', 'int maxevents', 'int timeout']
 	case 4250: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -3145,6 +3379,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4251 long sys_remap_file_pages ['unsigned long start', 'unsigned long size', 'unsigned long prot', 'unsigned long pgoff', 'unsigned long flags']
 	case 4251: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3164,6 +3399,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4252 long sys_set_tid_address ['int __user *tidptr']
 	case 4252: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -3175,11 +3411,13 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4253 long sys_restart_syscall ['void']
 	case 4253: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_restart_syscall_enter, cpu, pc);
 	}; break;
 	// 4254 long sys_fadvise64_64 ['int fd', 'loff_t offset', 'loff_t len', 'int advice']
 	case 4254: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -3197,6 +3435,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4255 long sys_statfs64 ['const char __user *path', 'size_t sz', 'struct statfs64 __user *buf']
 	case 4255: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3212,6 +3451,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4256 long sys_fstatfs64 ['unsigned int fd', 'size_t sz', 'struct statfs64 __user *buf']
 	case 4256: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3227,6 +3467,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4257 long sys_timer_create ['clockid_t which_clock', 'struct sigevent __user *timer_event_spec', 'timer_t __user *created_timer_id']
 	case 4257: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3242,6 +3483,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4258 long sys_timer_settime32 ['timer_t timer_id', 'int flags', 'struct old_itimerspec32 __user *new', 'struct old_itimerspec32 __user *old']
 	case 4258: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3259,6 +3501,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4259 long sys_timer_gettime32 ['timer_t timer_id', 'struct old_itimerspec32 __user *setting']
 	case 4259: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3272,6 +3515,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4260 long sys_timer_getoverrun ['timer_t timer_id']
 	case 4260: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -3283,6 +3527,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4261 long sys_timer_delete ['timer_t timer_id']
 	case 4261: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -3294,6 +3539,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4262 long sys_clock_settime32 ['clockid_t which_clock', 'struct old_timespec32 __user *tp']
 	case 4262: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3307,6 +3553,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4263 long sys_clock_gettime32 ['clockid_t which_clock', 'struct old_timespec32 __user *tp']
 	case 4263: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3320,6 +3567,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4264 long sys_clock_getres_time32 ['clockid_t which_clock', 'struct old_timespec32 __user *tp']
 	case 4264: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3333,6 +3581,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4265 long sys_clock_nanosleep_time32 ['clockid_t which_clock', 'int flags', 'struct old_timespec32 __user *rqtp', 'struct old_timespec32 __user *rmtp']
 	case 4265: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3350,6 +3599,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4266 long sys_tgkill ['pid_t tgid', 'pid_t pid', 'int sig']
 	case 4266: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -3365,6 +3615,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4267 long sys_utimes_time32 ['const char __user *filename', 'struct old_timeval32 __user *t']
 	case 4267: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3378,6 +3629,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4268 long sys_mbind ['unsigned long start', 'unsigned long len', 'unsigned long mode', 'const unsigned long __user *nmask', 'unsigned long maxnode', 'unsigned flags']
 	case 4268: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3399,6 +3651,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4269 long sys_get_mempolicy ['int __user *policy', 'unsigned long __user *nmask', 'unsigned long maxnode', 'unsigned long addr', 'unsigned long flags']
 	case 4269: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3418,6 +3671,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4270 long sys_set_mempolicy ['int mode', 'const unsigned long __user *nmask', 'unsigned long maxnode']
 	case 4270: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3433,6 +3687,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4271 long sys_mq_open ['const char __user *name', 'int oflag', 'umode_t mode', 'struct mq_attr __user *attr']
 	case 4271: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3450,6 +3705,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4272 long sys_mq_unlink ['const char __user *name']
 	case 4272: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -3461,6 +3717,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4273 long sys_mq_timedsend_time32 ['mqd_t mqdes', 'const char __user *u_msg_ptr', 'unsigned int msg_len', 'unsigned int msg_prio', 'const struct old_timespec32 __user *u_abs_timeout']
 	case 4273: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3480,6 +3737,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4274 long sys_mq_timedreceive_time32 ['mqd_t mqdes', 'char __user *u_msg_ptr', 'unsigned int msg_len', 'unsigned int __user *u_msg_prio', 'const struct old_timespec32 __user *u_abs_timeout']
 	case 4274: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3499,6 +3757,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4275 long sys_mq_notify ['mqd_t mqdes', 'const struct sigevent __user *notification']
 	case 4275: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3512,6 +3771,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4276 long sys_mq_getsetattr ['mqd_t mqdes', 'const struct mq_attr __user *mqstat', 'struct mq_attr __user *omqstat']
 	case 4276: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3527,6 +3787,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4278 long sys_waitid ['int which', 'pid_t pid', 'struct siginfo __user *infop', 'int options', 'struct rusage __user *ru']
 	case 4278: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3546,6 +3807,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4280 long sys_add_key ['const char __user *_type', 'const char __user *_description', 'const void __user *_payload', 'size_t plen', 'key_serial_t destringid']
 	case 4280: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3565,6 +3827,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4281 long sys_request_key ['const char __user *_type', 'const char __user *_description', 'const char __user *_callout_info', 'key_serial_t destringid']
 	case 4281: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3582,6 +3845,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4282 long sys_keyctl ['int cmd', 'unsigned long arg2', 'unsigned long arg3', 'unsigned long arg4', 'unsigned long arg5']
 	case 4282: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3601,6 +3865,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4283 long set_thread_area ['unsigned long tp']
 	case 4283: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -3612,11 +3877,13 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4284 long sys_inotify_init ['void']
 	case 4284: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_inotify_init_enter, cpu, pc);
 	}; break;
 	// 4285 long sys_inotify_add_watch ['int fd', 'const char __user *path', 'u32 mask']
 	case 4285: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3632,6 +3899,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4286 long sys_inotify_rm_watch ['int fd', '__s32 wd']
 	case 4286: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3645,6 +3913,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4287 long sys_migrate_pages ['pid_t pid', 'unsigned long maxnode', 'const unsigned long __user *from', 'const unsigned long __user *to']
 	case 4287: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3662,6 +3931,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4288 long sys_openat ['int dfd', 'const char __user *filename', 'int flags', 'umode_t mode']
 	case 4288: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -3679,6 +3949,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4289 long sys_mkdirat ['int dfd', 'const char __user *pathname', 'umode_t mode']
 	case 4289: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3694,6 +3965,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4290 long sys_mknodat ['int dfd', 'const char __user *filename', 'umode_t mode', 'unsigned dev']
 	case 4290: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3711,6 +3983,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4291 long sys_fchownat ['int dfd', 'const char __user *filename', 'uid_t user', 'gid_t group', 'int flag']
 	case 4291: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3730,6 +4003,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4292 long sys_futimesat_time32 ['unsigned int dfd', 'const char __user *filename', 'struct old_timeval32 __user *t']
 	case 4292: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3745,6 +4019,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4293 long sys_fstatat64 ['int dfd', 'const char __user *filename', 'struct stat64 __user *statbuf', 'int flag']
 	case 4293: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3762,6 +4037,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4294 long sys_unlinkat ['int dfd', 'const char __user *pathname', 'int flag']
 	case 4294: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -3777,6 +4053,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4295 long sys_renameat ['int olddfd', 'const char __user *oldname', 'int newdfd', 'const char __user *newname']
 	case 4295: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -3794,6 +4071,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4296 long sys_linkat ['int olddfd', 'const char __user *oldname', 'int newdfd', 'const char __user *newname', 'int flags']
 	case 4296: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -3813,6 +4091,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4297 long sys_symlinkat ['const char __user *oldname', 'int newdfd', 'const char __user *newname']
 	case 4297: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3828,6 +4107,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4298 long sys_readlinkat ['int dfd', 'const char __user *path', 'char __user *buf', 'int bufsiz']
 	case 4298: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3845,6 +4125,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4299 long sys_fchmodat ['int dfd', 'const char __user *filename', 'umode_t mode']
 	case 4299: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3860,6 +4141,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4300 long sys_faccessat ['int dfd', 'const char __user *filename', 'int mode']
 	case 4300: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -3875,6 +4157,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4301 long sys_pselect6_time32 ['int', 'fd_set __user *', 'fd_set __user *', 'fd_set __user *', 'struct old_timespec32 __user *', 'void __user *']
 	case 4301: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3896,6 +4179,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4302 long sys_ppoll_time32 ['struct pollfd __user *', 'unsigned int', 'struct old_timespec32 __user *', 'const sigset_t __user *', 'size_t']
 	case 4302: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3915,6 +4199,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4303 long sys_unshare ['unsigned long unshare_flags']
 	case 4303: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -3926,6 +4211,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4304 long sys_splice ['int fd_in', 'loff_t __user *off_in', 'int fd_out', 'loff_t __user *off_out', 'size_t len', 'unsigned int flags']
 	case 4304: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -3947,6 +4233,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4305 long sys_sync_file_range ['int fd', 'loff_t offset', 'loff_t nbytes', 'unsigned int flags']
 	case 4305: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -3964,6 +4251,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4306 long sys_tee ['int fdin', 'int fdout', 'size_t len', 'unsigned int flags']
 	case 4306: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3981,6 +4269,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4307 long sys_vmsplice ['int fd', 'const struct iovec __user *iov', 'unsigned long nr_segs', 'unsigned int flags']
 	case 4307: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3998,6 +4287,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4308 long sys_move_pages ['pid_t pid', 'unsigned long nr_pages', 'const void __user * __user *pages', 'const int __user *nodes', 'int __user *status', 'int flags']
 	case 4308: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4019,6 +4309,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4309 long sys_set_robust_list ['struct robust_list_head __user *head', 'size_t len']
 	case 4309: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -4032,6 +4323,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4310 long sys_get_robust_list ['int pid', 'struct robust_list_head __user * __user *head_ptr', 'size_t __user *len_ptr']
 	case 4310: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4047,6 +4339,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4311 long sys_kexec_load ['unsigned long entry', 'unsigned long nr_segments', 'struct kexec_segment __user *segments', 'unsigned long flags']
 	case 4311: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4064,6 +4357,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4312 long sys_getcpu ['unsigned __user *cpu', 'unsigned __user *node', 'struct getcpu_cache __user *cache']
 	case 4312: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4079,6 +4373,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4313 long sys_epoll_pwait ['int epfd', 'struct epoll_event __user *events', 'int maxevents', 'int timeout', 'const sigset_t __user *sigmask', 'size_t sigsetsize']
 	case 4313: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -4100,6 +4395,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4314 long sys_ioprio_set ['int which', 'int who', 'int ioprio']
 	case 4314: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -4115,6 +4411,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4315 long sys_ioprio_get ['int which', 'int who']
 	case 4315: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -4128,6 +4425,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4316 long sys_utimensat_time32 ['unsigned int dfd', 'const char __user *filename', 'struct old_timespec32 __user *t', 'int flags']
 	case 4316: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4145,6 +4443,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4317 long sys_signalfd ['int ufd', 'sigset_t __user *user_mask', 'size_t sizemask']
 	case 4317: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4160,11 +4459,13 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4318 long sys_ni_syscall ['void']
 	case 4318: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_ni_syscall_enter, cpu, pc);
 	}; break;
 	// 4319 long sys_eventfd ['unsigned int count']
 	case 4319: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -4176,6 +4477,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4320 long sys_fallocate ['int fd', 'int mode', 'loff_t offset', 'loff_t len']
 	case 4320: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -4193,6 +4495,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4321 long sys_timerfd_create ['int clockid', 'int flags']
 	case 4321: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -4206,6 +4509,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4322 long sys_timerfd_gettime32 ['int ufd', 'struct old_itimerspec32 __user *otmr']
 	case 4322: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -4219,6 +4523,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4323 long sys_timerfd_settime32 ['int ufd', 'int flags', 'const struct old_itimerspec32 __user *utmr', 'struct old_itimerspec32 __user *otmr']
 	case 4323: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4236,6 +4541,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4324 long sys_signalfd4 ['int ufd', 'sigset_t __user *user_mask', 'size_t sizemask', 'int flags']
 	case 4324: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4253,6 +4559,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4325 long sys_eventfd2 ['unsigned int count', 'int flags']
 	case 4325: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -4266,6 +4573,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4326 long sys_epoll_create1 ['int flags']
 	case 4326: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -4277,6 +4585,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4327 long sys_dup3 ['unsigned int oldfd', 'unsigned int newfd', 'int flags']
 	case 4327: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -4292,6 +4601,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4328 long sys_pipe2 ['int __user *fildes', 'int flags']
 	case 4328: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -4305,6 +4615,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4329 long sys_inotify_init1 ['int flags']
 	case 4329: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -4316,6 +4627,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4330 long sys_preadv ['unsigned long fd', 'const struct iovec __user *vec', 'unsigned long vlen', 'unsigned long pos_l', 'unsigned long pos_h']
 	case 4330: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4335,6 +4647,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4331 long sys_pwritev ['unsigned long fd', 'const struct iovec __user *vec', 'unsigned long vlen', 'unsigned long pos_l', 'unsigned long pos_h']
 	case 4331: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4354,6 +4667,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4332 long sys_rt_tgsigqueueinfo ['pid_t tgid', 'pid_t pid', 'int sig', 'siginfo_t __user *uinfo']
 	case 4332: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -4371,6 +4685,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4333 long sys_perf_event_open ['struct perf_event_attr __user *attr_uptr', 'pid_t pid', 'int cpu', 'int group_fd', 'unsigned long flags']
 	case 4333: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -4390,6 +4705,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4334 long sys_accept4 ['int', 'struct sockaddr __user *', 'int __user *', 'int']
 	case 4334: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4407,6 +4723,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4335 long sys_recvmmsg_time32 ['int fd', 'struct mmsghdr __user *msg', 'unsigned int vlen', 'unsigned flags', 'struct old_timespec32 __user *timeout']
 	case 4335: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4426,6 +4743,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4336 long sys_fanotify_init ['unsigned int flags', 'unsigned int event_f_flags']
 	case 4336: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -4439,6 +4757,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4337 long sys_fanotify_mark ['int fanotify_fd', 'unsigned int flags', 'u64 mask', 'int fd', 'const char __user *pathname']
 	case 4337: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -4458,6 +4777,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4338 long sys_prlimit64 ['pid_t pid', 'unsigned int resource', 'const struct rlimit64 __user *new_rlim', 'struct rlimit64 __user *old_rlim']
 	case 4338: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4475,6 +4795,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4339 long sys_name_to_handle_at ['int dfd', 'const char __user *name', 'struct file_handle __user *handle', 'int __user *mnt_id', 'int flag']
 	case 4339: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4494,6 +4815,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4340 long sys_open_by_handle_at ['int mountdirfd', 'struct file_handle __user *handle', 'int flags']
 	case 4340: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -4509,6 +4831,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4341 long sys_clock_adjtime32 ['clockid_t which_clock', 'struct old_timex32 __user *tx']
 	case 4341: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -4522,6 +4845,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4342 long sys_syncfs ['int fd']
 	case 4342: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -4533,6 +4857,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4343 long sys_sendmmsg ['int fd', 'struct mmsghdr __user *msg', 'unsigned int vlen', 'unsigned flags']
 	case 4343: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4550,6 +4875,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4344 long sys_setns ['int fd', 'int nstype']
 	case 4344: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -4563,6 +4889,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4345 long sys_process_vm_readv ['pid_t pid', 'const struct iovec __user *lvec', 'unsigned long liovcnt', 'const struct iovec __user *rvec', 'unsigned long riovcnt', 'unsigned long flags']
 	case 4345: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4584,6 +4911,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4346 long sys_process_vm_writev ['pid_t pid', 'const struct iovec __user *lvec', 'unsigned long liovcnt', 'const struct iovec __user *rvec', 'unsigned long riovcnt', 'unsigned long flags']
 	case 4346: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4605,6 +4933,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4347 long sys_kcmp ['pid_t pid1', 'pid_t pid2', 'int type', 'unsigned long idx1', 'unsigned long idx2']
 	case 4347: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -4624,6 +4953,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4348 long sys_finit_module ['int fd', 'const char __user *uargs', 'int flags']
 	case 4348: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -4639,6 +4969,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4349 long sys_sched_setattr ['pid_t pid', 'struct sched_attr __user *attr', 'unsigned int flags']
 	case 4349: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4654,6 +4985,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4350 long sys_sched_getattr ['pid_t pid', 'struct sched_attr __user *attr', 'unsigned int size', 'unsigned int flags']
 	case 4350: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4671,6 +5003,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4351 long sys_renameat2 ['int olddfd', 'const char __user *oldname', 'int newdfd', 'const char __user *newname', 'unsigned int flags']
 	case 4351: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -4690,6 +5023,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4352 long sys_seccomp ['unsigned int op', 'unsigned int flags', 'void __user *uargs']
 	case 4352: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4705,6 +5039,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4353 long sys_getrandom ['char __user *buf', 'size_t count', 'unsigned int flags']
 	case 4353: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4720,6 +5055,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4354 long sys_memfd_create ['const char __user *uname_ptr', 'unsigned int flags']
 	case 4354: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -4733,6 +5069,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4355 long sys_bpf ['int cmd', 'union bpf_attr *attr', 'unsigned int size']
 	case 4355: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4748,6 +5085,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4356 long sys_execveat ['int dfd', 'const char __user *filename', 'const char __user *const __user *argv', 'const char __user *const __user *envp', 'int flags']
 	case 4356: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4767,6 +5105,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4357 long sys_userfaultfd ['int flags']
 	case 4357: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -4778,6 +5117,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4358 long sys_membarrier ['int cmd', 'int flags']
 	case 4358: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -4791,6 +5131,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4359 long sys_mlock2 ['unsigned long start', 'size_t len', 'int flags']
 	case 4359: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -4806,6 +5147,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4360 long sys_copy_file_range ['int fd_in', 'loff_t __user *off_in', 'int fd_out', 'loff_t __user *off_out', 'size_t len', 'unsigned int flags']
 	case 4360: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -4827,6 +5169,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4361 long sys_preadv2 ['unsigned long fd', 'const struct iovec __user *vec', 'unsigned long vlen', 'unsigned long pos_l', 'unsigned long pos_h', 'rwf_t flags']
 	case 4361: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4848,6 +5191,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4362 long sys_pwritev2 ['unsigned long fd', 'const struct iovec __user *vec', 'unsigned long vlen', 'unsigned long pos_l', 'unsigned long pos_h', 'rwf_t flags']
 	case 4362: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4869,6 +5213,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4363 long sys_pkey_mprotect ['unsigned long start', 'size_t len', 'unsigned long prot', 'int pkey']
 	case 4363: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4886,6 +5231,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4364 long sys_pkey_alloc ['unsigned long flags', 'unsigned long init_val']
 	case 4364: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -4899,6 +5245,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4365 long sys_pkey_free ['int pkey']
 	case 4365: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -4910,6 +5257,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4366 long sys_statx ['int dfd', 'const char __user *path', 'unsigned flags', 'unsigned mask', 'struct statx __user *buffer']
 	case 4366: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4929,6 +5277,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4367 long sys_rseq ['struct rseq __user *rseq', 'uint32_t rseq_len', 'int flags', 'uint32_t sig']
 	case 4367: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -4946,6 +5295,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4368 long sys_io_pgetevents_time32 ['aio_context_t ctx_id', 'long min_nr', 'long nr', 'struct io_event __user *events', 'struct old_timespec32 __user *timeout', 'const struct __aio_sigset *sig']
 	case 4368: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -4967,6 +5317,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4393 long sys_semget ['key_t key', 'int nsems', 'int semflg']
 	case 4393: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -4982,6 +5333,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4394 long sys_semctl ['int semid', 'int semnum', 'int cmd', 'unsigned long arg']
 	case 4394: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -4999,6 +5351,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4395 long sys_shmget ['key_t key', 'size_t size', 'int flag']
 	case 4395: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -5014,6 +5367,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4396 long sys_shmctl ['int shmid', 'int cmd', 'struct shmid_ds __user *buf']
 	case 4396: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -5029,6 +5383,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4397 long sys_shmat ['int shmid', 'char __user *shmaddr', 'int shmflg']
 	case 4397: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -5044,6 +5399,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4398 long sys_shmdt ['char __user *shmaddr']
 	case 4398: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -5055,6 +5411,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4399 long sys_msgget ['key_t key', 'int msgflg']
 	case 4399: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -5068,6 +5425,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4400 long sys_msgsnd ['int msqid', 'struct msgbuf __user *msgp', 'size_t msgsz', 'int msgflg']
 	case 4400: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -5085,6 +5443,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4401 long sys_msgrcv ['int msqid', 'struct msgbuf __user *msgp', 'size_t msgsz', 'long msgtyp', 'int msgflg']
 	case 4401: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -5104,6 +5463,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4402 long sys_msgctl ['int msqid', 'int cmd', 'struct msqid_ds __user *buf']
 	case 4402: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -5119,6 +5479,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4403 long sys_clock_gettime ['clockid_t which_clock', 'struct __kernel_timespec __user *tp']
 	case 4403: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -5132,6 +5493,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4404 long sys_clock_settime ['clockid_t which_clock', 'const struct __kernel_timespec __user *tp']
 	case 4404: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -5145,6 +5507,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4405 long sys_clock_adjtime ['clockid_t which_clock', 'struct __kernel_timex __user *tx']
 	case 4405: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -5158,6 +5521,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4406 long sys_clock_getres ['clockid_t which_clock', 'struct __kernel_timespec __user *tp']
 	case 4406: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -5171,6 +5535,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4407 long sys_clock_nanosleep ['clockid_t which_clock', 'int flags', 'const struct __kernel_timespec __user *rqtp', 'struct __kernel_timespec __user *rmtp']
 	case 4407: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -5188,6 +5553,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4408 long sys_timer_gettime ['timer_t timer_id', 'struct __kernel_itimerspec __user *setting']
 	case 4408: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -5201,6 +5567,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4409 long sys_timer_settime ['timer_t timer_id', 'int flags', 'const struct __kernel_itimerspec __user *new_setting', 'struct __kernel_itimerspec __user *old_setting']
 	case 4409: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -5218,6 +5585,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4410 long sys_timerfd_gettime ['int ufd', 'struct __kernel_itimerspec __user *otmr']
 	case 4410: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -5231,6 +5599,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4411 long sys_timerfd_settime ['int ufd', 'int flags', 'const struct __kernel_itimerspec __user *utmr', 'struct __kernel_itimerspec __user *otmr']
 	case 4411: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -5248,6 +5617,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4412 long sys_utimensat ['int dfd', 'const char __user *filename', 'struct __kernel_timespec __user *utimes', 'int flags']
 	case 4412: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -5265,6 +5635,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4413 long sys_pselect6 ['int', 'fd_set __user *', 'fd_set __user *', 'fd_set __user *', 'struct __kernel_timespec __user *', 'void __user *']
 	case 4413: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -5286,6 +5657,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4414 long sys_ppoll ['struct pollfd __user *', 'unsigned int', 'struct __kernel_timespec __user *', 'const sigset_t __user *', 'size_t']
 	case 4414: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -5305,6 +5677,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4416 long sys_io_pgetevents ['aio_context_t ctx_id', 'long min_nr', 'long nr', 'struct io_event __user *events', 'struct __kernel_timespec __user *timeout', 'const struct __aio_sigset *sig']
 	case 4416: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -5326,6 +5699,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4417 long sys_recvmmsg ['int fd', 'struct mmsghdr __user *msg', 'unsigned int vlen', 'unsigned flags', 'struct __kernel_timespec __user *timeout']
 	case 4417: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -5345,6 +5719,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4418 long sys_mq_timedsend ['mqd_t mqdes', 'const char __user *msg_ptr', 'size_t msg_len', 'unsigned int msg_prio', 'const struct __kernel_timespec __user *abs_timeout']
 	case 4418: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -5364,6 +5739,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4419 long sys_mq_timedreceive ['mqd_t mqdes', 'char __user *msg_ptr', 'size_t msg_len', 'unsigned int __user *msg_prio', 'const struct __kernel_timespec __user *abs_timeout']
 	case 4419: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -5383,6 +5759,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4420 long sys_semtimedop ['int semid', 'struct sembuf __user *sops', 'unsigned nsops', 'const struct __kernel_timespec __user *timeout']
 	case 4420: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -5400,6 +5777,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4421 long sys_rt_sigtimedwait ['const sigset_t __user *uthese', 'siginfo_t __user *uinfo', 'const struct __kernel_timespec __user *uts', 'size_t sigsetsize']
 	case 4421: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -5417,6 +5795,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4422 long sys_futex ['u32 __user *uaddr', 'int op', 'u32 val', 'struct __kernel_timespec __user *utime', 'u32 __user *uaddr2', 'u32 val3']
 	case 4422: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -5438,6 +5817,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4423 long sys_sched_rr_get_interval ['pid_t pid', 'struct __kernel_timespec __user *interval']
 	case 4423: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -5451,6 +5831,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4424 long sys_pidfd_send_signal ['int pidfd', 'int sig', 'siginfo_t __user *info', 'unsigned int flags']
 	case 4424: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -5468,6 +5849,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4425 long sys_io_uring_setup ['u32 entries', 'struct io_uring_params __user *p']
 	case 4425: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -5481,6 +5863,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4426 long sys_io_uring_enter ['unsigned int fd', 'u32 to_submit', 'u32 min_complete', 'u32 flags', 'const sigset_t __user *sig', 'size_t sigsz']
 	case 4426: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -5502,6 +5885,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4427 long sys_io_uring_register ['unsigned int fd', 'unsigned int op', 'void __user *arg', 'unsigned int nr_args']
 	case 4427: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -5519,6 +5903,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4428 long sys_open_tree ['int dfd', 'const char __user *path', 'unsigned flags']
 	case 4428: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -5534,6 +5919,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4429 long sys_move_mount ['int from_dfd', 'const char __user *from_path', 'int to_dfd', 'const char __user *to_path', 'unsigned int ms_flags']
 	case 4429: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -5553,6 +5939,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4430 long sys_fsopen ['const char __user *fs_name', 'unsigned int flags']
 	case 4430: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -5566,6 +5953,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4431 long sys_fsconfig ['int fs_fd', 'unsigned int cmd', 'const char __user *key', 'const void __user *value', 'int aux']
 	case 4431: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -5585,6 +5973,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4432 long sys_fsmount ['int fs_fd', 'unsigned int flags', 'unsigned int ms_flags']
 	case 4432: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -5600,6 +5989,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4433 long sys_fspick ['int dfd', 'const char __user *path', 'unsigned int flags']
 	case 4433: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -5615,6 +6005,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4434 long sys_pidfd_open ['pid_t pid', 'unsigned int flags']
 	case 4434: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -5628,6 +6019,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4437 long sys_openat2 ['int dfd', 'const char __user *filename', 'struct open_how *how', 'size_t size']
 	case 4437: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -5645,6 +6037,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4438 long sys_pidfd_getfd ['int pidfd', 'int fd', 'unsigned int flags']
 	case 4438: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -5660,6 +6053,7 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 	// 4439 long sys_faccessat2 ['int dfd', 'const char __user *filename', 'int mode', 'int flags']
 	case 4439: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
diff --git a/panda/plugins/syscalls2/generated/syscall_switch_enter_linux_x64.cpp b/panda/plugins/syscalls2/generated/syscall_switch_enter_linux_x64.cpp
index 7b06fc8ceaa..6a3f4886092 100644
--- a/panda/plugins/syscalls2/generated/syscall_switch_enter_linux_x64.cpp
+++ b/panda/plugins/syscalls2/generated/syscall_switch_enter_linux_x64.cpp
@@ -33,6 +33,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	}
 	ctx.asid = panda_current_asid(cpu);
 	ctx.retaddr = calc_retaddr(cpu, pc);
+	ctx.double_return = false;
 	bool panda_noreturn;	// true if PANDA should not track the return of this system call
 	const syscall_info_t *call = NULL;
 	syscall_info_t zero = {0};
@@ -48,6 +49,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 0 long sys_read ['unsigned int fd', 'char __user *buf', 'size_t count']
 	case 0: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -63,6 +65,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 1 long sys_write ['unsigned int fd', 'const char __user *buf', 'size_t count']
 	case 1: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -78,6 +81,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 2 long sys_open ['const char __user *filename', 'int flags', 'umode_t mode']
 	case 2: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -93,6 +97,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 3 long sys_close ['unsigned int fd']
 	case 3: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -104,6 +109,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 4 long sys_newstat ['const char __user *filename', 'struct stat __user *statbuf']
 	case 4: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -117,6 +123,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 5 long sys_newfstat ['unsigned int fd', 'struct stat __user *statbuf']
 	case 5: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -130,6 +137,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 6 long sys_newlstat ['const char __user *filename', 'struct stat __user *statbuf']
 	case 6: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -143,6 +151,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 7 long sys_poll ['struct pollfd __user *ufds', 'unsigned int nfds', 'int timeout']
 	case 7: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -158,6 +167,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 8 long sys_lseek ['unsigned int fd', 'off_t offset', 'unsigned int whence']
 	case 8: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -173,6 +183,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 9 long sys_mmap ['unsigned long', 'unsigned long', 'unsigned long', 'unsigned long', 'unsigned long', 'unsigned long']
 	case 9: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -194,6 +205,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 10 long sys_mprotect ['unsigned long start', 'size_t len', 'unsigned long prot']
 	case 10: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -209,6 +221,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 11 long sys_munmap ['unsigned long addr', 'size_t len']
 	case 11: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -222,6 +235,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 12 long sys_brk ['unsigned long brk']
 	case 12: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -233,6 +247,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 13 long sys_rt_sigaction ['int', 'const struct sigaction __user *', 'struct sigaction __user *', 'size_t']
 	case 13: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -250,6 +265,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 14 long sys_rt_sigprocmask ['int how', 'sigset_t __user *set', 'sigset_t __user *oset', 'size_t sigsetsize']
 	case 14: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -267,11 +283,13 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 15 long sys_rt_sigreturn ['void']
 	case 15: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_rt_sigreturn_enter, cpu, pc);
 	}; break;
 	// 16 long sys_ioctl ['unsigned int fd', 'unsigned int cmd', 'unsigned long arg']
 	case 16: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -287,6 +305,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 17 long sys_pread64 ['unsigned int fd', 'char __user *buf', 'size_t count', 'loff_t pos']
 	case 17: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -304,6 +323,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 18 long sys_pwrite64 ['unsigned int fd', 'const char __user *buf', 'size_t count', 'loff_t pos']
 	case 18: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -321,6 +341,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 19 long sys_readv ['unsigned long fd', 'const struct iovec __user *vec', 'unsigned long vlen']
 	case 19: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -336,6 +357,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 20 long sys_writev ['unsigned long fd', 'const struct iovec __user *vec', 'unsigned long vlen']
 	case 20: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -351,6 +373,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 21 long sys_access ['const char __user *filename', 'int mode']
 	case 21: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -364,6 +387,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 22 long sys_pipe ['int __user *fildes']
 	case 22: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -375,6 +399,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 23 long sys_select ['int n', 'fd_set __user *inp', 'fd_set __user *outp', 'fd_set __user *exp', 'struct timeval __user *tvp']
 	case 23: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -394,11 +419,13 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 24 long sys_sched_yield ['void']
 	case 24: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_sched_yield_enter, cpu, pc);
 	}; break;
 	// 25 long sys_mremap ['unsigned long addr', 'unsigned long old_len', 'unsigned long new_len', 'unsigned long flags', 'unsigned long new_addr']
 	case 25: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -418,6 +445,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 26 long sys_msync ['unsigned long start', 'size_t len', 'int flags']
 	case 26: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -433,6 +461,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 27 long sys_mincore ['unsigned long start', 'size_t len', 'unsigned char __user *vec']
 	case 27: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -448,6 +477,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 28 long sys_madvise ['unsigned long start', 'size_t len', 'int behavior']
 	case 28: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -463,6 +493,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 29 long sys_shmget ['key_t key', 'size_t size', 'int flag']
 	case 29: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -478,6 +509,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 30 long sys_shmat ['int shmid', 'char __user *shmaddr', 'int shmflg']
 	case 30: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -493,6 +525,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 31 long sys_shmctl ['int shmid', 'int cmd', 'struct shmid_ds __user *buf']
 	case 31: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -508,6 +541,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 32 long sys_dup ['unsigned int fildes']
 	case 32: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -519,6 +553,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 33 long sys_dup2 ['unsigned int oldfd', 'unsigned int newfd']
 	case 33: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -532,11 +567,13 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 34 long sys_pause ['void']
 	case 34: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_pause_enter, cpu, pc);
 	}; break;
 	// 35 long sys_nanosleep ['struct timespec __user *rqtp', 'struct timespec __user *rmtp']
 	case 35: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -550,6 +587,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 36 long sys_getitimer ['int which', 'struct itimerval __user *value']
 	case 36: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -563,6 +601,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 37 long sys_alarm ['unsigned int seconds']
 	case 37: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -574,6 +613,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 38 long sys_setitimer ['int which', 'struct itimerval __user *value', 'struct itimerval __user *ovalue']
 	case 38: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -589,11 +629,13 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 39 long sys_getpid ['void']
 	case 39: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_getpid_enter, cpu, pc);
 	}; break;
 	// 40 long sys_sendfile64 ['int out_fd', 'int in_fd', 'loff_t __user *offset', 'size_t count']
 	case 40: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -611,6 +653,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 41 long sys_socket ['int', 'int', 'int']
 	case 41: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -626,6 +669,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 42 long sys_connect ['int', 'struct sockaddr __user *', 'int']
 	case 42: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -641,6 +685,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 43 long sys_accept ['int', 'struct sockaddr __user *', 'int __user *']
 	case 43: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -656,6 +701,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 44 long sys_sendto ['int', 'void __user *', 'size_t', 'unsigned', 'struct sockaddr __user *', 'int']
 	case 44: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -677,6 +723,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 45 long sys_recvfrom ['int', 'void __user *', 'size_t', 'unsigned', 'struct sockaddr __user *', 'int __user *']
 	case 45: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -698,6 +745,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 46 long sys_sendmsg ['int fd', 'struct user_msghdr __user *msg', 'unsigned flags']
 	case 46: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -713,6 +761,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 47 long sys_recvmsg ['int fd', 'struct user_msghdr __user *msg', 'unsigned flags']
 	case 47: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -728,6 +777,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 48 long sys_shutdown ['int', 'int']
 	case 48: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -741,6 +791,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 49 long sys_bind ['int', 'struct sockaddr __user *', 'int']
 	case 49: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -756,6 +807,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 50 long sys_listen ['int', 'int']
 	case 50: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -769,6 +821,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 51 long sys_getsockname ['int', 'struct sockaddr __user *', 'int __user *']
 	case 51: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -784,6 +837,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 52 long sys_getpeername ['int', 'struct sockaddr __user *', 'int __user *']
 	case 52: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -799,6 +853,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 53 long sys_socketpair ['int', 'int', 'int', 'int __user *']
 	case 53: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -816,6 +871,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 54 long sys_setsockopt ['int fd', 'int level', 'int optname', 'char __user *optval', 'int optlen']
 	case 54: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -835,6 +891,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 55 long sys_getsockopt ['int fd', 'int level', 'int optname', 'char __user *optval', 'int __user *optlen']
 	case 55: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -854,6 +911,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 56 long sys_clone ['unsigned long', 'unsigned long', 'int __user *', 'int __user *', 'unsigned long']
 	case 56: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -873,16 +931,19 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 57 long sys_fork ['void']
 	case 57: {
 		panda_noreturn = false;
+		ctx.double_return = true;
 		PPP_RUN_CB(on_sys_fork_enter, cpu, pc);
 	}; break;
 	// 58 long sys_vfork ['void']
 	case 58: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_vfork_enter, cpu, pc);
 	}; break;
 	// 59 long sys_execve ['const char __user *filename', 'const char __user *const __user *argv', 'const char __user *const __user *envp']
 	case 59: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -898,6 +959,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 60 long sys_exit ['int error_code']
 	case 60: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -909,6 +971,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 61 long sys_wait4 ['pid_t pid', 'int __user *stat_addr', 'int options', 'struct rusage __user *ru']
 	case 61: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -926,6 +989,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 62 long sys_kill ['pid_t pid', 'int sig']
 	case 62: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -939,6 +1003,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 63 long sys_newuname ['struct new_utsname __user *name']
 	case 63: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -950,6 +1015,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 64 long sys_semget ['key_t key', 'int nsems', 'int semflg']
 	case 64: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -965,6 +1031,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 65 long sys_semop ['int semid', 'struct sembuf __user *sops', 'unsigned nsops']
 	case 65: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -980,6 +1047,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 66 long sys_semctl ['int semid', 'int semnum', 'int cmd', 'unsigned long arg']
 	case 66: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -997,6 +1065,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 67 long sys_shmdt ['char __user *shmaddr']
 	case 67: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1008,6 +1077,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 68 long sys_msgget ['key_t key', 'int msgflg']
 	case 68: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1021,6 +1091,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 69 long sys_msgsnd ['int msqid', 'struct msgbuf __user *msgp', 'size_t msgsz', 'int msgflg']
 	case 69: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1038,6 +1109,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 70 long sys_msgrcv ['int msqid', 'struct msgbuf __user *msgp', 'size_t msgsz', 'long msgtyp', 'int msgflg']
 	case 70: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1057,6 +1129,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 71 long sys_msgctl ['int msqid', 'int cmd', 'struct msqid_ds __user *buf']
 	case 71: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -1072,6 +1145,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 72 long sys_fcntl ['unsigned int fd', 'unsigned int cmd', 'unsigned long arg']
 	case 72: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -1087,6 +1161,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 73 long sys_flock ['unsigned int fd', 'unsigned int cmd']
 	case 73: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1100,6 +1175,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 74 long sys_fsync ['unsigned int fd']
 	case 74: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1111,6 +1187,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 75 long sys_fdatasync ['unsigned int fd']
 	case 75: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1122,6 +1199,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 76 long sys_truncate ['const char __user *path', 'long length']
 	case 76: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		int64_t arg1 = get_s64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1135,6 +1213,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 77 long sys_ftruncate ['unsigned int fd', 'unsigned long length']
 	case 77: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1148,6 +1227,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 78 long sys_getdents ['unsigned int fd', 'struct linux_dirent __user *dirent', 'unsigned int count']
 	case 78: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1163,6 +1243,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 79 long sys_getcwd ['char __user *buf', 'unsigned long size']
 	case 79: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1176,6 +1257,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 80 long sys_chdir ['const char __user *filename']
 	case 80: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1187,6 +1269,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 81 long sys_fchdir ['unsigned int fd']
 	case 81: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1198,6 +1281,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 82 long sys_rename ['const char __user *oldname', 'const char __user *newname']
 	case 82: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1211,6 +1295,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 83 long sys_mkdir ['const char __user *pathname', 'umode_t mode']
 	case 83: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1224,6 +1309,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 84 long sys_rmdir ['const char __user *pathname']
 	case 84: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1235,6 +1321,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 85 long sys_creat ['const char __user *pathname', 'umode_t mode']
 	case 85: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1248,6 +1335,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 86 long sys_link ['const char __user *oldname', 'const char __user *newname']
 	case 86: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1261,6 +1349,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 87 long sys_unlink ['const char __user *pathname']
 	case 87: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1272,6 +1361,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 88 long sys_symlink ['const char __user *old', 'const char __user *new']
 	case 88: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1285,6 +1375,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 89 long sys_readlink ['const char __user *path', 'char __user *buf', 'int bufsiz']
 	case 89: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -1300,6 +1391,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 90 long sys_chmod ['const char __user *filename', 'umode_t mode']
 	case 90: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1313,6 +1405,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 91 long sys_fchmod ['unsigned int fd', 'umode_t mode']
 	case 91: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1326,6 +1419,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 92 long sys_chown ['const char __user *filename', 'uid_t user', 'gid_t group']
 	case 92: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1341,6 +1435,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 93 long sys_fchown ['unsigned int fd', 'uid_t user', 'gid_t group']
 	case 93: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1356,6 +1451,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 94 long sys_lchown ['const char __user *filename', 'uid_t user', 'gid_t group']
 	case 94: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1371,6 +1467,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 95 long sys_umask ['int mask']
 	case 95: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1382,6 +1479,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 96 long sys_gettimeofday ['struct timeval __user *tv', 'struct timezone __user *tz']
 	case 96: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1395,6 +1493,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 97 long sys_getrlimit ['unsigned int resource', 'struct rlimit __user *rlim']
 	case 97: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1408,6 +1507,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 98 long sys_getrusage ['int who', 'struct rusage __user *ru']
 	case 98: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1421,6 +1521,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 99 long sys_sysinfo ['struct sysinfo __user *info']
 	case 99: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1432,6 +1533,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 100 long sys_times ['struct tms __user *tbuf']
 	case 100: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1443,6 +1545,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 101 long sys_ptrace ['long request', 'long pid', 'unsigned long addr', 'unsigned long data']
 	case 101: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int64_t arg0 = get_s64(cpu, 0);
 		int64_t arg1 = get_s64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -1460,11 +1563,13 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 102 long sys_getuid ['void']
 	case 102: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_getuid_enter, cpu, pc);
 	}; break;
 	// 103 long sys_syslog ['int type', 'char __user *buf', 'int len']
 	case 103: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -1480,11 +1585,13 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 104 long sys_getgid ['void']
 	case 104: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_getgid_enter, cpu, pc);
 	}; break;
 	// 105 long sys_setuid ['uid_t uid']
 	case 105: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1496,6 +1603,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 106 long sys_setgid ['gid_t gid']
 	case 106: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1507,16 +1615,19 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 107 long sys_geteuid ['void']
 	case 107: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_geteuid_enter, cpu, pc);
 	}; break;
 	// 108 long sys_getegid ['void']
 	case 108: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_getegid_enter, cpu, pc);
 	}; break;
 	// 109 long sys_setpgid ['pid_t pid', 'pid_t pgid']
 	case 109: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1530,21 +1641,25 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 110 long sys_getppid ['void']
 	case 110: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_getppid_enter, cpu, pc);
 	}; break;
 	// 111 long sys_getpgrp ['void']
 	case 111: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_getpgrp_enter, cpu, pc);
 	}; break;
 	// 112 long sys_setsid ['void']
 	case 112: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_setsid_enter, cpu, pc);
 	}; break;
 	// 113 long sys_setreuid ['uid_t ruid', 'uid_t euid']
 	case 113: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1558,6 +1673,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 114 long sys_setregid ['gid_t rgid', 'gid_t egid']
 	case 114: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1571,6 +1687,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 115 long sys_getgroups ['int gidsetsize', 'gid_t __user *grouplist']
 	case 115: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1584,6 +1701,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 116 long sys_setgroups ['int gidsetsize', 'gid_t __user *grouplist']
 	case 116: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1597,6 +1715,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 117 long sys_setresuid ['uid_t ruid', 'uid_t euid', 'uid_t suid']
 	case 117: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1612,6 +1731,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 118 long sys_getresuid ['uid_t __user *ruid', 'uid_t __user *euid', 'uid_t __user *suid']
 	case 118: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -1627,6 +1747,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 119 long sys_setresgid ['gid_t rgid', 'gid_t egid', 'gid_t sgid']
 	case 119: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1642,6 +1763,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 120 long sys_getresgid ['gid_t __user *rgid', 'gid_t __user *egid', 'gid_t __user *sgid']
 	case 120: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -1657,6 +1779,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 121 long sys_getpgid ['pid_t pid']
 	case 121: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1668,6 +1791,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 122 long sys_setfsuid ['uid_t uid']
 	case 122: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1679,6 +1803,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 123 long sys_setfsgid ['gid_t gid']
 	case 123: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1690,6 +1815,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 124 long sys_getsid ['pid_t pid']
 	case 124: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1701,6 +1827,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 125 long sys_capget ['cap_user_header_t header', 'cap_user_data_t dataptr']
 	case 125: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1714,6 +1841,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 126 long sys_capset ['cap_user_header_t header', 'const cap_user_data_t data']
 	case 126: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1727,6 +1855,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 127 long sys_rt_sigpending ['sigset_t __user *set', 'size_t sigsetsize']
 	case 127: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1740,6 +1869,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 128 long sys_rt_sigtimedwait ['const sigset_t __user *uthese', 'siginfo_t __user *uinfo', 'const struct timespec __user *uts', 'size_t sigsetsize']
 	case 128: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -1757,6 +1887,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 129 long sys_rt_sigqueueinfo ['pid_t pid', 'int sig', 'siginfo_t __user *uinfo']
 	case 129: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -1772,6 +1903,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 130 long sys_rt_sigsuspend ['sigset_t __user *unewset', 'size_t sigsetsize']
 	case 130: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1785,6 +1917,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 131 long sys_sigaltstack ['const struct sigaltstack __user *uss', 'struct sigaltstack __user *uoss']
 	case 131: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1798,6 +1931,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 132 long sys_utime ['char __user *filename', 'struct utimbuf __user *times']
 	case 132: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1811,6 +1945,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 133 long sys_mknod ['const char __user *filename', 'umode_t mode', 'unsigned dev']
 	case 133: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1826,6 +1961,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 135 long sys_personality ['unsigned int personality']
 	case 135: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1837,6 +1973,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 136 long sys_ustat ['unsigned dev', 'struct ustat __user *ubuf']
 	case 136: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1850,6 +1987,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 137 long sys_statfs ['const char __user *path', 'struct statfs __user *buf']
 	case 137: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1863,6 +2001,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 138 long sys_fstatfs ['unsigned int fd', 'struct statfs __user *buf']
 	case 138: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1876,6 +2015,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 139 long sys_sysfs ['int option', 'unsigned long arg1', 'unsigned long arg2']
 	case 139: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -1891,6 +2031,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 140 long sys_getpriority ['int which', 'int who']
 	case 140: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1904,6 +2045,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 141 long sys_setpriority ['int which', 'int who', 'int niceval']
 	case 141: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -1919,6 +2061,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 142 long sys_sched_setparam ['pid_t pid', 'struct sched_param __user *param']
 	case 142: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1932,6 +2075,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 143 long sys_sched_getparam ['pid_t pid', 'struct sched_param __user *param']
 	case 143: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1945,6 +2089,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 144 long sys_sched_setscheduler ['pid_t pid', 'int policy', 'struct sched_param __user *param']
 	case 144: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -1960,6 +2105,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 145 long sys_sched_getscheduler ['pid_t pid']
 	case 145: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1971,6 +2117,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 146 long sys_sched_get_priority_max ['int policy']
 	case 146: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1982,6 +2129,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 147 long sys_sched_get_priority_min ['int policy']
 	case 147: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1993,6 +2141,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 148 long sys_sched_rr_get_interval ['pid_t pid', 'struct timespec __user *interval']
 	case 148: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2006,6 +2155,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 149 long sys_mlock ['unsigned long start', 'size_t len']
 	case 149: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2019,6 +2169,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 150 long sys_munlock ['unsigned long start', 'size_t len']
 	case 150: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2032,6 +2183,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 151 long sys_mlockall ['int flags']
 	case 151: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -2043,16 +2195,19 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 152 long sys_munlockall ['void']
 	case 152: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_munlockall_enter, cpu, pc);
 	}; break;
 	// 153 long sys_vhangup ['void']
 	case 153: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_vhangup_enter, cpu, pc);
 	}; break;
 	// 154 long sys_modify_ldt ['int', 'void __user *', 'unsigned long']
 	case 154: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -2068,6 +2223,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 155 long sys_pivot_root ['const char __user *new_root', 'const char __user *put_old']
 	case 155: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2081,6 +2237,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 156 long sys_sysctl ['struct __sysctl_args __user *args']
 	case 156: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -2092,6 +2249,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 157 long sys_prctl ['int option', 'unsigned long arg2', 'unsigned long arg3', 'unsigned long arg4', 'unsigned long arg5']
 	case 157: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -2111,6 +2269,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 158 long sys_arch_prctl ['int', 'unsigned long']
 	case 158: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2124,6 +2283,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 159 long sys_adjtimex ['struct timex __user *txc_p']
 	case 159: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -2135,6 +2295,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 160 long sys_setrlimit ['unsigned int resource', 'struct rlimit __user *rlim']
 	case 160: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2148,6 +2309,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 161 long sys_chroot ['const char __user *filename']
 	case 161: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -2159,11 +2321,13 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 162 long sys_sync ['void']
 	case 162: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_sync_enter, cpu, pc);
 	}; break;
 	// 163 long sys_acct ['const char __user *name']
 	case 163: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -2175,6 +2339,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 164 long sys_settimeofday ['struct timeval __user *tv', 'struct timezone __user *tz']
 	case 164: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2188,6 +2353,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 165 long sys_mount ['char __user *dev_name', 'char __user *dir_name', 'char __user *type', 'unsigned long flags', 'void __user *data']
 	case 165: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -2207,6 +2373,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 166 long sys_umount ['char __user *name', 'int flags']
 	case 166: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2220,6 +2387,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 167 long sys_swapon ['const char __user *specialfile', 'int swap_flags']
 	case 167: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2233,6 +2401,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 168 long sys_swapoff ['const char __user *specialfile']
 	case 168: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -2244,6 +2413,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 169 long sys_reboot ['int magic1', 'int magic2', 'unsigned int cmd', 'void __user *arg']
 	case 169: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2261,6 +2431,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 170 long sys_sethostname ['char __user *name', 'int len']
 	case 170: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2274,6 +2445,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 171 long sys_setdomainname ['char __user *name', 'int len']
 	case 171: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2287,6 +2459,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 172 long sys_iopl ['unsigned int']
 	case 172: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -2298,6 +2471,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 173 long sys_ioperm ['unsigned long', 'unsigned long', 'int']
 	case 173: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -2313,6 +2487,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 175 long sys_init_module ['void __user *umod', 'unsigned long len', 'const char __user *uargs']
 	case 175: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -2328,6 +2503,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 176 long sys_delete_module ['const char __user *name_user', 'unsigned int flags']
 	case 176: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2341,6 +2517,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 179 long sys_quotactl ['unsigned int cmd', 'const char __user *special', 'qid_t id', 'void __user *addr']
 	case 179: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2358,11 +2535,13 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 186 long sys_gettid ['void']
 	case 186: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_gettid_enter, cpu, pc);
 	}; break;
 	// 187 long sys_readahead ['int fd', 'loff_t offset', 'size_t count']
 	case 187: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2378,6 +2557,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 188 long sys_setxattr ['const char __user *path', 'const char __user *name', 'const void __user *value', 'size_t size', 'int flags']
 	case 188: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -2397,6 +2577,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 189 long sys_lsetxattr ['const char __user *path', 'const char __user *name', 'const void __user *value', 'size_t size', 'int flags']
 	case 189: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -2416,6 +2597,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 190 long sys_fsetxattr ['int fd', 'const char __user *name', 'const void __user *value', 'size_t size', 'int flags']
 	case 190: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -2435,6 +2617,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 191 long sys_getxattr ['const char __user *path', 'const char __user *name', 'void __user *value', 'size_t size']
 	case 191: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -2452,6 +2635,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 192 long sys_lgetxattr ['const char __user *path', 'const char __user *name', 'void __user *value', 'size_t size']
 	case 192: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -2469,6 +2653,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 193 long sys_fgetxattr ['int fd', 'const char __user *name', 'void __user *value', 'size_t size']
 	case 193: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -2486,6 +2671,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 194 long sys_listxattr ['const char __user *path', 'char __user *list', 'size_t size']
 	case 194: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2501,6 +2687,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 195 long sys_llistxattr ['const char __user *path', 'char __user *list', 'size_t size']
 	case 195: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2516,6 +2703,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 196 long sys_flistxattr ['int fd', 'char __user *list', 'size_t size']
 	case 196: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2531,6 +2719,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 197 long sys_removexattr ['const char __user *path', 'const char __user *name']
 	case 197: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2544,6 +2733,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 198 long sys_lremovexattr ['const char __user *path', 'const char __user *name']
 	case 198: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2557,6 +2747,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 199 long sys_fremovexattr ['int fd', 'const char __user *name']
 	case 199: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2570,6 +2761,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 200 long sys_tkill ['pid_t pid', 'int sig']
 	case 200: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2583,6 +2775,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 201 long sys_time ['time_t __user *tloc']
 	case 201: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -2594,6 +2787,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 202 long sys_futex ['u32 __user *uaddr', 'int op', 'u32 val', 'struct timespec __user *utime', 'u32 __user *uaddr2', 'u32 val3']
 	case 202: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2615,6 +2809,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 203 long sys_sched_setaffinity ['pid_t pid', 'unsigned int len', 'unsigned long __user *user_mask_ptr']
 	case 203: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -2630,6 +2825,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 204 long sys_sched_getaffinity ['pid_t pid', 'unsigned int len', 'unsigned long __user *user_mask_ptr']
 	case 204: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -2645,6 +2841,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 206 long sys_io_setup ['unsigned nr_reqs', 'aio_context_t __user *ctx']
 	case 206: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2658,6 +2855,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 207 long sys_io_destroy ['aio_context_t ctx']
 	case 207: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -2669,6 +2867,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 208 long sys_io_getevents ['aio_context_t ctx_id', 'long min_nr', 'long nr', 'struct io_event __user *events', 'struct timespec __user *timeout']
 	case 208: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		int64_t arg1 = get_s64(cpu, 1);
 		int64_t arg2 = get_s64(cpu, 2);
@@ -2688,6 +2887,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 209 long sys_io_submit ['aio_context_t', 'long', 'struct iocb __user * __user *']
 	case 209: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		int64_t arg1 = get_s64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -2703,6 +2903,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 210 long sys_io_cancel ['aio_context_t ctx_id', 'struct iocb __user *iocb', 'struct io_event __user *result']
 	case 210: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -2718,6 +2919,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 212 long sys_lookup_dcookie ['u64 cookie64', 'char __user *buf', 'size_t len']
 	case 212: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2733,6 +2935,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 213 long sys_epoll_create ['int size']
 	case 213: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -2744,6 +2947,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 216 long sys_remap_file_pages ['unsigned long start', 'unsigned long size', 'unsigned long prot', 'unsigned long pgoff', 'unsigned long flags']
 	case 216: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -2763,6 +2967,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 217 long sys_getdents64 ['unsigned int fd', 'struct linux_dirent64 __user *dirent', 'unsigned int count']
 	case 217: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2778,6 +2983,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 218 long sys_set_tid_address ['int __user *tidptr']
 	case 218: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -2789,11 +2995,13 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 219 long sys_restart_syscall ['void']
 	case 219: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_restart_syscall_enter, cpu, pc);
 	}; break;
 	// 220 long sys_semtimedop ['int semid', 'struct sembuf __user *sops', 'unsigned nsops', 'const struct timespec __user *timeout']
 	case 220: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2811,6 +3019,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 221 long sys_fadvise64 ['int fd', 'loff_t offset', 'size_t len', 'int advice']
 	case 221: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2828,6 +3037,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 222 long sys_timer_create ['clockid_t which_clock', 'struct sigevent __user *timer_event_spec', 'timer_t __user *created_timer_id']
 	case 222: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -2843,6 +3053,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 223 long sys_timer_settime ['timer_t timer_id', 'int flags', 'const struct itimerspec __user *new_setting', 'struct itimerspec __user *old_setting']
 	case 223: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -2860,6 +3071,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 224 long sys_timer_gettime ['timer_t timer_id', 'struct itimerspec __user *setting']
 	case 224: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2873,6 +3085,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 225 long sys_timer_getoverrun ['timer_t timer_id']
 	case 225: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -2884,6 +3097,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 226 long sys_timer_delete ['timer_t timer_id']
 	case 226: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -2895,6 +3109,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 227 long sys_clock_settime ['clockid_t which_clock', 'const struct timespec __user *tp']
 	case 227: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2908,6 +3123,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 228 long sys_clock_gettime ['clockid_t which_clock', 'struct timespec __user *tp']
 	case 228: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2921,6 +3137,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 229 long sys_clock_getres ['clockid_t which_clock', 'struct timespec __user *tp']
 	case 229: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2934,6 +3151,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 230 long sys_clock_nanosleep ['clockid_t which_clock', 'int flags', 'const struct timespec __user *rqtp', 'struct timespec __user *rmtp']
 	case 230: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -2951,6 +3169,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 231 long sys_exit_group ['int error_code']
 	case 231: {
 		panda_noreturn = true;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -2962,6 +3181,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 232 long sys_epoll_wait ['int epfd', 'struct epoll_event __user *events', 'int maxevents', 'int timeout']
 	case 232: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -2979,6 +3199,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 233 long sys_epoll_ctl ['int epfd', 'int op', 'int fd', 'struct epoll_event __user *event']
 	case 233: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -2996,6 +3217,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 234 long sys_tgkill ['pid_t tgid', 'pid_t pid', 'int sig']
 	case 234: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -3011,6 +3233,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 235 long sys_utimes ['char __user *filename', 'struct timeval __user *utimes']
 	case 235: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3024,6 +3247,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 237 long sys_mbind ['unsigned long start', 'unsigned long len', 'unsigned long mode', 'const unsigned long __user *nmask', 'unsigned long maxnode', 'unsigned flags']
 	case 237: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -3045,6 +3269,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 238 long sys_set_mempolicy ['int mode', 'const unsigned long __user *nmask', 'unsigned long maxnode']
 	case 238: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -3060,6 +3285,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 239 long sys_get_mempolicy ['int __user *policy', 'unsigned long __user *nmask', 'unsigned long maxnode', 'unsigned long addr', 'unsigned long flags']
 	case 239: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -3079,6 +3305,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 240 long sys_mq_open ['const char __user *name', 'int oflag', 'umode_t mode', 'struct mq_attr __user *attr']
 	case 240: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3096,6 +3323,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 241 long sys_mq_unlink ['const char __user *name']
 	case 241: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -3107,6 +3335,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 242 long sys_mq_timedsend ['mqd_t mqdes', 'const char __user *msg_ptr', 'size_t msg_len', 'unsigned int msg_prio', 'const struct timespec __user *abs_timeout']
 	case 242: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3126,6 +3355,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 243 long sys_mq_timedreceive ['mqd_t mqdes', 'char __user *msg_ptr', 'size_t msg_len', 'unsigned int __user *msg_prio', 'const struct timespec __user *abs_timeout']
 	case 243: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3145,6 +3375,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 244 long sys_mq_notify ['mqd_t mqdes', 'const struct sigevent __user *notification']
 	case 244: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3158,6 +3389,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 245 long sys_mq_getsetattr ['mqd_t mqdes', 'const struct mq_attr __user *mqstat', 'struct mq_attr __user *omqstat']
 	case 245: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -3173,6 +3405,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 246 long sys_kexec_load ['unsigned long entry', 'unsigned long nr_segments', 'struct kexec_segment __user *segments', 'unsigned long flags']
 	case 246: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -3190,6 +3423,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 247 long sys_waitid ['int which', 'pid_t pid', 'struct siginfo __user *infop', 'int options', 'struct rusage __user *ru']
 	case 247: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -3209,6 +3443,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 248 long sys_add_key ['const char __user *_type', 'const char __user *_description', 'const void __user *_payload', 'size_t plen', 'key_serial_t destringid']
 	case 248: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -3228,6 +3463,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 249 long sys_request_key ['const char __user *_type', 'const char __user *_description', 'const char __user *_callout_info', 'key_serial_t destringid']
 	case 249: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -3245,6 +3481,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 250 long sys_keyctl ['int cmd', 'unsigned long arg2', 'unsigned long arg3', 'unsigned long arg4', 'unsigned long arg5']
 	case 250: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -3264,6 +3501,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 251 long sys_ioprio_set ['int which', 'int who', 'int ioprio']
 	case 251: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -3279,6 +3517,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 252 long sys_ioprio_get ['int which', 'int who']
 	case 252: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3292,11 +3531,13 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 253 long sys_inotify_init ['void']
 	case 253: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_inotify_init_enter, cpu, pc);
 	}; break;
 	// 254 long sys_inotify_add_watch ['int fd', 'const char __user *path', 'u32 mask']
 	case 254: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3312,6 +3553,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 255 long sys_inotify_rm_watch ['int fd', '__s32 wd']
 	case 255: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3325,6 +3567,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 256 long sys_migrate_pages ['pid_t pid', 'unsigned long maxnode', 'const unsigned long __user *from', 'const unsigned long __user *to']
 	case 256: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -3342,6 +3585,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 257 long sys_openat ['int dfd', 'const char __user *filename', 'int flags', 'umode_t mode']
 	case 257: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -3359,6 +3603,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 258 long sys_mkdirat ['int dfd', 'const char __user *pathname', 'umode_t mode']
 	case 258: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3374,6 +3619,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 259 long sys_mknodat ['int dfd', 'const char __user *filename', 'umode_t mode', 'unsigned dev']
 	case 259: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3391,6 +3637,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 260 long sys_fchownat ['int dfd', 'const char __user *filename', 'uid_t user', 'gid_t group', 'int flag']
 	case 260: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3410,6 +3657,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 261 long sys_futimesat ['int dfd', 'const char __user *filename', 'struct timeval __user *utimes']
 	case 261: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -3425,6 +3673,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 262 long sys_newfstatat ['int dfd', 'const char __user *filename', 'struct stat __user *statbuf', 'int flag']
 	case 262: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -3442,6 +3691,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 263 long sys_unlinkat ['int dfd', 'const char __user *pathname', 'int flag']
 	case 263: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -3457,6 +3707,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 264 long sys_renameat ['int olddfd', 'const char __user *oldname', 'int newdfd', 'const char __user *newname']
 	case 264: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -3474,6 +3725,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 265 long sys_linkat ['int olddfd', 'const char __user *oldname', 'int newdfd', 'const char __user *newname', 'int flags']
 	case 265: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -3493,6 +3745,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 266 long sys_symlinkat ['const char __user *oldname', 'int newdfd', 'const char __user *newname']
 	case 266: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -3508,6 +3761,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 267 long sys_readlinkat ['int dfd', 'const char __user *path', 'char __user *buf', 'int bufsiz']
 	case 267: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -3525,6 +3779,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 268 long sys_fchmodat ['int dfd', 'const char __user *filename', 'umode_t mode']
 	case 268: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3540,6 +3795,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 269 long sys_faccessat ['int dfd', 'const char __user *filename', 'int mode']
 	case 269: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -3555,6 +3811,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 270 long sys_pselect6 ['int', 'fd_set __user *', 'fd_set __user *', 'fd_set __user *', 'struct timespec __user *', 'void __user *']
 	case 270: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -3576,6 +3833,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 271 long sys_ppoll ['struct pollfd __user *', 'unsigned int', 'struct timespec __user *', 'const sigset_t __user *', 'size_t']
 	case 271: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -3595,6 +3853,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 272 long sys_unshare ['unsigned long unshare_flags']
 	case 272: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -3606,6 +3865,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 273 long sys_set_robust_list ['struct robust_list_head __user *head', 'size_t len']
 	case 273: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3619,6 +3879,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 274 long sys_get_robust_list ['int pid', 'struct robust_list_head __user * __user *head_ptr', 'size_t __user *len_ptr']
 	case 274: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -3634,6 +3895,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 275 long sys_splice ['int fd_in', 'loff_t __user *off_in', 'int fd_out', 'loff_t __user *off_out', 'size_t len', 'unsigned int flags']
 	case 275: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -3655,6 +3917,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 276 long sys_tee ['int fdin', 'int fdout', 'size_t len', 'unsigned int flags']
 	case 276: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3672,6 +3935,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 277 long sys_sync_file_range ['int fd', 'loff_t offset', 'loff_t nbytes', 'unsigned int flags']
 	case 277: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -3689,6 +3953,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 278 long sys_vmsplice ['int fd', 'const struct iovec __user *iov', 'unsigned long nr_segs', 'unsigned int flags']
 	case 278: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -3706,6 +3971,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 279 long sys_move_pages ['pid_t pid', 'unsigned long nr_pages', 'const void __user * __user *pages', 'const int __user *nodes', 'int __user *status', 'int flags']
 	case 279: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -3727,6 +3993,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 280 long sys_utimensat ['int dfd', 'const char __user *filename', 'struct timespec __user *utimes', 'int flags']
 	case 280: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -3744,6 +4011,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 281 long sys_epoll_pwait ['int epfd', 'struct epoll_event __user *events', 'int maxevents', 'int timeout', 'const sigset_t __user *sigmask', 'size_t sigsetsize']
 	case 281: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -3765,6 +4033,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 282 long sys_signalfd ['int ufd', 'sigset_t __user *user_mask', 'size_t sizemask']
 	case 282: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3780,6 +4049,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 283 long sys_timerfd_create ['int clockid', 'int flags']
 	case 283: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3793,6 +4063,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 284 long sys_eventfd ['unsigned int count']
 	case 284: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -3804,6 +4075,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 285 long sys_fallocate ['int fd', 'int mode', 'loff_t offset', 'loff_t len']
 	case 285: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -3821,6 +4093,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 286 long sys_timerfd_settime ['int ufd', 'int flags', 'const struct itimerspec __user *utmr', 'struct itimerspec __user *otmr']
 	case 286: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -3838,6 +4111,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 287 long sys_timerfd_gettime ['int ufd', 'struct itimerspec __user *otmr']
 	case 287: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3851,6 +4125,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 288 long sys_accept4 ['int', 'struct sockaddr __user *', 'int __user *', 'int']
 	case 288: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -3868,6 +4143,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 289 long sys_signalfd4 ['int ufd', 'sigset_t __user *user_mask', 'size_t sizemask', 'int flags']
 	case 289: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3885,6 +4161,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 290 long sys_eventfd2 ['unsigned int count', 'int flags']
 	case 290: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3898,6 +4175,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 291 long sys_epoll_create1 ['int flags']
 	case 291: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -3909,6 +4187,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 292 long sys_dup3 ['unsigned int oldfd', 'unsigned int newfd', 'int flags']
 	case 292: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -3924,6 +4203,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 293 long sys_pipe2 ['int __user *fildes', 'int flags']
 	case 293: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3937,6 +4217,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 294 long sys_inotify_init1 ['int flags']
 	case 294: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -3948,6 +4229,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 295 long sys_preadv ['unsigned long fd', 'const struct iovec __user *vec', 'unsigned long vlen', 'unsigned long pos_l', 'unsigned long pos_h']
 	case 295: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -3967,6 +4249,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 296 long sys_pwritev ['unsigned long fd', 'const struct iovec __user *vec', 'unsigned long vlen', 'unsigned long pos_l', 'unsigned long pos_h']
 	case 296: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -3986,6 +4269,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 297 long sys_rt_tgsigqueueinfo ['pid_t tgid', 'pid_t pid', 'int sig', 'siginfo_t __user *uinfo']
 	case 297: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -4003,6 +4287,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 298 long sys_perf_event_open ['struct perf_event_attr __user *attr_uptr', 'pid_t pid', 'int cpu', 'int group_fd', 'unsigned long flags']
 	case 298: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -4022,6 +4307,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 299 long sys_recvmmsg ['int fd', 'struct mmsghdr __user *msg', 'unsigned int vlen', 'unsigned flags', 'struct timespec __user *timeout']
 	case 299: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4041,6 +4327,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 300 long sys_fanotify_init ['unsigned int flags', 'unsigned int event_f_flags']
 	case 300: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -4054,6 +4341,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 301 long sys_fanotify_mark ['int fanotify_fd', 'unsigned int flags', 'u64 mask', 'int fd', 'const char __user *pathname']
 	case 301: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -4073,6 +4361,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 302 long sys_prlimit64 ['pid_t pid', 'unsigned int resource', 'const struct rlimit64 __user *new_rlim', 'struct rlimit64 __user *old_rlim']
 	case 302: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -4090,6 +4379,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 303 long sys_name_to_handle_at ['int dfd', 'const char __user *name', 'struct file_handle __user *handle', 'int __user *mnt_id', 'int flag']
 	case 303: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -4109,6 +4399,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 304 long sys_open_by_handle_at ['int mountdirfd', 'struct file_handle __user *handle', 'int flags']
 	case 304: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -4124,6 +4415,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 305 long sys_clock_adjtime ['clockid_t which_clock', 'struct timex __user *tx']
 	case 305: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -4137,6 +4429,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 306 long sys_syncfs ['int fd']
 	case 306: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -4148,6 +4441,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 307 long sys_sendmmsg ['int fd', 'struct mmsghdr __user *msg', 'unsigned int vlen', 'unsigned flags']
 	case 307: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4165,6 +4459,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 308 long sys_setns ['int fd', 'int nstype']
 	case 308: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -4178,6 +4473,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 309 long sys_getcpu ['unsigned __user *cpu', 'unsigned __user *node', 'struct getcpu_cache __user *cache']
 	case 309: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -4193,6 +4489,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 310 long sys_process_vm_readv ['pid_t pid', 'const struct iovec __user *lvec', 'unsigned long liovcnt', 'const struct iovec __user *rvec', 'unsigned long riovcnt', 'unsigned long flags']
 	case 310: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -4214,6 +4511,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 311 long sys_process_vm_writev ['pid_t pid', 'const struct iovec __user *lvec', 'unsigned long liovcnt', 'const struct iovec __user *rvec', 'unsigned long riovcnt', 'unsigned long flags']
 	case 311: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -4235,6 +4533,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 312 long sys_kcmp ['pid_t pid1', 'pid_t pid2', 'int type', 'unsigned long idx1', 'unsigned long idx2']
 	case 312: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -4254,6 +4553,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 313 long sys_finit_module ['int fd', 'const char __user *uargs', 'int flags']
 	case 313: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -4269,6 +4569,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 314 long sys_sched_setattr ['pid_t pid', 'struct sched_attr __user *attr', 'unsigned int flags']
 	case 314: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4284,6 +4585,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 315 long sys_sched_getattr ['pid_t pid', 'struct sched_attr __user *attr', 'unsigned int size', 'unsigned int flags']
 	case 315: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4301,6 +4603,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 316 long sys_renameat2 ['int olddfd', 'const char __user *oldname', 'int newdfd', 'const char __user *newname', 'unsigned int flags']
 	case 316: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -4320,6 +4623,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 317 long sys_seccomp ['unsigned int op', 'unsigned int flags', 'const char __user *uargs']
 	case 317: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -4335,6 +4639,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 318 long sys_getrandom ['char __user *buf', 'size_t count', 'unsigned int flags']
 	case 318: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4350,6 +4655,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 319 long sys_memfd_create ['const char __user *uname_ptr', 'unsigned int flags']
 	case 319: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -4363,6 +4669,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 320 long sys_kexec_file_load ['int kernel_fd', 'int initrd_fd', 'unsigned long cmdline_len', 'const char __user *cmdline_ptr', 'unsigned long flags']
 	case 320: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -4382,6 +4689,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 321 long sys_bpf ['int cmd', 'union bpf_attr *attr', 'unsigned int size']
 	case 321: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4397,6 +4705,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 322 long sys_execveat ['int dfd', 'const char __user *filename', 'const char __user *const __user *argv', 'const char __user *const __user *envp', 'int flags']
 	case 322: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -4416,6 +4725,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 323 long sys_userfaultfd ['int flags']
 	case 323: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -4427,6 +4737,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 324 long sys_membarrier ['int cmd', 'int flags']
 	case 324: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -4440,6 +4751,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 325 long sys_mlock2 ['unsigned long start', 'size_t len', 'int flags']
 	case 325: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -4455,6 +4767,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 326 long sys_copy_file_range ['int fd_in', 'loff_t __user *off_in', 'int fd_out', 'loff_t __user *off_out', 'size_t len', 'unsigned int flags']
 	case 326: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -4476,6 +4789,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 327 long sys_preadv2 ['unsigned long fd', 'const struct iovec __user *vec', 'unsigned long vlen', 'unsigned long pos_l', 'unsigned long pos_h', 'rwf_t flags']
 	case 327: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -4497,6 +4811,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 328 long sys_pwritev2 ['unsigned long fd', 'const struct iovec __user *vec', 'unsigned long vlen', 'unsigned long pos_l', 'unsigned long pos_h', 'rwf_t flags']
 	case 328: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -4518,6 +4833,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 329 long sys_pkey_mprotect ['unsigned long start', 'size_t len', 'unsigned long prot', 'int pkey']
 	case 329: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -4535,6 +4851,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 330 long sys_pkey_alloc ['unsigned long flags', 'unsigned long init_val']
 	case 330: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -4548,6 +4865,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 331 long sys_pkey_free ['int pkey']
 	case 331: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -4559,6 +4877,7 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 	// 332 long sys_statx ['int dfd', 'const char __user *path', 'unsigned flags', 'unsigned mask', 'struct statx __user *buffer']
 	case 332: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
diff --git a/panda/plugins/syscalls2/generated/syscall_switch_enter_linux_x86.cpp b/panda/plugins/syscalls2/generated/syscall_switch_enter_linux_x86.cpp
index b0875ac3850..cbc2d583209 100644
--- a/panda/plugins/syscalls2/generated/syscall_switch_enter_linux_x86.cpp
+++ b/panda/plugins/syscalls2/generated/syscall_switch_enter_linux_x86.cpp
@@ -33,6 +33,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	}
 	ctx.asid = panda_current_asid(cpu);
 	ctx.retaddr = calc_retaddr(cpu, pc);
+	ctx.double_return = false;
 	bool panda_noreturn;	// true if PANDA should not track the return of this system call
 	const syscall_info_t *call = NULL;
 	syscall_info_t zero = {0};
@@ -48,11 +49,13 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 0 long sys_restart_syscall ['void']
 	case 0: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_restart_syscall_enter, cpu, pc);
 	}; break;
 	// 1 long sys_exit ['int error_code']
 	case 1: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -64,11 +67,13 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 2 long sys_fork ['void']
 	case 2: {
 		panda_noreturn = false;
+		ctx.double_return = true;
 		PPP_RUN_CB(on_sys_fork_enter, cpu, pc);
 	}; break;
 	// 3 long sys_read ['unsigned int fd', 'char __user *buf', 'size_t count']
 	case 3: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -84,6 +89,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 4 long sys_write ['unsigned int fd', 'const char __user *buf', 'size_t count']
 	case 4: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -99,6 +105,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 5 long sys_open ['const char __user *filename', 'int flags', 'umode_t mode']
 	case 5: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -114,6 +121,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 6 long sys_close ['unsigned int fd']
 	case 6: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -125,6 +133,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 7 long sys_waitpid ['pid_t pid', 'int __user *stat_addr', 'int options']
 	case 7: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -140,6 +149,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 8 long sys_creat ['const char __user *pathname', 'umode_t mode']
 	case 8: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -153,6 +163,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 9 long sys_link ['const char __user *oldname', 'const char __user *newname']
 	case 9: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -166,6 +177,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 10 long sys_unlink ['const char __user *pathname']
 	case 10: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -177,6 +189,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 11 long sys_execve ['const char __user *filename', 'const char __user *const __user *argv', 'const char __user *const __user *envp']
 	case 11: {
 		panda_noreturn = true;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -192,6 +205,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 12 long sys_chdir ['const char __user *filename']
 	case 12: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -203,6 +217,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 13 long sys_time ['time_t __user *tloc']
 	case 13: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -214,6 +229,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 14 long sys_mknod ['const char __user *filename', 'umode_t mode', 'unsigned dev']
 	case 14: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -229,6 +245,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 15 long sys_chmod ['const char __user *filename', 'umode_t mode']
 	case 15: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -242,6 +259,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 16 long sys_lchown16 ['const char __user *filename', 'old_uid_t user', 'old_gid_t group']
 	case 16: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -257,6 +275,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 18 long sys_stat ['const char __user *filename', 'struct __old_kernel_stat __user *statbuf']
 	case 18: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -270,6 +289,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 19 long sys_lseek ['unsigned int fd', 'off_t offset', 'unsigned int whence']
 	case 19: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -285,11 +305,13 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 20 long sys_getpid ['void']
 	case 20: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_getpid_enter, cpu, pc);
 	}; break;
 	// 21 long sys_mount ['char __user *dev_name', 'char __user *dir_name', 'char __user *type', 'unsigned long flags', 'void __user *data']
 	case 21: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -309,6 +331,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 22 long sys_oldumount ['char __user *name']
 	case 22: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -320,6 +343,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 23 long sys_setuid16 ['old_uid_t uid']
 	case 23: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -331,11 +355,13 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 24 long sys_getuid16 ['void']
 	case 24: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_getuid16_enter, cpu, pc);
 	}; break;
 	// 25 long sys_stime ['time_t __user *tptr']
 	case 25: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -347,6 +373,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 26 long sys_ptrace ['long request', 'long pid', 'unsigned long addr', 'unsigned long data']
 	case 26: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -364,6 +391,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 27 long sys_alarm ['unsigned int seconds']
 	case 27: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -375,6 +403,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 28 long sys_fstat ['unsigned int fd', 'struct __old_kernel_stat __user *statbuf']
 	case 28: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -388,11 +417,13 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 29 long sys_pause ['void']
 	case 29: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_pause_enter, cpu, pc);
 	}; break;
 	// 30 long sys_utime ['char __user *filename', 'struct utimbuf __user *times']
 	case 30: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -406,6 +437,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 33 long sys_access ['const char __user *filename', 'int mode']
 	case 33: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -419,6 +451,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 34 long sys_nice ['int increment']
 	case 34: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -430,11 +463,13 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 36 long sys_sync ['void']
 	case 36: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_sync_enter, cpu, pc);
 	}; break;
 	// 37 long sys_kill ['pid_t pid', 'int sig']
 	case 37: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -448,6 +483,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 38 long sys_rename ['const char __user *oldname', 'const char __user *newname']
 	case 38: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -461,6 +497,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 39 long sys_mkdir ['const char __user *pathname', 'umode_t mode']
 	case 39: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -474,6 +511,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 40 long sys_rmdir ['const char __user *pathname']
 	case 40: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -485,6 +523,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 41 long sys_dup ['unsigned int fildes']
 	case 41: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -496,6 +535,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 42 long sys_pipe ['int __user *fildes']
 	case 42: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -507,6 +547,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 43 long sys_times ['struct tms __user *tbuf']
 	case 43: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -518,6 +559,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 45 long sys_brk ['unsigned long brk']
 	case 45: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -529,6 +571,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 46 long sys_setgid16 ['old_gid_t gid']
 	case 46: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -540,11 +583,13 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 47 long sys_getgid16 ['void']
 	case 47: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_getgid16_enter, cpu, pc);
 	}; break;
 	// 48 long sys_signal ['int sig', '__sighandler_t handler']
 	case 48: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -558,16 +603,19 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 49 long sys_geteuid16 ['void']
 	case 49: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_geteuid16_enter, cpu, pc);
 	}; break;
 	// 50 long sys_getegid16 ['void']
 	case 50: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_getegid16_enter, cpu, pc);
 	}; break;
 	// 51 long sys_acct ['const char __user *name']
 	case 51: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -579,6 +627,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 52 long sys_umount ['char __user *name', 'int flags']
 	case 52: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -592,6 +641,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 54 long sys_ioctl ['unsigned int fd', 'unsigned int cmd', 'unsigned long arg']
 	case 54: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -607,6 +657,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 55 long sys_fcntl ['unsigned int fd', 'unsigned int cmd', 'unsigned long arg']
 	case 55: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -622,6 +673,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 57 long sys_setpgid ['pid_t pid', 'pid_t pgid']
 	case 57: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -635,6 +687,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 59 long sys_olduname ['struct oldold_utsname __user *']
 	case 59: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -646,6 +699,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 60 long sys_umask ['int mask']
 	case 60: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -657,6 +711,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 61 long sys_chroot ['const char __user *filename']
 	case 61: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -668,6 +723,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 62 long sys_ustat ['unsigned dev', 'struct ustat __user *ubuf']
 	case 62: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -681,6 +737,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 63 long sys_dup2 ['unsigned int oldfd', 'unsigned int newfd']
 	case 63: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -694,21 +751,25 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 64 long sys_getppid ['void']
 	case 64: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_getppid_enter, cpu, pc);
 	}; break;
 	// 65 long sys_getpgrp ['void']
 	case 65: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_getpgrp_enter, cpu, pc);
 	}; break;
 	// 66 long sys_setsid ['void']
 	case 66: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_setsid_enter, cpu, pc);
 	}; break;
 	// 67 long sys_sigaction ['int', 'const struct old_sigaction __user *', 'struct old_sigaction __user *']
 	case 67: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -724,11 +785,13 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 68 long sys_sgetmask ['void']
 	case 68: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_sgetmask_enter, cpu, pc);
 	}; break;
 	// 69 long sys_ssetmask ['int newmask']
 	case 69: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -740,6 +803,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 70 long sys_setreuid16 ['old_uid_t ruid', 'old_uid_t euid']
 	case 70: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -753,6 +817,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 71 long sys_setregid16 ['old_gid_t rgid', 'old_gid_t egid']
 	case 71: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -766,6 +831,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 72 long sys_sigsuspend ['int unused1', 'int unused2', 'old_sigset_t mask']
 	case 72: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -781,6 +847,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 73 long sys_sigpending ['old_sigset_t __user *set']
 	case 73: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -792,6 +859,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 74 long sys_sethostname ['char __user *name', 'int len']
 	case 74: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -805,6 +873,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 75 long sys_setrlimit ['unsigned int resource', 'struct rlimit __user *rlim']
 	case 75: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -818,6 +887,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 76 long sys_old_getrlimit ['unsigned int resource', 'struct rlimit __user *rlim']
 	case 76: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -831,6 +901,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 77 long sys_getrusage ['int who', 'struct rusage __user *ru']
 	case 77: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -844,6 +915,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 78 long sys_gettimeofday ['struct timeval __user *tv', 'struct timezone __user *tz']
 	case 78: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -857,6 +929,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 79 long sys_settimeofday ['struct timeval __user *tv', 'struct timezone __user *tz']
 	case 79: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -870,6 +943,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 80 long sys_getgroups16 ['int gidsetsize', 'old_gid_t __user *grouplist']
 	case 80: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -883,6 +957,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 81 long sys_setgroups16 ['int gidsetsize', 'old_gid_t __user *grouplist']
 	case 81: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -896,6 +971,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 82 long sys_old_select ['struct sel_arg_struct __user *arg']
 	case 82: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -907,6 +983,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 83 long sys_symlink ['const char __user *old', 'const char __user *new']
 	case 83: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -920,6 +997,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 84 long sys_lstat ['const char __user *filename', 'struct __old_kernel_stat __user *statbuf']
 	case 84: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -933,6 +1011,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 85 long sys_readlink ['const char __user *path', 'char __user *buf', 'int bufsiz']
 	case 85: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -948,6 +1027,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 86 long sys_uselib ['const char __user *library']
 	case 86: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -959,6 +1039,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 87 long sys_swapon ['const char __user *specialfile', 'int swap_flags']
 	case 87: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -972,6 +1053,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 88 long sys_reboot ['int magic1', 'int magic2', 'unsigned int cmd', 'void __user *arg']
 	case 88: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -989,6 +1071,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 89 long sys_old_readdir ['unsigned int', 'struct old_linux_dirent __user *', 'unsigned int']
 	case 89: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1004,6 +1087,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 90 long sys_old_mmap ['struct mmap_arg_struct __user *arg']
 	case 90: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1015,6 +1099,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 91 long sys_munmap ['unsigned long addr', 'size_t len']
 	case 91: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1028,6 +1113,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 92 long sys_truncate ['const char __user *path', 'long length']
 	case 92: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1041,6 +1127,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 93 long sys_ftruncate ['unsigned int fd', 'unsigned long length']
 	case 93: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1054,6 +1141,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 94 long sys_fchmod ['unsigned int fd', 'umode_t mode']
 	case 94: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1067,6 +1155,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 95 long sys_fchown16 ['unsigned int fd', 'old_uid_t user', 'old_gid_t group']
 	case 95: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1082,6 +1171,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 96 long sys_getpriority ['int which', 'int who']
 	case 96: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1095,6 +1185,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 97 long sys_setpriority ['int which', 'int who', 'int niceval']
 	case 97: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -1110,6 +1201,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 99 long sys_statfs ['const char __user *path', 'struct statfs __user *buf']
 	case 99: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1123,6 +1215,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 100 long sys_fstatfs ['unsigned int fd', 'struct statfs __user *buf']
 	case 100: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1136,6 +1229,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 101 long sys_ioperm ['unsigned long', 'unsigned long', 'int']
 	case 101: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -1151,6 +1245,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 102 long sys_socketcall ['int call', 'unsigned long __user *args']
 	case 102: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1164,6 +1259,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 103 long sys_syslog ['int type', 'char __user *buf', 'int len']
 	case 103: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -1179,6 +1275,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 104 long sys_setitimer ['int which', 'struct itimerval __user *value', 'struct itimerval __user *ovalue']
 	case 104: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1194,6 +1291,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 105 long sys_getitimer ['int which', 'struct itimerval __user *value']
 	case 105: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1207,6 +1305,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 106 long sys_newstat ['const char __user *filename', 'struct stat __user *statbuf']
 	case 106: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1220,6 +1319,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 107 long sys_newlstat ['const char __user *filename', 'struct stat __user *statbuf']
 	case 107: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1233,6 +1333,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 108 long sys_newfstat ['unsigned int fd', 'struct stat __user *statbuf']
 	case 108: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1246,6 +1347,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 109 long sys_uname ['struct old_utsname __user *']
 	case 109: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1257,6 +1359,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 110 long sys_iopl ['unsigned int']
 	case 110: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1268,11 +1371,13 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 111 long sys_vhangup ['void']
 	case 111: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_vhangup_enter, cpu, pc);
 	}; break;
 	// 113 long sys_vm86old ['struct vm86_struct __user *']
 	case 113: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1284,6 +1389,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 114 long sys_wait4 ['pid_t pid', 'int __user *stat_addr', 'int options', 'struct rusage __user *ru']
 	case 114: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -1301,6 +1407,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 115 long sys_swapoff ['const char __user *specialfile']
 	case 115: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1312,6 +1419,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 116 long sys_sysinfo ['struct sysinfo __user *info']
 	case 116: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1323,6 +1431,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 117 long sys_ipc ['unsigned int call', 'int first', 'unsigned long second', 'unsigned long third', 'void __user *ptr', 'long fifth']
 	case 117: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1344,6 +1453,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 118 long sys_fsync ['unsigned int fd']
 	case 118: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1355,11 +1465,13 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 119 long sys_sigreturn ['void']
 	case 119: {
 		panda_noreturn = true;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_sigreturn_enter, cpu, pc);
 	}; break;
 	// 120 long sys_clone ['unsigned long', 'unsigned long', 'int __user *', 'int __user *', 'unsigned long']
 	case 120: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1379,6 +1491,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 121 long sys_setdomainname ['char __user *name', 'int len']
 	case 121: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1392,6 +1505,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 122 long sys_newuname ['struct new_utsname __user *name']
 	case 122: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1403,6 +1517,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 123 long sys_modify_ldt ['int', 'void __user *', 'unsigned long']
 	case 123: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1418,6 +1533,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 124 long sys_adjtimex ['struct timex __user *txc_p']
 	case 124: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1429,6 +1545,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 125 long sys_mprotect ['unsigned long start', 'size_t len', 'unsigned long prot']
 	case 125: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1444,6 +1561,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 126 long sys_sigprocmask ['int how', 'old_sigset_t __user *set', 'old_sigset_t __user *oset']
 	case 126: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1459,6 +1577,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 128 long sys_init_module ['void __user *umod', 'unsigned long len', 'const char __user *uargs']
 	case 128: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1474,6 +1593,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 129 long sys_delete_module ['const char __user *name_user', 'unsigned int flags']
 	case 129: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1487,6 +1607,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 131 long sys_quotactl ['unsigned int cmd', 'const char __user *special', 'qid_t id', 'void __user *addr']
 	case 131: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1504,6 +1625,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 132 long sys_getpgid ['pid_t pid']
 	case 132: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1515,6 +1637,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 133 long sys_fchdir ['unsigned int fd']
 	case 133: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1526,6 +1649,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 134 long sys_bdflush ['int func', 'long data']
 	case 134: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1539,6 +1663,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 135 long sys_sysfs ['int option', 'unsigned long arg1', 'unsigned long arg2']
 	case 135: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1554,6 +1679,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 136 long sys_personality ['unsigned int personality']
 	case 136: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1565,6 +1691,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 138 long sys_setfsuid16 ['old_uid_t uid']
 	case 138: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1576,6 +1703,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 139 long sys_setfsgid16 ['old_gid_t gid']
 	case 139: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1587,6 +1715,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 140 long sys_llseek ['unsigned int fd', 'unsigned long offset_high', 'unsigned long offset_low', 'loff_t __user *result', 'unsigned int whence']
 	case 140: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1606,6 +1735,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 141 long sys_getdents ['unsigned int fd', 'struct linux_dirent __user *dirent', 'unsigned int count']
 	case 141: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1621,6 +1751,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 142 long sys_select ['int n', 'fd_set __user *inp', 'fd_set __user *outp', 'fd_set __user *exp', 'struct timeval __user *tvp']
 	case 142: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1640,6 +1771,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 143 long sys_flock ['unsigned int fd', 'unsigned int cmd']
 	case 143: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1653,6 +1785,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 144 long sys_msync ['unsigned long start', 'size_t len', 'int flags']
 	case 144: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -1668,6 +1801,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 145 long sys_readv ['unsigned long fd', 'const struct iovec __user *vec', 'unsigned long vlen']
 	case 145: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1683,6 +1817,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 146 long sys_writev ['unsigned long fd', 'const struct iovec __user *vec', 'unsigned long vlen']
 	case 146: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1698,6 +1833,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 147 long sys_getsid ['pid_t pid']
 	case 147: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1709,6 +1845,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 148 long sys_fdatasync ['unsigned int fd']
 	case 148: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1720,6 +1857,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 149 long sys_sysctl ['struct __sysctl_args __user *args']
 	case 149: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1731,6 +1869,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 150 long sys_mlock ['unsigned long start', 'size_t len']
 	case 150: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1744,6 +1883,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 151 long sys_munlock ['unsigned long start', 'size_t len']
 	case 151: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1757,6 +1897,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 152 long sys_mlockall ['int flags']
 	case 152: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1768,11 +1909,13 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 153 long sys_munlockall ['void']
 	case 153: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_munlockall_enter, cpu, pc);
 	}; break;
 	// 154 long sys_sched_setparam ['pid_t pid', 'struct sched_param __user *param']
 	case 154: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1786,6 +1929,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 155 long sys_sched_getparam ['pid_t pid', 'struct sched_param __user *param']
 	case 155: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1799,6 +1943,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 156 long sys_sched_setscheduler ['pid_t pid', 'int policy', 'struct sched_param __user *param']
 	case 156: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1814,6 +1959,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 157 long sys_sched_getscheduler ['pid_t pid']
 	case 157: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1825,11 +1971,13 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 158 long sys_sched_yield ['void']
 	case 158: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_sched_yield_enter, cpu, pc);
 	}; break;
 	// 159 long sys_sched_get_priority_max ['int policy']
 	case 159: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1841,6 +1989,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 160 long sys_sched_get_priority_min ['int policy']
 	case 160: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1852,6 +2001,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 161 long sys_sched_rr_get_interval ['pid_t pid', 'struct timespec __user *interval']
 	case 161: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1865,6 +2015,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 162 long sys_nanosleep ['struct timespec __user *rqtp', 'struct timespec __user *rmtp']
 	case 162: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1878,6 +2029,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 163 long sys_mremap ['unsigned long addr', 'unsigned long old_len', 'unsigned long new_len', 'unsigned long flags', 'unsigned long new_addr']
 	case 163: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1897,6 +2049,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 164 long sys_setresuid16 ['old_uid_t ruid', 'old_uid_t euid', 'old_uid_t suid']
 	case 164: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1912,6 +2065,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 165 long sys_getresuid16 ['old_uid_t __user *ruid', 'old_uid_t __user *euid', 'old_uid_t __user *suid']
 	case 165: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1927,6 +2081,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 166 long sys_vm86 ['unsigned long', 'unsigned long']
 	case 166: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1940,6 +2095,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 168 long sys_poll ['struct pollfd __user *ufds', 'unsigned int nfds', 'int timeout']
 	case 168: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -1955,6 +2111,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 170 long sys_setresgid16 ['old_gid_t rgid', 'old_gid_t egid', 'old_gid_t sgid']
 	case 170: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1970,6 +2127,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 171 long sys_getresgid16 ['old_gid_t __user *rgid', 'old_gid_t __user *egid', 'old_gid_t __user *sgid']
 	case 171: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1985,6 +2143,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 172 long sys_prctl ['int option', 'unsigned long arg2', 'unsigned long arg3', 'unsigned long arg4', 'unsigned long arg5']
 	case 172: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2004,11 +2163,13 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 173 long sys_rt_sigreturn ['void']
 	case 173: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_rt_sigreturn_enter, cpu, pc);
 	}; break;
 	// 174 long sys_rt_sigaction ['int', 'const struct sigaction __user *', 'struct sigaction __user *', 'size_t']
 	case 174: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2026,6 +2187,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 175 long sys_rt_sigprocmask ['int how', 'sigset_t __user *set', 'sigset_t __user *oset', 'size_t sigsetsize']
 	case 175: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2043,6 +2205,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 176 long sys_rt_sigpending ['sigset_t __user *set', 'size_t sigsetsize']
 	case 176: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2056,6 +2219,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 177 long sys_rt_sigtimedwait ['const sigset_t __user *uthese', 'siginfo_t __user *uinfo', 'const struct timespec __user *uts', 'size_t sigsetsize']
 	case 177: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2073,6 +2237,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 178 long sys_rt_sigqueueinfo ['pid_t pid', 'int sig', 'siginfo_t __user *uinfo']
 	case 178: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2088,6 +2253,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 179 long sys_rt_sigsuspend ['sigset_t __user *unewset', 'size_t sigsetsize']
 	case 179: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2101,6 +2267,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 180 long sys_pread64 ['unsigned int fd', 'char __user *buf', 'size_t count', 'loff_t pos']
 	case 180: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2118,6 +2285,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 181 long sys_pwrite64 ['unsigned int fd', 'const char __user *buf', 'size_t count', 'loff_t pos']
 	case 181: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2135,6 +2303,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 182 long sys_chown16 ['const char __user *filename', 'old_uid_t user', 'old_gid_t group']
 	case 182: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2150,6 +2319,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 183 long sys_getcwd ['char __user *buf', 'unsigned long size']
 	case 183: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2163,6 +2333,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 184 long sys_capget ['cap_user_header_t header', 'cap_user_data_t dataptr']
 	case 184: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2176,6 +2347,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 185 long sys_capset ['cap_user_header_t header', 'const cap_user_data_t data']
 	case 185: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2189,6 +2361,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 186 long sys_sigaltstack ['const struct sigaltstack __user *uss', 'struct sigaltstack __user *uoss']
 	case 186: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2202,6 +2375,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 187 long sys_sendfile ['int out_fd', 'int in_fd', 'off_t __user *offset', 'size_t count']
 	case 187: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2219,11 +2393,13 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 190 long sys_vfork ['void']
 	case 190: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_vfork_enter, cpu, pc);
 	}; break;
 	// 191 long sys_getrlimit ['unsigned int resource', 'struct rlimit __user *rlim']
 	case 191: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2237,6 +2413,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 192 long sys_mmap_pgoff ['unsigned long addr', 'unsigned long len', 'unsigned long prot', 'unsigned long flags', 'unsigned long fd', 'unsigned long pgoff']
 	case 192: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2258,6 +2435,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 193 long sys_truncate64 ['const char __user *path', 'loff_t length']
 	case 193: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2271,6 +2449,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 194 long sys_ftruncate64 ['unsigned int fd', 'loff_t length']
 	case 194: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2284,6 +2463,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 195 long sys_stat64 ['const char __user *filename', 'struct stat64 __user *statbuf']
 	case 195: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2297,6 +2477,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 196 long sys_lstat64 ['const char __user *filename', 'struct stat64 __user *statbuf']
 	case 196: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2310,6 +2491,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 197 long sys_fstat64 ['unsigned long fd', 'struct stat64 __user *statbuf']
 	case 197: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2323,6 +2505,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 198 long sys_lchown ['const char __user *filename', 'uid_t user', 'gid_t group']
 	case 198: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2338,26 +2521,31 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 199 long sys_getuid ['void']
 	case 199: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_getuid_enter, cpu, pc);
 	}; break;
 	// 200 long sys_getgid ['void']
 	case 200: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_getgid_enter, cpu, pc);
 	}; break;
 	// 201 long sys_geteuid ['void']
 	case 201: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_geteuid_enter, cpu, pc);
 	}; break;
 	// 202 long sys_getegid ['void']
 	case 202: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_getegid_enter, cpu, pc);
 	}; break;
 	// 203 long sys_setreuid ['uid_t ruid', 'uid_t euid']
 	case 203: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2371,6 +2559,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 204 long sys_setregid ['gid_t rgid', 'gid_t egid']
 	case 204: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2384,6 +2573,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 205 long sys_getgroups ['int gidsetsize', 'gid_t __user *grouplist']
 	case 205: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2397,6 +2587,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 206 long sys_setgroups ['int gidsetsize', 'gid_t __user *grouplist']
 	case 206: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2410,6 +2601,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 207 long sys_fchown ['unsigned int fd', 'uid_t user', 'gid_t group']
 	case 207: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2425,6 +2617,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 208 long sys_setresuid ['uid_t ruid', 'uid_t euid', 'uid_t suid']
 	case 208: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2440,6 +2633,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 209 long sys_getresuid ['uid_t __user *ruid', 'uid_t __user *euid', 'uid_t __user *suid']
 	case 209: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2455,6 +2649,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 210 long sys_setresgid ['gid_t rgid', 'gid_t egid', 'gid_t sgid']
 	case 210: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2470,6 +2665,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 211 long sys_getresgid ['gid_t __user *rgid', 'gid_t __user *egid', 'gid_t __user *sgid']
 	case 211: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2485,6 +2681,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 212 long sys_chown ['const char __user *filename', 'uid_t user', 'gid_t group']
 	case 212: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2500,6 +2697,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 213 long sys_setuid ['uid_t uid']
 	case 213: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -2511,6 +2709,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 214 long sys_setgid ['gid_t gid']
 	case 214: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -2522,6 +2721,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 215 long sys_setfsuid ['uid_t uid']
 	case 215: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -2533,6 +2733,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 216 long sys_setfsgid ['gid_t gid']
 	case 216: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -2544,6 +2745,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 217 long sys_pivot_root ['const char __user *new_root', 'const char __user *put_old']
 	case 217: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2557,6 +2759,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 218 long sys_mincore ['unsigned long start', 'size_t len', 'unsigned char __user *vec']
 	case 218: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2572,6 +2775,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 219 long sys_madvise ['unsigned long start', 'size_t len', 'int behavior']
 	case 219: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -2587,6 +2791,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 220 long sys_getdents64 ['unsigned int fd', 'struct linux_dirent64 __user *dirent', 'unsigned int count']
 	case 220: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2602,6 +2807,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 221 long sys_fcntl64 ['unsigned int fd', 'unsigned int cmd', 'unsigned long arg']
 	case 221: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2617,11 +2823,13 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 224 long sys_gettid ['void']
 	case 224: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_gettid_enter, cpu, pc);
 	}; break;
 	// 225 long sys_readahead ['int fd', 'loff_t offset', 'size_t count']
 	case 225: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2637,6 +2845,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 226 long sys_setxattr ['const char __user *path', 'const char __user *name', 'const void __user *value', 'size_t size', 'int flags']
 	case 226: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2656,6 +2865,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 227 long sys_lsetxattr ['const char __user *path', 'const char __user *name', 'const void __user *value', 'size_t size', 'int flags']
 	case 227: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2675,6 +2885,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 228 long sys_fsetxattr ['int fd', 'const char __user *name', 'const void __user *value', 'size_t size', 'int flags']
 	case 228: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2694,6 +2905,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 229 long sys_getxattr ['const char __user *path', 'const char __user *name', 'void __user *value', 'size_t size']
 	case 229: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2711,6 +2923,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 230 long sys_lgetxattr ['const char __user *path', 'const char __user *name', 'void __user *value', 'size_t size']
 	case 230: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2728,6 +2941,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 231 long sys_fgetxattr ['int fd', 'const char __user *name', 'void __user *value', 'size_t size']
 	case 231: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2745,6 +2959,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 232 long sys_listxattr ['const char __user *path', 'char __user *list', 'size_t size']
 	case 232: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2760,6 +2975,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 233 long sys_llistxattr ['const char __user *path', 'char __user *list', 'size_t size']
 	case 233: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2775,6 +2991,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 234 long sys_flistxattr ['int fd', 'char __user *list', 'size_t size']
 	case 234: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2790,6 +3007,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 235 long sys_removexattr ['const char __user *path', 'const char __user *name']
 	case 235: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2803,6 +3021,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 236 long sys_lremovexattr ['const char __user *path', 'const char __user *name']
 	case 236: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2816,6 +3035,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 237 long sys_fremovexattr ['int fd', 'const char __user *name']
 	case 237: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2829,6 +3049,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 238 long sys_tkill ['pid_t pid', 'int sig']
 	case 238: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2842,6 +3063,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 239 long sys_sendfile64 ['int out_fd', 'int in_fd', 'loff_t __user *offset', 'size_t count']
 	case 239: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2859,6 +3081,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 240 long sys_futex ['u32 __user *uaddr', 'int op', 'u32 val', 'struct timespec __user *utime', 'u32 __user *uaddr2', 'u32 val3']
 	case 240: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2880,6 +3103,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 241 long sys_sched_setaffinity ['pid_t pid', 'unsigned int len', 'unsigned long __user *user_mask_ptr']
 	case 241: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2895,6 +3119,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 242 long sys_sched_getaffinity ['pid_t pid', 'unsigned int len', 'unsigned long __user *user_mask_ptr']
 	case 242: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2910,6 +3135,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 243 long sys_set_thread_area ['struct user_desc __user *']
 	case 243: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -2921,6 +3147,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 244 long sys_get_thread_area ['struct user_desc __user *']
 	case 244: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -2932,6 +3159,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 245 long sys_io_setup ['unsigned nr_reqs', 'aio_context_t __user *ctx']
 	case 245: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2945,6 +3173,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 246 long sys_io_destroy ['aio_context_t ctx']
 	case 246: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -2956,6 +3185,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 247 long sys_io_getevents ['aio_context_t ctx_id', 'long min_nr', 'long nr', 'struct io_event __user *events', 'struct timespec __user *timeout']
 	case 247: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -2975,6 +3205,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 248 long sys_io_submit ['aio_context_t', 'long', 'struct iocb __user * __user *']
 	case 248: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2990,6 +3221,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 249 long sys_io_cancel ['aio_context_t ctx_id', 'struct iocb __user *iocb', 'struct io_event __user *result']
 	case 249: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3005,6 +3237,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 250 long sys_fadvise64 ['int fd', 'loff_t offset', 'size_t len', 'int advice']
 	case 250: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3022,6 +3255,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 252 long sys_exit_group ['int error_code']
 	case 252: {
 		panda_noreturn = true;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -3033,6 +3267,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 253 long sys_lookup_dcookie ['u64 cookie64', 'char __user *buf', 'size_t len']
 	case 253: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint64_t arg0 = get_64(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3048,6 +3283,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 254 long sys_epoll_create ['int size']
 	case 254: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -3059,6 +3295,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 255 long sys_epoll_ctl ['int epfd', 'int op', 'int fd', 'struct epoll_event __user *event']
 	case 255: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -3076,6 +3313,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 256 long sys_epoll_wait ['int epfd', 'struct epoll_event __user *events', 'int maxevents', 'int timeout']
 	case 256: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -3093,6 +3331,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 257 long sys_remap_file_pages ['unsigned long start', 'unsigned long size', 'unsigned long prot', 'unsigned long pgoff', 'unsigned long flags']
 	case 257: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3112,6 +3351,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 258 long sys_set_tid_address ['int __user *tidptr']
 	case 258: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -3123,6 +3363,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 259 long sys_timer_create ['clockid_t which_clock', 'struct sigevent __user *timer_event_spec', 'timer_t __user *created_timer_id']
 	case 259: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3138,6 +3379,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 260 long sys_timer_settime ['timer_t timer_id', 'int flags', 'const struct itimerspec __user *new_setting', 'struct itimerspec __user *old_setting']
 	case 260: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3155,6 +3397,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 261 long sys_timer_gettime ['timer_t timer_id', 'struct itimerspec __user *setting']
 	case 261: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3168,6 +3411,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 262 long sys_timer_getoverrun ['timer_t timer_id']
 	case 262: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -3179,6 +3423,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 263 long sys_timer_delete ['timer_t timer_id']
 	case 263: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -3190,6 +3435,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 264 long sys_clock_settime ['clockid_t which_clock', 'const struct timespec __user *tp']
 	case 264: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3203,6 +3449,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 265 long sys_clock_gettime ['clockid_t which_clock', 'struct timespec __user *tp']
 	case 265: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3216,6 +3463,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 266 long sys_clock_getres ['clockid_t which_clock', 'struct timespec __user *tp']
 	case 266: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3229,6 +3477,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 267 long sys_clock_nanosleep ['clockid_t which_clock', 'int flags', 'const struct timespec __user *rqtp', 'struct timespec __user *rmtp']
 	case 267: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3246,6 +3495,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 268 long sys_statfs64 ['const char __user *path', 'size_t sz', 'struct statfs64 __user *buf']
 	case 268: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3261,6 +3511,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 269 long sys_fstatfs64 ['unsigned int fd', 'size_t sz', 'struct statfs64 __user *buf']
 	case 269: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3276,6 +3527,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 270 long sys_tgkill ['pid_t tgid', 'pid_t pid', 'int sig']
 	case 270: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -3291,6 +3543,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 271 long sys_utimes ['char __user *filename', 'struct timeval __user *utimes']
 	case 271: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3304,6 +3557,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 272 long sys_fadvise64_64 ['int fd', 'loff_t offset', 'loff_t len', 'int advice']
 	case 272: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -3321,6 +3575,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 274 long sys_mbind ['unsigned long start', 'unsigned long len', 'unsigned long mode', 'const unsigned long __user *nmask', 'unsigned long maxnode', 'unsigned flags']
 	case 274: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3342,6 +3597,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 275 long sys_get_mempolicy ['int __user *policy', 'unsigned long __user *nmask', 'unsigned long maxnode', 'unsigned long addr', 'unsigned long flags']
 	case 275: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3361,6 +3617,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 276 long sys_set_mempolicy ['int mode', 'const unsigned long __user *nmask', 'unsigned long maxnode']
 	case 276: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3376,6 +3633,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 277 long sys_mq_open ['const char __user *name', 'int oflag', 'umode_t mode', 'struct mq_attr __user *attr']
 	case 277: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3393,6 +3651,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 278 long sys_mq_unlink ['const char __user *name']
 	case 278: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -3404,6 +3663,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 279 long sys_mq_timedsend ['mqd_t mqdes', 'const char __user *msg_ptr', 'size_t msg_len', 'unsigned int msg_prio', 'const struct timespec __user *abs_timeout']
 	case 279: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3423,6 +3683,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 280 long sys_mq_timedreceive ['mqd_t mqdes', 'char __user *msg_ptr', 'size_t msg_len', 'unsigned int __user *msg_prio', 'const struct timespec __user *abs_timeout']
 	case 280: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3442,6 +3703,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 281 long sys_mq_notify ['mqd_t mqdes', 'const struct sigevent __user *notification']
 	case 281: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3455,6 +3717,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 282 long sys_mq_getsetattr ['mqd_t mqdes', 'const struct mq_attr __user *mqstat', 'struct mq_attr __user *omqstat']
 	case 282: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3470,6 +3733,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 283 long sys_kexec_load ['unsigned long entry', 'unsigned long nr_segments', 'struct kexec_segment __user *segments', 'unsigned long flags']
 	case 283: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3487,6 +3751,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 284 long sys_waitid ['int which', 'pid_t pid', 'struct siginfo __user *infop', 'int options', 'struct rusage __user *ru']
 	case 284: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3506,6 +3771,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 286 long sys_add_key ['const char __user *_type', 'const char __user *_description', 'const void __user *_payload', 'size_t plen', 'key_serial_t destringid']
 	case 286: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3525,6 +3791,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 287 long sys_request_key ['const char __user *_type', 'const char __user *_description', 'const char __user *_callout_info', 'key_serial_t destringid']
 	case 287: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3542,6 +3809,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 288 long sys_keyctl ['int cmd', 'unsigned long arg2', 'unsigned long arg3', 'unsigned long arg4', 'unsigned long arg5']
 	case 288: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3561,6 +3829,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 289 long sys_ioprio_set ['int which', 'int who', 'int ioprio']
 	case 289: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -3576,6 +3845,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 290 long sys_ioprio_get ['int which', 'int who']
 	case 290: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3589,11 +3859,13 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 291 long sys_inotify_init ['void']
 	case 291: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_sys_inotify_init_enter, cpu, pc);
 	}; break;
 	// 292 long sys_inotify_add_watch ['int fd', 'const char __user *path', 'u32 mask']
 	case 292: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3609,6 +3881,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 293 long sys_inotify_rm_watch ['int fd', '__s32 wd']
 	case 293: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3622,6 +3895,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 294 long sys_migrate_pages ['pid_t pid', 'unsigned long maxnode', 'const unsigned long __user *from', 'const unsigned long __user *to']
 	case 294: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3639,6 +3913,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 295 long sys_openat ['int dfd', 'const char __user *filename', 'int flags', 'umode_t mode']
 	case 295: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -3656,6 +3931,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 296 long sys_mkdirat ['int dfd', 'const char __user *pathname', 'umode_t mode']
 	case 296: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3671,6 +3947,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 297 long sys_mknodat ['int dfd', 'const char __user *filename', 'umode_t mode', 'unsigned dev']
 	case 297: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3688,6 +3965,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 298 long sys_fchownat ['int dfd', 'const char __user *filename', 'uid_t user', 'gid_t group', 'int flag']
 	case 298: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3707,6 +3985,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 299 long sys_futimesat ['int dfd', 'const char __user *filename', 'struct timeval __user *utimes']
 	case 299: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3722,6 +4001,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 300 long sys_fstatat64 ['int dfd', 'const char __user *filename', 'struct stat64 __user *statbuf', 'int flag']
 	case 300: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3739,6 +4019,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 301 long sys_unlinkat ['int dfd', 'const char __user *pathname', 'int flag']
 	case 301: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -3754,6 +4035,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 302 long sys_renameat ['int olddfd', 'const char __user *oldname', 'int newdfd', 'const char __user *newname']
 	case 302: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -3771,6 +4053,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 303 long sys_linkat ['int olddfd', 'const char __user *oldname', 'int newdfd', 'const char __user *newname', 'int flags']
 	case 303: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -3790,6 +4073,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 304 long sys_symlinkat ['const char __user *oldname', 'int newdfd', 'const char __user *newname']
 	case 304: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3805,6 +4089,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 305 long sys_readlinkat ['int dfd', 'const char __user *path', 'char __user *buf', 'int bufsiz']
 	case 305: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3822,6 +4107,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 306 long sys_fchmodat ['int dfd', 'const char __user *filename', 'umode_t mode']
 	case 306: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3837,6 +4123,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 307 long sys_faccessat ['int dfd', 'const char __user *filename', 'int mode']
 	case 307: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -3852,6 +4139,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 308 long sys_pselect6 ['int', 'fd_set __user *', 'fd_set __user *', 'fd_set __user *', 'struct timespec __user *', 'void __user *']
 	case 308: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3873,6 +4161,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 309 long sys_ppoll ['struct pollfd __user *', 'unsigned int', 'struct timespec __user *', 'const sigset_t __user *', 'size_t']
 	case 309: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3892,6 +4181,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 310 long sys_unshare ['unsigned long unshare_flags']
 	case 310: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -3903,6 +4193,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 311 long sys_set_robust_list ['struct robust_list_head __user *head', 'size_t len']
 	case 311: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3916,6 +4207,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 312 long sys_get_robust_list ['int pid', 'struct robust_list_head __user * __user *head_ptr', 'size_t __user *len_ptr']
 	case 312: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3931,6 +4223,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 313 long sys_splice ['int fd_in', 'loff_t __user *off_in', 'int fd_out', 'loff_t __user *off_out', 'size_t len', 'unsigned int flags']
 	case 313: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -3952,6 +4245,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 314 long sys_sync_file_range ['int fd', 'loff_t offset', 'loff_t nbytes', 'unsigned int flags']
 	case 314: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint64_t arg1 = get_64(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -3969,6 +4263,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 315 long sys_tee ['int fdin', 'int fdout', 'size_t len', 'unsigned int flags']
 	case 315: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3986,6 +4281,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 316 long sys_vmsplice ['int fd', 'const struct iovec __user *iov', 'unsigned long nr_segs', 'unsigned int flags']
 	case 316: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4003,6 +4299,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 317 long sys_move_pages ['pid_t pid', 'unsigned long nr_pages', 'const void __user * __user *pages', 'const int __user *nodes', 'int __user *status', 'int flags']
 	case 317: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4024,6 +4321,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 318 long sys_getcpu ['unsigned __user *cpu', 'unsigned __user *node', 'struct getcpu_cache __user *cache']
 	case 318: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4039,6 +4337,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 319 long sys_epoll_pwait ['int epfd', 'struct epoll_event __user *events', 'int maxevents', 'int timeout', 'const sigset_t __user *sigmask', 'size_t sigsetsize']
 	case 319: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -4060,6 +4359,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 320 long sys_utimensat ['int dfd', 'const char __user *filename', 'struct timespec __user *utimes', 'int flags']
 	case 320: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4077,6 +4377,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 321 long sys_signalfd ['int ufd', 'sigset_t __user *user_mask', 'size_t sizemask']
 	case 321: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4092,6 +4393,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 322 long sys_timerfd_create ['int clockid', 'int flags']
 	case 322: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -4105,6 +4407,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 323 long sys_eventfd ['unsigned int count']
 	case 323: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -4116,6 +4419,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 324 long sys_fallocate ['int fd', 'int mode', 'loff_t offset', 'loff_t len']
 	case 324: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -4133,6 +4437,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 325 long sys_timerfd_settime ['int ufd', 'int flags', 'const struct itimerspec __user *utmr', 'struct itimerspec __user *otmr']
 	case 325: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4150,6 +4455,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 326 long sys_timerfd_gettime ['int ufd', 'struct itimerspec __user *otmr']
 	case 326: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -4163,6 +4469,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 327 long sys_signalfd4 ['int ufd', 'sigset_t __user *user_mask', 'size_t sizemask', 'int flags']
 	case 327: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4180,6 +4487,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 328 long sys_eventfd2 ['unsigned int count', 'int flags']
 	case 328: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -4193,6 +4501,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 329 long sys_epoll_create1 ['int flags']
 	case 329: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -4204,6 +4513,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 330 long sys_dup3 ['unsigned int oldfd', 'unsigned int newfd', 'int flags']
 	case 330: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -4219,6 +4529,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 331 long sys_pipe2 ['int __user *fildes', 'int flags']
 	case 331: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -4232,6 +4543,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 332 long sys_inotify_init1 ['int flags']
 	case 332: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -4243,6 +4555,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 333 long sys_preadv ['unsigned long fd', 'const struct iovec __user *vec', 'unsigned long vlen', 'unsigned long pos_l', 'unsigned long pos_h']
 	case 333: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4262,6 +4575,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 334 long sys_pwritev ['unsigned long fd', 'const struct iovec __user *vec', 'unsigned long vlen', 'unsigned long pos_l', 'unsigned long pos_h']
 	case 334: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4281,6 +4595,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 335 long sys_rt_tgsigqueueinfo ['pid_t tgid', 'pid_t pid', 'int sig', 'siginfo_t __user *uinfo']
 	case 335: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -4298,6 +4613,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 336 long sys_perf_event_open ['struct perf_event_attr __user *attr_uptr', 'pid_t pid', 'int cpu', 'int group_fd', 'unsigned long flags']
 	case 336: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -4317,6 +4633,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 337 long sys_recvmmsg ['int fd', 'struct mmsghdr __user *msg', 'unsigned int vlen', 'unsigned flags', 'struct timespec __user *timeout']
 	case 337: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4336,6 +4653,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 338 long sys_fanotify_init ['unsigned int flags', 'unsigned int event_f_flags']
 	case 338: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -4349,6 +4667,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 339 long sys_fanotify_mark ['int fanotify_fd', 'unsigned int flags', 'u64 mask', 'int fd', 'const char __user *pathname']
 	case 339: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint64_t arg2 = get_64(cpu, 2);
@@ -4368,6 +4687,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 340 long sys_prlimit64 ['pid_t pid', 'unsigned int resource', 'const struct rlimit64 __user *new_rlim', 'struct rlimit64 __user *old_rlim']
 	case 340: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4385,6 +4705,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 341 long sys_name_to_handle_at ['int dfd', 'const char __user *name', 'struct file_handle __user *handle', 'int __user *mnt_id', 'int flag']
 	case 341: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4404,6 +4725,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 342 long sys_open_by_handle_at ['int mountdirfd', 'struct file_handle __user *handle', 'int flags']
 	case 342: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -4419,6 +4741,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 343 long sys_clock_adjtime ['clockid_t which_clock', 'struct timex __user *tx']
 	case 343: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -4432,6 +4755,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 344 long sys_syncfs ['int fd']
 	case 344: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -4443,6 +4767,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 345 long sys_sendmmsg ['int fd', 'struct mmsghdr __user *msg', 'unsigned int vlen', 'unsigned flags']
 	case 345: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4460,6 +4785,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 346 long sys_setns ['int fd', 'int nstype']
 	case 346: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -4473,6 +4799,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 347 long sys_process_vm_readv ['pid_t pid', 'const struct iovec __user *lvec', 'unsigned long liovcnt', 'const struct iovec __user *rvec', 'unsigned long riovcnt', 'unsigned long flags']
 	case 347: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4494,6 +4821,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 348 long sys_process_vm_writev ['pid_t pid', 'const struct iovec __user *lvec', 'unsigned long liovcnt', 'const struct iovec __user *rvec', 'unsigned long riovcnt', 'unsigned long flags']
 	case 348: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4515,6 +4843,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 349 long sys_kcmp ['pid_t pid1', 'pid_t pid2', 'int type', 'unsigned long idx1', 'unsigned long idx2']
 	case 349: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -4534,6 +4863,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 350 long sys_finit_module ['int fd', 'const char __user *uargs', 'int flags']
 	case 350: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -4549,6 +4879,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 351 long sys_sched_setattr ['pid_t pid', 'struct sched_attr __user *attr', 'unsigned int flags']
 	case 351: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4564,6 +4895,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 352 long sys_sched_getattr ['pid_t pid', 'struct sched_attr __user *attr', 'unsigned int size', 'unsigned int flags']
 	case 352: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4581,6 +4913,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 353 long sys_renameat2 ['int olddfd', 'const char __user *oldname', 'int newdfd', 'const char __user *newname', 'unsigned int flags']
 	case 353: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -4600,6 +4933,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 354 long sys_seccomp ['unsigned int op', 'unsigned int flags', 'const char __user *uargs']
 	case 354: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4615,6 +4949,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 355 long sys_getrandom ['char __user *buf', 'size_t count', 'unsigned int flags']
 	case 355: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4630,6 +4965,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 356 long sys_memfd_create ['const char __user *uname_ptr', 'unsigned int flags']
 	case 356: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -4643,6 +4979,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 357 long sys_bpf ['int cmd', 'union bpf_attr *attr', 'unsigned int size']
 	case 357: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4658,6 +4995,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 358 long sys_execveat ['int dfd', 'const char __user *filename', 'const char __user *const __user *argv', 'const char __user *const __user *envp', 'int flags']
 	case 358: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4677,6 +5015,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 359 long sys_socket ['int', 'int', 'int']
 	case 359: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -4692,6 +5031,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 360 long sys_socketpair ['int', 'int', 'int', 'int __user *']
 	case 360: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -4709,6 +5049,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 361 long sys_bind ['int', 'struct sockaddr __user *', 'int']
 	case 361: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -4724,6 +5065,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 362 long sys_connect ['int', 'struct sockaddr __user *', 'int']
 	case 362: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -4739,6 +5081,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 363 long sys_listen ['int', 'int']
 	case 363: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -4752,6 +5095,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 364 long sys_accept4 ['int', 'struct sockaddr __user *', 'int __user *', 'int']
 	case 364: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4769,6 +5113,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 365 long sys_getsockopt ['int fd', 'int level', 'int optname', 'char __user *optval', 'int __user *optlen']
 	case 365: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -4788,6 +5133,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 366 long sys_setsockopt ['int fd', 'int level', 'int optname', 'char __user *optval', 'int optlen']
 	case 366: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -4807,6 +5153,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 367 long sys_getsockname ['int', 'struct sockaddr __user *', 'int __user *']
 	case 367: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4822,6 +5169,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 368 long sys_getpeername ['int', 'struct sockaddr __user *', 'int __user *']
 	case 368: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4837,6 +5185,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 369 long sys_sendto ['int', 'void __user *', 'size_t', 'unsigned', 'struct sockaddr __user *', 'int']
 	case 369: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4858,6 +5207,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 370 long sys_sendmsg ['int fd', 'struct user_msghdr __user *msg', 'unsigned flags']
 	case 370: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4873,6 +5223,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 371 long sys_recvfrom ['int', 'void __user *', 'size_t', 'unsigned', 'struct sockaddr __user *', 'int __user *']
 	case 371: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4894,6 +5245,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 372 long sys_recvmsg ['int fd', 'struct user_msghdr __user *msg', 'unsigned flags']
 	case 372: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4909,6 +5261,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 373 long sys_shutdown ['int', 'int']
 	case 373: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -4922,6 +5275,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 374 long sys_userfaultfd ['int flags']
 	case 374: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -4933,6 +5287,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 375 long sys_membarrier ['int cmd', 'int flags']
 	case 375: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -4946,6 +5301,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 376 long sys_mlock2 ['unsigned long start', 'size_t len', 'int flags']
 	case 376: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -4961,6 +5317,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 377 long sys_copy_file_range ['int fd_in', 'loff_t __user *off_in', 'int fd_out', 'loff_t __user *off_out', 'size_t len', 'unsigned int flags']
 	case 377: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		int32_t arg2 = get_s32(cpu, 2);
@@ -4982,6 +5339,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 378 long sys_preadv2 ['unsigned long fd', 'const struct iovec __user *vec', 'unsigned long vlen', 'unsigned long pos_l', 'unsigned long pos_h', 'rwf_t flags']
 	case 378: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -5003,6 +5361,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 379 long sys_pwritev2 ['unsigned long fd', 'const struct iovec __user *vec', 'unsigned long vlen', 'unsigned long pos_l', 'unsigned long pos_h', 'rwf_t flags']
 	case 379: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -5024,6 +5383,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 380 long sys_pkey_mprotect ['unsigned long start', 'size_t len', 'unsigned long prot', 'int pkey']
 	case 380: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -5041,6 +5401,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 381 long sys_pkey_alloc ['unsigned long flags', 'unsigned long init_val']
 	case 381: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -5054,6 +5415,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 382 long sys_pkey_free ['int pkey']
 	case 382: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -5065,6 +5427,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 383 long sys_statx ['int dfd', 'const char __user *path', 'unsigned flags', 'unsigned mask', 'struct statx __user *buffer']
 	case 383: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -5084,6 +5447,7 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 	// 384 long sys_arch_prctl ['int', 'unsigned long']
 	case 384: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		int32_t arg0 = get_s32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
diff --git a/panda/plugins/syscalls2/generated/syscall_switch_enter_windows_2000_x86.cpp b/panda/plugins/syscalls2/generated/syscall_switch_enter_windows_2000_x86.cpp
index b14adc5dde3..7505cd2284c 100644
--- a/panda/plugins/syscalls2/generated/syscall_switch_enter_windows_2000_x86.cpp
+++ b/panda/plugins/syscalls2/generated/syscall_switch_enter_windows_2000_x86.cpp
@@ -33,6 +33,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	}
 	ctx.asid = panda_current_asid(cpu);
 	ctx.retaddr = calc_retaddr(cpu, pc);
+	ctx.double_return = false;
 	bool panda_noreturn;	// true if PANDA should not track the return of this system call
 	const syscall_info_t *call = NULL;
 	syscall_info_t zero = {0};
@@ -48,6 +49,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 0 NTSTATUS NtAcceptConnectPort ['PHANDLE PortHandle', 'PVOID PortContext', 'PPORT_MESSAGE ConnectionRequest', 'BOOLEAN AcceptConnection', 'PPORT_VIEW ServerView', 'PREMOTE_PORT_VIEW ClientView']
 	case 0: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -69,6 +71,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 1 NTSTATUS NtAccessCheck ['PSECURITY_DESCRIPTOR SecurityDescriptor', 'HANDLE ClientToken', 'ACCESS_MASK DesiredAccess', 'PGENERIC_MAPPING GenericMapping', 'PPRIVILEGE_SET PrivilegeSet', 'PULONG PrivilegeSetLength', 'PACCESS_MASK GrantedAccess', 'PNTSTATUS AccessStatus']
 	case 1: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -94,6 +97,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 2 NTSTATUS NtAccessCheckAndAuditAlarm ['PUNICODE_STRING SubsystemName', 'PVOID HandleId', 'PUNICODE_STRING ObjectTypeName', 'PUNICODE_STRING ObjectName', 'PSECURITY_DESCRIPTOR SecurityDescriptor', 'ACCESS_MASK DesiredAccess', 'PGENERIC_MAPPING GenericMapping', 'BOOLEAN ObjectCreation', 'PACCESS_MASK GrantedAccess', 'PNTSTATUS AccessStatus', 'PBOOLEAN GenerateOnClose']
 	case 2: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -125,6 +129,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 3 NTSTATUS NtAccessCheckByType ['PSECURITY_DESCRIPTOR SecurityDescriptor', 'PSID PrincipalSelfSid', 'HANDLE ClientToken', 'ACCESS_MASK DesiredAccess', 'POBJECT_TYPE_LIST ObjectTypeList', 'ULONG ObjectTypeListLength', 'PGENERIC_MAPPING GenericMapping', 'PPRIVILEGE_SET PrivilegeSet', 'PULONG PrivilegeSetLength', 'PACCESS_MASK GrantedAccess', 'PNTSTATUS AccessStatus']
 	case 3: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -156,6 +161,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 4 NTSTATUS NtAccessCheckByTypeAndAuditAlarm ['PUNICODE_STRING SubsystemName', 'PVOID HandleId', 'PUNICODE_STRING ObjectTypeName', 'PUNICODE_STRING ObjectName', 'PSECURITY_DESCRIPTOR SecurityDescriptor', 'PSID PrincipalSelfSid', 'ACCESS_MASK DesiredAccess', 'AUDIT_EVENT_TYPE AuditType', 'ULONG Flags', 'POBJECT_TYPE_LIST ObjectTypeList', 'ULONG ObjectTypeListLength', 'PGENERIC_MAPPING GenericMapping', 'BOOLEAN ObjectCreation', 'PACCESS_MASK GrantedAccess', 'PNTSTATUS AccessStatus', 'PBOOLEAN GenerateOnClose']
 	case 4: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -197,6 +203,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 5 NTSTATUS NtAccessCheckByTypeResultList ['PSECURITY_DESCRIPTOR SecurityDescriptor', 'PSID PrincipalSelfSid', 'HANDLE ClientToken', 'ACCESS_MASK DesiredAccess', 'POBJECT_TYPE_LIST ObjectTypeList', 'ULONG ObjectTypeListLength', 'PGENERIC_MAPPING GenericMapping', 'PPRIVILEGE_SET PrivilegeSet', 'PULONG PrivilegeSetLength', 'PACCESS_MASK GrantedAccess', 'PNTSTATUS AccessStatus']
 	case 5: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -228,6 +235,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 6 NTSTATUS NtAccessCheckByTypeResultListAndAuditAlarm ['PUNICODE_STRING SubsystemName', 'PVOID HandleId', 'PUNICODE_STRING ObjectTypeName', 'PUNICODE_STRING ObjectName', 'PSECURITY_DESCRIPTOR SecurityDescriptor', 'PSID PrincipalSelfSid', 'ACCESS_MASK DesiredAccess', 'AUDIT_EVENT_TYPE AuditType', 'ULONG Flags', 'POBJECT_TYPE_LIST ObjectTypeList', 'ULONG ObjectTypeListLength', 'PGENERIC_MAPPING GenericMapping', 'BOOLEAN ObjectCreation', 'PACCESS_MASK GrantedAccess', 'PNTSTATUS AccessStatus', 'PBOOLEAN GenerateOnClose']
 	case 6: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -269,6 +277,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 7 NTSTATUS NtAccessCheckByTypeResultListAndAuditAlarmByHandle ['PUNICODE_STRING SubsystemName', 'PVOID HandleId', 'HANDLE ClientToken', 'PUNICODE_STRING ObjectTypeName', 'PUNICODE_STRING ObjectName', 'PSECURITY_DESCRIPTOR SecurityDescriptor', 'PSID PrincipalSelfSid', 'ACCESS_MASK DesiredAccess', 'AUDIT_EVENT_TYPE AuditType', 'ULONG Flags', 'POBJECT_TYPE_LIST ObjectTypeList', 'ULONG ObjectTypeListLength', 'PGENERIC_MAPPING GenericMapping', 'BOOLEAN ObjectCreation', 'PACCESS_MASK GrantedAccess', 'PNTSTATUS AccessStatus', 'PBOOLEAN GenerateOnClose']
 	case 7: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -312,6 +321,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 8 NTSTATUS NtAddAtom ['PWSTR AtomName', 'ULONG Length', 'PRTL_ATOM Atom']
 	case 8: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -327,6 +337,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 9 NTSTATUS NtAdjustGroupsToken ['HANDLE TokenHandle', 'BOOLEAN ResetToDefault', 'PTOKEN_GROUPS NewState', 'ULONG BufferLength', 'PTOKEN_GROUPS PreviousState', 'PULONG ReturnLength']
 	case 9: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -348,6 +359,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 10 NTSTATUS NtAdjustPrivilegesToken ['HANDLE TokenHandle', 'BOOLEAN DisableAllPrivileges', 'PTOKEN_PRIVILEGES NewState', 'ULONG BufferLength', 'PTOKEN_PRIVILEGES PreviousState', 'PULONG ReturnLength']
 	case 10: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -369,6 +381,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 11 NTSTATUS NtAlertResumeThread ['HANDLE ThreadHandle', 'PULONG PreviousSuspendCount']
 	case 11: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -382,6 +395,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 12 NTSTATUS NtAlertThread ['HANDLE ThreadHandle']
 	case 12: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -393,6 +407,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 13 NTSTATUS NtAllocateLocallyUniqueId ['PLUID Luid']
 	case 13: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -404,6 +419,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 14 NTSTATUS NtAllocateUserPhysicalPages ['HANDLE ProcessHandle', 'PULONG_PTR NumberOfPages', 'PULONG_PTR UserPfnArray']
 	case 14: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -419,6 +435,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 15 NTSTATUS NtAllocateUuids ['PULARGE_INTEGER Time', 'PULONG Range', 'PULONG Sequence', 'PCHAR Seed']
 	case 15: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -436,6 +453,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 16 NTSTATUS NtAllocateVirtualMemory ['HANDLE ProcessHandle', 'PVOID *BaseAddress', 'ULONG_PTR ZeroBits', 'PSIZE_T RegionSize', 'ULONG AllocationType', 'ULONG Protect']
 	case 16: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -457,6 +475,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 17 NTSTATUS NtAreMappedFilesTheSame ['PVOID File1MappedAsAnImage', 'PVOID File2MappedAsFile']
 	case 17: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -470,6 +489,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 18 NTSTATUS NtAssignProcessToJobObject ['HANDLE JobHandle', 'HANDLE ProcessHandle']
 	case 18: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -483,6 +503,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 19 NTSTATUS NtCallbackReturn ['PVOID OutputBuffer', 'ULONG OutputLength', 'NTSTATUS Status']
 	case 19: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -498,6 +519,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 20 NTSTATUS NtCancelIoFile ['HANDLE FileHandle', 'PIO_STATUS_BLOCK IoStatusBlock']
 	case 20: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -511,6 +533,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 21 NTSTATUS NtCancelTimer ['HANDLE TimerHandle', 'PBOOLEAN CurrentState']
 	case 21: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -524,6 +547,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 23 NTSTATUS NtClearEvent ['HANDLE EventHandle']
 	case 23: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -535,6 +559,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 24 NTSTATUS NtClose ['HANDLE Handle']
 	case 24: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -546,6 +571,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 25 NTSTATUS NtCloseObjectAuditAlarm ['PUNICODE_STRING SubsystemName', 'PVOID HandleId', 'BOOLEAN GenerateOnClose']
 	case 25: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -561,6 +587,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 26 NTSTATUS NtCompleteConnectPort ['HANDLE PortHandle']
 	case 26: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -572,6 +599,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 27 NTSTATUS NtConnectPort ['PHANDLE PortHandle', 'PUNICODE_STRING PortName', 'PSECURITY_QUALITY_OF_SERVICE SecurityQos', 'PPORT_VIEW ClientView', 'PREMOTE_PORT_VIEW ServerView', 'PULONG MaxMessageLength', 'PVOID ConnectionInformation', 'PULONG ConnectionInformationLength']
 	case 27: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -597,6 +625,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 28 NTSTATUS NtContinue ['PCONTEXT ContextRecord', 'BOOLEAN TestAlert']
 	case 28: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -610,6 +639,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 29 NTSTATUS NtCreateDirectoryObject ['PHANDLE DirectoryHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes']
 	case 29: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -625,6 +655,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 30 NTSTATUS NtCreateEvent ['PHANDLE EventHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes', 'EVENT_TYPE EventType', 'BOOLEAN InitialState']
 	case 30: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -644,6 +675,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 31 NTSTATUS NtCreateEventPair ['PHANDLE EventPairHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes']
 	case 31: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -659,6 +691,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 32 NTSTATUS NtCreateFile ['PHANDLE FileHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes', 'PIO_STATUS_BLOCK IoStatusBlock', 'PLARGE_INTEGER AllocationSize', 'ULONG FileAttributes', 'ULONG ShareAccess', 'ULONG CreateDisposition', 'ULONG CreateOptions', 'PVOID EaBuffer', 'ULONG EaLength']
 	case 32: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -690,6 +723,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 33 NTSTATUS NtCreateIoCompletion ['PHANDLE IoCompletionHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes', 'ULONG Count']
 	case 33: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -707,6 +741,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 34 NTSTATUS NtCreateJobObject ['PHANDLE JobHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes']
 	case 34: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -722,6 +757,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 35 NTSTATUS NtCreateKey ['PHANDLE KeyHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes', 'ULONG TitleIndex', 'PUNICODE_STRING Class', 'ULONG CreateOptions', 'PULONG Disposition']
 	case 35: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -745,6 +781,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 36 NTSTATUS NtCreateMailslotFile ['PHANDLE FileHandle', 'ULONG DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes', 'PIO_STATUS_BLOCK IoStatusBlock', 'ULONG CreateOptions', 'ULONG MailslotQuota', 'ULONG MaximumMessageSize', 'PLARGE_INTEGER ReadTimeout']
 	case 36: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -770,6 +807,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 37 NTSTATUS NtCreateMutant ['PHANDLE MutantHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes', 'BOOLEAN InitialOwner']
 	case 37: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -787,6 +825,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 38 NTSTATUS NtCreateNamedPipeFile ['PHANDLE FileHandle', 'ULONG DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes', 'PIO_STATUS_BLOCK IoStatusBlock', 'ULONG ShareAccess', 'ULONG CreateDisposition', 'ULONG CreateOptions', 'ULONG NamedPipeType', 'ULONG ReadMode', 'ULONG CompletionMode', 'ULONG MaximumInstances', 'ULONG InboundQuota', 'ULONG OutboundQuota', 'PLARGE_INTEGER DefaultTimeout']
 	case 38: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -824,6 +863,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 39 NTSTATUS NtCreatePagingFile ['PUNICODE_STRING PageFileName', 'PLARGE_INTEGER MinimumSize', 'PLARGE_INTEGER MaximumSize', 'ULONG Priority']
 	case 39: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -841,6 +881,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 40 NTSTATUS NtCreatePort ['PHANDLE PortHandle', 'POBJECT_ATTRIBUTES ObjectAttributes', 'ULONG MaxConnectionInfoLength', 'ULONG MaxMessageLength', 'ULONG MaxPoolUsage']
 	case 40: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -860,6 +901,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 41 NTSTATUS NtCreateProcess ['PHANDLE ProcessHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes', 'HANDLE ParentProcess', 'BOOLEAN InheritObjectTable', 'HANDLE SectionHandle', 'HANDLE DebugPort', 'HANDLE ExceptionPort']
 	case 41: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -885,6 +927,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 42 NTSTATUS NtCreateProfile ['PHANDLE ProfileHandle', 'HANDLE Process', 'PVOID RangeBase', 'SIZE_T RangeSize', 'ULONG BucketSize', 'PULONG Buffer', 'ULONG BufferSize', 'KPROFILE_SOURCE ProfileSource', 'KAFFINITY Affinity']
 	case 42: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -912,6 +955,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 43 NTSTATUS NtCreateSection ['PHANDLE SectionHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes', 'PLARGE_INTEGER MaximumSize', 'ULONG SectionPageProtection', 'ULONG AllocationAttributes', 'HANDLE FileHandle']
 	case 43: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -935,6 +979,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 44 NTSTATUS NtCreateSemaphore ['PHANDLE SemaphoreHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes', 'LONG InitialCount', 'LONG MaximumCount']
 	case 44: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -954,6 +999,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 45 NTSTATUS NtCreateSymbolicLinkObject ['PHANDLE LinkHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes', 'PUNICODE_STRING LinkTarget']
 	case 45: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -971,6 +1017,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 46 NTSTATUS NtCreateThread ['PHANDLE ThreadHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes', 'HANDLE ProcessHandle', 'PCLIENT_ID ClientId', 'PCONTEXT ThreadContext', 'PINITIAL_TEB InitialTeb', 'BOOLEAN CreateSuspended']
 	case 46: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -996,6 +1043,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 47 NTSTATUS NtCreateTimer ['PHANDLE TimerHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes', 'TIMER_TYPE TimerType']
 	case 47: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1013,6 +1061,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 48 NTSTATUS NtCreateToken ['PHANDLE TokenHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes', 'TOKEN_TYPE TokenType', 'PLUID AuthenticationId', 'PLARGE_INTEGER ExpirationTime', 'PTOKEN_USER User', 'PTOKEN_GROUPS Groups', 'PTOKEN_PRIVILEGES Privileges', 'PTOKEN_OWNER Owner', 'PTOKEN_PRIMARY_GROUP PrimaryGroup', 'PTOKEN_DEFAULT_DACL DefaultDacl', 'PTOKEN_SOURCE TokenSource']
 	case 48: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1048,6 +1097,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 49 NTSTATUS NtCreateWaitablePort ['PHANDLE PortHandle', 'POBJECT_ATTRIBUTES ObjectAttributes', 'ULONG MaxConnectionInfoLength', 'ULONG MaxMessageLength', 'ULONG MaxPoolUsage']
 	case 49: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1067,6 +1117,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 50 NTSTATUS NtDelayExecution ['BOOLEAN Alertable', 'PLARGE_INTEGER DelayInterval']
 	case 50: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1080,6 +1131,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 51 NTSTATUS NtDeleteAtom ['RTL_ATOM Atom']
 	case 51: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1091,6 +1143,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 52 NTSTATUS NtDeleteFile ['POBJECT_ATTRIBUTES ObjectAttributes']
 	case 52: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1102,6 +1155,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 53 NTSTATUS NtDeleteKey ['HANDLE KeyHandle']
 	case 53: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1113,6 +1167,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 54 NTSTATUS NtDeleteObjectAuditAlarm ['PUNICODE_STRING SubsystemName', 'PVOID HandleId', 'BOOLEAN GenerateOnClose']
 	case 54: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1128,6 +1183,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 55 NTSTATUS NtDeleteValueKey ['HANDLE KeyHandle', 'PUNICODE_STRING ValueName']
 	case 55: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1141,6 +1197,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 56 NTSTATUS NtDeviceIoControlFile ['HANDLE FileHandle', 'HANDLE Event', 'PIO_APC_ROUTINE ApcRoutine', 'PVOID ApcContext', 'PIO_STATUS_BLOCK IoStatusBlock', 'ULONG IoControlCode', 'PVOID InputBuffer', 'ULONG InputBufferLength', 'PVOID OutputBuffer', 'ULONG OutputBufferLength']
 	case 56: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1170,6 +1227,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 57 NTSTATUS NtDisplayString ['PUNICODE_STRING String']
 	case 57: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1181,6 +1239,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 58 NTSTATUS NtDuplicateObject ['HANDLE SourceProcessHandle', 'HANDLE SourceHandle', 'HANDLE TargetProcessHandle', 'PHANDLE TargetHandle', 'ACCESS_MASK DesiredAccess', 'ULONG HandleAttributes', 'ULONG Options']
 	case 58: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1204,6 +1263,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 59 NTSTATUS NtDuplicateToken ['HANDLE ExistingTokenHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes', 'BOOLEAN EffectiveOnly', 'TOKEN_TYPE TokenType', 'PHANDLE NewTokenHandle']
 	case 59: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1225,6 +1285,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 60 NTSTATUS NtEnumerateKey ['HANDLE KeyHandle', 'ULONG Index', 'KEY_INFORMATION_CLASS KeyInformationClass', 'PVOID KeyInformation', 'ULONG Length', 'PULONG ResultLength']
 	case 60: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1246,6 +1307,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 61 NTSTATUS NtEnumerateValueKey ['HANDLE KeyHandle', 'ULONG Index', 'KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass', 'PVOID KeyValueInformation', 'ULONG Length', 'PULONG ResultLength']
 	case 61: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1267,6 +1329,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 62 NTSTATUS NtExtendSection ['HANDLE SectionHandle', 'PLARGE_INTEGER NewSectionSize']
 	case 62: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1280,6 +1343,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 63 NTSTATUS NtFilterToken ['HANDLE ExistingTokenHandle', 'ULONG Flags', 'PTOKEN_GROUPS SidsToDisable', 'PTOKEN_PRIVILEGES PrivilegesToDelete', 'PTOKEN_GROUPS RestrictedSids', 'PHANDLE NewTokenHandle']
 	case 63: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1301,6 +1365,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 64 NTSTATUS NtFindAtom ['PWSTR AtomName', 'ULONG Length', 'PRTL_ATOM Atom']
 	case 64: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1316,6 +1381,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 65 NTSTATUS NtFlushBuffersFile ['HANDLE FileHandle', 'PIO_STATUS_BLOCK IoStatusBlock']
 	case 65: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1329,6 +1395,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 66 NTSTATUS NtFlushInstructionCache ['HANDLE ProcessHandle', 'PVOID BaseAddress', 'SIZE_T Length']
 	case 66: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1344,6 +1411,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 67 NTSTATUS NtFlushKey ['HANDLE KeyHandle']
 	case 67: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1355,6 +1423,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 68 NTSTATUS NtFlushVirtualMemory ['HANDLE ProcessHandle', 'PVOID *BaseAddress', 'PSIZE_T RegionSize', 'PIO_STATUS_BLOCK IoStatus']
 	case 68: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1372,11 +1441,13 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 69 NTSTATUS NtFlushWriteBuffer ['']
 	case 69: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_NtFlushWriteBuffer_enter, cpu, pc);
 	}; break;
 	// 70 NTSTATUS NtFreeUserPhysicalPages ['HANDLE ProcessHandle', 'PULONG_PTR NumberOfPages', 'PULONG_PTR UserPfnArray']
 	case 70: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1392,6 +1463,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 71 NTSTATUS NtFreeVirtualMemory ['HANDLE ProcessHandle', 'PVOID *BaseAddress', 'PSIZE_T RegionSize', 'ULONG FreeType']
 	case 71: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1409,6 +1481,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 72 NTSTATUS NtFsControlFile ['HANDLE FileHandle', 'HANDLE Event', 'PIO_APC_ROUTINE ApcRoutine', 'PVOID ApcContext', 'PIO_STATUS_BLOCK IoStatusBlock', 'ULONG IoControlCode', 'PVOID InputBuffer', 'ULONG InputBufferLength', 'PVOID OutputBuffer', 'ULONG OutputBufferLength']
 	case 72: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1438,6 +1511,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 73 NTSTATUS NtGetContextThread ['HANDLE ThreadHandle', 'PCONTEXT ThreadContext']
 	case 73: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1451,6 +1525,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 74 NTSTATUS NtGetDevicePowerState ['HANDLE Device', 'DEVICE_POWER_STATE *State']
 	case 74: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1464,6 +1539,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 75 NTSTATUS NtGetPlugPlayEvent ['HANDLE EventHandle', 'PVOID Context', 'PPLUGPLAY_EVENT_BLOCK EventBlock', 'ULONG EventBufferSize']
 	case 75: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1481,6 +1557,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 77 NTSTATUS NtGetWriteWatch ['HANDLE ProcessHandle', 'ULONG Flags', 'PVOID BaseAddress', 'SIZE_T RegionSize', 'PVOID *UserAddressArray', 'PULONG_PTR EntriesInUserAddressArray', 'PULONG Granularity']
 	case 77: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1504,6 +1581,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 78 NTSTATUS NtImpersonateAnonymousToken ['HANDLE ThreadHandle']
 	case 78: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1515,6 +1593,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 79 NTSTATUS NtImpersonateClientOfPort ['HANDLE PortHandle', 'PPORT_MESSAGE Message']
 	case 79: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1528,6 +1607,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 80 NTSTATUS NtImpersonateThread ['HANDLE ServerThreadHandle', 'HANDLE ClientThreadHandle', 'PSECURITY_QUALITY_OF_SERVICE SecurityQos']
 	case 80: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1543,6 +1623,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 81 NTSTATUS NtInitializeRegistry ['USHORT BootCondition']
 	case 81: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1554,6 +1635,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 82 NTSTATUS NtInitiatePowerAction ['POWER_ACTION SystemAction', 'SYSTEM_POWER_STATE MinSystemState', 'ULONG Flags', 'BOOLEAN Asynchronous']
 	case 82: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1571,11 +1653,13 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 83 BOOLEAN NtIsSystemResumeAutomatic ['']
 	case 83: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_NtIsSystemResumeAutomatic_enter, cpu, pc);
 	}; break;
 	// 84 NTSTATUS NtListenPort ['HANDLE PortHandle', 'PPORT_MESSAGE ConnectionRequest']
 	case 84: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1589,6 +1673,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 85 NTSTATUS NtLoadDriver ['PUNICODE_STRING DriverServiceName']
 	case 85: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1600,6 +1685,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 86 NTSTATUS NtLoadKey ['POBJECT_ATTRIBUTES TargetKey', 'POBJECT_ATTRIBUTES SourceFile']
 	case 86: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1613,6 +1699,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 87 NTSTATUS NtLoadKey2 ['POBJECT_ATTRIBUTES TargetKey', 'POBJECT_ATTRIBUTES SourceFile', 'ULONG Flags']
 	case 87: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1628,6 +1715,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 88 NTSTATUS NtLockFile ['HANDLE FileHandle', 'HANDLE Event', 'PIO_APC_ROUTINE ApcRoutine', 'PVOID ApcContext', 'PIO_STATUS_BLOCK IoStatusBlock', 'PLARGE_INTEGER ByteOffset', 'PLARGE_INTEGER Length', 'ULONG Key', 'BOOLEAN FailImmediately', 'BOOLEAN ExclusiveLock']
 	case 88: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1657,6 +1745,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 89 NTSTATUS NtLockVirtualMemory ['HANDLE ProcessHandle', 'PVOID *BaseAddress', 'PSIZE_T RegionSize', 'ULONG MapType']
 	case 89: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1674,6 +1763,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 90 NTSTATUS NtMakeTemporaryObject ['HANDLE Handle']
 	case 90: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1685,6 +1775,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 91 NTSTATUS NtMapUserPhysicalPages ['PVOID VirtualAddress', 'ULONG_PTR NumberOfPages', 'PULONG_PTR UserPfnArray']
 	case 91: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1700,6 +1791,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 92 NTSTATUS NtMapUserPhysicalPagesScatter ['PVOID *VirtualAddresses', 'ULONG_PTR NumberOfPages', 'PULONG_PTR UserPfnArray']
 	case 92: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1715,6 +1807,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 93 NTSTATUS NtMapViewOfSection ['HANDLE SectionHandle', 'HANDLE ProcessHandle', 'PVOID *BaseAddress', 'ULONG_PTR ZeroBits', 'SIZE_T CommitSize', 'PLARGE_INTEGER SectionOffset', 'PSIZE_T ViewSize', 'SECTION_INHERIT InheritDisposition', 'ULONG AllocationType', 'WIN32_PROTECTION_MASK Win32Protect']
 	case 93: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1744,6 +1837,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 94 NTSTATUS NtNotifyChangeDirectoryFile ['HANDLE FileHandle', 'HANDLE Event', 'PIO_APC_ROUTINE ApcRoutine', 'PVOID ApcContext', 'PIO_STATUS_BLOCK IoStatusBlock', 'PVOID Buffer', 'ULONG Length', 'ULONG CompletionFilter', 'BOOLEAN WatchTree']
 	case 94: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1771,6 +1865,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 95 NTSTATUS NtNotifyChangeKey ['HANDLE KeyHandle', 'HANDLE Event', 'PIO_APC_ROUTINE ApcRoutine', 'PVOID ApcContext', 'PIO_STATUS_BLOCK IoStatusBlock', 'ULONG CompletionFilter', 'BOOLEAN WatchTree', 'PVOID Buffer', 'ULONG BufferSize', 'BOOLEAN Asynchronous']
 	case 95: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1800,6 +1895,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 96 NTSTATUS NtNotifyChangeMultipleKeys ['HANDLE MasterKeyHandle', 'ULONG Count', 'OBJECT_ATTRIBUTES SlaveObjects[]', 'HANDLE Event', 'PIO_APC_ROUTINE ApcRoutine', 'PVOID ApcContext', 'PIO_STATUS_BLOCK IoStatusBlock', 'ULONG CompletionFilter', 'BOOLEAN WatchTree', 'PVOID Buffer', 'ULONG BufferSize', 'BOOLEAN Asynchronous']
 	case 96: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1833,6 +1929,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 97 NTSTATUS NtOpenDirectoryObject ['PHANDLE DirectoryHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes']
 	case 97: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1848,6 +1945,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 98 NTSTATUS NtOpenEvent ['PHANDLE EventHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes']
 	case 98: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1863,6 +1961,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 99 NTSTATUS NtOpenEventPair ['PHANDLE EventPairHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes']
 	case 99: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1878,6 +1977,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 100 NTSTATUS NtOpenFile ['PHANDLE FileHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes', 'PIO_STATUS_BLOCK IoStatusBlock', 'ULONG ShareAccess', 'ULONG OpenOptions']
 	case 100: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1899,6 +1999,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 101 NTSTATUS NtOpenIoCompletion ['PHANDLE IoCompletionHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes']
 	case 101: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1914,6 +2015,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 102 NTSTATUS NtOpenJobObject ['PHANDLE JobHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes']
 	case 102: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1929,6 +2031,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 103 NTSTATUS NtOpenKey ['PHANDLE KeyHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes']
 	case 103: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1944,6 +2047,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 104 NTSTATUS NtOpenMutant ['PHANDLE MutantHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes']
 	case 104: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1959,6 +2063,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 105 NTSTATUS NtOpenObjectAuditAlarm ['PUNICODE_STRING SubsystemName', 'PVOID HandleId', 'PUNICODE_STRING ObjectTypeName', 'PUNICODE_STRING ObjectName', 'PSECURITY_DESCRIPTOR SecurityDescriptor', 'HANDLE ClientToken', 'ACCESS_MASK DesiredAccess', 'ACCESS_MASK GrantedAccess', 'PPRIVILEGE_SET Privileges', 'BOOLEAN ObjectCreation', 'BOOLEAN AccessGranted', 'PBOOLEAN GenerateOnClose']
 	case 105: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1992,6 +2097,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 106 NTSTATUS NtOpenProcess ['PHANDLE ProcessHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes', 'PCLIENT_ID ClientId']
 	case 106: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2009,6 +2115,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 107 NTSTATUS NtOpenProcessToken ['HANDLE ProcessHandle', 'ACCESS_MASK DesiredAccess', 'PHANDLE TokenHandle']
 	case 107: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2024,6 +2131,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 108 NTSTATUS NtOpenSection ['PHANDLE SectionHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes']
 	case 108: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2039,6 +2147,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 109 NTSTATUS NtOpenSemaphore ['PHANDLE SemaphoreHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes']
 	case 109: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2054,6 +2163,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 110 NTSTATUS NtOpenSymbolicLinkObject ['PHANDLE LinkHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes']
 	case 110: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2069,6 +2179,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 111 NTSTATUS NtOpenThread ['PHANDLE ThreadHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes', 'PCLIENT_ID ClientId']
 	case 111: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2086,6 +2197,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 112 NTSTATUS NtOpenThreadToken ['HANDLE ThreadHandle', 'ACCESS_MASK DesiredAccess', 'BOOLEAN OpenAsSelf', 'PHANDLE TokenHandle']
 	case 112: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2103,6 +2215,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 113 NTSTATUS NtOpenTimer ['PHANDLE TimerHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes']
 	case 113: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2118,6 +2231,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 114 NTSTATUS NtPlugPlayControl ['PLUGPLAY_CONTROL_CLASS PnPControlClass', 'PVOID PnPControlData', 'ULONG PnPControlDataLength']
 	case 114: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2133,6 +2247,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 115 NTSTATUS NtPowerInformation ['POWER_INFORMATION_LEVEL InformationLevel', 'PVOID InputBuffer', 'ULONG InputBufferLength', 'PVOID OutputBuffer', 'ULONG OutputBufferLength']
 	case 115: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2152,6 +2267,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 116 NTSTATUS NtPrivilegeCheck ['HANDLE ClientToken', 'PPRIVILEGE_SET RequiredPrivileges', 'PBOOLEAN Result']
 	case 116: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2167,6 +2283,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 117 NTSTATUS NtPrivilegedServiceAuditAlarm ['PUNICODE_STRING SubsystemName', 'PUNICODE_STRING ServiceName', 'HANDLE ClientToken', 'PPRIVILEGE_SET Privileges', 'BOOLEAN AccessGranted']
 	case 117: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2186,6 +2303,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 118 NTSTATUS NtPrivilegeObjectAuditAlarm ['PUNICODE_STRING SubsystemName', 'PVOID HandleId', 'HANDLE ClientToken', 'ACCESS_MASK DesiredAccess', 'PPRIVILEGE_SET Privileges', 'BOOLEAN AccessGranted']
 	case 118: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2207,6 +2325,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 119 NTSTATUS NtProtectVirtualMemory ['HANDLE ProcessHandle', 'PVOID *BaseAddress', 'PSIZE_T RegionSize', 'WIN32_PROTECTION_MASK NewProtectWin32', 'PULONG OldProtect']
 	case 119: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2226,6 +2345,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 120 NTSTATUS NtPulseEvent ['HANDLE EventHandle', 'PLONG PreviousState']
 	case 120: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2239,6 +2359,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 121 NTSTATUS NtQueryInformationAtom ['RTL_ATOM Atom', 'ATOM_INFORMATION_CLASS InformationClass', 'PVOID AtomInformation', 'ULONG AtomInformationLength', 'PULONG ReturnLength']
 	case 121: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2258,6 +2379,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 122 NTSTATUS NtQueryAttributesFile ['POBJECT_ATTRIBUTES ObjectAttributes', 'PFILE_BASIC_INFORMATION FileInformation']
 	case 122: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2271,6 +2393,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 123 NTSTATUS NtQueryDefaultLocale ['BOOLEAN UserProfile', 'PLCID DefaultLocaleId']
 	case 123: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2284,6 +2407,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 124 NTSTATUS NtQueryDefaultUILanguage ['LANGID *DefaultUILanguageId']
 	case 124: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -2295,6 +2419,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 125 NTSTATUS NtQueryDirectoryFile ['HANDLE FileHandle', 'HANDLE Event', 'PIO_APC_ROUTINE ApcRoutine', 'PVOID ApcContext', 'PIO_STATUS_BLOCK IoStatusBlock', 'PVOID FileInformation', 'ULONG Length', 'FILE_INFORMATION_CLASS FileInformationClass', 'BOOLEAN ReturnSingleEntry', 'PUNICODE_STRING FileName', 'BOOLEAN RestartScan']
 	case 125: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2326,6 +2451,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 126 NTSTATUS NtQueryDirectoryObject ['HANDLE DirectoryHandle', 'PVOID Buffer', 'ULONG Length', 'BOOLEAN ReturnSingleEntry', 'BOOLEAN RestartScan', 'PULONG Context', 'PULONG ReturnLength']
 	case 126: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2349,6 +2475,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 127 NTSTATUS NtQueryEaFile ['HANDLE FileHandle', 'PIO_STATUS_BLOCK IoStatusBlock', 'PVOID Buffer', 'ULONG Length', 'BOOLEAN ReturnSingleEntry', 'PVOID EaList', 'ULONG EaListLength', 'PULONG EaIndex', 'BOOLEAN RestartScan']
 	case 127: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2376,6 +2503,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 128 NTSTATUS NtQueryEvent ['HANDLE EventHandle', 'EVENT_INFORMATION_CLASS EventInformationClass', 'PVOID EventInformation', 'ULONG EventInformationLength', 'PULONG ReturnLength']
 	case 128: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2395,6 +2523,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 129 NTSTATUS NtQueryFullAttributesFile ['POBJECT_ATTRIBUTES ObjectAttributes', 'PFILE_NETWORK_OPEN_INFORMATION FileInformation']
 	case 129: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2408,6 +2537,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 130 NTSTATUS NtQueryInformationFile ['HANDLE FileHandle', 'PIO_STATUS_BLOCK IoStatusBlock', 'PVOID FileInformation', 'ULONG Length', 'FILE_INFORMATION_CLASS FileInformationClass']
 	case 130: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2427,6 +2557,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 131 NTSTATUS NtQueryInformationJobObject ['HANDLE JobHandle', 'JOBOBJECTINFOCLASS JobObjectInformationClass', 'PVOID JobObjectInformation', 'ULONG JobObjectInformationLength', 'PULONG ReturnLength']
 	case 131: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2446,6 +2577,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 132 NTSTATUS NtQueryIoCompletion ['HANDLE IoCompletionHandle', 'IO_COMPLETION_INFORMATION_CLASS IoCompletionInformationClass', 'PVOID IoCompletionInformation', 'ULONG IoCompletionInformationLength', 'PULONG ReturnLength']
 	case 132: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2465,6 +2597,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 133 NTSTATUS NtQueryInformationPort ['HANDLE PortHandle', 'PORT_INFORMATION_CLASS PortInformationClass', 'PVOID PortInformation', 'ULONG Length', 'PULONG ReturnLength']
 	case 133: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2484,6 +2617,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 134 NTSTATUS NtQueryInformationProcess ['HANDLE ProcessHandle', 'PROCESSINFOCLASS ProcessInformationClass', 'PVOID ProcessInformation', 'ULONG ProcessInformationLength', 'PULONG ReturnLength']
 	case 134: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2503,6 +2637,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 135 NTSTATUS NtQueryInformationThread ['HANDLE ThreadHandle', 'THREADINFOCLASS ThreadInformationClass', 'PVOID ThreadInformation', 'ULONG ThreadInformationLength', 'PULONG ReturnLength']
 	case 135: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2522,6 +2657,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 136 NTSTATUS NtQueryInformationToken ['HANDLE TokenHandle', 'TOKEN_INFORMATION_CLASS TokenInformationClass', 'PVOID TokenInformation', 'ULONG TokenInformationLength', 'PULONG ReturnLength']
 	case 136: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2541,6 +2677,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 137 NTSTATUS NtQueryInstallUILanguage ['LANGID *InstallUILanguageId']
 	case 137: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -2552,6 +2689,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 138 NTSTATUS NtQueryIntervalProfile ['KPROFILE_SOURCE ProfileSource', 'PULONG Interval']
 	case 138: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2565,6 +2703,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 139 NTSTATUS NtQueryKey ['HANDLE KeyHandle', 'KEY_INFORMATION_CLASS KeyInformationClass', 'PVOID KeyInformation', 'ULONG Length', 'PULONG ResultLength']
 	case 139: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2584,6 +2723,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 140 NTSTATUS NtQueryMultipleValueKey ['HANDLE KeyHandle', 'PKEY_VALUE_ENTRY ValueEntries', 'ULONG EntryCount', 'PVOID ValueBuffer', 'PULONG BufferLength', 'PULONG RequiredBufferLength']
 	case 140: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2605,6 +2745,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 141 NTSTATUS NtQueryMutant ['HANDLE MutantHandle', 'MUTANT_INFORMATION_CLASS MutantInformationClass', 'PVOID MutantInformation', 'ULONG MutantInformationLength', 'PULONG ReturnLength']
 	case 141: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2624,6 +2765,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 142 NTSTATUS NtQueryObject ['HANDLE Handle', 'OBJECT_INFORMATION_CLASS ObjectInformationClass', 'PVOID ObjectInformation', 'ULONG ObjectInformationLength', 'PULONG ReturnLength']
 	case 142: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2643,6 +2785,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 143 NTSTATUS NtQueryOpenSubKeys ['POBJECT_ATTRIBUTES TargetKey', 'PULONG HandleCount']
 	case 143: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2656,6 +2799,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 144 NTSTATUS NtQueryPerformanceCounter ['PLARGE_INTEGER PerformanceCounter', 'PLARGE_INTEGER PerformanceFrequency']
 	case 144: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2669,6 +2813,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 145 NTSTATUS NtQueryQuotaInformationFile ['HANDLE FileHandle', 'PIO_STATUS_BLOCK IoStatusBlock', 'PVOID Buffer', 'ULONG Length', 'BOOLEAN ReturnSingleEntry', 'PVOID SidList', 'ULONG SidListLength', 'PULONG StartSid', 'BOOLEAN RestartScan']
 	case 145: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2696,6 +2841,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 146 NTSTATUS NtQuerySection ['HANDLE SectionHandle', 'SECTION_INFORMATION_CLASS SectionInformationClass', 'PVOID SectionInformation', 'SIZE_T SectionInformationLength', 'PSIZE_T ReturnLength']
 	case 146: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2715,6 +2861,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 147 NTSTATUS NtQuerySecurityObject ['HANDLE Handle', 'SECURITY_INFORMATION SecurityInformation', 'PSECURITY_DESCRIPTOR SecurityDescriptor', 'ULONG Length', 'PULONG LengthNeeded']
 	case 147: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2734,6 +2881,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 148 NTSTATUS NtQuerySemaphore ['HANDLE SemaphoreHandle', 'SEMAPHORE_INFORMATION_CLASS SemaphoreInformationClass', 'PVOID SemaphoreInformation', 'ULONG SemaphoreInformationLength', 'PULONG ReturnLength']
 	case 148: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2753,6 +2901,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 149 NTSTATUS NtQuerySymbolicLinkObject ['HANDLE LinkHandle', 'PUNICODE_STRING LinkTarget', 'PULONG ReturnedLength']
 	case 149: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2768,6 +2917,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 150 NTSTATUS NtQuerySystemEnvironmentValue ['PUNICODE_STRING VariableName', 'PWSTR VariableValue', 'USHORT ValueLength', 'PUSHORT ReturnLength']
 	case 150: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2785,6 +2935,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 151 NTSTATUS NtQuerySystemInformation ['SYSTEM_INFORMATION_CLASS SystemInformationClass', 'PVOID SystemInformation', 'ULONG SystemInformationLength', 'PULONG ReturnLength']
 	case 151: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2802,6 +2953,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 152 NTSTATUS NtQuerySystemTime ['PLARGE_INTEGER SystemTime']
 	case 152: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -2813,6 +2965,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 153 NTSTATUS NtQueryTimer ['HANDLE TimerHandle', 'TIMER_INFORMATION_CLASS TimerInformationClass', 'PVOID TimerInformation', 'ULONG TimerInformationLength', 'PULONG ReturnLength']
 	case 153: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2832,6 +2985,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 154 NTSTATUS NtQueryTimerResolution ['PULONG MaximumTime', 'PULONG MinimumTime', 'PULONG CurrentTime']
 	case 154: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2847,6 +3001,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 155 NTSTATUS NtQueryValueKey ['HANDLE KeyHandle', 'PUNICODE_STRING ValueName', 'KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass', 'PVOID KeyValueInformation', 'ULONG Length', 'PULONG ResultLength']
 	case 155: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2868,6 +3023,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 156 NTSTATUS NtQueryVirtualMemory ['HANDLE ProcessHandle', 'PVOID BaseAddress', 'MEMORY_INFORMATION_CLASS MemoryInformationClass', 'PVOID MemoryInformation', 'SIZE_T MemoryInformationLength', 'PSIZE_T ReturnLength']
 	case 156: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2889,6 +3045,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 157 NTSTATUS NtQueryVolumeInformationFile ['HANDLE FileHandle', 'PIO_STATUS_BLOCK IoStatusBlock', 'PVOID FsInformation', 'ULONG Length', 'FS_INFORMATION_CLASS FsInformationClass']
 	case 157: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2908,6 +3065,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 158 NTSTATUS NtQueueApcThread ['HANDLE ThreadHandle', 'PPS_APC_ROUTINE ApcRoutine', 'PVOID ApcArgument1', 'PVOID ApcArgument2', 'PVOID ApcArgument3']
 	case 158: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2927,6 +3085,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 159 NTSTATUS NtRaiseException ['PEXCEPTION_RECORD ExceptionRecord', 'PCONTEXT ContextRecord', 'BOOLEAN FirstChance']
 	case 159: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2942,6 +3101,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 160 NTSTATUS NtRaiseHardError ['NTSTATUS ErrorStatus', 'ULONG NumberOfParameters', 'ULONG UnicodeStringParameterMask', 'PULONG_PTR Parameters', 'ULONG ValidResponseOptions', 'PULONG Response']
 	case 160: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2963,6 +3123,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 161 NTSTATUS NtReadFile ['HANDLE FileHandle', 'HANDLE Event', 'PIO_APC_ROUTINE ApcRoutine', 'PVOID ApcContext', 'PIO_STATUS_BLOCK IoStatusBlock', 'PVOID Buffer', 'ULONG Length', 'PLARGE_INTEGER ByteOffset', 'PULONG Key']
 	case 161: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2990,6 +3151,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 162 NTSTATUS NtReadFileScatter ['HANDLE FileHandle', 'HANDLE Event', 'PIO_APC_ROUTINE ApcRoutine', 'PVOID ApcContext', 'PIO_STATUS_BLOCK IoStatusBlock', 'PFILE_SEGMENT_ELEMENT SegmentArray', 'ULONG Length', 'PLARGE_INTEGER ByteOffset', 'PULONG Key']
 	case 162: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3017,6 +3179,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 163 NTSTATUS NtReadRequestData ['HANDLE PortHandle', 'PPORT_MESSAGE Message', 'ULONG DataEntryIndex', 'PVOID Buffer', 'SIZE_T BufferSize', 'PSIZE_T NumberOfBytesRead']
 	case 163: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3038,6 +3201,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 164 NTSTATUS NtReadVirtualMemory ['HANDLE ProcessHandle', 'PVOID BaseAddress', 'PVOID Buffer', 'SIZE_T BufferSize', 'PSIZE_T NumberOfBytesRead']
 	case 164: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3057,6 +3221,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 165 NTSTATUS NtRegisterThreadTerminatePort ['HANDLE PortHandle']
 	case 165: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -3068,6 +3233,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 166 NTSTATUS NtReleaseMutant ['HANDLE MutantHandle', 'PLONG PreviousCount']
 	case 166: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3081,6 +3247,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 167 NTSTATUS NtReleaseSemaphore ['HANDLE SemaphoreHandle', 'LONG ReleaseCount', 'PLONG PreviousCount']
 	case 167: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3096,6 +3263,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 168 NTSTATUS NtRemoveIoCompletion ['HANDLE IoCompletionHandle', 'PVOID *KeyContext', 'PVOID *ApcContext', 'PIO_STATUS_BLOCK IoStatusBlock', 'PLARGE_INTEGER Timeout']
 	case 168: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3115,6 +3283,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 169 NTSTATUS NtReplaceKey ['POBJECT_ATTRIBUTES NewFile', 'HANDLE TargetHandle', 'POBJECT_ATTRIBUTES OldFile']
 	case 169: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3130,6 +3299,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 170 NTSTATUS NtReplyPort ['HANDLE PortHandle', 'PPORT_MESSAGE ReplyMessage']
 	case 170: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3143,6 +3313,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 171 NTSTATUS NtReplyWaitReceivePort ['HANDLE PortHandle', 'PVOID *PortContext', 'PPORT_MESSAGE ReplyMessage', 'PPORT_MESSAGE ReceiveMessage']
 	case 171: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3160,6 +3331,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 172 NTSTATUS NtReplyWaitReceivePortEx ['HANDLE PortHandle', 'PVOID *PortContext', 'PPORT_MESSAGE ReplyMessage', 'PPORT_MESSAGE ReceiveMessage', 'PLARGE_INTEGER Timeout']
 	case 172: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3179,6 +3351,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 173 NTSTATUS NtReplyWaitReplyPort ['HANDLE PortHandle', 'PPORT_MESSAGE ReplyMessage']
 	case 173: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3192,6 +3365,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 175 NTSTATUS NtRequestPort ['HANDLE PortHandle', 'PPORT_MESSAGE RequestMessage']
 	case 175: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3205,6 +3379,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 176 NTSTATUS NtRequestWaitReplyPort ['HANDLE PortHandle', 'PPORT_MESSAGE RequestMessage', 'PPORT_MESSAGE ReplyMessage']
 	case 176: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3220,6 +3395,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 178 NTSTATUS NtResetEvent ['HANDLE EventHandle', 'PLONG PreviousState']
 	case 178: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3233,6 +3409,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 179 NTSTATUS NtResetWriteWatch ['HANDLE ProcessHandle', 'PVOID BaseAddress', 'SIZE_T RegionSize']
 	case 179: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3248,6 +3425,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 180 NTSTATUS NtRestoreKey ['HANDLE KeyHandle', 'HANDLE FileHandle', 'ULONG Flags']
 	case 180: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3263,6 +3441,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 181 NTSTATUS NtResumeThread ['HANDLE ThreadHandle', 'PULONG PreviousSuspendCount']
 	case 181: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3276,6 +3455,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 182 NTSTATUS NtSaveKey ['HANDLE KeyHandle', 'HANDLE FileHandle']
 	case 182: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3289,6 +3469,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 183 NTSTATUS NtSaveMergedKeys ['HANDLE HighPrecedenceKeyHandle', 'HANDLE LowPrecedenceKeyHandle', 'HANDLE FileHandle']
 	case 183: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3304,6 +3485,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 184 NTSTATUS NtSecureConnectPort ['PHANDLE PortHandle', 'PUNICODE_STRING PortName', 'PSECURITY_QUALITY_OF_SERVICE SecurityQos', 'PPORT_VIEW ClientView', 'PSID RequiredServerSid', 'PREMOTE_PORT_VIEW ServerView', 'PULONG MaxMessageLength', 'PVOID ConnectionInformation', 'PULONG ConnectionInformationLength']
 	case 184: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3331,6 +3513,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 185 NTSTATUS NtSetIoCompletion ['HANDLE IoCompletionHandle', 'PVOID KeyContext', 'PVOID ApcContext', 'NTSTATUS IoStatus', 'ULONG_PTR IoStatusInformation']
 	case 185: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3350,6 +3533,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 186 NTSTATUS NtSetContextThread ['HANDLE ThreadHandle', 'PCONTEXT ThreadContext']
 	case 186: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3363,6 +3547,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 187 NTSTATUS NtSetDefaultHardErrorPort ['HANDLE DefaultHardErrorPort']
 	case 187: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -3374,6 +3559,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 188 NTSTATUS NtSetDefaultLocale ['BOOLEAN UserProfile', 'LCID DefaultLocaleId']
 	case 188: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3387,6 +3573,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 189 NTSTATUS NtSetDefaultUILanguage ['LANGID DefaultUILanguageId']
 	case 189: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -3398,6 +3585,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 190 NTSTATUS NtSetEaFile ['HANDLE FileHandle', 'PIO_STATUS_BLOCK IoStatusBlock', 'PVOID Buffer', 'ULONG Length']
 	case 190: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3415,6 +3603,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 191 NTSTATUS NtSetEvent ['HANDLE EventHandle', 'PLONG PreviousState']
 	case 191: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3428,6 +3617,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 192 NTSTATUS NtSetHighEventPair ['HANDLE EventPairHandle']
 	case 192: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -3439,6 +3629,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 193 NTSTATUS NtSetHighWaitLowEventPair ['HANDLE EventPairHandle']
 	case 193: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -3450,6 +3641,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 194 NTSTATUS NtSetInformationFile ['HANDLE FileHandle', 'PIO_STATUS_BLOCK IoStatusBlock', 'PVOID FileInformation', 'ULONG Length', 'FILE_INFORMATION_CLASS FileInformationClass']
 	case 194: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3469,6 +3661,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 195 NTSTATUS NtSetInformationJobObject ['HANDLE JobHandle', 'JOBOBJECTINFOCLASS JobObjectInformationClass', 'PVOID JobObjectInformation', 'ULONG JobObjectInformationLength']
 	case 195: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3486,6 +3679,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 196 NTSTATUS NtSetInformationKey ['HANDLE KeyHandle', 'KEY_SET_INFORMATION_CLASS KeySetInformationClass', 'PVOID KeySetInformation', 'ULONG KeySetInformationLength']
 	case 196: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3503,6 +3697,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 197 NTSTATUS NtSetInformationObject ['HANDLE Handle', 'OBJECT_INFORMATION_CLASS ObjectInformationClass', 'PVOID ObjectInformation', 'ULONG ObjectInformationLength']
 	case 197: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3520,6 +3715,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 198 NTSTATUS NtSetInformationProcess ['HANDLE ProcessHandle', 'PROCESSINFOCLASS ProcessInformationClass', 'PVOID ProcessInformation', 'ULONG ProcessInformationLength']
 	case 198: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3537,6 +3733,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 199 NTSTATUS NtSetInformationThread ['HANDLE ThreadHandle', 'THREADINFOCLASS ThreadInformationClass', 'PVOID ThreadInformation', 'ULONG ThreadInformationLength']
 	case 199: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3554,6 +3751,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 200 NTSTATUS NtSetInformationToken ['HANDLE TokenHandle', 'TOKEN_INFORMATION_CLASS TokenInformationClass', 'PVOID TokenInformation', 'ULONG TokenInformationLength']
 	case 200: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3571,6 +3769,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 201 NTSTATUS NtSetIntervalProfile ['ULONG Interval', 'KPROFILE_SOURCE Source']
 	case 201: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3584,6 +3783,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 202 NTSTATUS NtSetLdtEntries ['ULONG Selector0', 'ULONG Entry0Low', 'ULONG Entry0Hi', 'ULONG Selector1', 'ULONG Entry1Low', 'ULONG Entry1Hi']
 	case 202: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3605,6 +3805,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 203 NTSTATUS NtSetLowEventPair ['HANDLE EventPairHandle']
 	case 203: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -3616,6 +3817,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 204 NTSTATUS NtSetLowWaitHighEventPair ['HANDLE EventPairHandle']
 	case 204: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -3627,6 +3829,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 205 NTSTATUS NtSetQuotaInformationFile ['HANDLE FileHandle', 'PIO_STATUS_BLOCK IoStatusBlock', 'PVOID Buffer', 'ULONG Length']
 	case 205: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3644,6 +3847,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 206 NTSTATUS NtSetSecurityObject ['HANDLE Handle', 'SECURITY_INFORMATION SecurityInformation', 'PSECURITY_DESCRIPTOR SecurityDescriptor']
 	case 206: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3659,6 +3863,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 207 NTSTATUS NtSetSystemEnvironmentValue ['PUNICODE_STRING VariableName', 'PUNICODE_STRING VariableValue']
 	case 207: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3672,6 +3877,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 208 NTSTATUS NtSetSystemInformation ['SYSTEM_INFORMATION_CLASS SystemInformationClass', 'PVOID SystemInformation', 'ULONG SystemInformationLength']
 	case 208: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3687,6 +3893,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 209 NTSTATUS NtSetSystemPowerState ['POWER_ACTION SystemAction', 'SYSTEM_POWER_STATE MinSystemState', 'ULONG Flags']
 	case 209: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3702,6 +3909,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 210 NTSTATUS NtSetSystemTime ['PLARGE_INTEGER SystemTime', 'PLARGE_INTEGER PreviousTime']
 	case 210: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3715,6 +3923,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 211 NTSTATUS NtSetThreadExecutionState ['EXECUTION_STATE esFlags', 'PEXECUTION_STATE PreviousFlags']
 	case 211: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3728,6 +3937,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 212 NTSTATUS NtSetTimer ['HANDLE TimerHandle', 'PLARGE_INTEGER DueTime', 'PTIMER_APC_ROUTINE TimerApcRoutine', 'PVOID TimerContext', 'BOOLEAN WakeTimer', 'LONG Period', 'PBOOLEAN PreviousState']
 	case 212: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3751,6 +3961,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 213 NTSTATUS NtSetTimerResolution ['ULONG DesiredTime', 'BOOLEAN SetResolution', 'PULONG ActualTime']
 	case 213: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3766,6 +3977,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 214 NTSTATUS NtSetUuidSeed ['PCHAR Seed']
 	case 214: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -3777,6 +3989,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 215 NTSTATUS NtSetValueKey ['HANDLE KeyHandle', 'PUNICODE_STRING ValueName', 'ULONG TitleIndex', 'ULONG Type', 'PVOID Data', 'ULONG DataSize']
 	case 215: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3798,6 +4011,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 216 NTSTATUS NtSetVolumeInformationFile ['HANDLE FileHandle', 'PIO_STATUS_BLOCK IoStatusBlock', 'PVOID FsInformation', 'ULONG Length', 'FS_INFORMATION_CLASS FsInformationClass']
 	case 216: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3817,6 +4031,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 217 NTSTATUS NtShutdownSystem ['SHUTDOWN_ACTION Action']
 	case 217: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -3828,6 +4043,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 218 NTSTATUS NtSignalAndWaitForSingleObject ['HANDLE SignalHandle', 'HANDLE WaitHandle', 'BOOLEAN Alertable', 'PLARGE_INTEGER Timeout']
 	case 218: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3845,6 +4061,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 219 NTSTATUS NtStartProfile ['HANDLE ProfileHandle']
 	case 219: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -3856,6 +4073,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 220 NTSTATUS NtStopProfile ['HANDLE ProfileHandle']
 	case 220: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -3867,6 +4085,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 221 NTSTATUS NtSuspendThread ['HANDLE ThreadHandle', 'PULONG PreviousSuspendCount']
 	case 221: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3880,6 +4099,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 222 NTSTATUS NtSystemDebugControl ['SYSDBG_COMMAND Command', 'PVOID InputBuffer', 'ULONG InputBufferLength', 'PVOID OutputBuffer', 'ULONG OutputBufferLength', 'PULONG ReturnLength']
 	case 222: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3901,6 +4121,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 223 NTSTATUS NtTerminateJobObject ['HANDLE JobHandle', 'NTSTATUS ExitStatus']
 	case 223: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3914,6 +4135,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 224 NTSTATUS NtTerminateProcess ['HANDLE ProcessHandle', 'NTSTATUS ExitStatus']
 	case 224: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3927,6 +4149,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 225 NTSTATUS NtTerminateThread ['HANDLE ThreadHandle', 'NTSTATUS ExitStatus']
 	case 225: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3940,11 +4163,13 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 226 NTSTATUS NtTestAlert ['']
 	case 226: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_NtTestAlert_enter, cpu, pc);
 	}; break;
 	// 227 NTSTATUS NtUnloadDriver ['PUNICODE_STRING DriverServiceName']
 	case 227: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -3956,6 +4181,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 228 NTSTATUS NtUnloadKey ['POBJECT_ATTRIBUTES TargetKey']
 	case 228: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -3967,6 +4193,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 229 NTSTATUS NtUnlockFile ['HANDLE FileHandle', 'PIO_STATUS_BLOCK IoStatusBlock', 'PLARGE_INTEGER ByteOffset', 'PLARGE_INTEGER Length', 'ULONG Key']
 	case 229: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3986,6 +4213,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 230 NTSTATUS NtUnlockVirtualMemory ['HANDLE ProcessHandle', 'PVOID *BaseAddress', 'PSIZE_T RegionSize', 'ULONG MapType']
 	case 230: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4003,6 +4231,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 231 NTSTATUS NtUnmapViewOfSection ['HANDLE ProcessHandle', 'PVOID BaseAddress']
 	case 231: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -4016,6 +4245,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 232 NTSTATUS NtVdmControl ['VDMSERVICECLASS Service', 'PVOID ServiceData']
 	case 232: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -4029,6 +4259,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 233 NTSTATUS NtWaitForMultipleObjects ['ULONG Count', 'HANDLE Handles[]', 'WAIT_TYPE WaitType', 'BOOLEAN Alertable', 'PLARGE_INTEGER Timeout']
 	case 233: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4048,6 +4279,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 234 NTSTATUS NtWaitForSingleObject ['HANDLE Handle', 'BOOLEAN Alertable', 'PLARGE_INTEGER Timeout']
 	case 234: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4063,6 +4295,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 235 NTSTATUS NtWaitHighEventPair ['HANDLE EventPairHandle']
 	case 235: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -4074,6 +4307,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 236 NTSTATUS NtWaitLowEventPair ['HANDLE EventPairHandle']
 	case 236: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -4085,6 +4319,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 237 NTSTATUS NtWriteFile ['HANDLE FileHandle', 'HANDLE Event', 'PIO_APC_ROUTINE ApcRoutine', 'PVOID ApcContext', 'PIO_STATUS_BLOCK IoStatusBlock', 'PVOID Buffer', 'ULONG Length', 'PLARGE_INTEGER ByteOffset', 'PULONG Key']
 	case 237: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4112,6 +4347,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 238 NTSTATUS NtWriteFileGather ['HANDLE FileHandle', 'HANDLE Event', 'PIO_APC_ROUTINE ApcRoutine', 'PVOID ApcContext', 'PIO_STATUS_BLOCK IoStatusBlock', 'PFILE_SEGMENT_ELEMENT SegmentArray', 'ULONG Length', 'PLARGE_INTEGER ByteOffset', 'PULONG Key']
 	case 238: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4139,6 +4375,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 239 NTSTATUS NtWriteRequestData ['HANDLE PortHandle', 'PPORT_MESSAGE Message', 'ULONG DataEntryIndex', 'PVOID Buffer', 'SIZE_T BufferSize', 'PSIZE_T NumberOfBytesWritten']
 	case 239: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4160,6 +4397,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 240 NTSTATUS NtWriteVirtualMemory ['HANDLE ProcessHandle', 'PVOID BaseAddress', 'PVOID Buffer', 'SIZE_T BufferSize', 'PSIZE_T NumberOfBytesWritten']
 	case 240: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4179,6 +4417,7 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 	// 247 NTSTATUS NtYieldExecution ['']
 	case 247: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_NtYieldExecution_enter, cpu, pc);
 	}; break;
 	default:
diff --git a/panda/plugins/syscalls2/generated/syscall_switch_enter_windows_7_x86.cpp b/panda/plugins/syscalls2/generated/syscall_switch_enter_windows_7_x86.cpp
index 8017d607bc1..792d3734eb2 100644
--- a/panda/plugins/syscalls2/generated/syscall_switch_enter_windows_7_x86.cpp
+++ b/panda/plugins/syscalls2/generated/syscall_switch_enter_windows_7_x86.cpp
@@ -33,6 +33,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	}
 	ctx.asid = panda_current_asid(cpu);
 	ctx.retaddr = calc_retaddr(cpu, pc);
+	ctx.double_return = false;
 	bool panda_noreturn;	// true if PANDA should not track the return of this system call
 	const syscall_info_t *call = NULL;
 	syscall_info_t zero = {0};
@@ -48,6 +49,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 0 NTSTATUS NtAcceptConnectPort ['PHANDLE PortHandle', 'PVOID PortContext', 'PPORT_MESSAGE ConnectionRequest', 'BOOLEAN AcceptConnection', 'PPORT_VIEW ServerView', 'PREMOTE_PORT_VIEW ClientView']
 	case 0: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -69,6 +71,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 1 NTSTATUS NtAccessCheck ['PSECURITY_DESCRIPTOR SecurityDescriptor', 'HANDLE ClientToken', 'ACCESS_MASK DesiredAccess', 'PGENERIC_MAPPING GenericMapping', 'PPRIVILEGE_SET PrivilegeSet', 'PULONG PrivilegeSetLength', 'PACCESS_MASK GrantedAccess', 'PNTSTATUS AccessStatus']
 	case 1: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -94,6 +97,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 2 NTSTATUS NtAccessCheckAndAuditAlarm ['PUNICODE_STRING SubsystemName', 'PVOID HandleId', 'PUNICODE_STRING ObjectTypeName', 'PUNICODE_STRING ObjectName', 'PSECURITY_DESCRIPTOR SecurityDescriptor', 'ACCESS_MASK DesiredAccess', 'PGENERIC_MAPPING GenericMapping', 'BOOLEAN ObjectCreation', 'PACCESS_MASK GrantedAccess', 'PNTSTATUS AccessStatus', 'PBOOLEAN GenerateOnClose']
 	case 2: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -125,6 +129,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 3 NTSTATUS NtAccessCheckByType ['PSECURITY_DESCRIPTOR SecurityDescriptor', 'PSID PrincipalSelfSid', 'HANDLE ClientToken', 'ACCESS_MASK DesiredAccess', 'POBJECT_TYPE_LIST ObjectTypeList', 'ULONG ObjectTypeListLength', 'PGENERIC_MAPPING GenericMapping', 'PPRIVILEGE_SET PrivilegeSet', 'PULONG PrivilegeSetLength', 'PACCESS_MASK GrantedAccess', 'PNTSTATUS AccessStatus']
 	case 3: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -156,6 +161,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 4 NTSTATUS NtAccessCheckByTypeAndAuditAlarm ['PUNICODE_STRING SubsystemName', 'PVOID HandleId', 'PUNICODE_STRING ObjectTypeName', 'PUNICODE_STRING ObjectName', 'PSECURITY_DESCRIPTOR SecurityDescriptor', 'PSID PrincipalSelfSid', 'ACCESS_MASK DesiredAccess', 'AUDIT_EVENT_TYPE AuditType', 'ULONG Flags', 'POBJECT_TYPE_LIST ObjectTypeList', 'ULONG ObjectTypeListLength', 'PGENERIC_MAPPING GenericMapping', 'BOOLEAN ObjectCreation', 'PACCESS_MASK GrantedAccess', 'PNTSTATUS AccessStatus', 'PBOOLEAN GenerateOnClose']
 	case 4: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -197,6 +203,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 5 NTSTATUS NtAccessCheckByTypeResultList ['PSECURITY_DESCRIPTOR SecurityDescriptor', 'PSID PrincipalSelfSid', 'HANDLE ClientToken', 'ACCESS_MASK DesiredAccess', 'POBJECT_TYPE_LIST ObjectTypeList', 'ULONG ObjectTypeListLength', 'PGENERIC_MAPPING GenericMapping', 'PPRIVILEGE_SET PrivilegeSet', 'PULONG PrivilegeSetLength', 'PACCESS_MASK GrantedAccess', 'PNTSTATUS AccessStatus']
 	case 5: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -228,6 +235,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 6 NTSTATUS NtAccessCheckByTypeResultListAndAuditAlarm ['PUNICODE_STRING SubsystemName', 'PVOID HandleId', 'PUNICODE_STRING ObjectTypeName', 'PUNICODE_STRING ObjectName', 'PSECURITY_DESCRIPTOR SecurityDescriptor', 'PSID PrincipalSelfSid', 'ACCESS_MASK DesiredAccess', 'AUDIT_EVENT_TYPE AuditType', 'ULONG Flags', 'POBJECT_TYPE_LIST ObjectTypeList', 'ULONG ObjectTypeListLength', 'PGENERIC_MAPPING GenericMapping', 'BOOLEAN ObjectCreation', 'PACCESS_MASK GrantedAccess', 'PNTSTATUS AccessStatus', 'PBOOLEAN GenerateOnClose']
 	case 6: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -269,6 +277,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 7 NTSTATUS NtAccessCheckByTypeResultListAndAuditAlarmByHandle ['PUNICODE_STRING SubsystemName', 'PVOID HandleId', 'HANDLE ClientToken', 'PUNICODE_STRING ObjectTypeName', 'PUNICODE_STRING ObjectName', 'PSECURITY_DESCRIPTOR SecurityDescriptor', 'PSID PrincipalSelfSid', 'ACCESS_MASK DesiredAccess', 'AUDIT_EVENT_TYPE AuditType', 'ULONG Flags', 'POBJECT_TYPE_LIST ObjectTypeList', 'ULONG ObjectTypeListLength', 'PGENERIC_MAPPING GenericMapping', 'BOOLEAN ObjectCreation', 'PACCESS_MASK GrantedAccess', 'PNTSTATUS AccessStatus', 'PBOOLEAN GenerateOnClose']
 	case 7: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -312,6 +321,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 8 NTSTATUS NtAddAtom ['PWSTR AtomName', 'ULONG Length', 'PRTL_ATOM Atom']
 	case 8: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -327,6 +337,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 9 NTSTATUS NtAddBootEntry ['PBOOT_ENTRY BootEntry', 'PULONG Id']
 	case 9: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -340,6 +351,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 10 NTSTATUS NtAddDriverEntry ['PEFI_DRIVER_ENTRY DriverEntry', 'PULONG Id']
 	case 10: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -353,6 +365,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 11 NTSTATUS NtAdjustGroupsToken ['HANDLE TokenHandle', 'BOOLEAN ResetToDefault', 'PTOKEN_GROUPS NewState', 'ULONG BufferLength', 'PTOKEN_GROUPS PreviousState', 'PULONG ReturnLength']
 	case 11: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -374,6 +387,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 12 NTSTATUS NtAdjustPrivilegesToken ['HANDLE TokenHandle', 'BOOLEAN DisableAllPrivileges', 'PTOKEN_PRIVILEGES NewState', 'ULONG BufferLength', 'PTOKEN_PRIVILEGES PreviousState', 'PULONG ReturnLength']
 	case 12: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -395,6 +409,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 13 NTSTATUS NtAlertResumeThread ['HANDLE ThreadHandle', 'PULONG PreviousSuspendCount']
 	case 13: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -408,6 +423,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 14 NTSTATUS NtAlertThread ['HANDLE ThreadHandle']
 	case 14: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -419,6 +435,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 15 NTSTATUS NtAllocateLocallyUniqueId ['PLUID Luid']
 	case 15: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -430,6 +447,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 16 NTSTATUS NtAllocateReserveObject ['PHANDLE MemoryReserveHandle', 'POBJECT_ATTRIBUTES ObjectAttributes', 'MEMORY_RESERVE_TYPE Type']
 	case 16: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -445,6 +463,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 17 NTSTATUS NtAllocateUserPhysicalPages ['HANDLE ProcessHandle', 'PULONG_PTR NumberOfPages', 'PULONG_PTR UserPfnArray']
 	case 17: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -460,6 +479,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 18 NTSTATUS NtAllocateUuids ['PULARGE_INTEGER Time', 'PULONG Range', 'PULONG Sequence', 'PCHAR Seed']
 	case 18: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -477,6 +497,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 19 NTSTATUS NtAllocateVirtualMemory ['HANDLE ProcessHandle', 'PVOID *BaseAddress', 'ULONG_PTR ZeroBits', 'PSIZE_T RegionSize', 'ULONG AllocationType', 'ULONG Protect']
 	case 19: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -498,6 +519,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 20 NTSTATUS NtAlpcAcceptConnectPort ['PHANDLE PortHandle', 'HANDLE ConnectionPortHandle', 'ULONG Flags', 'POBJECT_ATTRIBUTES ObjectAttributes', 'PALPC_PORT_ATTRIBUTES PortAttributes', 'PVOID PortContext', 'PPORT_MESSAGE ConnectionRequest', 'PALPC_MESSAGE_ATTRIBUTES ConnectionMessageAttributes', 'BOOLEAN AcceptConnection']
 	case 20: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -525,6 +547,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 21 NTSTATUS NtAlpcCancelMessage ['HANDLE PortHandle', 'ULONG Flags', 'PALPC_CONTEXT_ATTR MessageContext']
 	case 21: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -540,6 +563,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 22 NTSTATUS NtAlpcConnectPort ['PHANDLE PortHandle', 'PUNICODE_STRING PortName', 'POBJECT_ATTRIBUTES ObjectAttributes', 'PALPC_PORT_ATTRIBUTES PortAttributes', 'ULONG Flags', 'PSID RequiredServerSid', 'PPORT_MESSAGE ConnectionMessage', 'PULONG BufferLength', 'PALPC_MESSAGE_ATTRIBUTES OutMessageAttributes', 'PALPC_MESSAGE_ATTRIBUTES InMessageAttributes', 'PLARGE_INTEGER Timeout']
 	case 22: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -571,6 +595,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 23 NTSTATUS NtAlpcCreatePort ['PHANDLE PortHandle', 'POBJECT_ATTRIBUTES ObjectAttributes', 'PALPC_PORT_ATTRIBUTES PortAttributes']
 	case 23: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -586,6 +611,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 24 NTSTATUS NtAlpcCreatePortSection ['HANDLE PortHandle', 'ULONG Flags', 'HANDLE SectionHandle', 'SIZE_T SectionSize', 'PALPC_HANDLE AlpcSectionHandle', 'PSIZE_T ActualSectionSize']
 	case 24: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -607,6 +633,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 25 NTSTATUS NtAlpcCreateResourceReserve ['HANDLE PortHandle', 'ULONG Flags', 'SIZE_T MessageSize', 'PALPC_HANDLE ResourceId']
 	case 25: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -624,6 +651,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 26 NTSTATUS NtAlpcCreateSectionView ['HANDLE PortHandle', 'ULONG Flags', 'PALPC_DATA_VIEW_ATTR ViewAttributes']
 	case 26: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -639,6 +667,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 27 NTSTATUS NtAlpcCreateSecurityContext ['HANDLE PortHandle', 'ULONG Flags', 'PALPC_SECURITY_ATTR SecurityAttribute']
 	case 27: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -654,6 +683,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 28 NTSTATUS NtAlpcDeletePortSection ['HANDLE PortHandle', 'ULONG Flags', 'ALPC_HANDLE SectionHandle']
 	case 28: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -669,6 +699,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 29 NTSTATUS NtAlpcDeleteResourceReserve ['HANDLE PortHandle', 'ULONG Flags', 'ALPC_HANDLE ResourceId']
 	case 29: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -684,6 +715,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 30 NTSTATUS NtAlpcDeleteSectionView ['HANDLE PortHandle', 'ULONG Flags', 'PVOID ViewBase']
 	case 30: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -699,6 +731,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 31 NTSTATUS NtAlpcDeleteSecurityContext ['HANDLE PortHandle', 'ULONG Flags', 'ALPC_HANDLE ContextHandle']
 	case 31: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -714,6 +747,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 32 NTSTATUS NtAlpcDisconnectPort ['HANDLE PortHandle', 'ULONG Flags']
 	case 32: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -727,6 +761,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 33 NTSTATUS NtAlpcImpersonateClientOfPort ['HANDLE PortHandle', 'PPORT_MESSAGE PortMessage', 'PVOID Reserved']
 	case 33: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -742,6 +777,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 34 NTSTATUS NtAlpcOpenSenderProcess ['PHANDLE ProcessHandle', 'HANDLE PortHandle', 'PPORT_MESSAGE PortMessage', 'ULONG Flags', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes']
 	case 34: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -763,6 +799,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 35 NTSTATUS NtAlpcOpenSenderThread ['PHANDLE ThreadHandle', 'HANDLE PortHandle', 'PPORT_MESSAGE PortMessage', 'ULONG Flags', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes']
 	case 35: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -784,6 +821,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 36 NTSTATUS NtAlpcQueryInformation ['HANDLE PortHandle', 'ALPC_PORT_INFORMATION_CLASS PortInformationClass', 'PVOID PortInformation', 'ULONG Length', 'PULONG ReturnLength']
 	case 36: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -803,6 +841,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 37 NTSTATUS NtAlpcQueryInformationMessage ['HANDLE PortHandle', 'PPORT_MESSAGE PortMessage', 'ALPC_MESSAGE_INFORMATION_CLASS MessageInformationClass', 'PVOID MessageInformation', 'ULONG Length', 'PULONG ReturnLength']
 	case 37: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -824,6 +863,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 38 NTSTATUS NtAlpcRevokeSecurityContext ['HANDLE PortHandle', 'ULONG Flags', 'ALPC_HANDLE ContextHandle']
 	case 38: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -839,6 +879,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 39 NTSTATUS NtAlpcSendWaitReceivePort ['HANDLE PortHandle', 'ULONG Flags', 'PPORT_MESSAGE SendMessage', 'PALPC_MESSAGE_ATTRIBUTES SendMessageAttributes', 'PPORT_MESSAGE ReceiveMessage', 'PULONG BufferLength', 'PALPC_MESSAGE_ATTRIBUTES ReceiveMessageAttributes', 'PLARGE_INTEGER Timeout']
 	case 39: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -864,6 +905,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 40 NTSTATUS NtAlpcSetInformation ['HANDLE PortHandle', 'ALPC_PORT_INFORMATION_CLASS PortInformationClass', 'PVOID PortInformation', 'ULONG Length']
 	case 40: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -881,6 +923,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 41 NTSTATUS NtApphelpCacheControl ['APPHELPCOMMAND type', 'PVOID buf']
 	case 41: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -894,6 +937,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 42 NTSTATUS NtAreMappedFilesTheSame ['PVOID File1MappedAsAnImage', 'PVOID File2MappedAsFile']
 	case 42: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -907,6 +951,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 43 NTSTATUS NtAssignProcessToJobObject ['HANDLE JobHandle', 'HANDLE ProcessHandle']
 	case 43: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -920,6 +965,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 44 NTSTATUS NtCallbackReturn ['PVOID OutputBuffer', 'ULONG OutputLength', 'NTSTATUS Status']
 	case 44: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -935,6 +981,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 45 NTSTATUS NtCancelIoFile ['HANDLE FileHandle', 'PIO_STATUS_BLOCK IoStatusBlock']
 	case 45: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -948,6 +995,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 46 NTSTATUS NtCancelIoFileEx ['HANDLE FileHandle', 'PIO_STATUS_BLOCK IoRequestToCancel', 'PIO_STATUS_BLOCK IoStatusBlock']
 	case 46: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -963,6 +1011,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 47 NTSTATUS NtCancelSynchronousIoFile ['HANDLE ThreadHandle', 'PIO_STATUS_BLOCK IoRequestToCancel', 'PIO_STATUS_BLOCK IoStatusBlock']
 	case 47: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -978,6 +1027,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 48 NTSTATUS NtCancelTimer ['HANDLE TimerHandle', 'PBOOLEAN CurrentState']
 	case 48: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -991,6 +1041,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 49 NTSTATUS NtClearEvent ['HANDLE EventHandle']
 	case 49: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1002,6 +1053,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 50 NTSTATUS NtClose ['HANDLE Handle']
 	case 50: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1013,6 +1065,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 51 NTSTATUS NtCloseObjectAuditAlarm ['PUNICODE_STRING SubsystemName', 'PVOID HandleId', 'BOOLEAN GenerateOnClose']
 	case 51: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1028,6 +1081,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 52 NTSTATUS NtCommitComplete ['HANDLE EnlistmentHandle', 'PLARGE_INTEGER TmVirtualClock']
 	case 52: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1041,6 +1095,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 53 NTSTATUS NtCommitEnlistment ['HANDLE EnlistmentHandle', 'PLARGE_INTEGER TmVirtualClock']
 	case 53: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1054,6 +1109,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 54 NTSTATUS NtCommitTransaction ['HANDLE TransactionHandle', 'BOOLEAN Wait']
 	case 54: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1067,6 +1123,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 55 NTSTATUS NtCompactKeys ['ULONG Count', 'HANDLE KeyArray[]']
 	case 55: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1080,6 +1137,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 56 NTSTATUS NtCompareTokens ['HANDLE FirstTokenHandle', 'HANDLE SecondTokenHandle', 'PBOOLEAN Equal']
 	case 56: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1095,6 +1153,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 57 NTSTATUS NtCompleteConnectPort ['HANDLE PortHandle']
 	case 57: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1106,6 +1165,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 58 NTSTATUS NtCompressKey ['HANDLE Key']
 	case 58: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1117,6 +1177,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 59 NTSTATUS NtConnectPort ['PHANDLE PortHandle', 'PUNICODE_STRING PortName', 'PSECURITY_QUALITY_OF_SERVICE SecurityQos', 'PPORT_VIEW ClientView', 'PREMOTE_PORT_VIEW ServerView', 'PULONG MaxMessageLength', 'PVOID ConnectionInformation', 'PULONG ConnectionInformationLength']
 	case 59: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1142,6 +1203,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 60 NTSTATUS NtContinue ['PCONTEXT ContextRecord', 'BOOLEAN TestAlert']
 	case 60: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1155,6 +1217,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 61 NTSTATUS NtCreateDebugObject ['PHANDLE DebugObjectHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes', 'ULONG Flags']
 	case 61: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1172,6 +1235,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 62 NTSTATUS NtCreateDirectoryObject ['PHANDLE DirectoryHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes']
 	case 62: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1187,6 +1251,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 63 NTSTATUS NtCreateEnlistment ['PHANDLE EnlistmentHandle', 'ACCESS_MASK DesiredAccess', 'HANDLE ResourceManagerHandle', 'HANDLE TransactionHandle', 'POBJECT_ATTRIBUTES ObjectAttributes', 'ULONG CreateOptions', 'NOTIFICATION_MASK NotificationMask', 'PVOID EnlistmentKey']
 	case 63: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1212,6 +1277,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 64 NTSTATUS NtCreateEvent ['PHANDLE EventHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes', 'EVENT_TYPE EventType', 'BOOLEAN InitialState']
 	case 64: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1231,6 +1297,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 65 NTSTATUS NtCreateEventPair ['PHANDLE EventPairHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes']
 	case 65: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1246,6 +1313,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 66 NTSTATUS NtCreateFile ['PHANDLE FileHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes', 'PIO_STATUS_BLOCK IoStatusBlock', 'PLARGE_INTEGER AllocationSize', 'ULONG FileAttributes', 'ULONG ShareAccess', 'ULONG CreateDisposition', 'ULONG CreateOptions', 'PVOID EaBuffer', 'ULONG EaLength']
 	case 66: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1277,6 +1345,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 67 NTSTATUS NtCreateIoCompletion ['PHANDLE IoCompletionHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes', 'ULONG Count']
 	case 67: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1294,6 +1363,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 68 NTSTATUS NtCreateJobObject ['PHANDLE JobHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes']
 	case 68: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1309,6 +1379,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 69 NTSTATUS NtCreateJobSet ['ULONG NumJob', 'PJOB_SET_ARRAY UserJobSet', 'ULONG Flags']
 	case 69: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1324,6 +1395,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 70 NTSTATUS NtCreateKey ['PHANDLE KeyHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes', 'ULONG TitleIndex', 'PUNICODE_STRING Class', 'ULONG CreateOptions', 'PULONG Disposition']
 	case 70: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1347,6 +1419,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 71 NTSTATUS NtCreateKeyedEvent ['PHANDLE KeyedEventHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes', 'ULONG Flags']
 	case 71: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1364,6 +1437,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 72 NTSTATUS NtCreateKeyTransacted ['PHANDLE KeyHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes', 'ULONG TitleIndex', 'PUNICODE_STRING Class', 'ULONG CreateOptions', 'HANDLE TransactionHandle', 'PULONG Disposition']
 	case 72: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1389,6 +1463,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 73 NTSTATUS NtCreateMailslotFile ['PHANDLE FileHandle', 'ULONG DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes', 'PIO_STATUS_BLOCK IoStatusBlock', 'ULONG CreateOptions', 'ULONG MailslotQuota', 'ULONG MaximumMessageSize', 'PLARGE_INTEGER ReadTimeout']
 	case 73: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1414,6 +1489,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 74 NTSTATUS NtCreateMutant ['PHANDLE MutantHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes', 'BOOLEAN InitialOwner']
 	case 74: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1431,6 +1507,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 75 NTSTATUS NtCreateNamedPipeFile ['PHANDLE FileHandle', 'ULONG DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes', 'PIO_STATUS_BLOCK IoStatusBlock', 'ULONG ShareAccess', 'ULONG CreateDisposition', 'ULONG CreateOptions', 'ULONG NamedPipeType', 'ULONG ReadMode', 'ULONG CompletionMode', 'ULONG MaximumInstances', 'ULONG InboundQuota', 'ULONG OutboundQuota', 'PLARGE_INTEGER DefaultTimeout']
 	case 75: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1468,6 +1545,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 76 NTSTATUS NtCreatePagingFile ['PUNICODE_STRING PageFileName', 'PLARGE_INTEGER MinimumSize', 'PLARGE_INTEGER MaximumSize', 'ULONG Priority']
 	case 76: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1485,6 +1563,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 77 NTSTATUS NtCreatePort ['PHANDLE PortHandle', 'POBJECT_ATTRIBUTES ObjectAttributes', 'ULONG MaxConnectionInfoLength', 'ULONG MaxMessageLength', 'ULONG MaxPoolUsage']
 	case 77: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1504,6 +1583,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 78 NTSTATUS NtCreatePrivateNamespace ['PHANDLE NamespaceHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes', 'PVOID BoundaryDescriptor']
 	case 78: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1521,6 +1601,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 79 NTSTATUS NtCreateProcess ['PHANDLE ProcessHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes', 'HANDLE ParentProcess', 'BOOLEAN InheritObjectTable', 'HANDLE SectionHandle', 'HANDLE DebugPort', 'HANDLE ExceptionPort']
 	case 79: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1546,6 +1627,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 80 NTSTATUS NtCreateProcessEx ['PHANDLE ProcessHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes', 'HANDLE ParentProcess', 'ULONG Flags', 'HANDLE SectionHandle', 'HANDLE DebugPort', 'HANDLE ExceptionPort', 'ULONG JobMemberLevel']
 	case 80: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1573,6 +1655,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 81 NTSTATUS NtCreateProfile ['PHANDLE ProfileHandle', 'HANDLE Process', 'PVOID RangeBase', 'SIZE_T RangeSize', 'ULONG BucketSize', 'PULONG Buffer', 'ULONG BufferSize', 'KPROFILE_SOURCE ProfileSource', 'KAFFINITY Affinity']
 	case 81: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1600,6 +1683,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 82 NTSTATUS NtCreateProfileEx ['PHANDLE ProfileHandle', 'HANDLE Process', 'PVOID ProfileBase', 'SIZE_T ProfileSize', 'ULONG BucketSize', 'PULONG Buffer', 'ULONG BufferSize', 'KPROFILE_SOURCE ProfileSource', 'ULONG GroupAffinityCount', 'PGROUP_AFFINITY GroupAffinity']
 	case 82: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1629,6 +1713,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 83 NTSTATUS NtCreateResourceManager ['PHANDLE ResourceManagerHandle', 'ACCESS_MASK DesiredAccess', 'HANDLE TmHandle', 'LPGUID RmGuid', 'POBJECT_ATTRIBUTES ObjectAttributes', 'ULONG CreateOptions', 'PUNICODE_STRING Description']
 	case 83: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1652,6 +1737,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 84 NTSTATUS NtCreateSection ['PHANDLE SectionHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes', 'PLARGE_INTEGER MaximumSize', 'ULONG SectionPageProtection', 'ULONG AllocationAttributes', 'HANDLE FileHandle']
 	case 84: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1675,6 +1761,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 85 NTSTATUS NtCreateSemaphore ['PHANDLE SemaphoreHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes', 'LONG InitialCount', 'LONG MaximumCount']
 	case 85: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1694,6 +1781,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 86 NTSTATUS NtCreateSymbolicLinkObject ['PHANDLE LinkHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes', 'PUNICODE_STRING LinkTarget']
 	case 86: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1711,6 +1799,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 87 NTSTATUS NtCreateThread ['PHANDLE ThreadHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes', 'HANDLE ProcessHandle', 'PCLIENT_ID ClientId', 'PCONTEXT ThreadContext', 'PINITIAL_TEB InitialTeb', 'BOOLEAN CreateSuspended']
 	case 87: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1736,6 +1825,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 88 NTSTATUS NtCreateThreadEx ['PHANDLE ThreadHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes', 'HANDLE ProcessHandle', 'PVOID StartRoutine', 'PVOID Argument', 'ULONG CreateFlags', 'ULONG_PTR ZeroBits', 'SIZE_T StackSize', 'SIZE_T MaximumStackSize', 'PPS_ATTRIBUTE_LIST AttributeList']
 	case 88: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1767,6 +1857,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 89 NTSTATUS NtCreateTimer ['PHANDLE TimerHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes', 'TIMER_TYPE TimerType']
 	case 89: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1784,6 +1875,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 90 NTSTATUS NtCreateToken ['PHANDLE TokenHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes', 'TOKEN_TYPE TokenType', 'PLUID AuthenticationId', 'PLARGE_INTEGER ExpirationTime', 'PTOKEN_USER User', 'PTOKEN_GROUPS Groups', 'PTOKEN_PRIVILEGES Privileges', 'PTOKEN_OWNER Owner', 'PTOKEN_PRIMARY_GROUP PrimaryGroup', 'PTOKEN_DEFAULT_DACL DefaultDacl', 'PTOKEN_SOURCE TokenSource']
 	case 90: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1819,6 +1911,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 91 NTSTATUS NtCreateTransaction ['PHANDLE TransactionHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes', 'LPGUID Uow', 'HANDLE TmHandle', 'ULONG CreateOptions', 'ULONG IsolationLevel', 'ULONG IsolationFlags', 'PLARGE_INTEGER Timeout', 'PUNICODE_STRING Description']
 	case 91: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1848,6 +1941,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 92 NTSTATUS NtCreateTransactionManager ['PHANDLE TmHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes', 'PUNICODE_STRING LogFileName', 'ULONG CreateOptions', 'ULONG CommitStrength']
 	case 92: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1869,6 +1963,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 93 NTSTATUS NtCreateUserProcess ['PHANDLE ProcessHandle', 'PHANDLE ThreadHandle', 'ACCESS_MASK ProcessDesiredAccess', 'ACCESS_MASK ThreadDesiredAccess', 'POBJECT_ATTRIBUTES ProcessObjectAttributes', 'POBJECT_ATTRIBUTES ThreadObjectAttributes', 'ULONG ProcessFlags', 'ULONG ThreadFlags', 'PRTL_USER_PROCESS_PARAMETERS ProcessParameters', 'PPROCESS_CREATE_INFO CreateInfo', 'PPROCESS_ATTRIBUTE_LIST AttributeList']
 	case 93: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1900,6 +1995,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 94 NTSTATUS NtCreateWaitablePort ['PHANDLE PortHandle', 'POBJECT_ATTRIBUTES ObjectAttributes', 'ULONG MaxConnectionInfoLength', 'ULONG MaxMessageLength', 'ULONG MaxPoolUsage']
 	case 94: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1919,6 +2015,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 95 NTSTATUS NtCreateWorkerFactory ['PHANDLE WorkerFactoryHandleReturn', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes', 'HANDLE CompletionPortHandle', 'HANDLE WorkerProcessHandle', 'PVOID StartRoutine', 'PVOID StartParameter', 'ULONG MaxThreadCount', 'SIZE_T StackReserve', 'SIZE_T StackCommit']
 	case 95: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1948,6 +2045,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 96 NTSTATUS NtDebugActiveProcess ['HANDLE ProcessHandle', 'HANDLE DebugObjectHandle']
 	case 96: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1961,6 +2059,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 97 NTSTATUS NtDebugContinue ['HANDLE DebugObjectHandle', 'PCLIENT_ID ClientId', 'NTSTATUS ContinueStatus']
 	case 97: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1976,6 +2075,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 98 NTSTATUS NtDelayExecution ['BOOLEAN Alertable', 'PLARGE_INTEGER DelayInterval']
 	case 98: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1989,6 +2089,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 99 NTSTATUS NtDeleteAtom ['RTL_ATOM Atom']
 	case 99: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -2000,6 +2101,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 100 NTSTATUS NtDeleteBootEntry ['ULONG Id']
 	case 100: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -2011,6 +2113,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 101 NTSTATUS NtDeleteDriverEntry ['ULONG Id']
 	case 101: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -2022,6 +2125,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 102 NTSTATUS NtDeleteFile ['POBJECT_ATTRIBUTES ObjectAttributes']
 	case 102: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -2033,6 +2137,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 103 NTSTATUS NtDeleteKey ['HANDLE KeyHandle']
 	case 103: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -2044,6 +2149,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 104 NTSTATUS NtDeleteObjectAuditAlarm ['PUNICODE_STRING SubsystemName', 'PVOID HandleId', 'BOOLEAN GenerateOnClose']
 	case 104: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2059,6 +2165,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 105 NTSTATUS NtDeletePrivateNamespace ['HANDLE NamespaceHandle']
 	case 105: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -2070,6 +2177,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 106 NTSTATUS NtDeleteValueKey ['HANDLE KeyHandle', 'PUNICODE_STRING ValueName']
 	case 106: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2083,6 +2191,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 107 NTSTATUS NtDeviceIoControlFile ['HANDLE FileHandle', 'HANDLE Event', 'PIO_APC_ROUTINE ApcRoutine', 'PVOID ApcContext', 'PIO_STATUS_BLOCK IoStatusBlock', 'ULONG IoControlCode', 'PVOID InputBuffer', 'ULONG InputBufferLength', 'PVOID OutputBuffer', 'ULONG OutputBufferLength']
 	case 107: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2112,11 +2221,13 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 108 NTSTATUS NtDisableLastKnownGood ['']
 	case 108: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_NtDisableLastKnownGood_enter, cpu, pc);
 	}; break;
 	// 109 NTSTATUS NtDisplayString ['PUNICODE_STRING String']
 	case 109: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -2128,6 +2239,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 110 NTSTATUS NtDrawText ['PUNICODE_STRING Text']
 	case 110: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -2139,6 +2251,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 111 NTSTATUS NtDuplicateObject ['HANDLE SourceProcessHandle', 'HANDLE SourceHandle', 'HANDLE TargetProcessHandle', 'PHANDLE TargetHandle', 'ACCESS_MASK DesiredAccess', 'ULONG HandleAttributes', 'ULONG Options']
 	case 111: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2162,6 +2275,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 112 NTSTATUS NtDuplicateToken ['HANDLE ExistingTokenHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes', 'BOOLEAN EffectiveOnly', 'TOKEN_TYPE TokenType', 'PHANDLE NewTokenHandle']
 	case 112: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2183,11 +2297,13 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 113 NTSTATUS NtEnableLastKnownGood ['']
 	case 113: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_NtEnableLastKnownGood_enter, cpu, pc);
 	}; break;
 	// 114 NTSTATUS NtEnumerateBootEntries ['PVOID Buffer', 'PULONG BufferLength']
 	case 114: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2201,6 +2317,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 115 NTSTATUS NtEnumerateDriverEntries ['PVOID Buffer', 'PULONG BufferLength']
 	case 115: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2214,6 +2331,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 116 NTSTATUS NtEnumerateKey ['HANDLE KeyHandle', 'ULONG Index', 'KEY_INFORMATION_CLASS KeyInformationClass', 'PVOID KeyInformation', 'ULONG Length', 'PULONG ResultLength']
 	case 116: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2235,6 +2353,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 117 NTSTATUS NtEnumerateSystemEnvironmentValuesEx ['ULONG InformationClass', 'PVOID Buffer', 'PULONG BufferLength']
 	case 117: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2250,6 +2369,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 118 NTSTATUS NtEnumerateTransactionObject ['HANDLE RootObjectHandle', 'KTMOBJECT_TYPE QueryType', 'PKTMOBJECT_CURSOR ObjectCursor', 'ULONG ObjectCursorLength', 'PULONG ReturnLength']
 	case 118: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2269,6 +2389,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 119 NTSTATUS NtEnumerateValueKey ['HANDLE KeyHandle', 'ULONG Index', 'KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass', 'PVOID KeyValueInformation', 'ULONG Length', 'PULONG ResultLength']
 	case 119: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2290,6 +2411,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 120 NTSTATUS NtExtendSection ['HANDLE SectionHandle', 'PLARGE_INTEGER NewSectionSize']
 	case 120: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2303,6 +2425,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 121 NTSTATUS NtFilterToken ['HANDLE ExistingTokenHandle', 'ULONG Flags', 'PTOKEN_GROUPS SidsToDisable', 'PTOKEN_PRIVILEGES PrivilegesToDelete', 'PTOKEN_GROUPS RestrictedSids', 'PHANDLE NewTokenHandle']
 	case 121: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2324,6 +2447,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 122 NTSTATUS NtFindAtom ['PWSTR AtomName', 'ULONG Length', 'PRTL_ATOM Atom']
 	case 122: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2339,6 +2463,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 123 NTSTATUS NtFlushBuffersFile ['HANDLE FileHandle', 'PIO_STATUS_BLOCK IoStatusBlock']
 	case 123: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2352,6 +2477,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 124 NTSTATUS NtFlushInstallUILanguage ['LANGID InstallUILanguage', 'ULONG SetComittedFlag']
 	case 124: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2365,6 +2491,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 125 NTSTATUS NtFlushInstructionCache ['HANDLE ProcessHandle', 'PVOID BaseAddress', 'SIZE_T Length']
 	case 125: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2380,6 +2507,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 126 NTSTATUS NtFlushKey ['HANDLE KeyHandle']
 	case 126: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -2391,11 +2519,13 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 127 VOID NtFlushProcessWriteBuffers ['']
 	case 127: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_NtFlushProcessWriteBuffers_enter, cpu, pc);
 	}; break;
 	// 128 NTSTATUS NtFlushVirtualMemory ['HANDLE ProcessHandle', 'PVOID *BaseAddress', 'PSIZE_T RegionSize', 'PIO_STATUS_BLOCK IoStatus']
 	case 128: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2413,11 +2543,13 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 129 NTSTATUS NtFlushWriteBuffer ['']
 	case 129: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_NtFlushWriteBuffer_enter, cpu, pc);
 	}; break;
 	// 130 NTSTATUS NtFreeUserPhysicalPages ['HANDLE ProcessHandle', 'PULONG_PTR NumberOfPages', 'PULONG_PTR UserPfnArray']
 	case 130: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2433,6 +2565,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 131 NTSTATUS NtFreeVirtualMemory ['HANDLE ProcessHandle', 'PVOID *BaseAddress', 'PSIZE_T RegionSize', 'ULONG FreeType']
 	case 131: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2450,6 +2583,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 132 NTSTATUS NtFreezeRegistry ['ULONG TimeOutInSeconds']
 	case 132: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -2461,6 +2595,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 133 NTSTATUS NtFreezeTransactions ['PLARGE_INTEGER FreezeTimeout', 'PLARGE_INTEGER ThawTimeout']
 	case 133: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2474,6 +2609,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 134 NTSTATUS NtFsControlFile ['HANDLE FileHandle', 'HANDLE Event', 'PIO_APC_ROUTINE ApcRoutine', 'PVOID ApcContext', 'PIO_STATUS_BLOCK IoStatusBlock', 'ULONG IoControlCode', 'PVOID InputBuffer', 'ULONG InputBufferLength', 'PVOID OutputBuffer', 'ULONG OutputBufferLength']
 	case 134: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2503,6 +2639,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 135 NTSTATUS NtGetContextThread ['HANDLE ThreadHandle', 'PCONTEXT ThreadContext']
 	case 135: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2516,11 +2653,13 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 136 ULONG NtGetCurrentProcessorNumber ['']
 	case 136: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_NtGetCurrentProcessorNumber_enter, cpu, pc);
 	}; break;
 	// 137 NTSTATUS NtGetDevicePowerState ['HANDLE Device', 'DEVICE_POWER_STATE *State']
 	case 137: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2534,6 +2673,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 138 NTSTATUS NtGetMUIRegistryInfo ['ULONG Flags', 'PULONG DataSize', 'PVOID Data']
 	case 138: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2549,6 +2689,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 139 NTSTATUS NtGetNextProcess ['HANDLE ProcessHandle', 'ACCESS_MASK DesiredAccess', 'ULONG HandleAttributes', 'ULONG Flags', 'PHANDLE NewProcessHandle']
 	case 139: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2568,6 +2709,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 140 NTSTATUS NtGetNextThread ['HANDLE ProcessHandle', 'HANDLE ThreadHandle', 'ACCESS_MASK DesiredAccess', 'ULONG HandleAttributes', 'ULONG Flags', 'PHANDLE NewThreadHandle']
 	case 140: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2589,6 +2731,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 141 NTSTATUS NtGetNlsSectionPtr ['ULONG SectionType', 'ULONG SectionData', 'PVOID ContextData', 'PVOID *SectionPointer', 'PULONG SectionSize']
 	case 141: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2608,6 +2751,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 142 NTSTATUS NtGetNotificationResourceManager ['HANDLE ResourceManagerHandle', 'PTRANSACTION_NOTIFICATION TransactionNotification', 'ULONG NotificationLength', 'PLARGE_INTEGER Timeout', 'PULONG ReturnLength', 'ULONG Asynchronous', 'ULONG_PTR AsynchronousContext']
 	case 142: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2631,6 +2775,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 143 NTSTATUS NtGetPlugPlayEvent ['HANDLE EventHandle', 'PVOID Context', 'PPLUGPLAY_EVENT_BLOCK EventBlock', 'ULONG EventBufferSize']
 	case 143: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2648,6 +2793,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 144 NTSTATUS NtGetWriteWatch ['HANDLE ProcessHandle', 'ULONG Flags', 'PVOID BaseAddress', 'SIZE_T RegionSize', 'PVOID *UserAddressArray', 'PULONG_PTR EntriesInUserAddressArray', 'PULONG Granularity']
 	case 144: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2671,6 +2817,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 145 NTSTATUS NtImpersonateAnonymousToken ['HANDLE ThreadHandle']
 	case 145: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -2682,6 +2829,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 146 NTSTATUS NtImpersonateClientOfPort ['HANDLE PortHandle', 'PPORT_MESSAGE Message']
 	case 146: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2695,6 +2843,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 147 NTSTATUS NtImpersonateThread ['HANDLE ServerThreadHandle', 'HANDLE ClientThreadHandle', 'PSECURITY_QUALITY_OF_SERVICE SecurityQos']
 	case 147: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2710,6 +2859,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 148 NTSTATUS NtInitializeNlsFiles ['PVOID *BaseAddress', 'PLCID DefaultLocaleId', 'PLARGE_INTEGER DefaultCasingTableSize']
 	case 148: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2725,6 +2875,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 149 NTSTATUS NtInitializeRegistry ['USHORT BootCondition']
 	case 149: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -2736,6 +2887,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 150 NTSTATUS NtInitiatePowerAction ['POWER_ACTION SystemAction', 'SYSTEM_POWER_STATE MinSystemState', 'ULONG Flags', 'BOOLEAN Asynchronous']
 	case 150: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2753,6 +2905,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 151 NTSTATUS NtIsProcessInJob ['HANDLE ProcessHandle', 'HANDLE JobHandle']
 	case 151: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2766,16 +2919,19 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 152 BOOLEAN NtIsSystemResumeAutomatic ['']
 	case 152: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_NtIsSystemResumeAutomatic_enter, cpu, pc);
 	}; break;
 	// 153 NTSTATUS NtIsUILanguageComitted ['']
 	case 153: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_NtIsUILanguageComitted_enter, cpu, pc);
 	}; break;
 	// 154 NTSTATUS NtListenPort ['HANDLE PortHandle', 'PPORT_MESSAGE ConnectionRequest']
 	case 154: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2789,6 +2945,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 155 NTSTATUS NtLoadDriver ['PUNICODE_STRING DriverServiceName']
 	case 155: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -2800,6 +2957,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 156 NTSTATUS NtLoadKey ['POBJECT_ATTRIBUTES TargetKey', 'POBJECT_ATTRIBUTES SourceFile']
 	case 156: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2813,6 +2971,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 157 NTSTATUS NtLoadKey2 ['POBJECT_ATTRIBUTES TargetKey', 'POBJECT_ATTRIBUTES SourceFile', 'ULONG Flags']
 	case 157: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2828,6 +2987,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 158 NTSTATUS NtLoadKeyEx ['POBJECT_ATTRIBUTES TargetKey', 'POBJECT_ATTRIBUTES SourceFile', 'ULONG Flags', 'HANDLE TrustClassKey']
 	case 158: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2845,6 +3005,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 159 NTSTATUS NtLockFile ['HANDLE FileHandle', 'HANDLE Event', 'PIO_APC_ROUTINE ApcRoutine', 'PVOID ApcContext', 'PIO_STATUS_BLOCK IoStatusBlock', 'PLARGE_INTEGER ByteOffset', 'PLARGE_INTEGER Length', 'ULONG Key', 'BOOLEAN FailImmediately', 'BOOLEAN ExclusiveLock']
 	case 159: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2874,6 +3035,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 160 NTSTATUS NtLockProductActivationKeys ['ULONG *pPrivateVer', 'ULONG *pSafeMode']
 	case 160: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2887,6 +3049,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 161 NTSTATUS NtLockRegistryKey ['HANDLE KeyHandle']
 	case 161: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -2898,6 +3061,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 162 NTSTATUS NtLockVirtualMemory ['HANDLE ProcessHandle', 'PVOID *BaseAddress', 'PSIZE_T RegionSize', 'ULONG MapType']
 	case 162: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2915,6 +3079,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 163 NTSTATUS NtMakePermanentObject ['HANDLE Handle']
 	case 163: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -2926,6 +3091,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 164 NTSTATUS NtMakeTemporaryObject ['HANDLE Handle']
 	case 164: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -2937,6 +3103,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 165 NTSTATUS NtMapCMFModule ['ULONG What', 'ULONG Index', 'PULONG CacheIndexOut', 'PULONG CacheFlagsOut', 'PULONG ViewSizeOut', 'PVOID *BaseAddress']
 	case 165: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2958,6 +3125,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 166 NTSTATUS NtMapUserPhysicalPages ['PVOID VirtualAddress', 'ULONG_PTR NumberOfPages', 'PULONG_PTR UserPfnArray']
 	case 166: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2973,6 +3141,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 167 NTSTATUS NtMapUserPhysicalPagesScatter ['PVOID *VirtualAddresses', 'ULONG_PTR NumberOfPages', 'PULONG_PTR UserPfnArray']
 	case 167: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2988,6 +3157,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 168 NTSTATUS NtMapViewOfSection ['HANDLE SectionHandle', 'HANDLE ProcessHandle', 'PVOID *BaseAddress', 'ULONG_PTR ZeroBits', 'SIZE_T CommitSize', 'PLARGE_INTEGER SectionOffset', 'PSIZE_T ViewSize', 'SECTION_INHERIT InheritDisposition', 'ULONG AllocationType', 'WIN32_PROTECTION_MASK Win32Protect']
 	case 168: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3017,6 +3187,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 169 NTSTATUS NtModifyBootEntry ['PBOOT_ENTRY BootEntry']
 	case 169: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -3028,6 +3199,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 170 NTSTATUS NtModifyDriverEntry ['PEFI_DRIVER_ENTRY DriverEntry']
 	case 170: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -3039,6 +3211,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 171 NTSTATUS NtNotifyChangeDirectoryFile ['HANDLE FileHandle', 'HANDLE Event', 'PIO_APC_ROUTINE ApcRoutine', 'PVOID ApcContext', 'PIO_STATUS_BLOCK IoStatusBlock', 'PVOID Buffer', 'ULONG Length', 'ULONG CompletionFilter', 'BOOLEAN WatchTree']
 	case 171: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3066,6 +3239,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 172 NTSTATUS NtNotifyChangeKey ['HANDLE KeyHandle', 'HANDLE Event', 'PIO_APC_ROUTINE ApcRoutine', 'PVOID ApcContext', 'PIO_STATUS_BLOCK IoStatusBlock', 'ULONG CompletionFilter', 'BOOLEAN WatchTree', 'PVOID Buffer', 'ULONG BufferSize', 'BOOLEAN Asynchronous']
 	case 172: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3095,6 +3269,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 173 NTSTATUS NtNotifyChangeMultipleKeys ['HANDLE MasterKeyHandle', 'ULONG Count', 'OBJECT_ATTRIBUTES SlaveObjects[]', 'HANDLE Event', 'PIO_APC_ROUTINE ApcRoutine', 'PVOID ApcContext', 'PIO_STATUS_BLOCK IoStatusBlock', 'ULONG CompletionFilter', 'BOOLEAN WatchTree', 'PVOID Buffer', 'ULONG BufferSize', 'BOOLEAN Asynchronous']
 	case 173: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3128,6 +3303,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 174 NTSTATUS NtNotifyChangeSession ['HANDLE Session', 'ULONG IoStateSequence', 'PVOID Reserved', 'ULONG Action', 'IO_SESSION_STATE IoState', 'IO_SESSION_STATE IoState2', 'PVOID Buffer', 'ULONG BufferSize']
 	case 174: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3153,6 +3329,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 175 NTSTATUS NtOpenDirectoryObject ['PHANDLE DirectoryHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes']
 	case 175: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3168,6 +3345,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 176 NTSTATUS NtOpenEnlistment ['PHANDLE EnlistmentHandle', 'ACCESS_MASK DesiredAccess', 'HANDLE ResourceManagerHandle', 'LPGUID EnlistmentGuid', 'POBJECT_ATTRIBUTES ObjectAttributes']
 	case 176: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3187,6 +3365,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 177 NTSTATUS NtOpenEvent ['PHANDLE EventHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes']
 	case 177: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3202,6 +3381,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 178 NTSTATUS NtOpenEventPair ['PHANDLE EventPairHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes']
 	case 178: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3217,6 +3397,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 179 NTSTATUS NtOpenFile ['PHANDLE FileHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes', 'PIO_STATUS_BLOCK IoStatusBlock', 'ULONG ShareAccess', 'ULONG OpenOptions']
 	case 179: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3238,6 +3419,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 180 NTSTATUS NtOpenIoCompletion ['PHANDLE IoCompletionHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes']
 	case 180: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3253,6 +3435,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 181 NTSTATUS NtOpenJobObject ['PHANDLE JobHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes']
 	case 181: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3268,6 +3451,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 182 NTSTATUS NtOpenKey ['PHANDLE KeyHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes']
 	case 182: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3283,6 +3467,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 183 NTSTATUS NtOpenKeyEx ['PHANDLE KeyHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes', 'ULONG OpenOptions']
 	case 183: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3300,6 +3485,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 184 NTSTATUS NtOpenKeyedEvent ['PHANDLE KeyedEventHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes']
 	case 184: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3315,6 +3501,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 185 NTSTATUS NtOpenKeyTransacted ['PHANDLE KeyHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes', 'HANDLE TransactionHandle']
 	case 185: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3332,6 +3519,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 186 NTSTATUS NtOpenKeyTransactedEx ['PHANDLE KeyHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes', 'ULONG OpenOptions', 'HANDLE TransactionHandle']
 	case 186: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3351,6 +3539,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 187 NTSTATUS NtOpenMutant ['PHANDLE MutantHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes']
 	case 187: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3366,6 +3555,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 188 NTSTATUS NtOpenObjectAuditAlarm ['PUNICODE_STRING SubsystemName', 'PVOID HandleId', 'PUNICODE_STRING ObjectTypeName', 'PUNICODE_STRING ObjectName', 'PSECURITY_DESCRIPTOR SecurityDescriptor', 'HANDLE ClientToken', 'ACCESS_MASK DesiredAccess', 'ACCESS_MASK GrantedAccess', 'PPRIVILEGE_SET Privileges', 'BOOLEAN ObjectCreation', 'BOOLEAN AccessGranted', 'PBOOLEAN GenerateOnClose']
 	case 188: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3399,6 +3589,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 189 NTSTATUS NtOpenPrivateNamespace ['PHANDLE NamespaceHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes', 'PVOID BoundaryDescriptor']
 	case 189: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3416,6 +3607,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 190 NTSTATUS NtOpenProcess ['PHANDLE ProcessHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes', 'PCLIENT_ID ClientId']
 	case 190: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3433,6 +3625,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 191 NTSTATUS NtOpenProcessToken ['HANDLE ProcessHandle', 'ACCESS_MASK DesiredAccess', 'PHANDLE TokenHandle']
 	case 191: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3448,6 +3641,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 192 NTSTATUS NtOpenProcessTokenEx ['HANDLE ProcessHandle', 'ACCESS_MASK DesiredAccess', 'ULONG HandleAttributes', 'PHANDLE TokenHandle']
 	case 192: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3465,6 +3659,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 193 NTSTATUS NtOpenResourceManager ['PHANDLE ResourceManagerHandle', 'ACCESS_MASK DesiredAccess', 'HANDLE TmHandle', 'LPGUID ResourceManagerGuid', 'POBJECT_ATTRIBUTES ObjectAttributes']
 	case 193: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3484,6 +3679,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 194 NTSTATUS NtOpenSection ['PHANDLE SectionHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes']
 	case 194: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3499,6 +3695,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 195 NTSTATUS NtOpenSemaphore ['PHANDLE SemaphoreHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes']
 	case 195: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3514,6 +3711,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 196 NTSTATUS NtOpenSession ['PHANDLE SessionHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes']
 	case 196: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3529,6 +3727,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 197 NTSTATUS NtOpenSymbolicLinkObject ['PHANDLE LinkHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes']
 	case 197: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3544,6 +3743,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 198 NTSTATUS NtOpenThread ['PHANDLE ThreadHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes', 'PCLIENT_ID ClientId']
 	case 198: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3561,6 +3761,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 199 NTSTATUS NtOpenThreadToken ['HANDLE ThreadHandle', 'ACCESS_MASK DesiredAccess', 'BOOLEAN OpenAsSelf', 'PHANDLE TokenHandle']
 	case 199: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3578,6 +3779,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 200 NTSTATUS NtOpenThreadTokenEx ['HANDLE ThreadHandle', 'ACCESS_MASK DesiredAccess', 'BOOLEAN OpenAsSelf', 'ULONG HandleAttributes', 'PHANDLE TokenHandle']
 	case 200: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3597,6 +3799,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 201 NTSTATUS NtOpenTimer ['PHANDLE TimerHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes']
 	case 201: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3612,6 +3815,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 202 NTSTATUS NtOpenTransaction ['PHANDLE TransactionHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes', 'LPGUID Uow', 'HANDLE TmHandle']
 	case 202: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3631,6 +3835,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 203 NTSTATUS NtOpenTransactionManager ['PHANDLE TmHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes', 'PUNICODE_STRING LogFileName', 'LPGUID TmIdentity', 'ULONG OpenOptions']
 	case 203: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3652,6 +3857,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 204 NTSTATUS NtPlugPlayControl ['PLUGPLAY_CONTROL_CLASS PnPControlClass', 'PVOID PnPControlData', 'ULONG PnPControlDataLength']
 	case 204: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3667,6 +3873,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 205 NTSTATUS NtPowerInformation ['POWER_INFORMATION_LEVEL InformationLevel', 'PVOID InputBuffer', 'ULONG InputBufferLength', 'PVOID OutputBuffer', 'ULONG OutputBufferLength']
 	case 205: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3686,6 +3893,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 206 NTSTATUS NtPrepareComplete ['HANDLE EnlistmentHandle', 'PLARGE_INTEGER TmVirtualClock']
 	case 206: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3699,6 +3907,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 207 NTSTATUS NtPrepareEnlistment ['HANDLE EnlistmentHandle', 'PLARGE_INTEGER TmVirtualClock']
 	case 207: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3712,6 +3921,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 208 NTSTATUS NtPrePrepareComplete ['HANDLE EnlistmentHandle', 'PLARGE_INTEGER TmVirtualClock']
 	case 208: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3725,6 +3935,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 209 NTSTATUS NtPrePrepareEnlistment ['HANDLE EnlistmentHandle', 'PLARGE_INTEGER TmVirtualClock']
 	case 209: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3738,6 +3949,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 210 NTSTATUS NtPrivilegeCheck ['HANDLE ClientToken', 'PPRIVILEGE_SET RequiredPrivileges', 'PBOOLEAN Result']
 	case 210: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3753,6 +3965,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 211 NTSTATUS NtPrivilegedServiceAuditAlarm ['PUNICODE_STRING SubsystemName', 'PUNICODE_STRING ServiceName', 'HANDLE ClientToken', 'PPRIVILEGE_SET Privileges', 'BOOLEAN AccessGranted']
 	case 211: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3772,6 +3985,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 212 NTSTATUS NtPrivilegeObjectAuditAlarm ['PUNICODE_STRING SubsystemName', 'PVOID HandleId', 'HANDLE ClientToken', 'ACCESS_MASK DesiredAccess', 'PPRIVILEGE_SET Privileges', 'BOOLEAN AccessGranted']
 	case 212: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3793,6 +4007,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 213 NTSTATUS NtPropagationComplete ['HANDLE ResourceManagerHandle', 'ULONG RequestCookie', 'ULONG BufferLength', 'PVOID Buffer']
 	case 213: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3810,6 +4025,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 214 NTSTATUS NtPropagationFailed ['HANDLE ResourceManagerHandle', 'ULONG RequestCookie', 'NTSTATUS PropStatus']
 	case 214: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3825,6 +4041,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 215 NTSTATUS NtProtectVirtualMemory ['HANDLE ProcessHandle', 'PVOID *BaseAddress', 'PSIZE_T RegionSize', 'WIN32_PROTECTION_MASK NewProtectWin32', 'PULONG OldProtect']
 	case 215: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3844,6 +4061,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 216 NTSTATUS NtPulseEvent ['HANDLE EventHandle', 'PLONG PreviousState']
 	case 216: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3857,6 +4075,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 217 NTSTATUS NtQueryAttributesFile ['POBJECT_ATTRIBUTES ObjectAttributes', 'PFILE_BASIC_INFORMATION FileInformation']
 	case 217: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3870,6 +4089,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 218 NTSTATUS NtQueryBootEntryOrder ['PULONG Ids', 'PULONG Count']
 	case 218: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3883,6 +4103,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 219 NTSTATUS NtQueryBootOptions ['PBOOT_OPTIONS BootOptions', 'PULONG BootOptionsLength']
 	case 219: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3896,6 +4117,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 220 NTSTATUS NtQueryDebugFilterState ['ULONG ComponentId', 'ULONG Level']
 	case 220: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3909,6 +4131,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 221 NTSTATUS NtQueryDefaultLocale ['BOOLEAN UserProfile', 'PLCID DefaultLocaleId']
 	case 221: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3922,6 +4145,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 222 NTSTATUS NtQueryDefaultUILanguage ['LANGID *DefaultUILanguageId']
 	case 222: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -3933,6 +4157,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 223 NTSTATUS NtQueryDirectoryFile ['HANDLE FileHandle', 'HANDLE Event', 'PIO_APC_ROUTINE ApcRoutine', 'PVOID ApcContext', 'PIO_STATUS_BLOCK IoStatusBlock', 'PVOID FileInformation', 'ULONG Length', 'FILE_INFORMATION_CLASS FileInformationClass', 'BOOLEAN ReturnSingleEntry', 'PUNICODE_STRING FileName', 'BOOLEAN RestartScan']
 	case 223: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3964,6 +4189,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 224 NTSTATUS NtQueryDirectoryObject ['HANDLE DirectoryHandle', 'PVOID Buffer', 'ULONG Length', 'BOOLEAN ReturnSingleEntry', 'BOOLEAN RestartScan', 'PULONG Context', 'PULONG ReturnLength']
 	case 224: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3987,6 +4213,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 225 NTSTATUS NtQueryDriverEntryOrder ['PULONG Ids', 'PULONG Count']
 	case 225: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -4000,6 +4227,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 226 NTSTATUS NtQueryEaFile ['HANDLE FileHandle', 'PIO_STATUS_BLOCK IoStatusBlock', 'PVOID Buffer', 'ULONG Length', 'BOOLEAN ReturnSingleEntry', 'PVOID EaList', 'ULONG EaListLength', 'PULONG EaIndex', 'BOOLEAN RestartScan']
 	case 226: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4027,6 +4255,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 227 NTSTATUS NtQueryEvent ['HANDLE EventHandle', 'EVENT_INFORMATION_CLASS EventInformationClass', 'PVOID EventInformation', 'ULONG EventInformationLength', 'PULONG ReturnLength']
 	case 227: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4046,6 +4275,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 228 NTSTATUS NtQueryFullAttributesFile ['POBJECT_ATTRIBUTES ObjectAttributes', 'PFILE_NETWORK_OPEN_INFORMATION FileInformation']
 	case 228: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -4059,6 +4289,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 229 NTSTATUS NtQueryInformationAtom ['RTL_ATOM Atom', 'ATOM_INFORMATION_CLASS InformationClass', 'PVOID AtomInformation', 'ULONG AtomInformationLength', 'PULONG ReturnLength']
 	case 229: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4078,6 +4309,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 230 NTSTATUS NtQueryInformationEnlistment ['HANDLE EnlistmentHandle', 'ENLISTMENT_INFORMATION_CLASS EnlistmentInformationClass', 'PVOID EnlistmentInformation', 'ULONG EnlistmentInformationLength', 'PULONG ReturnLength']
 	case 230: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4097,6 +4329,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 231 NTSTATUS NtQueryInformationFile ['HANDLE FileHandle', 'PIO_STATUS_BLOCK IoStatusBlock', 'PVOID FileInformation', 'ULONG Length', 'FILE_INFORMATION_CLASS FileInformationClass']
 	case 231: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4116,6 +4349,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 232 NTSTATUS NtQueryInformationJobObject ['HANDLE JobHandle', 'JOBOBJECTINFOCLASS JobObjectInformationClass', 'PVOID JobObjectInformation', 'ULONG JobObjectInformationLength', 'PULONG ReturnLength']
 	case 232: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4135,6 +4369,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 233 NTSTATUS NtQueryInformationPort ['HANDLE PortHandle', 'PORT_INFORMATION_CLASS PortInformationClass', 'PVOID PortInformation', 'ULONG Length', 'PULONG ReturnLength']
 	case 233: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4154,6 +4389,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 234 NTSTATUS NtQueryInformationProcess ['HANDLE ProcessHandle', 'PROCESSINFOCLASS ProcessInformationClass', 'PVOID ProcessInformation', 'ULONG ProcessInformationLength', 'PULONG ReturnLength']
 	case 234: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4173,6 +4409,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 235 NTSTATUS NtQueryInformationResourceManager ['HANDLE ResourceManagerHandle', 'RESOURCEMANAGER_INFORMATION_CLASS ResourceManagerInformationClass', 'PVOID ResourceManagerInformation', 'ULONG ResourceManagerInformationLength', 'PULONG ReturnLength']
 	case 235: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4192,6 +4429,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 236 NTSTATUS NtQueryInformationThread ['HANDLE ThreadHandle', 'THREADINFOCLASS ThreadInformationClass', 'PVOID ThreadInformation', 'ULONG ThreadInformationLength', 'PULONG ReturnLength']
 	case 236: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4211,6 +4449,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 237 NTSTATUS NtQueryInformationToken ['HANDLE TokenHandle', 'TOKEN_INFORMATION_CLASS TokenInformationClass', 'PVOID TokenInformation', 'ULONG TokenInformationLength', 'PULONG ReturnLength']
 	case 237: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4230,6 +4469,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 238 NTSTATUS NtQueryInformationTransaction ['HANDLE TransactionHandle', 'TRANSACTION_INFORMATION_CLASS TransactionInformationClass', 'PVOID TransactionInformation', 'ULONG TransactionInformationLength', 'PULONG ReturnLength']
 	case 238: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4249,6 +4489,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 239 NTSTATUS NtQueryInformationTransactionManager ['HANDLE TransactionManagerHandle', 'TRANSACTIONMANAGER_INFORMATION_CLASS TransactionManagerInformationClass', 'PVOID TransactionManagerInformation', 'ULONG TransactionManagerInformationLength', 'PULONG ReturnLength']
 	case 239: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4268,6 +4509,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 240 NTSTATUS NtQueryInformationWorkerFactory ['HANDLE WorkerFactoryHandle', 'WORKERFACTORYINFOCLASS WorkerFactoryInformationClass', 'PVOID WorkerFactoryInformation', 'ULONG WorkerFactoryInformationLength', 'PULONG ReturnLength']
 	case 240: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4287,6 +4529,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 241 NTSTATUS NtQueryInstallUILanguage ['LANGID *InstallUILanguageId']
 	case 241: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -4298,6 +4541,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 242 NTSTATUS NtQueryIntervalProfile ['KPROFILE_SOURCE ProfileSource', 'PULONG Interval']
 	case 242: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -4311,6 +4555,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 243 NTSTATUS NtQueryIoCompletion ['HANDLE IoCompletionHandle', 'IO_COMPLETION_INFORMATION_CLASS IoCompletionInformationClass', 'PVOID IoCompletionInformation', 'ULONG IoCompletionInformationLength', 'PULONG ReturnLength']
 	case 243: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4330,6 +4575,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 244 NTSTATUS NtQueryKey ['HANDLE KeyHandle', 'KEY_INFORMATION_CLASS KeyInformationClass', 'PVOID KeyInformation', 'ULONG Length', 'PULONG ResultLength']
 	case 244: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4349,6 +4595,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 245 NTSTATUS NtQueryLicenseValue ['PUNICODE_STRING Name', 'PULONG Type', 'PVOID Buffer', 'ULONG Length', 'PULONG ReturnedLength']
 	case 245: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4368,6 +4615,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 246 NTSTATUS NtQueryMultipleValueKey ['HANDLE KeyHandle', 'PKEY_VALUE_ENTRY ValueEntries', 'ULONG EntryCount', 'PVOID ValueBuffer', 'PULONG BufferLength', 'PULONG RequiredBufferLength']
 	case 246: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4389,6 +4637,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 247 NTSTATUS NtQueryMutant ['HANDLE MutantHandle', 'MUTANT_INFORMATION_CLASS MutantInformationClass', 'PVOID MutantInformation', 'ULONG MutantInformationLength', 'PULONG ReturnLength']
 	case 247: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4408,6 +4657,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 248 NTSTATUS NtQueryObject ['HANDLE Handle', 'OBJECT_INFORMATION_CLASS ObjectInformationClass', 'PVOID ObjectInformation', 'ULONG ObjectInformationLength', 'PULONG ReturnLength']
 	case 248: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4427,6 +4677,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 249 NTSTATUS NtQueryOpenSubKeys ['POBJECT_ATTRIBUTES TargetKey', 'PULONG HandleCount']
 	case 249: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -4440,6 +4691,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 250 NTSTATUS NtQueryOpenSubKeysEx ['POBJECT_ATTRIBUTES TargetKey', 'ULONG BufferLength', 'PVOID Buffer', 'PULONG RequiredSize']
 	case 250: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4457,6 +4709,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 251 NTSTATUS NtQueryPerformanceCounter ['PLARGE_INTEGER PerformanceCounter', 'PLARGE_INTEGER PerformanceFrequency']
 	case 251: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -4470,11 +4723,13 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 252 NTSTATUS NtQueryPortInformationProcess ['']
 	case 252: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_NtQueryPortInformationProcess_enter, cpu, pc);
 	}; break;
 	// 253 NTSTATUS NtQueryQuotaInformationFile ['HANDLE FileHandle', 'PIO_STATUS_BLOCK IoStatusBlock', 'PVOID Buffer', 'ULONG Length', 'BOOLEAN ReturnSingleEntry', 'PVOID SidList', 'ULONG SidListLength', 'PULONG StartSid', 'BOOLEAN RestartScan']
 	case 253: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4502,6 +4757,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 254 NTSTATUS NtQuerySection ['HANDLE SectionHandle', 'SECTION_INFORMATION_CLASS SectionInformationClass', 'PVOID SectionInformation', 'SIZE_T SectionInformationLength', 'PSIZE_T ReturnLength']
 	case 254: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4521,6 +4777,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 255 NTSTATUS NtQuerySecurityAttributesToken ['HANDLE TokenHandle', 'PUNICODE_STRING Attributes', 'ULONG NumberOfAttributes', 'PVOID Buffer', 'ULONG Length', 'PULONG ReturnLength']
 	case 255: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4542,6 +4799,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 256 NTSTATUS NtQuerySecurityObject ['HANDLE Handle', 'SECURITY_INFORMATION SecurityInformation', 'PSECURITY_DESCRIPTOR SecurityDescriptor', 'ULONG Length', 'PULONG LengthNeeded']
 	case 256: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4561,6 +4819,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 257 NTSTATUS NtQuerySemaphore ['HANDLE SemaphoreHandle', 'SEMAPHORE_INFORMATION_CLASS SemaphoreInformationClass', 'PVOID SemaphoreInformation', 'ULONG SemaphoreInformationLength', 'PULONG ReturnLength']
 	case 257: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4580,6 +4839,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 258 NTSTATUS NtQuerySymbolicLinkObject ['HANDLE LinkHandle', 'PUNICODE_STRING LinkTarget', 'PULONG ReturnedLength']
 	case 258: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4595,6 +4855,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 259 NTSTATUS NtQuerySystemEnvironmentValue ['PUNICODE_STRING VariableName', 'PWSTR VariableValue', 'USHORT ValueLength', 'PUSHORT ReturnLength']
 	case 259: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4612,6 +4873,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 260 NTSTATUS NtQuerySystemEnvironmentValueEx ['PUNICODE_STRING VariableName', 'LPGUID VendorGuid', 'PVOID Value', 'PULONG ValueLength', 'PULONG Attributes']
 	case 260: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4631,6 +4893,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 261 NTSTATUS NtQuerySystemInformation ['SYSTEM_INFORMATION_CLASS SystemInformationClass', 'PVOID SystemInformation', 'ULONG SystemInformationLength', 'PULONG ReturnLength']
 	case 261: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4648,6 +4911,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 262 NTSTATUS NtQuerySystemInformationEx ['SYSTEM_INFORMATION_CLASS SystemInformationClass', 'PVOID QueryInformation', 'ULONG QueryInformationLength', 'PVOID SystemInformation', 'ULONG SystemInformationLength', 'PULONG ReturnLength']
 	case 262: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4669,6 +4933,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 263 NTSTATUS NtQuerySystemTime ['PLARGE_INTEGER SystemTime']
 	case 263: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -4680,6 +4945,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 264 NTSTATUS NtQueryTimer ['HANDLE TimerHandle', 'TIMER_INFORMATION_CLASS TimerInformationClass', 'PVOID TimerInformation', 'ULONG TimerInformationLength', 'PULONG ReturnLength']
 	case 264: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4699,6 +4965,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 265 NTSTATUS NtQueryTimerResolution ['PULONG MaximumTime', 'PULONG MinimumTime', 'PULONG CurrentTime']
 	case 265: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4714,6 +4981,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 266 NTSTATUS NtQueryValueKey ['HANDLE KeyHandle', 'PUNICODE_STRING ValueName', 'KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass', 'PVOID KeyValueInformation', 'ULONG Length', 'PULONG ResultLength']
 	case 266: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4735,6 +5003,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 267 NTSTATUS NtQueryVirtualMemory ['HANDLE ProcessHandle', 'PVOID BaseAddress', 'MEMORY_INFORMATION_CLASS MemoryInformationClass', 'PVOID MemoryInformation', 'SIZE_T MemoryInformationLength', 'PSIZE_T ReturnLength']
 	case 267: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4756,6 +5025,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 268 NTSTATUS NtQueryVolumeInformationFile ['HANDLE FileHandle', 'PIO_STATUS_BLOCK IoStatusBlock', 'PVOID FsInformation', 'ULONG Length', 'FS_INFORMATION_CLASS FsInformationClass']
 	case 268: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4775,6 +5045,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 269 NTSTATUS NtQueueApcThread ['HANDLE ThreadHandle', 'PPS_APC_ROUTINE ApcRoutine', 'PVOID ApcArgument1', 'PVOID ApcArgument2', 'PVOID ApcArgument3']
 	case 269: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4794,6 +5065,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 270 NTSTATUS NtQueueApcThreadEx ['HANDLE ThreadHandle', 'HANDLE UserApcReserveHandle', 'PPS_APC_ROUTINE ApcRoutine', 'PVOID ApcArgument1', 'PVOID ApcArgument2', 'PVOID ApcArgument3']
 	case 270: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4815,6 +5087,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 271 NTSTATUS NtRaiseException ['PEXCEPTION_RECORD ExceptionRecord', 'PCONTEXT ContextRecord', 'BOOLEAN FirstChance']
 	case 271: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4830,6 +5103,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 272 NTSTATUS NtRaiseHardError ['NTSTATUS ErrorStatus', 'ULONG NumberOfParameters', 'ULONG UnicodeStringParameterMask', 'PULONG_PTR Parameters', 'ULONG ValidResponseOptions', 'PULONG Response']
 	case 272: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4851,6 +5125,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 273 NTSTATUS NtReadFile ['HANDLE FileHandle', 'HANDLE Event', 'PIO_APC_ROUTINE ApcRoutine', 'PVOID ApcContext', 'PIO_STATUS_BLOCK IoStatusBlock', 'PVOID Buffer', 'ULONG Length', 'PLARGE_INTEGER ByteOffset', 'PULONG Key']
 	case 273: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4878,6 +5153,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 274 NTSTATUS NtReadFileScatter ['HANDLE FileHandle', 'HANDLE Event', 'PIO_APC_ROUTINE ApcRoutine', 'PVOID ApcContext', 'PIO_STATUS_BLOCK IoStatusBlock', 'PFILE_SEGMENT_ELEMENT SegmentArray', 'ULONG Length', 'PLARGE_INTEGER ByteOffset', 'PULONG Key']
 	case 274: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4905,6 +5181,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 275 NTSTATUS NtReadOnlyEnlistment ['HANDLE EnlistmentHandle', 'PLARGE_INTEGER TmVirtualClock']
 	case 275: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -4918,6 +5195,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 276 NTSTATUS NtReadRequestData ['HANDLE PortHandle', 'PPORT_MESSAGE Message', 'ULONG DataEntryIndex', 'PVOID Buffer', 'SIZE_T BufferSize', 'PSIZE_T NumberOfBytesRead']
 	case 276: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4939,6 +5217,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 277 NTSTATUS NtReadVirtualMemory ['HANDLE ProcessHandle', 'PVOID BaseAddress', 'PVOID Buffer', 'SIZE_T BufferSize', 'PSIZE_T NumberOfBytesRead']
 	case 277: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4958,6 +5237,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 278 NTSTATUS NtRecoverEnlistment ['HANDLE EnlistmentHandle', 'PVOID EnlistmentKey']
 	case 278: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -4971,6 +5251,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 279 NTSTATUS NtRecoverResourceManager ['HANDLE ResourceManagerHandle']
 	case 279: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -4982,6 +5263,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 280 NTSTATUS NtRecoverTransactionManager ['HANDLE TransactionManagerHandle']
 	case 280: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -4993,6 +5275,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 281 NTSTATUS NtRegisterProtocolAddressInformation ['HANDLE ResourceManager', 'PCRM_PROTOCOL_ID ProtocolId', 'ULONG ProtocolInformationSize', 'PVOID ProtocolInformation', 'ULONG CreateOptions']
 	case 281: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -5012,6 +5295,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 282 NTSTATUS NtRegisterThreadTerminatePort ['HANDLE PortHandle']
 	case 282: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -5023,6 +5307,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 283 NTSTATUS NtReleaseKeyedEvent ['HANDLE KeyedEventHandle', 'PVOID KeyValue', 'BOOLEAN Alertable', 'PLARGE_INTEGER Timeout']
 	case 283: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -5040,6 +5325,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 284 NTSTATUS NtReleaseMutant ['HANDLE MutantHandle', 'PLONG PreviousCount']
 	case 284: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -5053,6 +5339,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 285 NTSTATUS NtReleaseSemaphore ['HANDLE SemaphoreHandle', 'LONG ReleaseCount', 'PLONG PreviousCount']
 	case 285: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -5068,6 +5355,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 286 NTSTATUS NtReleaseWorkerFactoryWorker ['HANDLE WorkerFactoryHandle']
 	case 286: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -5079,6 +5367,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 287 NTSTATUS NtRemoveIoCompletion ['HANDLE IoCompletionHandle', 'PVOID *KeyContext', 'PVOID *ApcContext', 'PIO_STATUS_BLOCK IoStatusBlock', 'PLARGE_INTEGER Timeout']
 	case 287: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -5098,6 +5387,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 288 NTSTATUS NtRemoveIoCompletionEx ['HANDLE IoCompletionHandle', 'PFILE_IO_COMPLETION_INFORMATION IoCompletionInformation', 'ULONG Count', 'PULONG NumEntriesRemoved', 'PLARGE_INTEGER Timeout', 'BOOLEAN Alertable']
 	case 288: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -5119,6 +5409,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 289 NTSTATUS NtRemoveProcessDebug ['HANDLE ProcessHandle', 'HANDLE DebugObjectHandle']
 	case 289: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -5132,6 +5423,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 290 NTSTATUS NtRenameKey ['HANDLE KeyHandle', 'PUNICODE_STRING NewName']
 	case 290: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -5145,6 +5437,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 291 NTSTATUS NtRenameTransactionManager ['PUNICODE_STRING LogFileName', 'LPGUID ExistingTransactionManagerGuid']
 	case 291: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -5158,6 +5451,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 292 NTSTATUS NtReplaceKey ['POBJECT_ATTRIBUTES NewFile', 'HANDLE TargetHandle', 'POBJECT_ATTRIBUTES OldFile']
 	case 292: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -5173,6 +5467,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 293 NTSTATUS NtReplacePartitionUnit ['PUNICODE_STRING TargetInstancePath', 'PUNICODE_STRING SpareInstancePath', 'ULONG Flags']
 	case 293: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -5188,6 +5483,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 294 NTSTATUS NtReplyPort ['HANDLE PortHandle', 'PPORT_MESSAGE ReplyMessage']
 	case 294: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -5201,6 +5497,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 295 NTSTATUS NtReplyWaitReceivePort ['HANDLE PortHandle', 'PVOID *PortContext', 'PPORT_MESSAGE ReplyMessage', 'PPORT_MESSAGE ReceiveMessage']
 	case 295: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -5218,6 +5515,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 296 NTSTATUS NtReplyWaitReceivePortEx ['HANDLE PortHandle', 'PVOID *PortContext', 'PPORT_MESSAGE ReplyMessage', 'PPORT_MESSAGE ReceiveMessage', 'PLARGE_INTEGER Timeout']
 	case 296: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -5237,6 +5535,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 297 NTSTATUS NtReplyWaitReplyPort ['HANDLE PortHandle', 'PPORT_MESSAGE ReplyMessage']
 	case 297: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -5250,6 +5549,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 298 NTSTATUS NtRequestPort ['HANDLE PortHandle', 'PPORT_MESSAGE RequestMessage']
 	case 298: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -5263,6 +5563,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 299 NTSTATUS NtRequestWaitReplyPort ['HANDLE PortHandle', 'PPORT_MESSAGE RequestMessage', 'PPORT_MESSAGE ReplyMessage']
 	case 299: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -5278,6 +5579,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 300 NTSTATUS NtResetEvent ['HANDLE EventHandle', 'PLONG PreviousState']
 	case 300: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -5291,6 +5593,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 301 NTSTATUS NtResetWriteWatch ['HANDLE ProcessHandle', 'PVOID BaseAddress', 'SIZE_T RegionSize']
 	case 301: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -5306,6 +5609,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 302 NTSTATUS NtRestoreKey ['HANDLE KeyHandle', 'HANDLE FileHandle', 'ULONG Flags']
 	case 302: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -5321,6 +5625,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 303 NTSTATUS NtResumeProcess ['HANDLE ProcessHandle']
 	case 303: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -5332,6 +5637,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 304 NTSTATUS NtResumeThread ['HANDLE ThreadHandle', 'PULONG PreviousSuspendCount']
 	case 304: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -5345,6 +5651,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 305 NTSTATUS NtRollbackComplete ['HANDLE EnlistmentHandle', 'PLARGE_INTEGER TmVirtualClock']
 	case 305: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -5358,6 +5665,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 306 NTSTATUS NtRollbackEnlistment ['HANDLE EnlistmentHandle', 'PLARGE_INTEGER TmVirtualClock']
 	case 306: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -5371,6 +5679,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 307 NTSTATUS NtRollbackTransaction ['HANDLE TransactionHandle', 'BOOLEAN Wait']
 	case 307: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -5384,6 +5693,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 308 NTSTATUS NtRollforwardTransactionManager ['HANDLE TransactionManagerHandle', 'PLARGE_INTEGER TmVirtualClock']
 	case 308: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -5397,6 +5707,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 309 NTSTATUS NtSaveKey ['HANDLE KeyHandle', 'HANDLE FileHandle']
 	case 309: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -5410,6 +5721,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 310 NTSTATUS NtSaveKeyEx ['HANDLE KeyHandle', 'HANDLE FileHandle', 'ULONG Format']
 	case 310: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -5425,6 +5737,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 311 NTSTATUS NtSaveMergedKeys ['HANDLE HighPrecedenceKeyHandle', 'HANDLE LowPrecedenceKeyHandle', 'HANDLE FileHandle']
 	case 311: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -5440,6 +5753,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 312 NTSTATUS NtSecureConnectPort ['PHANDLE PortHandle', 'PUNICODE_STRING PortName', 'PSECURITY_QUALITY_OF_SERVICE SecurityQos', 'PPORT_VIEW ClientView', 'PSID RequiredServerSid', 'PREMOTE_PORT_VIEW ServerView', 'PULONG MaxMessageLength', 'PVOID ConnectionInformation', 'PULONG ConnectionInformationLength']
 	case 312: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -5467,11 +5781,13 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 313 NTSTATUS NtSerializeBoot ['']
 	case 313: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_NtSerializeBoot_enter, cpu, pc);
 	}; break;
 	// 314 NTSTATUS NtSetBootEntryOrder ['PULONG Ids', 'ULONG Count']
 	case 314: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -5485,6 +5801,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 315 NTSTATUS NtSetBootOptions ['PBOOT_OPTIONS BootOptions', 'ULONG FieldsToChange']
 	case 315: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -5498,6 +5815,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 316 NTSTATUS NtSetContextThread ['HANDLE ThreadHandle', 'PCONTEXT ThreadContext']
 	case 316: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -5511,6 +5829,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 317 NTSTATUS NtSetDebugFilterState ['ULONG ComponentId', 'ULONG Level', 'BOOLEAN State']
 	case 317: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -5526,6 +5845,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 318 NTSTATUS NtSetDefaultHardErrorPort ['HANDLE DefaultHardErrorPort']
 	case 318: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -5537,6 +5857,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 319 NTSTATUS NtSetDefaultLocale ['BOOLEAN UserProfile', 'LCID DefaultLocaleId']
 	case 319: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -5550,6 +5871,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 320 NTSTATUS NtSetDefaultUILanguage ['LANGID DefaultUILanguageId']
 	case 320: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -5561,6 +5883,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 321 NTSTATUS NtSetDriverEntryOrder ['PULONG Ids', 'ULONG Count']
 	case 321: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -5574,6 +5897,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 322 NTSTATUS NtSetEaFile ['HANDLE FileHandle', 'PIO_STATUS_BLOCK IoStatusBlock', 'PVOID Buffer', 'ULONG Length']
 	case 322: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -5591,6 +5915,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 323 NTSTATUS NtSetEvent ['HANDLE EventHandle', 'PLONG PreviousState']
 	case 323: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -5604,6 +5929,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 324 NTSTATUS NtSetEventBoostPriority ['HANDLE EventHandle']
 	case 324: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -5615,6 +5941,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 325 NTSTATUS NtSetHighEventPair ['HANDLE EventPairHandle']
 	case 325: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -5626,6 +5953,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 326 NTSTATUS NtSetHighWaitLowEventPair ['HANDLE EventPairHandle']
 	case 326: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -5637,6 +5965,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 327 NTSTATUS NtSetInformationDebugObject ['HANDLE DebugObjectHandle', 'DEBUGOBJECTINFOCLASS DebugObjectInformationClass', 'PVOID DebugInformation', 'ULONG DebugInformationLength', 'PULONG ReturnLength']
 	case 327: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -5656,6 +5985,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 328 NTSTATUS NtSetInformationEnlistment ['HANDLE EnlistmentHandle', 'ENLISTMENT_INFORMATION_CLASS EnlistmentInformationClass', 'PVOID EnlistmentInformation', 'ULONG EnlistmentInformationLength']
 	case 328: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -5673,6 +6003,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 329 NTSTATUS NtSetInformationFile ['HANDLE FileHandle', 'PIO_STATUS_BLOCK IoStatusBlock', 'PVOID FileInformation', 'ULONG Length', 'FILE_INFORMATION_CLASS FileInformationClass']
 	case 329: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -5692,6 +6023,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 330 NTSTATUS NtSetInformationJobObject ['HANDLE JobHandle', 'JOBOBJECTINFOCLASS JobObjectInformationClass', 'PVOID JobObjectInformation', 'ULONG JobObjectInformationLength']
 	case 330: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -5709,6 +6041,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 331 NTSTATUS NtSetInformationKey ['HANDLE KeyHandle', 'KEY_SET_INFORMATION_CLASS KeySetInformationClass', 'PVOID KeySetInformation', 'ULONG KeySetInformationLength']
 	case 331: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -5726,6 +6059,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 332 NTSTATUS NtSetInformationObject ['HANDLE Handle', 'OBJECT_INFORMATION_CLASS ObjectInformationClass', 'PVOID ObjectInformation', 'ULONG ObjectInformationLength']
 	case 332: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -5743,6 +6077,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 333 NTSTATUS NtSetInformationProcess ['HANDLE ProcessHandle', 'PROCESSINFOCLASS ProcessInformationClass', 'PVOID ProcessInformation', 'ULONG ProcessInformationLength']
 	case 333: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -5760,6 +6095,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 334 NTSTATUS NtSetInformationResourceManager ['HANDLE ResourceManagerHandle', 'RESOURCEMANAGER_INFORMATION_CLASS ResourceManagerInformationClass', 'PVOID ResourceManagerInformation', 'ULONG ResourceManagerInformationLength']
 	case 334: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -5777,6 +6113,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 335 NTSTATUS NtSetInformationThread ['HANDLE ThreadHandle', 'THREADINFOCLASS ThreadInformationClass', 'PVOID ThreadInformation', 'ULONG ThreadInformationLength']
 	case 335: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -5794,6 +6131,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 336 NTSTATUS NtSetInformationToken ['HANDLE TokenHandle', 'TOKEN_INFORMATION_CLASS TokenInformationClass', 'PVOID TokenInformation', 'ULONG TokenInformationLength']
 	case 336: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -5811,6 +6149,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 337 NTSTATUS NtSetInformationTransaction ['HANDLE TransactionHandle', 'TRANSACTION_INFORMATION_CLASS TransactionInformationClass', 'PVOID TransactionInformation', 'ULONG TransactionInformationLength']
 	case 337: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -5828,6 +6167,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 338 NTSTATUS NtSetInformationTransactionManager ['HANDLE TmHandle', 'TRANSACTIONMANAGER_INFORMATION_CLASS TransactionManagerInformationClass', 'PVOID TransactionManagerInformation', 'ULONG TransactionManagerInformationLength']
 	case 338: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -5845,6 +6185,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 339 NTSTATUS NtSetInformationWorkerFactory ['HANDLE WorkerFactoryHandle', 'WORKERFACTORYINFOCLASS WorkerFactoryInformationClass', 'PVOID WorkerFactoryInformation', 'ULONG WorkerFactoryInformationLength']
 	case 339: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -5862,6 +6203,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 340 NTSTATUS NtSetIntervalProfile ['ULONG Interval', 'KPROFILE_SOURCE Source']
 	case 340: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -5875,6 +6217,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 341 NTSTATUS NtSetIoCompletion ['HANDLE IoCompletionHandle', 'PVOID KeyContext', 'PVOID ApcContext', 'NTSTATUS IoStatus', 'ULONG_PTR IoStatusInformation']
 	case 341: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -5894,6 +6237,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 342 NTSTATUS NtSetIoCompletionEx ['HANDLE IoCompletionHandle', 'HANDLE IoCompletionReserveHandle', 'PVOID KeyContext', 'PVOID ApcContext', 'NTSTATUS IoStatus', 'ULONG_PTR IoStatusInformation']
 	case 342: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -5915,6 +6259,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 343 NTSTATUS NtSetLdtEntries ['ULONG Selector0', 'ULONG Entry0Low', 'ULONG Entry0Hi', 'ULONG Selector1', 'ULONG Entry1Low', 'ULONG Entry1Hi']
 	case 343: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -5936,6 +6281,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 344 NTSTATUS NtSetLowEventPair ['HANDLE EventPairHandle']
 	case 344: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -5947,6 +6293,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 345 NTSTATUS NtSetLowWaitHighEventPair ['HANDLE EventPairHandle']
 	case 345: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -5958,6 +6305,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 346 NTSTATUS NtSetQuotaInformationFile ['HANDLE FileHandle', 'PIO_STATUS_BLOCK IoStatusBlock', 'PVOID Buffer', 'ULONG Length']
 	case 346: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -5975,6 +6323,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 347 NTSTATUS NtSetSecurityObject ['HANDLE Handle', 'SECURITY_INFORMATION SecurityInformation', 'PSECURITY_DESCRIPTOR SecurityDescriptor']
 	case 347: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -5990,6 +6339,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 348 NTSTATUS NtSetSystemEnvironmentValue ['PUNICODE_STRING VariableName', 'PUNICODE_STRING VariableValue']
 	case 348: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -6003,6 +6353,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 349 NTSTATUS NtSetSystemEnvironmentValueEx ['PUNICODE_STRING VariableName', 'LPGUID VendorGuid', 'PVOID Value', 'ULONG ValueLength', 'ULONG Attributes']
 	case 349: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -6022,6 +6373,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 350 NTSTATUS NtSetSystemInformation ['SYSTEM_INFORMATION_CLASS SystemInformationClass', 'PVOID SystemInformation', 'ULONG SystemInformationLength']
 	case 350: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -6037,6 +6389,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 351 NTSTATUS NtSetSystemPowerState ['POWER_ACTION SystemAction', 'SYSTEM_POWER_STATE MinSystemState', 'ULONG Flags']
 	case 351: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -6052,6 +6405,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 352 NTSTATUS NtSetSystemTime ['PLARGE_INTEGER SystemTime', 'PLARGE_INTEGER PreviousTime']
 	case 352: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -6065,6 +6419,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 353 NTSTATUS NtSetThreadExecutionState ['EXECUTION_STATE esFlags', 'PEXECUTION_STATE PreviousFlags']
 	case 353: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -6078,6 +6433,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 354 NTSTATUS NtSetTimer ['HANDLE TimerHandle', 'PLARGE_INTEGER DueTime', 'PTIMER_APC_ROUTINE TimerApcRoutine', 'PVOID TimerContext', 'BOOLEAN WakeTimer', 'LONG Period', 'PBOOLEAN PreviousState']
 	case 354: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -6101,6 +6457,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 355 NTSTATUS NtSetTimerEx ['HANDLE TimerHandle', 'TIMER_SET_INFORMATION_CLASS TimerSetInformationClass', 'PVOID TimerSetInformation', 'ULONG TimerSetInformationLength']
 	case 355: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -6118,6 +6475,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 356 NTSTATUS NtSetTimerResolution ['ULONG DesiredTime', 'BOOLEAN SetResolution', 'PULONG ActualTime']
 	case 356: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -6133,6 +6491,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 357 NTSTATUS NtSetUuidSeed ['PCHAR Seed']
 	case 357: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -6144,6 +6503,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 358 NTSTATUS NtSetValueKey ['HANDLE KeyHandle', 'PUNICODE_STRING ValueName', 'ULONG TitleIndex', 'ULONG Type', 'PVOID Data', 'ULONG DataSize']
 	case 358: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -6165,6 +6525,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 359 NTSTATUS NtSetVolumeInformationFile ['HANDLE FileHandle', 'PIO_STATUS_BLOCK IoStatusBlock', 'PVOID FsInformation', 'ULONG Length', 'FS_INFORMATION_CLASS FsInformationClass']
 	case 359: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -6184,6 +6545,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 360 NTSTATUS NtShutdownSystem ['SHUTDOWN_ACTION Action']
 	case 360: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -6195,6 +6557,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 361 NTSTATUS NtShutdownWorkerFactory ['HANDLE WorkerFactoryHandle', 'LONG *PendingWorkerCount']
 	case 361: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -6208,6 +6571,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 362 NTSTATUS NtSignalAndWaitForSingleObject ['HANDLE SignalHandle', 'HANDLE WaitHandle', 'BOOLEAN Alertable', 'PLARGE_INTEGER Timeout']
 	case 362: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -6225,6 +6589,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 363 NTSTATUS NtSinglePhaseReject ['HANDLE EnlistmentHandle', 'PLARGE_INTEGER TmVirtualClock']
 	case 363: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -6238,6 +6603,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 364 NTSTATUS NtStartProfile ['HANDLE ProfileHandle']
 	case 364: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -6249,6 +6615,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 365 NTSTATUS NtStopProfile ['HANDLE ProfileHandle']
 	case 365: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -6260,6 +6627,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 366 NTSTATUS NtSuspendProcess ['HANDLE ProcessHandle']
 	case 366: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -6271,6 +6639,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 367 NTSTATUS NtSuspendThread ['HANDLE ThreadHandle', 'PULONG PreviousSuspendCount']
 	case 367: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -6284,6 +6653,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 368 NTSTATUS NtSystemDebugControl ['SYSDBG_COMMAND Command', 'PVOID InputBuffer', 'ULONG InputBufferLength', 'PVOID OutputBuffer', 'ULONG OutputBufferLength', 'PULONG ReturnLength']
 	case 368: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -6305,6 +6675,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 369 NTSTATUS NtTerminateJobObject ['HANDLE JobHandle', 'NTSTATUS ExitStatus']
 	case 369: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -6318,6 +6689,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 370 NTSTATUS NtTerminateProcess ['HANDLE ProcessHandle', 'NTSTATUS ExitStatus']
 	case 370: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -6331,6 +6703,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 371 NTSTATUS NtTerminateThread ['HANDLE ThreadHandle', 'NTSTATUS ExitStatus']
 	case 371: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -6344,21 +6717,25 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 372 NTSTATUS NtTestAlert ['']
 	case 372: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_NtTestAlert_enter, cpu, pc);
 	}; break;
 	// 373 NTSTATUS NtThawRegistry ['']
 	case 373: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_NtThawRegistry_enter, cpu, pc);
 	}; break;
 	// 374 NTSTATUS NtThawTransactions ['']
 	case 374: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_NtThawTransactions_enter, cpu, pc);
 	}; break;
 	// 375 NTSTATUS NtTraceControl ['ULONG FunctionCode', 'PVOID InBuffer', 'ULONG InBufferLen', 'PVOID OutBuffer', 'ULONG OutBufferLen', 'PULONG ReturnLength']
 	case 375: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -6380,6 +6757,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 376 NTSTATUS NtTraceEvent ['HANDLE TraceHandle', 'ULONG Flags', 'ULONG FieldSize', 'PVOID Fields']
 	case 376: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -6397,6 +6775,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 377 NTSTATUS NtTranslateFilePath ['PFILE_PATH InputFilePath', 'ULONG OutputType', 'PFILE_PATH OutputFilePath', 'PULONG OutputFilePathLength']
 	case 377: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -6414,6 +6793,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 378 NTSTATUS NtUmsThreadYield ['PVOID SchedulerParam']
 	case 378: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -6425,6 +6805,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 379 NTSTATUS NtUnloadDriver ['PUNICODE_STRING DriverServiceName']
 	case 379: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -6436,6 +6817,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 380 NTSTATUS NtUnloadKey ['POBJECT_ATTRIBUTES TargetKey']
 	case 380: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -6447,6 +6829,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 381 NTSTATUS NtUnloadKey2 ['POBJECT_ATTRIBUTES TargetKey', 'ULONG Flags']
 	case 381: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -6460,6 +6843,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 382 NTSTATUS NtUnloadKeyEx ['POBJECT_ATTRIBUTES TargetKey', 'HANDLE Event']
 	case 382: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -6473,6 +6857,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 383 NTSTATUS NtUnlockFile ['HANDLE FileHandle', 'PIO_STATUS_BLOCK IoStatusBlock', 'PLARGE_INTEGER ByteOffset', 'PLARGE_INTEGER Length', 'ULONG Key']
 	case 383: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -6492,6 +6877,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 384 NTSTATUS NtUnlockVirtualMemory ['HANDLE ProcessHandle', 'PVOID *BaseAddress', 'PSIZE_T RegionSize', 'ULONG MapType']
 	case 384: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -6509,6 +6895,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 385 NTSTATUS NtUnmapViewOfSection ['HANDLE ProcessHandle', 'PVOID BaseAddress']
 	case 385: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -6522,6 +6909,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 386 NTSTATUS NtVdmControl ['VDMSERVICECLASS Service', 'PVOID ServiceData']
 	case 386: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -6535,6 +6923,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 387 NTSTATUS NtWaitForDebugEvent ['HANDLE DebugObjectHandle', 'BOOLEAN Alertable', 'PLARGE_INTEGER Timeout', 'PDBGUI_WAIT_STATE_CHANGE WaitStateChange']
 	case 387: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -6552,6 +6941,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 388 NTSTATUS NtWaitForKeyedEvent ['HANDLE KeyedEventHandle', 'PVOID KeyValue', 'BOOLEAN Alertable', 'PLARGE_INTEGER Timeout']
 	case 388: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -6569,6 +6959,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 389 NTSTATUS NtWaitForMultipleObjects ['ULONG Count', 'HANDLE Handles[]', 'WAIT_TYPE WaitType', 'BOOLEAN Alertable', 'PLARGE_INTEGER Timeout']
 	case 389: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -6588,6 +6979,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 390 NTSTATUS NtWaitForMultipleObjects32 ['ULONG Count', 'LONG Handles[]', 'WAIT_TYPE WaitType', 'BOOLEAN Alertable', 'PLARGE_INTEGER Timeout']
 	case 390: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -6607,6 +6999,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 391 NTSTATUS NtWaitForSingleObject ['HANDLE Handle', 'BOOLEAN Alertable', 'PLARGE_INTEGER Timeout']
 	case 391: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -6622,6 +7015,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 392 NTSTATUS NtWaitForWorkViaWorkerFactory ['HANDLE WorkerFactoryHandle', 'PFILE_IO_COMPLETION_INFORMATION MiniPacket']
 	case 392: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -6635,6 +7029,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 393 NTSTATUS NtWaitHighEventPair ['HANDLE EventPairHandle']
 	case 393: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -6646,6 +7041,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 394 NTSTATUS NtWaitLowEventPair ['HANDLE EventPairHandle']
 	case 394: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -6657,6 +7053,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 395 NTSTATUS NtWorkerFactoryWorkerReady ['HANDLE WorkerFactoryHandle']
 	case 395: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -6668,6 +7065,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 396 NTSTATUS NtWriteFile ['HANDLE FileHandle', 'HANDLE Event', 'PIO_APC_ROUTINE ApcRoutine', 'PVOID ApcContext', 'PIO_STATUS_BLOCK IoStatusBlock', 'PVOID Buffer', 'ULONG Length', 'PLARGE_INTEGER ByteOffset', 'PULONG Key']
 	case 396: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -6695,6 +7093,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 397 NTSTATUS NtWriteFileGather ['HANDLE FileHandle', 'HANDLE Event', 'PIO_APC_ROUTINE ApcRoutine', 'PVOID ApcContext', 'PIO_STATUS_BLOCK IoStatusBlock', 'PFILE_SEGMENT_ELEMENT SegmentArray', 'ULONG Length', 'PLARGE_INTEGER ByteOffset', 'PULONG Key']
 	case 397: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -6722,6 +7121,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 398 NTSTATUS NtWriteRequestData ['HANDLE PortHandle', 'PPORT_MESSAGE Message', 'ULONG DataEntryIndex', 'PVOID Buffer', 'SIZE_T BufferSize', 'PSIZE_T NumberOfBytesWritten']
 	case 398: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -6743,6 +7143,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 399 NTSTATUS NtWriteVirtualMemory ['HANDLE ProcessHandle', 'PVOID BaseAddress', 'PVOID Buffer', 'SIZE_T BufferSize', 'PSIZE_T NumberOfBytesWritten']
 	case 399: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -6762,6 +7163,7 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 	// 400 NTSTATUS NtYieldExecution ['']
 	case 400: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_NtYieldExecution_enter, cpu, pc);
 	}; break;
 	default:
diff --git a/panda/plugins/syscalls2/generated/syscall_switch_enter_windows_xpsp2_x86.cpp b/panda/plugins/syscalls2/generated/syscall_switch_enter_windows_xpsp2_x86.cpp
index 32704662189..3f433d93d40 100644
--- a/panda/plugins/syscalls2/generated/syscall_switch_enter_windows_xpsp2_x86.cpp
+++ b/panda/plugins/syscalls2/generated/syscall_switch_enter_windows_xpsp2_x86.cpp
@@ -33,6 +33,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	}
 	ctx.asid = panda_current_asid(cpu);
 	ctx.retaddr = calc_retaddr(cpu, pc);
+	ctx.double_return = false;
 	bool panda_noreturn;	// true if PANDA should not track the return of this system call
 	const syscall_info_t *call = NULL;
 	syscall_info_t zero = {0};
@@ -48,6 +49,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 0 NTSTATUS NtAcceptConnectPort ['PHANDLE PortHandle', 'PVOID PortContext', 'PPORT_MESSAGE ConnectionRequest', 'BOOLEAN AcceptConnection', 'PPORT_VIEW ServerView', 'PREMOTE_PORT_VIEW ClientView']
 	case 0: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -69,6 +71,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 1 NTSTATUS NtAccessCheck ['PSECURITY_DESCRIPTOR SecurityDescriptor', 'HANDLE ClientToken', 'ACCESS_MASK DesiredAccess', 'PGENERIC_MAPPING GenericMapping', 'PPRIVILEGE_SET PrivilegeSet', 'PULONG PrivilegeSetLength', 'PACCESS_MASK GrantedAccess', 'PNTSTATUS AccessStatus']
 	case 1: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -94,6 +97,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 2 NTSTATUS NtAccessCheckAndAuditAlarm ['PUNICODE_STRING SubsystemName', 'PVOID HandleId', 'PUNICODE_STRING ObjectTypeName', 'PUNICODE_STRING ObjectName', 'PSECURITY_DESCRIPTOR SecurityDescriptor', 'ACCESS_MASK DesiredAccess', 'PGENERIC_MAPPING GenericMapping', 'BOOLEAN ObjectCreation', 'PACCESS_MASK GrantedAccess', 'PNTSTATUS AccessStatus', 'PBOOLEAN GenerateOnClose']
 	case 2: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -125,6 +129,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 3 NTSTATUS NtAccessCheckByType ['PSECURITY_DESCRIPTOR SecurityDescriptor', 'PSID PrincipalSelfSid', 'HANDLE ClientToken', 'ACCESS_MASK DesiredAccess', 'POBJECT_TYPE_LIST ObjectTypeList', 'ULONG ObjectTypeListLength', 'PGENERIC_MAPPING GenericMapping', 'PPRIVILEGE_SET PrivilegeSet', 'PULONG PrivilegeSetLength', 'PACCESS_MASK GrantedAccess', 'PNTSTATUS AccessStatus']
 	case 3: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -156,6 +161,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 4 NTSTATUS NtAccessCheckByTypeAndAuditAlarm ['PUNICODE_STRING SubsystemName', 'PVOID HandleId', 'PUNICODE_STRING ObjectTypeName', 'PUNICODE_STRING ObjectName', 'PSECURITY_DESCRIPTOR SecurityDescriptor', 'PSID PrincipalSelfSid', 'ACCESS_MASK DesiredAccess', 'AUDIT_EVENT_TYPE AuditType', 'ULONG Flags', 'POBJECT_TYPE_LIST ObjectTypeList', 'ULONG ObjectTypeListLength', 'PGENERIC_MAPPING GenericMapping', 'BOOLEAN ObjectCreation', 'PACCESS_MASK GrantedAccess', 'PNTSTATUS AccessStatus', 'PBOOLEAN GenerateOnClose']
 	case 4: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -197,6 +203,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 5 NTSTATUS NtAccessCheckByTypeResultList ['PSECURITY_DESCRIPTOR SecurityDescriptor', 'PSID PrincipalSelfSid', 'HANDLE ClientToken', 'ACCESS_MASK DesiredAccess', 'POBJECT_TYPE_LIST ObjectTypeList', 'ULONG ObjectTypeListLength', 'PGENERIC_MAPPING GenericMapping', 'PPRIVILEGE_SET PrivilegeSet', 'PULONG PrivilegeSetLength', 'PACCESS_MASK GrantedAccess', 'PNTSTATUS AccessStatus']
 	case 5: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -228,6 +235,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 6 NTSTATUS NtAccessCheckByTypeResultListAndAuditAlarm ['PUNICODE_STRING SubsystemName', 'PVOID HandleId', 'PUNICODE_STRING ObjectTypeName', 'PUNICODE_STRING ObjectName', 'PSECURITY_DESCRIPTOR SecurityDescriptor', 'PSID PrincipalSelfSid', 'ACCESS_MASK DesiredAccess', 'AUDIT_EVENT_TYPE AuditType', 'ULONG Flags', 'POBJECT_TYPE_LIST ObjectTypeList', 'ULONG ObjectTypeListLength', 'PGENERIC_MAPPING GenericMapping', 'BOOLEAN ObjectCreation', 'PACCESS_MASK GrantedAccess', 'PNTSTATUS AccessStatus', 'PBOOLEAN GenerateOnClose']
 	case 6: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -269,6 +277,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 7 NTSTATUS NtAccessCheckByTypeResultListAndAuditAlarmByHandle ['PUNICODE_STRING SubsystemName', 'PVOID HandleId', 'HANDLE ClientToken', 'PUNICODE_STRING ObjectTypeName', 'PUNICODE_STRING ObjectName', 'PSECURITY_DESCRIPTOR SecurityDescriptor', 'PSID PrincipalSelfSid', 'ACCESS_MASK DesiredAccess', 'AUDIT_EVENT_TYPE AuditType', 'ULONG Flags', 'POBJECT_TYPE_LIST ObjectTypeList', 'ULONG ObjectTypeListLength', 'PGENERIC_MAPPING GenericMapping', 'BOOLEAN ObjectCreation', 'PACCESS_MASK GrantedAccess', 'PNTSTATUS AccessStatus', 'PBOOLEAN GenerateOnClose']
 	case 7: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -312,6 +321,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 8 NTSTATUS NtAddAtom ['PWSTR AtomName', 'ULONG Length', 'PRTL_ATOM Atom']
 	case 8: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -327,6 +337,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 9 NTSTATUS NtAddBootEntry ['PBOOT_ENTRY BootEntry', 'PULONG Id']
 	case 9: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -340,6 +351,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 10 NTSTATUS NtAdjustGroupsToken ['HANDLE TokenHandle', 'BOOLEAN ResetToDefault', 'PTOKEN_GROUPS NewState', 'ULONG BufferLength', 'PTOKEN_GROUPS PreviousState', 'PULONG ReturnLength']
 	case 10: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -361,6 +373,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 11 NTSTATUS NtAdjustPrivilegesToken ['HANDLE TokenHandle', 'BOOLEAN DisableAllPrivileges', 'PTOKEN_PRIVILEGES NewState', 'ULONG BufferLength', 'PTOKEN_PRIVILEGES PreviousState', 'PULONG ReturnLength']
 	case 11: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -382,6 +395,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 12 NTSTATUS NtAlertResumeThread ['HANDLE ThreadHandle', 'PULONG PreviousSuspendCount']
 	case 12: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -395,6 +409,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 13 NTSTATUS NtAlertThread ['HANDLE ThreadHandle']
 	case 13: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -406,6 +421,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 14 NTSTATUS NtAllocateLocallyUniqueId ['PLUID Luid']
 	case 14: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -417,6 +433,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 15 NTSTATUS NtAllocateUserPhysicalPages ['HANDLE ProcessHandle', 'PULONG_PTR NumberOfPages', 'PULONG_PTR UserPfnArray']
 	case 15: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -432,6 +449,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 16 NTSTATUS NtAllocateUuids ['PULARGE_INTEGER Time', 'PULONG Range', 'PULONG Sequence', 'PCHAR Seed']
 	case 16: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -449,6 +467,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 17 NTSTATUS NtAllocateVirtualMemory ['HANDLE ProcessHandle', 'PVOID *BaseAddress', 'ULONG_PTR ZeroBits', 'PSIZE_T RegionSize', 'ULONG AllocationType', 'ULONG Protect']
 	case 17: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -470,6 +489,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 18 NTSTATUS NtAreMappedFilesTheSame ['PVOID File1MappedAsAnImage', 'PVOID File2MappedAsFile']
 	case 18: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -483,6 +503,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 19 NTSTATUS NtAssignProcessToJobObject ['HANDLE JobHandle', 'HANDLE ProcessHandle']
 	case 19: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -496,6 +517,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 20 NTSTATUS NtCallbackReturn ['PVOID OutputBuffer', 'ULONG OutputLength', 'NTSTATUS Status']
 	case 20: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -511,6 +533,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 22 NTSTATUS NtCancelIoFile ['HANDLE FileHandle', 'PIO_STATUS_BLOCK IoStatusBlock']
 	case 22: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -524,6 +547,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 23 NTSTATUS NtCancelTimer ['HANDLE TimerHandle', 'PBOOLEAN CurrentState']
 	case 23: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -537,6 +561,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 24 NTSTATUS NtClearEvent ['HANDLE EventHandle']
 	case 24: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -548,6 +573,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 25 NTSTATUS NtClose ['HANDLE Handle']
 	case 25: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -559,6 +585,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 26 NTSTATUS NtCloseObjectAuditAlarm ['PUNICODE_STRING SubsystemName', 'PVOID HandleId', 'BOOLEAN GenerateOnClose']
 	case 26: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -574,6 +601,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 27 NTSTATUS NtCompactKeys ['ULONG Count', 'HANDLE KeyArray[]']
 	case 27: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -587,6 +615,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 28 NTSTATUS NtCompareTokens ['HANDLE FirstTokenHandle', 'HANDLE SecondTokenHandle', 'PBOOLEAN Equal']
 	case 28: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -602,6 +631,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 29 NTSTATUS NtCompleteConnectPort ['HANDLE PortHandle']
 	case 29: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -613,6 +643,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 30 NTSTATUS NtCompressKey ['HANDLE Key']
 	case 30: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -624,6 +655,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 31 NTSTATUS NtConnectPort ['PHANDLE PortHandle', 'PUNICODE_STRING PortName', 'PSECURITY_QUALITY_OF_SERVICE SecurityQos', 'PPORT_VIEW ClientView', 'PREMOTE_PORT_VIEW ServerView', 'PULONG MaxMessageLength', 'PVOID ConnectionInformation', 'PULONG ConnectionInformationLength']
 	case 31: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -649,6 +681,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 32 NTSTATUS NtContinue ['PCONTEXT ContextRecord', 'BOOLEAN TestAlert']
 	case 32: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -662,6 +695,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 33 NTSTATUS NtCreateDebugObject ['PHANDLE DebugObjectHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes', 'ULONG Flags']
 	case 33: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -679,6 +713,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 34 NTSTATUS NtCreateDirectoryObject ['PHANDLE DirectoryHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes']
 	case 34: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -694,6 +729,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 35 NTSTATUS NtCreateEvent ['PHANDLE EventHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes', 'EVENT_TYPE EventType', 'BOOLEAN InitialState']
 	case 35: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -713,6 +749,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 36 NTSTATUS NtCreateEventPair ['PHANDLE EventPairHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes']
 	case 36: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -728,6 +765,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 37 NTSTATUS NtCreateFile ['PHANDLE FileHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes', 'PIO_STATUS_BLOCK IoStatusBlock', 'PLARGE_INTEGER AllocationSize', 'ULONG FileAttributes', 'ULONG ShareAccess', 'ULONG CreateDisposition', 'ULONG CreateOptions', 'PVOID EaBuffer', 'ULONG EaLength']
 	case 37: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -759,6 +797,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 38 NTSTATUS NtCreateIoCompletion ['PHANDLE IoCompletionHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes', 'ULONG Count']
 	case 38: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -776,6 +815,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 39 NTSTATUS NtCreateJobObject ['PHANDLE JobHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes']
 	case 39: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -791,6 +831,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 40 NTSTATUS NtCreateJobSet ['ULONG NumJob', 'PJOB_SET_ARRAY UserJobSet', 'ULONG Flags']
 	case 40: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -806,6 +847,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 41 NTSTATUS NtCreateKey ['PHANDLE KeyHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes', 'ULONG TitleIndex', 'PUNICODE_STRING Class', 'ULONG CreateOptions', 'PULONG Disposition']
 	case 41: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -829,6 +871,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 42 NTSTATUS NtCreateMailslotFile ['PHANDLE FileHandle', 'ULONG DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes', 'PIO_STATUS_BLOCK IoStatusBlock', 'ULONG CreateOptions', 'ULONG MailslotQuota', 'ULONG MaximumMessageSize', 'PLARGE_INTEGER ReadTimeout']
 	case 42: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -854,6 +897,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 43 NTSTATUS NtCreateMutant ['PHANDLE MutantHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes', 'BOOLEAN InitialOwner']
 	case 43: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -871,6 +915,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 44 NTSTATUS NtCreateNamedPipeFile ['PHANDLE FileHandle', 'ULONG DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes', 'PIO_STATUS_BLOCK IoStatusBlock', 'ULONG ShareAccess', 'ULONG CreateDisposition', 'ULONG CreateOptions', 'ULONG NamedPipeType', 'ULONG ReadMode', 'ULONG CompletionMode', 'ULONG MaximumInstances', 'ULONG InboundQuota', 'ULONG OutboundQuota', 'PLARGE_INTEGER DefaultTimeout']
 	case 44: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -908,6 +953,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 45 NTSTATUS NtCreatePagingFile ['PUNICODE_STRING PageFileName', 'PLARGE_INTEGER MinimumSize', 'PLARGE_INTEGER MaximumSize', 'ULONG Priority']
 	case 45: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -925,6 +971,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 46 NTSTATUS NtCreatePort ['PHANDLE PortHandle', 'POBJECT_ATTRIBUTES ObjectAttributes', 'ULONG MaxConnectionInfoLength', 'ULONG MaxMessageLength', 'ULONG MaxPoolUsage']
 	case 46: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -944,6 +991,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 47 NTSTATUS NtCreateProcess ['PHANDLE ProcessHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes', 'HANDLE ParentProcess', 'BOOLEAN InheritObjectTable', 'HANDLE SectionHandle', 'HANDLE DebugPort', 'HANDLE ExceptionPort']
 	case 47: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -969,6 +1017,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 48 NTSTATUS NtCreateProcessEx ['PHANDLE ProcessHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes', 'HANDLE ParentProcess', 'ULONG Flags', 'HANDLE SectionHandle', 'HANDLE DebugPort', 'HANDLE ExceptionPort', 'ULONG JobMemberLevel']
 	case 48: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -996,6 +1045,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 49 NTSTATUS NtCreateProfile ['PHANDLE ProfileHandle', 'HANDLE Process', 'PVOID RangeBase', 'SIZE_T RangeSize', 'ULONG BucketSize', 'PULONG Buffer', 'ULONG BufferSize', 'KPROFILE_SOURCE ProfileSource', 'KAFFINITY Affinity']
 	case 49: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1023,6 +1073,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 50 NTSTATUS NtCreateSection ['PHANDLE SectionHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes', 'PLARGE_INTEGER MaximumSize', 'ULONG SectionPageProtection', 'ULONG AllocationAttributes', 'HANDLE FileHandle']
 	case 50: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1046,6 +1097,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 51 NTSTATUS NtCreateSemaphore ['PHANDLE SemaphoreHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes', 'LONG InitialCount', 'LONG MaximumCount']
 	case 51: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1065,6 +1117,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 52 NTSTATUS NtCreateSymbolicLinkObject ['PHANDLE LinkHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes', 'PUNICODE_STRING LinkTarget']
 	case 52: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1082,6 +1135,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 53 NTSTATUS NtCreateThread ['PHANDLE ThreadHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes', 'HANDLE ProcessHandle', 'PCLIENT_ID ClientId', 'PCONTEXT ThreadContext', 'PINITIAL_TEB InitialTeb', 'BOOLEAN CreateSuspended']
 	case 53: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1107,6 +1161,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 54 NTSTATUS NtCreateTimer ['PHANDLE TimerHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes', 'TIMER_TYPE TimerType']
 	case 54: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1124,6 +1179,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 55 NTSTATUS NtCreateToken ['PHANDLE TokenHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes', 'TOKEN_TYPE TokenType', 'PLUID AuthenticationId', 'PLARGE_INTEGER ExpirationTime', 'PTOKEN_USER User', 'PTOKEN_GROUPS Groups', 'PTOKEN_PRIVILEGES Privileges', 'PTOKEN_OWNER Owner', 'PTOKEN_PRIMARY_GROUP PrimaryGroup', 'PTOKEN_DEFAULT_DACL DefaultDacl', 'PTOKEN_SOURCE TokenSource']
 	case 55: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1159,6 +1215,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 56 NTSTATUS NtCreateWaitablePort ['PHANDLE PortHandle', 'POBJECT_ATTRIBUTES ObjectAttributes', 'ULONG MaxConnectionInfoLength', 'ULONG MaxMessageLength', 'ULONG MaxPoolUsage']
 	case 56: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1178,6 +1235,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 57 NTSTATUS NtDebugActiveProcess ['HANDLE ProcessHandle', 'HANDLE DebugObjectHandle']
 	case 57: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1191,6 +1249,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 58 NTSTATUS NtDebugContinue ['HANDLE DebugObjectHandle', 'PCLIENT_ID ClientId', 'NTSTATUS ContinueStatus']
 	case 58: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1206,6 +1265,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 59 NTSTATUS NtDelayExecution ['BOOLEAN Alertable', 'PLARGE_INTEGER DelayInterval']
 	case 59: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1219,6 +1279,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 60 NTSTATUS NtDeleteAtom ['RTL_ATOM Atom']
 	case 60: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1230,6 +1291,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 61 NTSTATUS NtDeleteBootEntry ['ULONG Id']
 	case 61: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1241,6 +1303,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 62 NTSTATUS NtDeleteFile ['POBJECT_ATTRIBUTES ObjectAttributes']
 	case 62: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1252,6 +1315,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 63 NTSTATUS NtDeleteKey ['HANDLE KeyHandle']
 	case 63: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1263,6 +1327,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 64 NTSTATUS NtDeleteObjectAuditAlarm ['PUNICODE_STRING SubsystemName', 'PVOID HandleId', 'BOOLEAN GenerateOnClose']
 	case 64: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1278,6 +1343,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 65 NTSTATUS NtDeleteValueKey ['HANDLE KeyHandle', 'PUNICODE_STRING ValueName']
 	case 65: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1291,6 +1357,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 66 NTSTATUS NtDeviceIoControlFile ['HANDLE FileHandle', 'HANDLE Event', 'PIO_APC_ROUTINE ApcRoutine', 'PVOID ApcContext', 'PIO_STATUS_BLOCK IoStatusBlock', 'ULONG IoControlCode', 'PVOID InputBuffer', 'ULONG InputBufferLength', 'PVOID OutputBuffer', 'ULONG OutputBufferLength']
 	case 66: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1320,6 +1387,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 67 NTSTATUS NtDisplayString ['PUNICODE_STRING String']
 	case 67: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1331,6 +1399,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 68 NTSTATUS NtDuplicateObject ['HANDLE SourceProcessHandle', 'HANDLE SourceHandle', 'HANDLE TargetProcessHandle', 'PHANDLE TargetHandle', 'ACCESS_MASK DesiredAccess', 'ULONG HandleAttributes', 'ULONG Options']
 	case 68: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1354,6 +1423,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 69 NTSTATUS NtDuplicateToken ['HANDLE ExistingTokenHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes', 'BOOLEAN EffectiveOnly', 'TOKEN_TYPE TokenType', 'PHANDLE NewTokenHandle']
 	case 69: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1375,6 +1445,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 70 NTSTATUS NtEnumerateBootEntries ['PVOID Buffer', 'PULONG BufferLength']
 	case 70: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1388,6 +1459,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 71 NTSTATUS NtEnumerateKey ['HANDLE KeyHandle', 'ULONG Index', 'KEY_INFORMATION_CLASS KeyInformationClass', 'PVOID KeyInformation', 'ULONG Length', 'PULONG ResultLength']
 	case 71: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1409,6 +1481,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 72 NTSTATUS NtEnumerateSystemEnvironmentValuesEx ['ULONG InformationClass', 'PVOID Buffer', 'PULONG BufferLength']
 	case 72: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1424,6 +1497,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 73 NTSTATUS NtEnumerateValueKey ['HANDLE KeyHandle', 'ULONG Index', 'KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass', 'PVOID KeyValueInformation', 'ULONG Length', 'PULONG ResultLength']
 	case 73: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1445,6 +1519,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 74 NTSTATUS NtExtendSection ['HANDLE SectionHandle', 'PLARGE_INTEGER NewSectionSize']
 	case 74: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1458,6 +1533,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 75 NTSTATUS NtFilterToken ['HANDLE ExistingTokenHandle', 'ULONG Flags', 'PTOKEN_GROUPS SidsToDisable', 'PTOKEN_PRIVILEGES PrivilegesToDelete', 'PTOKEN_GROUPS RestrictedSids', 'PHANDLE NewTokenHandle']
 	case 75: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1479,6 +1555,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 76 NTSTATUS NtFindAtom ['PWSTR AtomName', 'ULONG Length', 'PRTL_ATOM Atom']
 	case 76: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1494,6 +1571,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 77 NTSTATUS NtFlushBuffersFile ['HANDLE FileHandle', 'PIO_STATUS_BLOCK IoStatusBlock']
 	case 77: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1507,6 +1585,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 78 NTSTATUS NtFlushInstructionCache ['HANDLE ProcessHandle', 'PVOID BaseAddress', 'SIZE_T Length']
 	case 78: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1522,6 +1601,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 79 NTSTATUS NtFlushKey ['HANDLE KeyHandle']
 	case 79: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1533,6 +1613,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 80 NTSTATUS NtFlushVirtualMemory ['HANDLE ProcessHandle', 'PVOID *BaseAddress', 'PSIZE_T RegionSize', 'PIO_STATUS_BLOCK IoStatus']
 	case 80: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1550,11 +1631,13 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 81 NTSTATUS NtFlushWriteBuffer ['']
 	case 81: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_NtFlushWriteBuffer_enter, cpu, pc);
 	}; break;
 	// 82 NTSTATUS NtFreeUserPhysicalPages ['HANDLE ProcessHandle', 'PULONG_PTR NumberOfPages', 'PULONG_PTR UserPfnArray']
 	case 82: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1570,6 +1653,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 83 NTSTATUS NtFreeVirtualMemory ['HANDLE ProcessHandle', 'PVOID *BaseAddress', 'PSIZE_T RegionSize', 'ULONG FreeType']
 	case 83: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1587,6 +1671,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 84 NTSTATUS NtFsControlFile ['HANDLE FileHandle', 'HANDLE Event', 'PIO_APC_ROUTINE ApcRoutine', 'PVOID ApcContext', 'PIO_STATUS_BLOCK IoStatusBlock', 'ULONG IoControlCode', 'PVOID InputBuffer', 'ULONG InputBufferLength', 'PVOID OutputBuffer', 'ULONG OutputBufferLength']
 	case 84: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1616,6 +1701,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 85 NTSTATUS NtGetContextThread ['HANDLE ThreadHandle', 'PCONTEXT ThreadContext']
 	case 85: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1629,6 +1715,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 86 NTSTATUS NtGetDevicePowerState ['HANDLE Device', 'DEVICE_POWER_STATE *State']
 	case 86: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1642,6 +1729,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 87 NTSTATUS NtGetPlugPlayEvent ['HANDLE EventHandle', 'PVOID Context', 'PPLUGPLAY_EVENT_BLOCK EventBlock', 'ULONG EventBufferSize']
 	case 87: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1659,6 +1747,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 88 NTSTATUS NtGetWriteWatch ['HANDLE ProcessHandle', 'ULONG Flags', 'PVOID BaseAddress', 'SIZE_T RegionSize', 'PVOID *UserAddressArray', 'PULONG_PTR EntriesInUserAddressArray', 'PULONG Granularity']
 	case 88: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1682,6 +1771,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 89 NTSTATUS NtImpersonateAnonymousToken ['HANDLE ThreadHandle']
 	case 89: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1693,6 +1783,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 90 NTSTATUS NtImpersonateClientOfPort ['HANDLE PortHandle', 'PPORT_MESSAGE Message']
 	case 90: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1706,6 +1797,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 91 NTSTATUS NtImpersonateThread ['HANDLE ServerThreadHandle', 'HANDLE ClientThreadHandle', 'PSECURITY_QUALITY_OF_SERVICE SecurityQos']
 	case 91: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1721,6 +1813,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 92 NTSTATUS NtInitializeRegistry ['USHORT BootCondition']
 	case 92: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1732,6 +1825,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 93 NTSTATUS NtInitiatePowerAction ['POWER_ACTION SystemAction', 'SYSTEM_POWER_STATE MinSystemState', 'ULONG Flags', 'BOOLEAN Asynchronous']
 	case 93: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1749,6 +1843,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 94 NTSTATUS NtIsProcessInJob ['HANDLE ProcessHandle', 'HANDLE JobHandle']
 	case 94: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1762,11 +1857,13 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 95 BOOLEAN NtIsSystemResumeAutomatic ['']
 	case 95: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_NtIsSystemResumeAutomatic_enter, cpu, pc);
 	}; break;
 	// 96 NTSTATUS NtListenPort ['HANDLE PortHandle', 'PPORT_MESSAGE ConnectionRequest']
 	case 96: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1780,6 +1877,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 97 NTSTATUS NtLoadDriver ['PUNICODE_STRING DriverServiceName']
 	case 97: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1791,6 +1889,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 98 NTSTATUS NtLoadKey ['POBJECT_ATTRIBUTES TargetKey', 'POBJECT_ATTRIBUTES SourceFile']
 	case 98: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1804,6 +1903,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 99 NTSTATUS NtLoadKey2 ['POBJECT_ATTRIBUTES TargetKey', 'POBJECT_ATTRIBUTES SourceFile', 'ULONG Flags']
 	case 99: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1819,6 +1919,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 100 NTSTATUS NtLockFile ['HANDLE FileHandle', 'HANDLE Event', 'PIO_APC_ROUTINE ApcRoutine', 'PVOID ApcContext', 'PIO_STATUS_BLOCK IoStatusBlock', 'PLARGE_INTEGER ByteOffset', 'PLARGE_INTEGER Length', 'ULONG Key', 'BOOLEAN FailImmediately', 'BOOLEAN ExclusiveLock']
 	case 100: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1848,6 +1949,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 101 NTSTATUS NtLockProductActivationKeys ['ULONG *pPrivateVer', 'ULONG *pSafeMode']
 	case 101: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1861,6 +1963,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 102 NTSTATUS NtLockRegistryKey ['HANDLE KeyHandle']
 	case 102: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1872,6 +1975,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 103 NTSTATUS NtLockVirtualMemory ['HANDLE ProcessHandle', 'PVOID *BaseAddress', 'PSIZE_T RegionSize', 'ULONG MapType']
 	case 103: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1889,6 +1993,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 104 NTSTATUS NtMakePermanentObject ['HANDLE Handle']
 	case 104: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1900,6 +2005,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 105 NTSTATUS NtMakeTemporaryObject ['HANDLE Handle']
 	case 105: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1911,6 +2017,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 106 NTSTATUS NtMapUserPhysicalPages ['PVOID VirtualAddress', 'ULONG_PTR NumberOfPages', 'PULONG_PTR UserPfnArray']
 	case 106: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1926,6 +2033,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 107 NTSTATUS NtMapUserPhysicalPagesScatter ['PVOID *VirtualAddresses', 'ULONG_PTR NumberOfPages', 'PULONG_PTR UserPfnArray']
 	case 107: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1941,6 +2049,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 108 NTSTATUS NtMapViewOfSection ['HANDLE SectionHandle', 'HANDLE ProcessHandle', 'PVOID *BaseAddress', 'ULONG_PTR ZeroBits', 'SIZE_T CommitSize', 'PLARGE_INTEGER SectionOffset', 'PSIZE_T ViewSize', 'SECTION_INHERIT InheritDisposition', 'ULONG AllocationType', 'WIN32_PROTECTION_MASK Win32Protect']
 	case 108: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1970,6 +2079,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 109 NTSTATUS NtModifyBootEntry ['PBOOT_ENTRY BootEntry']
 	case 109: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1981,6 +2091,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 110 NTSTATUS NtNotifyChangeDirectoryFile ['HANDLE FileHandle', 'HANDLE Event', 'PIO_APC_ROUTINE ApcRoutine', 'PVOID ApcContext', 'PIO_STATUS_BLOCK IoStatusBlock', 'PVOID Buffer', 'ULONG Length', 'ULONG CompletionFilter', 'BOOLEAN WatchTree']
 	case 110: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2008,6 +2119,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 111 NTSTATUS NtNotifyChangeKey ['HANDLE KeyHandle', 'HANDLE Event', 'PIO_APC_ROUTINE ApcRoutine', 'PVOID ApcContext', 'PIO_STATUS_BLOCK IoStatusBlock', 'ULONG CompletionFilter', 'BOOLEAN WatchTree', 'PVOID Buffer', 'ULONG BufferSize', 'BOOLEAN Asynchronous']
 	case 111: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2037,6 +2149,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 112 NTSTATUS NtNotifyChangeMultipleKeys ['HANDLE MasterKeyHandle', 'ULONG Count', 'OBJECT_ATTRIBUTES SlaveObjects[]', 'HANDLE Event', 'PIO_APC_ROUTINE ApcRoutine', 'PVOID ApcContext', 'PIO_STATUS_BLOCK IoStatusBlock', 'ULONG CompletionFilter', 'BOOLEAN WatchTree', 'PVOID Buffer', 'ULONG BufferSize', 'BOOLEAN Asynchronous']
 	case 112: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2070,6 +2183,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 113 NTSTATUS NtOpenDirectoryObject ['PHANDLE DirectoryHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes']
 	case 113: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2085,6 +2199,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 114 NTSTATUS NtOpenEvent ['PHANDLE EventHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes']
 	case 114: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2100,6 +2215,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 115 NTSTATUS NtOpenEventPair ['PHANDLE EventPairHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes']
 	case 115: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2115,6 +2231,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 116 NTSTATUS NtOpenFile ['PHANDLE FileHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes', 'PIO_STATUS_BLOCK IoStatusBlock', 'ULONG ShareAccess', 'ULONG OpenOptions']
 	case 116: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2136,6 +2253,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 117 NTSTATUS NtOpenIoCompletion ['PHANDLE IoCompletionHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes']
 	case 117: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2151,6 +2269,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 118 NTSTATUS NtOpenJobObject ['PHANDLE JobHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes']
 	case 118: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2166,6 +2285,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 119 NTSTATUS NtOpenKey ['PHANDLE KeyHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes']
 	case 119: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2181,6 +2301,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 120 NTSTATUS NtOpenMutant ['PHANDLE MutantHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes']
 	case 120: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2196,6 +2317,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 121 NTSTATUS NtOpenObjectAuditAlarm ['PUNICODE_STRING SubsystemName', 'PVOID HandleId', 'PUNICODE_STRING ObjectTypeName', 'PUNICODE_STRING ObjectName', 'PSECURITY_DESCRIPTOR SecurityDescriptor', 'HANDLE ClientToken', 'ACCESS_MASK DesiredAccess', 'ACCESS_MASK GrantedAccess', 'PPRIVILEGE_SET Privileges', 'BOOLEAN ObjectCreation', 'BOOLEAN AccessGranted', 'PBOOLEAN GenerateOnClose']
 	case 121: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2229,6 +2351,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 122 NTSTATUS NtOpenProcess ['PHANDLE ProcessHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes', 'PCLIENT_ID ClientId']
 	case 122: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2246,6 +2369,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 123 NTSTATUS NtOpenProcessToken ['HANDLE ProcessHandle', 'ACCESS_MASK DesiredAccess', 'PHANDLE TokenHandle']
 	case 123: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2261,6 +2385,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 124 NTSTATUS NtOpenProcessTokenEx ['HANDLE ProcessHandle', 'ACCESS_MASK DesiredAccess', 'ULONG HandleAttributes', 'PHANDLE TokenHandle']
 	case 124: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2278,6 +2403,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 125 NTSTATUS NtOpenSection ['PHANDLE SectionHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes']
 	case 125: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2293,6 +2419,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 126 NTSTATUS NtOpenSemaphore ['PHANDLE SemaphoreHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes']
 	case 126: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2308,6 +2435,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 127 NTSTATUS NtOpenSymbolicLinkObject ['PHANDLE LinkHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes']
 	case 127: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2323,6 +2451,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 128 NTSTATUS NtOpenThread ['PHANDLE ThreadHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes', 'PCLIENT_ID ClientId']
 	case 128: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2340,6 +2469,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 129 NTSTATUS NtOpenThreadToken ['HANDLE ThreadHandle', 'ACCESS_MASK DesiredAccess', 'BOOLEAN OpenAsSelf', 'PHANDLE TokenHandle']
 	case 129: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2357,6 +2487,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 130 NTSTATUS NtOpenThreadTokenEx ['HANDLE ThreadHandle', 'ACCESS_MASK DesiredAccess', 'BOOLEAN OpenAsSelf', 'ULONG HandleAttributes', 'PHANDLE TokenHandle']
 	case 130: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2376,6 +2507,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 131 NTSTATUS NtOpenTimer ['PHANDLE TimerHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes']
 	case 131: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2391,6 +2523,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 132 NTSTATUS NtPlugPlayControl ['PLUGPLAY_CONTROL_CLASS PnPControlClass', 'PVOID PnPControlData', 'ULONG PnPControlDataLength']
 	case 132: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2406,6 +2539,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 133 NTSTATUS NtPowerInformation ['POWER_INFORMATION_LEVEL InformationLevel', 'PVOID InputBuffer', 'ULONG InputBufferLength', 'PVOID OutputBuffer', 'ULONG OutputBufferLength']
 	case 133: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2425,6 +2559,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 134 NTSTATUS NtPrivilegeCheck ['HANDLE ClientToken', 'PPRIVILEGE_SET RequiredPrivileges', 'PBOOLEAN Result']
 	case 134: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2440,6 +2575,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 135 NTSTATUS NtPrivilegeObjectAuditAlarm ['PUNICODE_STRING SubsystemName', 'PVOID HandleId', 'HANDLE ClientToken', 'ACCESS_MASK DesiredAccess', 'PPRIVILEGE_SET Privileges', 'BOOLEAN AccessGranted']
 	case 135: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2461,6 +2597,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 136 NTSTATUS NtPrivilegedServiceAuditAlarm ['PUNICODE_STRING SubsystemName', 'PUNICODE_STRING ServiceName', 'HANDLE ClientToken', 'PPRIVILEGE_SET Privileges', 'BOOLEAN AccessGranted']
 	case 136: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2480,6 +2617,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 137 NTSTATUS NtProtectVirtualMemory ['HANDLE ProcessHandle', 'PVOID *BaseAddress', 'PSIZE_T RegionSize', 'WIN32_PROTECTION_MASK NewProtectWin32', 'PULONG OldProtect']
 	case 137: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2499,6 +2637,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 138 NTSTATUS NtPulseEvent ['HANDLE EventHandle', 'PLONG PreviousState']
 	case 138: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2512,6 +2651,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 139 NTSTATUS NtQueryAttributesFile ['POBJECT_ATTRIBUTES ObjectAttributes', 'PFILE_BASIC_INFORMATION FileInformation']
 	case 139: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2525,6 +2665,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 140 NTSTATUS NtQueryBootEntryOrder ['PULONG Ids', 'PULONG Count']
 	case 140: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2538,6 +2679,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 141 NTSTATUS NtQueryBootOptions ['PBOOT_OPTIONS BootOptions', 'PULONG BootOptionsLength']
 	case 141: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2551,6 +2693,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 142 NTSTATUS NtQueryDebugFilterState ['ULONG ComponentId', 'ULONG Level']
 	case 142: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2564,6 +2707,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 143 NTSTATUS NtQueryDefaultLocale ['BOOLEAN UserProfile', 'PLCID DefaultLocaleId']
 	case 143: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2577,6 +2721,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 144 NTSTATUS NtQueryDefaultUILanguage ['LANGID *DefaultUILanguageId']
 	case 144: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -2588,6 +2733,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 145 NTSTATUS NtQueryDirectoryFile ['HANDLE FileHandle', 'HANDLE Event', 'PIO_APC_ROUTINE ApcRoutine', 'PVOID ApcContext', 'PIO_STATUS_BLOCK IoStatusBlock', 'PVOID FileInformation', 'ULONG Length', 'FILE_INFORMATION_CLASS FileInformationClass', 'BOOLEAN ReturnSingleEntry', 'PUNICODE_STRING FileName', 'BOOLEAN RestartScan']
 	case 145: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2619,6 +2765,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 146 NTSTATUS NtQueryDirectoryObject ['HANDLE DirectoryHandle', 'PVOID Buffer', 'ULONG Length', 'BOOLEAN ReturnSingleEntry', 'BOOLEAN RestartScan', 'PULONG Context', 'PULONG ReturnLength']
 	case 146: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2642,6 +2789,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 147 NTSTATUS NtQueryEaFile ['HANDLE FileHandle', 'PIO_STATUS_BLOCK IoStatusBlock', 'PVOID Buffer', 'ULONG Length', 'BOOLEAN ReturnSingleEntry', 'PVOID EaList', 'ULONG EaListLength', 'PULONG EaIndex', 'BOOLEAN RestartScan']
 	case 147: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2669,6 +2817,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 148 NTSTATUS NtQueryEvent ['HANDLE EventHandle', 'EVENT_INFORMATION_CLASS EventInformationClass', 'PVOID EventInformation', 'ULONG EventInformationLength', 'PULONG ReturnLength']
 	case 148: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2688,6 +2837,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 149 NTSTATUS NtQueryFullAttributesFile ['POBJECT_ATTRIBUTES ObjectAttributes', 'PFILE_NETWORK_OPEN_INFORMATION FileInformation']
 	case 149: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2701,6 +2851,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 150 NTSTATUS NtQueryInformationAtom ['RTL_ATOM Atom', 'ATOM_INFORMATION_CLASS InformationClass', 'PVOID AtomInformation', 'ULONG AtomInformationLength', 'PULONG ReturnLength']
 	case 150: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2720,6 +2871,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 151 NTSTATUS NtQueryInformationFile ['HANDLE FileHandle', 'PIO_STATUS_BLOCK IoStatusBlock', 'PVOID FileInformation', 'ULONG Length', 'FILE_INFORMATION_CLASS FileInformationClass']
 	case 151: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2739,6 +2891,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 152 NTSTATUS NtQueryInformationJobObject ['HANDLE JobHandle', 'JOBOBJECTINFOCLASS JobObjectInformationClass', 'PVOID JobObjectInformation', 'ULONG JobObjectInformationLength', 'PULONG ReturnLength']
 	case 152: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2758,6 +2911,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 153 NTSTATUS NtQueryInformationPort ['HANDLE PortHandle', 'PORT_INFORMATION_CLASS PortInformationClass', 'PVOID PortInformation', 'ULONG Length', 'PULONG ReturnLength']
 	case 153: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2777,6 +2931,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 154 NTSTATUS NtQueryInformationProcess ['HANDLE ProcessHandle', 'PROCESSINFOCLASS ProcessInformationClass', 'PVOID ProcessInformation', 'ULONG ProcessInformationLength', 'PULONG ReturnLength']
 	case 154: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2796,6 +2951,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 155 NTSTATUS NtQueryInformationThread ['HANDLE ThreadHandle', 'THREADINFOCLASS ThreadInformationClass', 'PVOID ThreadInformation', 'ULONG ThreadInformationLength', 'PULONG ReturnLength']
 	case 155: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2815,6 +2971,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 156 NTSTATUS NtQueryInformationToken ['HANDLE TokenHandle', 'TOKEN_INFORMATION_CLASS TokenInformationClass', 'PVOID TokenInformation', 'ULONG TokenInformationLength', 'PULONG ReturnLength']
 	case 156: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2834,6 +2991,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 157 NTSTATUS NtQueryInstallUILanguage ['LANGID *InstallUILanguageId']
 	case 157: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -2845,6 +3003,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 158 NTSTATUS NtQueryIntervalProfile ['KPROFILE_SOURCE ProfileSource', 'PULONG Interval']
 	case 158: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2858,6 +3017,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 159 NTSTATUS NtQueryIoCompletion ['HANDLE IoCompletionHandle', 'IO_COMPLETION_INFORMATION_CLASS IoCompletionInformationClass', 'PVOID IoCompletionInformation', 'ULONG IoCompletionInformationLength', 'PULONG ReturnLength']
 	case 159: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2877,6 +3037,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 160 NTSTATUS NtQueryKey ['HANDLE KeyHandle', 'KEY_INFORMATION_CLASS KeyInformationClass', 'PVOID KeyInformation', 'ULONG Length', 'PULONG ResultLength']
 	case 160: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2896,6 +3057,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 161 NTSTATUS NtQueryMultipleValueKey ['HANDLE KeyHandle', 'PKEY_VALUE_ENTRY ValueEntries', 'ULONG EntryCount', 'PVOID ValueBuffer', 'PULONG BufferLength', 'PULONG RequiredBufferLength']
 	case 161: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2917,6 +3079,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 162 NTSTATUS NtQueryMutant ['HANDLE MutantHandle', 'MUTANT_INFORMATION_CLASS MutantInformationClass', 'PVOID MutantInformation', 'ULONG MutantInformationLength', 'PULONG ReturnLength']
 	case 162: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2936,6 +3099,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 163 NTSTATUS NtQueryObject ['HANDLE Handle', 'OBJECT_INFORMATION_CLASS ObjectInformationClass', 'PVOID ObjectInformation', 'ULONG ObjectInformationLength', 'PULONG ReturnLength']
 	case 163: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2955,6 +3119,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 164 NTSTATUS NtQueryOpenSubKeys ['POBJECT_ATTRIBUTES TargetKey', 'PULONG HandleCount']
 	case 164: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2968,6 +3133,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 165 NTSTATUS NtQueryPerformanceCounter ['PLARGE_INTEGER PerformanceCounter', 'PLARGE_INTEGER PerformanceFrequency']
 	case 165: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2981,6 +3147,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 166 NTSTATUS NtQueryQuotaInformationFile ['HANDLE FileHandle', 'PIO_STATUS_BLOCK IoStatusBlock', 'PVOID Buffer', 'ULONG Length', 'BOOLEAN ReturnSingleEntry', 'PVOID SidList', 'ULONG SidListLength', 'PULONG StartSid', 'BOOLEAN RestartScan']
 	case 166: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3008,6 +3175,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 167 NTSTATUS NtQuerySection ['HANDLE SectionHandle', 'SECTION_INFORMATION_CLASS SectionInformationClass', 'PVOID SectionInformation', 'SIZE_T SectionInformationLength', 'PSIZE_T ReturnLength']
 	case 167: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3027,6 +3195,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 168 NTSTATUS NtQuerySecurityObject ['HANDLE Handle', 'SECURITY_INFORMATION SecurityInformation', 'PSECURITY_DESCRIPTOR SecurityDescriptor', 'ULONG Length', 'PULONG LengthNeeded']
 	case 168: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3046,6 +3215,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 169 NTSTATUS NtQuerySemaphore ['HANDLE SemaphoreHandle', 'SEMAPHORE_INFORMATION_CLASS SemaphoreInformationClass', 'PVOID SemaphoreInformation', 'ULONG SemaphoreInformationLength', 'PULONG ReturnLength']
 	case 169: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3065,6 +3235,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 170 NTSTATUS NtQuerySymbolicLinkObject ['HANDLE LinkHandle', 'PUNICODE_STRING LinkTarget', 'PULONG ReturnedLength']
 	case 170: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3080,6 +3251,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 171 NTSTATUS NtQuerySystemEnvironmentValue ['PUNICODE_STRING VariableName', 'PWSTR VariableValue', 'USHORT ValueLength', 'PUSHORT ReturnLength']
 	case 171: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3097,6 +3269,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 172 NTSTATUS NtQuerySystemEnvironmentValueEx ['PUNICODE_STRING VariableName', 'LPGUID VendorGuid', 'PVOID Value', 'PULONG ValueLength', 'PULONG Attributes']
 	case 172: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3116,6 +3289,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 173 NTSTATUS NtQuerySystemInformation ['SYSTEM_INFORMATION_CLASS SystemInformationClass', 'PVOID SystemInformation', 'ULONG SystemInformationLength', 'PULONG ReturnLength']
 	case 173: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3133,6 +3307,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 174 NTSTATUS NtQuerySystemTime ['PLARGE_INTEGER SystemTime']
 	case 174: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -3144,6 +3319,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 175 NTSTATUS NtQueryTimer ['HANDLE TimerHandle', 'TIMER_INFORMATION_CLASS TimerInformationClass', 'PVOID TimerInformation', 'ULONG TimerInformationLength', 'PULONG ReturnLength']
 	case 175: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3163,6 +3339,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 176 NTSTATUS NtQueryTimerResolution ['PULONG MaximumTime', 'PULONG MinimumTime', 'PULONG CurrentTime']
 	case 176: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3178,6 +3355,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 177 NTSTATUS NtQueryValueKey ['HANDLE KeyHandle', 'PUNICODE_STRING ValueName', 'KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass', 'PVOID KeyValueInformation', 'ULONG Length', 'PULONG ResultLength']
 	case 177: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3199,6 +3377,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 178 NTSTATUS NtQueryVirtualMemory ['HANDLE ProcessHandle', 'PVOID BaseAddress', 'MEMORY_INFORMATION_CLASS MemoryInformationClass', 'PVOID MemoryInformation', 'SIZE_T MemoryInformationLength', 'PSIZE_T ReturnLength']
 	case 178: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3220,6 +3399,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 179 NTSTATUS NtQueryVolumeInformationFile ['HANDLE FileHandle', 'PIO_STATUS_BLOCK IoStatusBlock', 'PVOID FsInformation', 'ULONG Length', 'FS_INFORMATION_CLASS FsInformationClass']
 	case 179: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3239,6 +3419,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 180 NTSTATUS NtQueueApcThread ['HANDLE ThreadHandle', 'PPS_APC_ROUTINE ApcRoutine', 'PVOID ApcArgument1', 'PVOID ApcArgument2', 'PVOID ApcArgument3']
 	case 180: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3258,6 +3439,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 181 NTSTATUS NtRaiseException ['PEXCEPTION_RECORD ExceptionRecord', 'PCONTEXT ContextRecord', 'BOOLEAN FirstChance']
 	case 181: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3273,6 +3455,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 182 NTSTATUS NtRaiseHardError ['NTSTATUS ErrorStatus', 'ULONG NumberOfParameters', 'ULONG UnicodeStringParameterMask', 'PULONG_PTR Parameters', 'ULONG ValidResponseOptions', 'PULONG Response']
 	case 182: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3294,6 +3477,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 183 NTSTATUS NtReadFile ['HANDLE FileHandle', 'HANDLE Event', 'PIO_APC_ROUTINE ApcRoutine', 'PVOID ApcContext', 'PIO_STATUS_BLOCK IoStatusBlock', 'PVOID Buffer', 'ULONG Length', 'PLARGE_INTEGER ByteOffset', 'PULONG Key']
 	case 183: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3321,6 +3505,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 184 NTSTATUS NtReadFileScatter ['HANDLE FileHandle', 'HANDLE Event', 'PIO_APC_ROUTINE ApcRoutine', 'PVOID ApcContext', 'PIO_STATUS_BLOCK IoStatusBlock', 'PFILE_SEGMENT_ELEMENT SegmentArray', 'ULONG Length', 'PLARGE_INTEGER ByteOffset', 'PULONG Key']
 	case 184: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3348,6 +3533,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 185 NTSTATUS NtReadRequestData ['HANDLE PortHandle', 'PPORT_MESSAGE Message', 'ULONG DataEntryIndex', 'PVOID Buffer', 'SIZE_T BufferSize', 'PSIZE_T NumberOfBytesRead']
 	case 185: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3369,6 +3555,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 186 NTSTATUS NtReadVirtualMemory ['HANDLE ProcessHandle', 'PVOID BaseAddress', 'PVOID Buffer', 'SIZE_T BufferSize', 'PSIZE_T NumberOfBytesRead']
 	case 186: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3388,6 +3575,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 187 NTSTATUS NtRegisterThreadTerminatePort ['HANDLE PortHandle']
 	case 187: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -3399,6 +3587,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 188 NTSTATUS NtReleaseMutant ['HANDLE MutantHandle', 'PLONG PreviousCount']
 	case 188: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3412,6 +3601,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 189 NTSTATUS NtReleaseSemaphore ['HANDLE SemaphoreHandle', 'LONG ReleaseCount', 'PLONG PreviousCount']
 	case 189: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3427,6 +3617,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 190 NTSTATUS NtRemoveIoCompletion ['HANDLE IoCompletionHandle', 'PVOID *KeyContext', 'PVOID *ApcContext', 'PIO_STATUS_BLOCK IoStatusBlock', 'PLARGE_INTEGER Timeout']
 	case 190: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3446,6 +3637,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 191 NTSTATUS NtRemoveProcessDebug ['HANDLE ProcessHandle', 'HANDLE DebugObjectHandle']
 	case 191: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3459,6 +3651,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 192 NTSTATUS NtRenameKey ['HANDLE KeyHandle', 'PUNICODE_STRING NewName']
 	case 192: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3472,6 +3665,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 193 NTSTATUS NtReplaceKey ['POBJECT_ATTRIBUTES NewFile', 'HANDLE TargetHandle', 'POBJECT_ATTRIBUTES OldFile']
 	case 193: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3487,6 +3681,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 194 NTSTATUS NtReplyPort ['HANDLE PortHandle', 'PPORT_MESSAGE ReplyMessage']
 	case 194: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3500,6 +3695,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 195 NTSTATUS NtReplyWaitReceivePort ['HANDLE PortHandle', 'PVOID *PortContext', 'PPORT_MESSAGE ReplyMessage', 'PPORT_MESSAGE ReceiveMessage']
 	case 195: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3517,6 +3713,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 196 NTSTATUS NtReplyWaitReceivePortEx ['HANDLE PortHandle', 'PVOID *PortContext', 'PPORT_MESSAGE ReplyMessage', 'PPORT_MESSAGE ReceiveMessage', 'PLARGE_INTEGER Timeout']
 	case 196: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3536,6 +3733,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 197 NTSTATUS NtReplyWaitReplyPort ['HANDLE PortHandle', 'PPORT_MESSAGE ReplyMessage']
 	case 197: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3549,6 +3747,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 199 NTSTATUS NtRequestPort ['HANDLE PortHandle', 'PPORT_MESSAGE RequestMessage']
 	case 199: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3562,6 +3761,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 200 NTSTATUS NtRequestWaitReplyPort ['HANDLE PortHandle', 'PPORT_MESSAGE RequestMessage', 'PPORT_MESSAGE ReplyMessage']
 	case 200: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3577,6 +3777,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 202 NTSTATUS NtResetEvent ['HANDLE EventHandle', 'PLONG PreviousState']
 	case 202: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3590,6 +3791,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 203 NTSTATUS NtResetWriteWatch ['HANDLE ProcessHandle', 'PVOID BaseAddress', 'SIZE_T RegionSize']
 	case 203: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3605,6 +3807,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 204 NTSTATUS NtRestoreKey ['HANDLE KeyHandle', 'HANDLE FileHandle', 'ULONG Flags']
 	case 204: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3620,6 +3823,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 205 NTSTATUS NtResumeProcess ['HANDLE ProcessHandle']
 	case 205: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -3631,6 +3835,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 206 NTSTATUS NtResumeThread ['HANDLE ThreadHandle', 'PULONG PreviousSuspendCount']
 	case 206: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3644,6 +3849,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 207 NTSTATUS NtSaveKey ['HANDLE KeyHandle', 'HANDLE FileHandle']
 	case 207: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3657,6 +3863,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 208 NTSTATUS NtSaveKeyEx ['HANDLE KeyHandle', 'HANDLE FileHandle', 'ULONG Format']
 	case 208: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3672,6 +3879,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 209 NTSTATUS NtSaveMergedKeys ['HANDLE HighPrecedenceKeyHandle', 'HANDLE LowPrecedenceKeyHandle', 'HANDLE FileHandle']
 	case 209: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3687,6 +3895,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 210 NTSTATUS NtSecureConnectPort ['PHANDLE PortHandle', 'PUNICODE_STRING PortName', 'PSECURITY_QUALITY_OF_SERVICE SecurityQos', 'PPORT_VIEW ClientView', 'PSID RequiredServerSid', 'PREMOTE_PORT_VIEW ServerView', 'PULONG MaxMessageLength', 'PVOID ConnectionInformation', 'PULONG ConnectionInformationLength']
 	case 210: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3714,6 +3923,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 211 NTSTATUS NtSetBootEntryOrder ['PULONG Ids', 'ULONG Count']
 	case 211: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3727,6 +3937,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 212 NTSTATUS NtSetBootOptions ['PBOOT_OPTIONS BootOptions', 'ULONG FieldsToChange']
 	case 212: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3740,6 +3951,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 213 NTSTATUS NtSetContextThread ['HANDLE ThreadHandle', 'PCONTEXT ThreadContext']
 	case 213: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3753,6 +3965,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 214 NTSTATUS NtSetDebugFilterState ['ULONG ComponentId', 'ULONG Level', 'BOOLEAN State']
 	case 214: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3768,6 +3981,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 215 NTSTATUS NtSetDefaultHardErrorPort ['HANDLE DefaultHardErrorPort']
 	case 215: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -3779,6 +3993,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 216 NTSTATUS NtSetDefaultLocale ['BOOLEAN UserProfile', 'LCID DefaultLocaleId']
 	case 216: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3792,6 +4007,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 217 NTSTATUS NtSetDefaultUILanguage ['LANGID DefaultUILanguageId']
 	case 217: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -3803,6 +4019,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 218 NTSTATUS NtSetEaFile ['HANDLE FileHandle', 'PIO_STATUS_BLOCK IoStatusBlock', 'PVOID Buffer', 'ULONG Length']
 	case 218: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3820,6 +4037,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 219 NTSTATUS NtSetEvent ['HANDLE EventHandle', 'PLONG PreviousState']
 	case 219: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3833,6 +4051,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 220 NTSTATUS NtSetEventBoostPriority ['HANDLE EventHandle']
 	case 220: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -3844,6 +4063,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 221 NTSTATUS NtSetHighEventPair ['HANDLE EventPairHandle']
 	case 221: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -3855,6 +4075,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 222 NTSTATUS NtSetHighWaitLowEventPair ['HANDLE EventPairHandle']
 	case 222: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -3866,6 +4087,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 223 NTSTATUS NtSetInformationDebugObject ['HANDLE DebugObjectHandle', 'DEBUGOBJECTINFOCLASS DebugObjectInformationClass', 'PVOID DebugInformation', 'ULONG DebugInformationLength', 'PULONG ReturnLength']
 	case 223: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3885,6 +4107,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 224 NTSTATUS NtSetInformationFile ['HANDLE FileHandle', 'PIO_STATUS_BLOCK IoStatusBlock', 'PVOID FileInformation', 'ULONG Length', 'FILE_INFORMATION_CLASS FileInformationClass']
 	case 224: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3904,6 +4127,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 225 NTSTATUS NtSetInformationJobObject ['HANDLE JobHandle', 'JOBOBJECTINFOCLASS JobObjectInformationClass', 'PVOID JobObjectInformation', 'ULONG JobObjectInformationLength']
 	case 225: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3921,6 +4145,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 226 NTSTATUS NtSetInformationKey ['HANDLE KeyHandle', 'KEY_SET_INFORMATION_CLASS KeySetInformationClass', 'PVOID KeySetInformation', 'ULONG KeySetInformationLength']
 	case 226: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3938,6 +4163,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 227 NTSTATUS NtSetInformationObject ['HANDLE Handle', 'OBJECT_INFORMATION_CLASS ObjectInformationClass', 'PVOID ObjectInformation', 'ULONG ObjectInformationLength']
 	case 227: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3955,6 +4181,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 228 NTSTATUS NtSetInformationProcess ['HANDLE ProcessHandle', 'PROCESSINFOCLASS ProcessInformationClass', 'PVOID ProcessInformation', 'ULONG ProcessInformationLength']
 	case 228: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3972,6 +4199,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 229 NTSTATUS NtSetInformationThread ['HANDLE ThreadHandle', 'THREADINFOCLASS ThreadInformationClass', 'PVOID ThreadInformation', 'ULONG ThreadInformationLength']
 	case 229: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3989,6 +4217,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 230 NTSTATUS NtSetInformationToken ['HANDLE TokenHandle', 'TOKEN_INFORMATION_CLASS TokenInformationClass', 'PVOID TokenInformation', 'ULONG TokenInformationLength']
 	case 230: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4006,6 +4235,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 231 NTSTATUS NtSetIntervalProfile ['ULONG Interval', 'KPROFILE_SOURCE Source']
 	case 231: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -4019,6 +4249,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 232 NTSTATUS NtSetIoCompletion ['HANDLE IoCompletionHandle', 'PVOID KeyContext', 'PVOID ApcContext', 'NTSTATUS IoStatus', 'ULONG_PTR IoStatusInformation']
 	case 232: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4038,6 +4269,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 233 NTSTATUS NtSetLdtEntries ['ULONG Selector0', 'ULONG Entry0Low', 'ULONG Entry0Hi', 'ULONG Selector1', 'ULONG Entry1Low', 'ULONG Entry1Hi']
 	case 233: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4059,6 +4291,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 234 NTSTATUS NtSetLowEventPair ['HANDLE EventPairHandle']
 	case 234: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -4070,6 +4303,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 235 NTSTATUS NtSetLowWaitHighEventPair ['HANDLE EventPairHandle']
 	case 235: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -4081,6 +4315,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 236 NTSTATUS NtSetQuotaInformationFile ['HANDLE FileHandle', 'PIO_STATUS_BLOCK IoStatusBlock', 'PVOID Buffer', 'ULONG Length']
 	case 236: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4098,6 +4333,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 237 NTSTATUS NtSetSecurityObject ['HANDLE Handle', 'SECURITY_INFORMATION SecurityInformation', 'PSECURITY_DESCRIPTOR SecurityDescriptor']
 	case 237: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4113,6 +4349,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 238 NTSTATUS NtSetSystemEnvironmentValue ['PUNICODE_STRING VariableName', 'PUNICODE_STRING VariableValue']
 	case 238: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -4126,6 +4363,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 239 NTSTATUS NtSetSystemEnvironmentValueEx ['PUNICODE_STRING VariableName', 'LPGUID VendorGuid', 'PVOID Value', 'ULONG ValueLength', 'ULONG Attributes']
 	case 239: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4145,6 +4383,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 240 NTSTATUS NtSetSystemInformation ['SYSTEM_INFORMATION_CLASS SystemInformationClass', 'PVOID SystemInformation', 'ULONG SystemInformationLength']
 	case 240: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4160,6 +4399,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 241 NTSTATUS NtSetSystemPowerState ['POWER_ACTION SystemAction', 'SYSTEM_POWER_STATE MinSystemState', 'ULONG Flags']
 	case 241: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4175,6 +4415,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 242 NTSTATUS NtSetSystemTime ['PLARGE_INTEGER SystemTime', 'PLARGE_INTEGER PreviousTime']
 	case 242: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -4188,6 +4429,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 243 NTSTATUS NtSetThreadExecutionState ['EXECUTION_STATE esFlags', 'PEXECUTION_STATE PreviousFlags']
 	case 243: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -4201,6 +4443,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 244 NTSTATUS NtSetTimer ['HANDLE TimerHandle', 'PLARGE_INTEGER DueTime', 'PTIMER_APC_ROUTINE TimerApcRoutine', 'PVOID TimerContext', 'BOOLEAN WakeTimer', 'LONG Period', 'PBOOLEAN PreviousState']
 	case 244: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4224,6 +4467,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 245 NTSTATUS NtSetTimerResolution ['ULONG DesiredTime', 'BOOLEAN SetResolution', 'PULONG ActualTime']
 	case 245: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4239,6 +4483,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 246 NTSTATUS NtSetUuidSeed ['PCHAR Seed']
 	case 246: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -4250,6 +4495,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 247 NTSTATUS NtSetValueKey ['HANDLE KeyHandle', 'PUNICODE_STRING ValueName', 'ULONG TitleIndex', 'ULONG Type', 'PVOID Data', 'ULONG DataSize']
 	case 247: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4271,6 +4517,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 248 NTSTATUS NtSetVolumeInformationFile ['HANDLE FileHandle', 'PIO_STATUS_BLOCK IoStatusBlock', 'PVOID FsInformation', 'ULONG Length', 'FS_INFORMATION_CLASS FsInformationClass']
 	case 248: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4290,6 +4537,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 249 NTSTATUS NtShutdownSystem ['SHUTDOWN_ACTION Action']
 	case 249: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -4301,6 +4549,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 250 NTSTATUS NtSignalAndWaitForSingleObject ['HANDLE SignalHandle', 'HANDLE WaitHandle', 'BOOLEAN Alertable', 'PLARGE_INTEGER Timeout']
 	case 250: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4318,6 +4567,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 251 NTSTATUS NtStartProfile ['HANDLE ProfileHandle']
 	case 251: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -4329,6 +4579,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 252 NTSTATUS NtStopProfile ['HANDLE ProfileHandle']
 	case 252: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -4340,6 +4591,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 253 NTSTATUS NtSuspendProcess ['HANDLE ProcessHandle']
 	case 253: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -4351,6 +4603,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 254 NTSTATUS NtSuspendThread ['HANDLE ThreadHandle', 'PULONG PreviousSuspendCount']
 	case 254: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -4364,6 +4617,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 255 NTSTATUS NtSystemDebugControl ['SYSDBG_COMMAND Command', 'PVOID InputBuffer', 'ULONG InputBufferLength', 'PVOID OutputBuffer', 'ULONG OutputBufferLength', 'PULONG ReturnLength']
 	case 255: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4385,6 +4639,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 256 NTSTATUS NtTerminateJobObject ['HANDLE JobHandle', 'NTSTATUS ExitStatus']
 	case 256: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -4398,6 +4653,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 257 NTSTATUS NtTerminateProcess ['HANDLE ProcessHandle', 'NTSTATUS ExitStatus']
 	case 257: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -4411,6 +4667,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 258 NTSTATUS NtTerminateThread ['HANDLE ThreadHandle', 'NTSTATUS ExitStatus']
 	case 258: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -4424,11 +4681,13 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 259 NTSTATUS NtTestAlert ['']
 	case 259: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_NtTestAlert_enter, cpu, pc);
 	}; break;
 	// 260 NTSTATUS NtTraceEvent ['HANDLE TraceHandle', 'ULONG Flags', 'ULONG FieldSize', 'PVOID Fields']
 	case 260: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4446,6 +4705,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 261 NTSTATUS NtTranslateFilePath ['PFILE_PATH InputFilePath', 'ULONG OutputType', 'PFILE_PATH OutputFilePath', 'PULONG OutputFilePathLength']
 	case 261: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4463,6 +4723,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 262 NTSTATUS NtUnloadDriver ['PUNICODE_STRING DriverServiceName']
 	case 262: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -4474,6 +4735,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 263 NTSTATUS NtUnloadKey ['POBJECT_ATTRIBUTES TargetKey']
 	case 263: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -4485,6 +4747,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 264 NTSTATUS NtUnloadKeyEx ['POBJECT_ATTRIBUTES TargetKey', 'HANDLE Event']
 	case 264: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -4498,6 +4761,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 265 NTSTATUS NtUnlockFile ['HANDLE FileHandle', 'PIO_STATUS_BLOCK IoStatusBlock', 'PLARGE_INTEGER ByteOffset', 'PLARGE_INTEGER Length', 'ULONG Key']
 	case 265: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4517,6 +4781,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 266 NTSTATUS NtUnlockVirtualMemory ['HANDLE ProcessHandle', 'PVOID *BaseAddress', 'PSIZE_T RegionSize', 'ULONG MapType']
 	case 266: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4534,6 +4799,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 267 NTSTATUS NtUnmapViewOfSection ['HANDLE ProcessHandle', 'PVOID BaseAddress']
 	case 267: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -4547,6 +4813,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 268 NTSTATUS NtVdmControl ['VDMSERVICECLASS Service', 'PVOID ServiceData']
 	case 268: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -4560,6 +4827,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 269 NTSTATUS NtWaitForDebugEvent ['HANDLE DebugObjectHandle', 'BOOLEAN Alertable', 'PLARGE_INTEGER Timeout', 'PDBGUI_WAIT_STATE_CHANGE WaitStateChange']
 	case 269: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4577,6 +4845,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 270 NTSTATUS NtWaitForMultipleObjects ['ULONG Count', 'HANDLE Handles[]', 'WAIT_TYPE WaitType', 'BOOLEAN Alertable', 'PLARGE_INTEGER Timeout']
 	case 270: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4596,6 +4865,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 271 NTSTATUS NtWaitForSingleObject ['HANDLE Handle', 'BOOLEAN Alertable', 'PLARGE_INTEGER Timeout']
 	case 271: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4611,6 +4881,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 272 NTSTATUS NtWaitHighEventPair ['HANDLE EventPairHandle']
 	case 272: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -4622,6 +4893,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 273 NTSTATUS NtWaitLowEventPair ['HANDLE EventPairHandle']
 	case 273: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -4633,6 +4905,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 274 NTSTATUS NtWriteFile ['HANDLE FileHandle', 'HANDLE Event', 'PIO_APC_ROUTINE ApcRoutine', 'PVOID ApcContext', 'PIO_STATUS_BLOCK IoStatusBlock', 'PVOID Buffer', 'ULONG Length', 'PLARGE_INTEGER ByteOffset', 'PULONG Key']
 	case 274: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4660,6 +4933,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 275 NTSTATUS NtWriteFileGather ['HANDLE FileHandle', 'HANDLE Event', 'PIO_APC_ROUTINE ApcRoutine', 'PVOID ApcContext', 'PIO_STATUS_BLOCK IoStatusBlock', 'PFILE_SEGMENT_ELEMENT SegmentArray', 'ULONG Length', 'PLARGE_INTEGER ByteOffset', 'PULONG Key']
 	case 275: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4687,6 +4961,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 276 NTSTATUS NtWriteRequestData ['HANDLE PortHandle', 'PPORT_MESSAGE Message', 'ULONG DataEntryIndex', 'PVOID Buffer', 'SIZE_T BufferSize', 'PSIZE_T NumberOfBytesWritten']
 	case 276: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4708,6 +4983,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 277 NTSTATUS NtWriteVirtualMemory ['HANDLE ProcessHandle', 'PVOID BaseAddress', 'PVOID Buffer', 'SIZE_T BufferSize', 'PSIZE_T NumberOfBytesWritten']
 	case 277: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4727,11 +5003,13 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 278 NTSTATUS NtYieldExecution ['']
 	case 278: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_NtYieldExecution_enter, cpu, pc);
 	}; break;
 	// 279 NTSTATUS NtCreateKeyedEvent ['PHANDLE KeyedEventHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes', 'ULONG Flags']
 	case 279: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4749,6 +5027,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 280 NTSTATUS NtOpenKeyedEvent ['PHANDLE KeyedEventHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes']
 	case 280: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4764,6 +5043,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 281 NTSTATUS NtReleaseKeyedEvent ['HANDLE KeyedEventHandle', 'PVOID KeyValue', 'BOOLEAN Alertable', 'PLARGE_INTEGER Timeout']
 	case 281: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4781,6 +5061,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 282 NTSTATUS NtWaitForKeyedEvent ['HANDLE KeyedEventHandle', 'PVOID KeyValue', 'BOOLEAN Alertable', 'PLARGE_INTEGER Timeout']
 	case 282: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4798,6 +5079,7 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 	// 283 NTSTATUS NtQueryPortInformationProcess ['']
 	case 283: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_NtQueryPortInformationProcess_enter, cpu, pc);
 	}; break;
 	default:
diff --git a/panda/plugins/syscalls2/generated/syscall_switch_enter_windows_xpsp3_x86.cpp b/panda/plugins/syscalls2/generated/syscall_switch_enter_windows_xpsp3_x86.cpp
index ca7e79ac45d..3186d357136 100644
--- a/panda/plugins/syscalls2/generated/syscall_switch_enter_windows_xpsp3_x86.cpp
+++ b/panda/plugins/syscalls2/generated/syscall_switch_enter_windows_xpsp3_x86.cpp
@@ -33,6 +33,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	}
 	ctx.asid = panda_current_asid(cpu);
 	ctx.retaddr = calc_retaddr(cpu, pc);
+	ctx.double_return = false;
 	bool panda_noreturn;	// true if PANDA should not track the return of this system call
 	const syscall_info_t *call = NULL;
 	syscall_info_t zero = {0};
@@ -48,6 +49,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 0 NTSTATUS NtAcceptConnectPort ['PHANDLE PortHandle', 'PVOID PortContext', 'PPORT_MESSAGE ConnectionRequest', 'BOOLEAN AcceptConnection', 'PPORT_VIEW ServerView', 'PREMOTE_PORT_VIEW ClientView']
 	case 0: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -69,6 +71,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 1 NTSTATUS NtAccessCheck ['PSECURITY_DESCRIPTOR SecurityDescriptor', 'HANDLE ClientToken', 'ACCESS_MASK DesiredAccess', 'PGENERIC_MAPPING GenericMapping', 'PPRIVILEGE_SET PrivilegeSet', 'PULONG PrivilegeSetLength', 'PACCESS_MASK GrantedAccess', 'PNTSTATUS AccessStatus']
 	case 1: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -94,6 +97,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 2 NTSTATUS NtAccessCheckAndAuditAlarm ['PUNICODE_STRING SubsystemName', 'PVOID HandleId', 'PUNICODE_STRING ObjectTypeName', 'PUNICODE_STRING ObjectName', 'PSECURITY_DESCRIPTOR SecurityDescriptor', 'ACCESS_MASK DesiredAccess', 'PGENERIC_MAPPING GenericMapping', 'BOOLEAN ObjectCreation', 'PACCESS_MASK GrantedAccess', 'PNTSTATUS AccessStatus', 'PBOOLEAN GenerateOnClose']
 	case 2: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -125,6 +129,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 3 NTSTATUS NtAccessCheckByType ['PSECURITY_DESCRIPTOR SecurityDescriptor', 'PSID PrincipalSelfSid', 'HANDLE ClientToken', 'ACCESS_MASK DesiredAccess', 'POBJECT_TYPE_LIST ObjectTypeList', 'ULONG ObjectTypeListLength', 'PGENERIC_MAPPING GenericMapping', 'PPRIVILEGE_SET PrivilegeSet', 'PULONG PrivilegeSetLength', 'PACCESS_MASK GrantedAccess', 'PNTSTATUS AccessStatus']
 	case 3: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -156,6 +161,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 4 NTSTATUS NtAccessCheckByTypeAndAuditAlarm ['PUNICODE_STRING SubsystemName', 'PVOID HandleId', 'PUNICODE_STRING ObjectTypeName', 'PUNICODE_STRING ObjectName', 'PSECURITY_DESCRIPTOR SecurityDescriptor', 'PSID PrincipalSelfSid', 'ACCESS_MASK DesiredAccess', 'AUDIT_EVENT_TYPE AuditType', 'ULONG Flags', 'POBJECT_TYPE_LIST ObjectTypeList', 'ULONG ObjectTypeListLength', 'PGENERIC_MAPPING GenericMapping', 'BOOLEAN ObjectCreation', 'PACCESS_MASK GrantedAccess', 'PNTSTATUS AccessStatus', 'PBOOLEAN GenerateOnClose']
 	case 4: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -197,6 +203,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 5 NTSTATUS NtAccessCheckByTypeResultList ['PSECURITY_DESCRIPTOR SecurityDescriptor', 'PSID PrincipalSelfSid', 'HANDLE ClientToken', 'ACCESS_MASK DesiredAccess', 'POBJECT_TYPE_LIST ObjectTypeList', 'ULONG ObjectTypeListLength', 'PGENERIC_MAPPING GenericMapping', 'PPRIVILEGE_SET PrivilegeSet', 'PULONG PrivilegeSetLength', 'PACCESS_MASK GrantedAccess', 'PNTSTATUS AccessStatus']
 	case 5: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -228,6 +235,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 6 NTSTATUS NtAccessCheckByTypeResultListAndAuditAlarm ['PUNICODE_STRING SubsystemName', 'PVOID HandleId', 'PUNICODE_STRING ObjectTypeName', 'PUNICODE_STRING ObjectName', 'PSECURITY_DESCRIPTOR SecurityDescriptor', 'PSID PrincipalSelfSid', 'ACCESS_MASK DesiredAccess', 'AUDIT_EVENT_TYPE AuditType', 'ULONG Flags', 'POBJECT_TYPE_LIST ObjectTypeList', 'ULONG ObjectTypeListLength', 'PGENERIC_MAPPING GenericMapping', 'BOOLEAN ObjectCreation', 'PACCESS_MASK GrantedAccess', 'PNTSTATUS AccessStatus', 'PBOOLEAN GenerateOnClose']
 	case 6: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -269,6 +277,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 7 NTSTATUS NtAccessCheckByTypeResultListAndAuditAlarmByHandle ['PUNICODE_STRING SubsystemName', 'PVOID HandleId', 'HANDLE ClientToken', 'PUNICODE_STRING ObjectTypeName', 'PUNICODE_STRING ObjectName', 'PSECURITY_DESCRIPTOR SecurityDescriptor', 'PSID PrincipalSelfSid', 'ACCESS_MASK DesiredAccess', 'AUDIT_EVENT_TYPE AuditType', 'ULONG Flags', 'POBJECT_TYPE_LIST ObjectTypeList', 'ULONG ObjectTypeListLength', 'PGENERIC_MAPPING GenericMapping', 'BOOLEAN ObjectCreation', 'PACCESS_MASK GrantedAccess', 'PNTSTATUS AccessStatus', 'PBOOLEAN GenerateOnClose']
 	case 7: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -312,6 +321,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 8 NTSTATUS NtAddAtom ['PWSTR AtomName', 'ULONG Length', 'PRTL_ATOM Atom']
 	case 8: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -327,6 +337,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 9 NTSTATUS NtAddBootEntry ['PBOOT_ENTRY BootEntry', 'PULONG Id']
 	case 9: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -340,6 +351,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 10 NTSTATUS NtAdjustGroupsToken ['HANDLE TokenHandle', 'BOOLEAN ResetToDefault', 'PTOKEN_GROUPS NewState', 'ULONG BufferLength', 'PTOKEN_GROUPS PreviousState', 'PULONG ReturnLength']
 	case 10: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -361,6 +373,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 11 NTSTATUS NtAdjustPrivilegesToken ['HANDLE TokenHandle', 'BOOLEAN DisableAllPrivileges', 'PTOKEN_PRIVILEGES NewState', 'ULONG BufferLength', 'PTOKEN_PRIVILEGES PreviousState', 'PULONG ReturnLength']
 	case 11: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -382,6 +395,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 12 NTSTATUS NtAlertResumeThread ['HANDLE ThreadHandle', 'PULONG PreviousSuspendCount']
 	case 12: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -395,6 +409,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 13 NTSTATUS NtAlertThread ['HANDLE ThreadHandle']
 	case 13: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -406,6 +421,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 14 NTSTATUS NtAllocateLocallyUniqueId ['PLUID Luid']
 	case 14: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -417,6 +433,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 15 NTSTATUS NtAllocateUserPhysicalPages ['HANDLE ProcessHandle', 'PULONG_PTR NumberOfPages', 'PULONG_PTR UserPfnArray']
 	case 15: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -432,6 +449,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 16 NTSTATUS NtAllocateUuids ['PULARGE_INTEGER Time', 'PULONG Range', 'PULONG Sequence', 'PCHAR Seed']
 	case 16: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -449,6 +467,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 17 NTSTATUS NtAllocateVirtualMemory ['HANDLE ProcessHandle', 'PVOID *BaseAddress', 'ULONG_PTR ZeroBits', 'PSIZE_T RegionSize', 'ULONG AllocationType', 'ULONG Protect']
 	case 17: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -470,6 +489,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 18 NTSTATUS NtAreMappedFilesTheSame ['PVOID File1MappedAsAnImage', 'PVOID File2MappedAsFile']
 	case 18: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -483,6 +503,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 19 NTSTATUS NtAssignProcessToJobObject ['HANDLE JobHandle', 'HANDLE ProcessHandle']
 	case 19: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -496,6 +517,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 20 NTSTATUS NtCallbackReturn ['PVOID OutputBuffer', 'ULONG OutputLength', 'NTSTATUS Status']
 	case 20: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -511,6 +533,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 22 NTSTATUS NtCancelIoFile ['HANDLE FileHandle', 'PIO_STATUS_BLOCK IoStatusBlock']
 	case 22: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -524,6 +547,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 23 NTSTATUS NtCancelTimer ['HANDLE TimerHandle', 'PBOOLEAN CurrentState']
 	case 23: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -537,6 +561,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 24 NTSTATUS NtClearEvent ['HANDLE EventHandle']
 	case 24: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -548,6 +573,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 25 NTSTATUS NtClose ['HANDLE Handle']
 	case 25: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -559,6 +585,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 26 NTSTATUS NtCloseObjectAuditAlarm ['PUNICODE_STRING SubsystemName', 'PVOID HandleId', 'BOOLEAN GenerateOnClose']
 	case 26: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -574,6 +601,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 27 NTSTATUS NtCompactKeys ['ULONG Count', 'HANDLE KeyArray[]']
 	case 27: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -587,6 +615,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 28 NTSTATUS NtCompareTokens ['HANDLE FirstTokenHandle', 'HANDLE SecondTokenHandle', 'PBOOLEAN Equal']
 	case 28: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -602,6 +631,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 29 NTSTATUS NtCompleteConnectPort ['HANDLE PortHandle']
 	case 29: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -613,6 +643,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 30 NTSTATUS NtCompressKey ['HANDLE Key']
 	case 30: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -624,6 +655,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 31 NTSTATUS NtConnectPort ['PHANDLE PortHandle', 'PUNICODE_STRING PortName', 'PSECURITY_QUALITY_OF_SERVICE SecurityQos', 'PPORT_VIEW ClientView', 'PREMOTE_PORT_VIEW ServerView', 'PULONG MaxMessageLength', 'PVOID ConnectionInformation', 'PULONG ConnectionInformationLength']
 	case 31: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -649,6 +681,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 32 NTSTATUS NtContinue ['PCONTEXT ContextRecord', 'BOOLEAN TestAlert']
 	case 32: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -662,6 +695,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 33 NTSTATUS NtCreateDebugObject ['PHANDLE DebugObjectHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes', 'ULONG Flags']
 	case 33: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -679,6 +713,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 34 NTSTATUS NtCreateDirectoryObject ['PHANDLE DirectoryHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes']
 	case 34: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -694,6 +729,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 35 NTSTATUS NtCreateEvent ['PHANDLE EventHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes', 'EVENT_TYPE EventType', 'BOOLEAN InitialState']
 	case 35: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -713,6 +749,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 36 NTSTATUS NtCreateEventPair ['PHANDLE EventPairHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes']
 	case 36: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -728,6 +765,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 37 NTSTATUS NtCreateFile ['PHANDLE FileHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes', 'PIO_STATUS_BLOCK IoStatusBlock', 'PLARGE_INTEGER AllocationSize', 'ULONG FileAttributes', 'ULONG ShareAccess', 'ULONG CreateDisposition', 'ULONG CreateOptions', 'PVOID EaBuffer', 'ULONG EaLength']
 	case 37: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -759,6 +797,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 38 NTSTATUS NtCreateIoCompletion ['PHANDLE IoCompletionHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes', 'ULONG Count']
 	case 38: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -776,6 +815,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 39 NTSTATUS NtCreateJobObject ['PHANDLE JobHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes']
 	case 39: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -791,6 +831,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 40 NTSTATUS NtCreateJobSet ['ULONG NumJob', 'PJOB_SET_ARRAY UserJobSet', 'ULONG Flags']
 	case 40: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -806,6 +847,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 41 NTSTATUS NtCreateKey ['PHANDLE KeyHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes', 'ULONG TitleIndex', 'PUNICODE_STRING Class', 'ULONG CreateOptions', 'PULONG Disposition']
 	case 41: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -829,6 +871,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 42 NTSTATUS NtCreateMailslotFile ['PHANDLE FileHandle', 'ULONG DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes', 'PIO_STATUS_BLOCK IoStatusBlock', 'ULONG CreateOptions', 'ULONG MailslotQuota', 'ULONG MaximumMessageSize', 'PLARGE_INTEGER ReadTimeout']
 	case 42: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -854,6 +897,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 43 NTSTATUS NtCreateMutant ['PHANDLE MutantHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes', 'BOOLEAN InitialOwner']
 	case 43: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -871,6 +915,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 44 NTSTATUS NtCreateNamedPipeFile ['PHANDLE FileHandle', 'ULONG DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes', 'PIO_STATUS_BLOCK IoStatusBlock', 'ULONG ShareAccess', 'ULONG CreateDisposition', 'ULONG CreateOptions', 'ULONG NamedPipeType', 'ULONG ReadMode', 'ULONG CompletionMode', 'ULONG MaximumInstances', 'ULONG InboundQuota', 'ULONG OutboundQuota', 'PLARGE_INTEGER DefaultTimeout']
 	case 44: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -908,6 +953,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 45 NTSTATUS NtCreatePagingFile ['PUNICODE_STRING PageFileName', 'PLARGE_INTEGER MinimumSize', 'PLARGE_INTEGER MaximumSize', 'ULONG Priority']
 	case 45: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -925,6 +971,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 46 NTSTATUS NtCreatePort ['PHANDLE PortHandle', 'POBJECT_ATTRIBUTES ObjectAttributes', 'ULONG MaxConnectionInfoLength', 'ULONG MaxMessageLength', 'ULONG MaxPoolUsage']
 	case 46: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -944,6 +991,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 47 NTSTATUS NtCreateProcess ['PHANDLE ProcessHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes', 'HANDLE ParentProcess', 'BOOLEAN InheritObjectTable', 'HANDLE SectionHandle', 'HANDLE DebugPort', 'HANDLE ExceptionPort']
 	case 47: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -969,6 +1017,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 48 NTSTATUS NtCreateProcessEx ['PHANDLE ProcessHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes', 'HANDLE ParentProcess', 'ULONG Flags', 'HANDLE SectionHandle', 'HANDLE DebugPort', 'HANDLE ExceptionPort', 'ULONG JobMemberLevel']
 	case 48: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -996,6 +1045,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 49 NTSTATUS NtCreateProfile ['PHANDLE ProfileHandle', 'HANDLE Process', 'PVOID RangeBase', 'SIZE_T RangeSize', 'ULONG BucketSize', 'PULONG Buffer', 'ULONG BufferSize', 'KPROFILE_SOURCE ProfileSource', 'KAFFINITY Affinity']
 	case 49: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1023,6 +1073,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 50 NTSTATUS NtCreateSection ['PHANDLE SectionHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes', 'PLARGE_INTEGER MaximumSize', 'ULONG SectionPageProtection', 'ULONG AllocationAttributes', 'HANDLE FileHandle']
 	case 50: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1046,6 +1097,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 51 NTSTATUS NtCreateSemaphore ['PHANDLE SemaphoreHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes', 'LONG InitialCount', 'LONG MaximumCount']
 	case 51: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1065,6 +1117,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 52 NTSTATUS NtCreateSymbolicLinkObject ['PHANDLE LinkHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes', 'PUNICODE_STRING LinkTarget']
 	case 52: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1082,6 +1135,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 53 NTSTATUS NtCreateThread ['PHANDLE ThreadHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes', 'HANDLE ProcessHandle', 'PCLIENT_ID ClientId', 'PCONTEXT ThreadContext', 'PINITIAL_TEB InitialTeb', 'BOOLEAN CreateSuspended']
 	case 53: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1107,6 +1161,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 54 NTSTATUS NtCreateTimer ['PHANDLE TimerHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes', 'TIMER_TYPE TimerType']
 	case 54: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1124,6 +1179,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 55 NTSTATUS NtCreateToken ['PHANDLE TokenHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes', 'TOKEN_TYPE TokenType', 'PLUID AuthenticationId', 'PLARGE_INTEGER ExpirationTime', 'PTOKEN_USER User', 'PTOKEN_GROUPS Groups', 'PTOKEN_PRIVILEGES Privileges', 'PTOKEN_OWNER Owner', 'PTOKEN_PRIMARY_GROUP PrimaryGroup', 'PTOKEN_DEFAULT_DACL DefaultDacl', 'PTOKEN_SOURCE TokenSource']
 	case 55: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1159,6 +1215,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 56 NTSTATUS NtCreateWaitablePort ['PHANDLE PortHandle', 'POBJECT_ATTRIBUTES ObjectAttributes', 'ULONG MaxConnectionInfoLength', 'ULONG MaxMessageLength', 'ULONG MaxPoolUsage']
 	case 56: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1178,6 +1235,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 57 NTSTATUS NtDebugActiveProcess ['HANDLE ProcessHandle', 'HANDLE DebugObjectHandle']
 	case 57: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1191,6 +1249,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 58 NTSTATUS NtDebugContinue ['HANDLE DebugObjectHandle', 'PCLIENT_ID ClientId', 'NTSTATUS ContinueStatus']
 	case 58: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1206,6 +1265,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 59 NTSTATUS NtDelayExecution ['BOOLEAN Alertable', 'PLARGE_INTEGER DelayInterval']
 	case 59: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1219,6 +1279,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 60 NTSTATUS NtDeleteAtom ['RTL_ATOM Atom']
 	case 60: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1230,6 +1291,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 61 NTSTATUS NtDeleteBootEntry ['ULONG Id']
 	case 61: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1241,6 +1303,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 62 NTSTATUS NtDeleteFile ['POBJECT_ATTRIBUTES ObjectAttributes']
 	case 62: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1252,6 +1315,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 63 NTSTATUS NtDeleteKey ['HANDLE KeyHandle']
 	case 63: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1263,6 +1327,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 64 NTSTATUS NtDeleteObjectAuditAlarm ['PUNICODE_STRING SubsystemName', 'PVOID HandleId', 'BOOLEAN GenerateOnClose']
 	case 64: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1278,6 +1343,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 65 NTSTATUS NtDeleteValueKey ['HANDLE KeyHandle', 'PUNICODE_STRING ValueName']
 	case 65: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1291,6 +1357,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 66 NTSTATUS NtDeviceIoControlFile ['HANDLE FileHandle', 'HANDLE Event', 'PIO_APC_ROUTINE ApcRoutine', 'PVOID ApcContext', 'PIO_STATUS_BLOCK IoStatusBlock', 'ULONG IoControlCode', 'PVOID InputBuffer', 'ULONG InputBufferLength', 'PVOID OutputBuffer', 'ULONG OutputBufferLength']
 	case 66: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1320,6 +1387,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 67 NTSTATUS NtDisplayString ['PUNICODE_STRING String']
 	case 67: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1331,6 +1399,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 68 NTSTATUS NtDuplicateObject ['HANDLE SourceProcessHandle', 'HANDLE SourceHandle', 'HANDLE TargetProcessHandle', 'PHANDLE TargetHandle', 'ACCESS_MASK DesiredAccess', 'ULONG HandleAttributes', 'ULONG Options']
 	case 68: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1354,6 +1423,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 69 NTSTATUS NtDuplicateToken ['HANDLE ExistingTokenHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes', 'BOOLEAN EffectiveOnly', 'TOKEN_TYPE TokenType', 'PHANDLE NewTokenHandle']
 	case 69: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1375,6 +1445,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 70 NTSTATUS NtEnumerateBootEntries ['PVOID Buffer', 'PULONG BufferLength']
 	case 70: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1388,6 +1459,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 71 NTSTATUS NtEnumerateKey ['HANDLE KeyHandle', 'ULONG Index', 'KEY_INFORMATION_CLASS KeyInformationClass', 'PVOID KeyInformation', 'ULONG Length', 'PULONG ResultLength']
 	case 71: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1409,6 +1481,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 72 NTSTATUS NtEnumerateSystemEnvironmentValuesEx ['ULONG InformationClass', 'PVOID Buffer', 'PULONG BufferLength']
 	case 72: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1424,6 +1497,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 73 NTSTATUS NtEnumerateValueKey ['HANDLE KeyHandle', 'ULONG Index', 'KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass', 'PVOID KeyValueInformation', 'ULONG Length', 'PULONG ResultLength']
 	case 73: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1445,6 +1519,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 74 NTSTATUS NtExtendSection ['HANDLE SectionHandle', 'PLARGE_INTEGER NewSectionSize']
 	case 74: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1458,6 +1533,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 75 NTSTATUS NtFilterToken ['HANDLE ExistingTokenHandle', 'ULONG Flags', 'PTOKEN_GROUPS SidsToDisable', 'PTOKEN_PRIVILEGES PrivilegesToDelete', 'PTOKEN_GROUPS RestrictedSids', 'PHANDLE NewTokenHandle']
 	case 75: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1479,6 +1555,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 76 NTSTATUS NtFindAtom ['PWSTR AtomName', 'ULONG Length', 'PRTL_ATOM Atom']
 	case 76: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1494,6 +1571,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 77 NTSTATUS NtFlushBuffersFile ['HANDLE FileHandle', 'PIO_STATUS_BLOCK IoStatusBlock']
 	case 77: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1507,6 +1585,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 78 NTSTATUS NtFlushInstructionCache ['HANDLE ProcessHandle', 'PVOID BaseAddress', 'SIZE_T Length']
 	case 78: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1522,6 +1601,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 79 NTSTATUS NtFlushKey ['HANDLE KeyHandle']
 	case 79: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1533,6 +1613,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 80 NTSTATUS NtFlushVirtualMemory ['HANDLE ProcessHandle', 'PVOID *BaseAddress', 'PSIZE_T RegionSize', 'PIO_STATUS_BLOCK IoStatus']
 	case 80: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1550,11 +1631,13 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 81 NTSTATUS NtFlushWriteBuffer ['']
 	case 81: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_NtFlushWriteBuffer_enter, cpu, pc);
 	}; break;
 	// 82 NTSTATUS NtFreeUserPhysicalPages ['HANDLE ProcessHandle', 'PULONG_PTR NumberOfPages', 'PULONG_PTR UserPfnArray']
 	case 82: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1570,6 +1653,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 83 NTSTATUS NtFreeVirtualMemory ['HANDLE ProcessHandle', 'PVOID *BaseAddress', 'PSIZE_T RegionSize', 'ULONG FreeType']
 	case 83: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1587,6 +1671,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 84 NTSTATUS NtFsControlFile ['HANDLE FileHandle', 'HANDLE Event', 'PIO_APC_ROUTINE ApcRoutine', 'PVOID ApcContext', 'PIO_STATUS_BLOCK IoStatusBlock', 'ULONG IoControlCode', 'PVOID InputBuffer', 'ULONG InputBufferLength', 'PVOID OutputBuffer', 'ULONG OutputBufferLength']
 	case 84: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1616,6 +1701,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 85 NTSTATUS NtGetContextThread ['HANDLE ThreadHandle', 'PCONTEXT ThreadContext']
 	case 85: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1629,6 +1715,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 86 NTSTATUS NtGetDevicePowerState ['HANDLE Device', 'DEVICE_POWER_STATE *State']
 	case 86: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1642,6 +1729,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 87 NTSTATUS NtGetPlugPlayEvent ['HANDLE EventHandle', 'PVOID Context', 'PPLUGPLAY_EVENT_BLOCK EventBlock', 'ULONG EventBufferSize']
 	case 87: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1659,6 +1747,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 88 NTSTATUS NtGetWriteWatch ['HANDLE ProcessHandle', 'ULONG Flags', 'PVOID BaseAddress', 'SIZE_T RegionSize', 'PVOID *UserAddressArray', 'PULONG_PTR EntriesInUserAddressArray', 'PULONG Granularity']
 	case 88: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1682,6 +1771,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 89 NTSTATUS NtImpersonateAnonymousToken ['HANDLE ThreadHandle']
 	case 89: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1693,6 +1783,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 90 NTSTATUS NtImpersonateClientOfPort ['HANDLE PortHandle', 'PPORT_MESSAGE Message']
 	case 90: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1706,6 +1797,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 91 NTSTATUS NtImpersonateThread ['HANDLE ServerThreadHandle', 'HANDLE ClientThreadHandle', 'PSECURITY_QUALITY_OF_SERVICE SecurityQos']
 	case 91: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1721,6 +1813,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 92 NTSTATUS NtInitializeRegistry ['USHORT BootCondition']
 	case 92: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1732,6 +1825,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 93 NTSTATUS NtInitiatePowerAction ['POWER_ACTION SystemAction', 'SYSTEM_POWER_STATE MinSystemState', 'ULONG Flags', 'BOOLEAN Asynchronous']
 	case 93: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1749,6 +1843,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 94 NTSTATUS NtIsProcessInJob ['HANDLE ProcessHandle', 'HANDLE JobHandle']
 	case 94: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1762,11 +1857,13 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 95 BOOLEAN NtIsSystemResumeAutomatic ['']
 	case 95: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_NtIsSystemResumeAutomatic_enter, cpu, pc);
 	}; break;
 	// 96 NTSTATUS NtListenPort ['HANDLE PortHandle', 'PPORT_MESSAGE ConnectionRequest']
 	case 96: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1780,6 +1877,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 97 NTSTATUS NtLoadDriver ['PUNICODE_STRING DriverServiceName']
 	case 97: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1791,6 +1889,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 98 NTSTATUS NtLoadKey ['POBJECT_ATTRIBUTES TargetKey', 'POBJECT_ATTRIBUTES SourceFile']
 	case 98: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1804,6 +1903,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 99 NTSTATUS NtLoadKey2 ['POBJECT_ATTRIBUTES TargetKey', 'POBJECT_ATTRIBUTES SourceFile', 'ULONG Flags']
 	case 99: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1819,6 +1919,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 100 NTSTATUS NtLockFile ['HANDLE FileHandle', 'HANDLE Event', 'PIO_APC_ROUTINE ApcRoutine', 'PVOID ApcContext', 'PIO_STATUS_BLOCK IoStatusBlock', 'PLARGE_INTEGER ByteOffset', 'PLARGE_INTEGER Length', 'ULONG Key', 'BOOLEAN FailImmediately', 'BOOLEAN ExclusiveLock']
 	case 100: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1848,6 +1949,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 101 NTSTATUS NtLockProductActivationKeys ['ULONG *pPrivateVer', 'ULONG *pSafeMode']
 	case 101: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -1861,6 +1963,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 102 NTSTATUS NtLockRegistryKey ['HANDLE KeyHandle']
 	case 102: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1872,6 +1975,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 103 NTSTATUS NtLockVirtualMemory ['HANDLE ProcessHandle', 'PVOID *BaseAddress', 'PSIZE_T RegionSize', 'ULONG MapType']
 	case 103: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1889,6 +1993,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 104 NTSTATUS NtMakePermanentObject ['HANDLE Handle']
 	case 104: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1900,6 +2005,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 105 NTSTATUS NtMakeTemporaryObject ['HANDLE Handle']
 	case 105: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1911,6 +2017,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 106 NTSTATUS NtMapUserPhysicalPages ['PVOID VirtualAddress', 'ULONG_PTR NumberOfPages', 'PULONG_PTR UserPfnArray']
 	case 106: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1926,6 +2033,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 107 NTSTATUS NtMapUserPhysicalPagesScatter ['PVOID *VirtualAddresses', 'ULONG_PTR NumberOfPages', 'PULONG_PTR UserPfnArray']
 	case 107: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1941,6 +2049,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 108 NTSTATUS NtMapViewOfSection ['HANDLE SectionHandle', 'HANDLE ProcessHandle', 'PVOID *BaseAddress', 'ULONG_PTR ZeroBits', 'SIZE_T CommitSize', 'PLARGE_INTEGER SectionOffset', 'PSIZE_T ViewSize', 'SECTION_INHERIT InheritDisposition', 'ULONG AllocationType', 'WIN32_PROTECTION_MASK Win32Protect']
 	case 108: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -1970,6 +2079,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 109 NTSTATUS NtModifyBootEntry ['PBOOT_ENTRY BootEntry']
 	case 109: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -1981,6 +2091,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 110 NTSTATUS NtNotifyChangeDirectoryFile ['HANDLE FileHandle', 'HANDLE Event', 'PIO_APC_ROUTINE ApcRoutine', 'PVOID ApcContext', 'PIO_STATUS_BLOCK IoStatusBlock', 'PVOID Buffer', 'ULONG Length', 'ULONG CompletionFilter', 'BOOLEAN WatchTree']
 	case 110: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2008,6 +2119,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 111 NTSTATUS NtNotifyChangeKey ['HANDLE KeyHandle', 'HANDLE Event', 'PIO_APC_ROUTINE ApcRoutine', 'PVOID ApcContext', 'PIO_STATUS_BLOCK IoStatusBlock', 'ULONG CompletionFilter', 'BOOLEAN WatchTree', 'PVOID Buffer', 'ULONG BufferSize', 'BOOLEAN Asynchronous']
 	case 111: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2037,6 +2149,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 112 NTSTATUS NtNotifyChangeMultipleKeys ['HANDLE MasterKeyHandle', 'ULONG Count', 'OBJECT_ATTRIBUTES SlaveObjects[]', 'HANDLE Event', 'PIO_APC_ROUTINE ApcRoutine', 'PVOID ApcContext', 'PIO_STATUS_BLOCK IoStatusBlock', 'ULONG CompletionFilter', 'BOOLEAN WatchTree', 'PVOID Buffer', 'ULONG BufferSize', 'BOOLEAN Asynchronous']
 	case 112: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2070,6 +2183,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 113 NTSTATUS NtOpenDirectoryObject ['PHANDLE DirectoryHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes']
 	case 113: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2085,6 +2199,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 114 NTSTATUS NtOpenEvent ['PHANDLE EventHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes']
 	case 114: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2100,6 +2215,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 115 NTSTATUS NtOpenEventPair ['PHANDLE EventPairHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes']
 	case 115: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2115,6 +2231,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 116 NTSTATUS NtOpenFile ['PHANDLE FileHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes', 'PIO_STATUS_BLOCK IoStatusBlock', 'ULONG ShareAccess', 'ULONG OpenOptions']
 	case 116: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2136,6 +2253,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 117 NTSTATUS NtOpenIoCompletion ['PHANDLE IoCompletionHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes']
 	case 117: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2151,6 +2269,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 118 NTSTATUS NtOpenJobObject ['PHANDLE JobHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes']
 	case 118: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2166,6 +2285,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 119 NTSTATUS NtOpenKey ['PHANDLE KeyHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes']
 	case 119: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2181,6 +2301,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 120 NTSTATUS NtOpenMutant ['PHANDLE MutantHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes']
 	case 120: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2196,6 +2317,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 121 NTSTATUS NtOpenObjectAuditAlarm ['PUNICODE_STRING SubsystemName', 'PVOID HandleId', 'PUNICODE_STRING ObjectTypeName', 'PUNICODE_STRING ObjectName', 'PSECURITY_DESCRIPTOR SecurityDescriptor', 'HANDLE ClientToken', 'ACCESS_MASK DesiredAccess', 'ACCESS_MASK GrantedAccess', 'PPRIVILEGE_SET Privileges', 'BOOLEAN ObjectCreation', 'BOOLEAN AccessGranted', 'PBOOLEAN GenerateOnClose']
 	case 121: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2229,6 +2351,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 122 NTSTATUS NtOpenProcess ['PHANDLE ProcessHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes', 'PCLIENT_ID ClientId']
 	case 122: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2246,6 +2369,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 123 NTSTATUS NtOpenProcessToken ['HANDLE ProcessHandle', 'ACCESS_MASK DesiredAccess', 'PHANDLE TokenHandle']
 	case 123: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2261,6 +2385,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 124 NTSTATUS NtOpenProcessTokenEx ['HANDLE ProcessHandle', 'ACCESS_MASK DesiredAccess', 'ULONG HandleAttributes', 'PHANDLE TokenHandle']
 	case 124: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2278,6 +2403,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 125 NTSTATUS NtOpenSection ['PHANDLE SectionHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes']
 	case 125: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2293,6 +2419,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 126 NTSTATUS NtOpenSemaphore ['PHANDLE SemaphoreHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes']
 	case 126: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2308,6 +2435,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 127 NTSTATUS NtOpenSymbolicLinkObject ['PHANDLE LinkHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes']
 	case 127: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2323,6 +2451,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 128 NTSTATUS NtOpenThread ['PHANDLE ThreadHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes', 'PCLIENT_ID ClientId']
 	case 128: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2340,6 +2469,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 129 NTSTATUS NtOpenThreadToken ['HANDLE ThreadHandle', 'ACCESS_MASK DesiredAccess', 'BOOLEAN OpenAsSelf', 'PHANDLE TokenHandle']
 	case 129: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2357,6 +2487,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 130 NTSTATUS NtOpenThreadTokenEx ['HANDLE ThreadHandle', 'ACCESS_MASK DesiredAccess', 'BOOLEAN OpenAsSelf', 'ULONG HandleAttributes', 'PHANDLE TokenHandle']
 	case 130: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2376,6 +2507,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 131 NTSTATUS NtOpenTimer ['PHANDLE TimerHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes']
 	case 131: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2391,6 +2523,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 132 NTSTATUS NtPlugPlayControl ['PLUGPLAY_CONTROL_CLASS PnPControlClass', 'PVOID PnPControlData', 'ULONG PnPControlDataLength']
 	case 132: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2406,6 +2539,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 133 NTSTATUS NtPowerInformation ['POWER_INFORMATION_LEVEL InformationLevel', 'PVOID InputBuffer', 'ULONG InputBufferLength', 'PVOID OutputBuffer', 'ULONG OutputBufferLength']
 	case 133: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2425,6 +2559,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 134 NTSTATUS NtPrivilegeCheck ['HANDLE ClientToken', 'PPRIVILEGE_SET RequiredPrivileges', 'PBOOLEAN Result']
 	case 134: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2440,6 +2575,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 135 NTSTATUS NtPrivilegeObjectAuditAlarm ['PUNICODE_STRING SubsystemName', 'PVOID HandleId', 'HANDLE ClientToken', 'ACCESS_MASK DesiredAccess', 'PPRIVILEGE_SET Privileges', 'BOOLEAN AccessGranted']
 	case 135: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2461,6 +2597,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 136 NTSTATUS NtPrivilegedServiceAuditAlarm ['PUNICODE_STRING SubsystemName', 'PUNICODE_STRING ServiceName', 'HANDLE ClientToken', 'PPRIVILEGE_SET Privileges', 'BOOLEAN AccessGranted']
 	case 136: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2480,6 +2617,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 137 NTSTATUS NtProtectVirtualMemory ['HANDLE ProcessHandle', 'PVOID *BaseAddress', 'PSIZE_T RegionSize', 'WIN32_PROTECTION_MASK NewProtectWin32', 'PULONG OldProtect']
 	case 137: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2499,6 +2637,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 138 NTSTATUS NtPulseEvent ['HANDLE EventHandle', 'PLONG PreviousState']
 	case 138: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2512,6 +2651,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 139 NTSTATUS NtQueryAttributesFile ['POBJECT_ATTRIBUTES ObjectAttributes', 'PFILE_BASIC_INFORMATION FileInformation']
 	case 139: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2525,6 +2665,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 140 NTSTATUS NtQueryBootEntryOrder ['PULONG Ids', 'PULONG Count']
 	case 140: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2538,6 +2679,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 141 NTSTATUS NtQueryBootOptions ['PBOOT_OPTIONS BootOptions', 'PULONG BootOptionsLength']
 	case 141: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2551,6 +2693,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 142 NTSTATUS NtQueryDebugFilterState ['ULONG ComponentId', 'ULONG Level']
 	case 142: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2564,6 +2707,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 143 NTSTATUS NtQueryDefaultLocale ['BOOLEAN UserProfile', 'PLCID DefaultLocaleId']
 	case 143: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2577,6 +2721,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 144 NTSTATUS NtQueryDefaultUILanguage ['LANGID *DefaultUILanguageId']
 	case 144: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -2588,6 +2733,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 145 NTSTATUS NtQueryDirectoryFile ['HANDLE FileHandle', 'HANDLE Event', 'PIO_APC_ROUTINE ApcRoutine', 'PVOID ApcContext', 'PIO_STATUS_BLOCK IoStatusBlock', 'PVOID FileInformation', 'ULONG Length', 'FILE_INFORMATION_CLASS FileInformationClass', 'BOOLEAN ReturnSingleEntry', 'PUNICODE_STRING FileName', 'BOOLEAN RestartScan']
 	case 145: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2619,6 +2765,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 146 NTSTATUS NtQueryDirectoryObject ['HANDLE DirectoryHandle', 'PVOID Buffer', 'ULONG Length', 'BOOLEAN ReturnSingleEntry', 'BOOLEAN RestartScan', 'PULONG Context', 'PULONG ReturnLength']
 	case 146: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2642,6 +2789,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 147 NTSTATUS NtQueryEaFile ['HANDLE FileHandle', 'PIO_STATUS_BLOCK IoStatusBlock', 'PVOID Buffer', 'ULONG Length', 'BOOLEAN ReturnSingleEntry', 'PVOID EaList', 'ULONG EaListLength', 'PULONG EaIndex', 'BOOLEAN RestartScan']
 	case 147: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2669,6 +2817,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 148 NTSTATUS NtQueryEvent ['HANDLE EventHandle', 'EVENT_INFORMATION_CLASS EventInformationClass', 'PVOID EventInformation', 'ULONG EventInformationLength', 'PULONG ReturnLength']
 	case 148: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2688,6 +2837,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 149 NTSTATUS NtQueryFullAttributesFile ['POBJECT_ATTRIBUTES ObjectAttributes', 'PFILE_NETWORK_OPEN_INFORMATION FileInformation']
 	case 149: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2701,6 +2851,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 150 NTSTATUS NtQueryInformationAtom ['RTL_ATOM Atom', 'ATOM_INFORMATION_CLASS InformationClass', 'PVOID AtomInformation', 'ULONG AtomInformationLength', 'PULONG ReturnLength']
 	case 150: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2720,6 +2871,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 151 NTSTATUS NtQueryInformationFile ['HANDLE FileHandle', 'PIO_STATUS_BLOCK IoStatusBlock', 'PVOID FileInformation', 'ULONG Length', 'FILE_INFORMATION_CLASS FileInformationClass']
 	case 151: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2739,6 +2891,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 152 NTSTATUS NtQueryInformationJobObject ['HANDLE JobHandle', 'JOBOBJECTINFOCLASS JobObjectInformationClass', 'PVOID JobObjectInformation', 'ULONG JobObjectInformationLength', 'PULONG ReturnLength']
 	case 152: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2758,6 +2911,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 153 NTSTATUS NtQueryInformationPort ['HANDLE PortHandle', 'PORT_INFORMATION_CLASS PortInformationClass', 'PVOID PortInformation', 'ULONG Length', 'PULONG ReturnLength']
 	case 153: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2777,6 +2931,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 154 NTSTATUS NtQueryInformationProcess ['HANDLE ProcessHandle', 'PROCESSINFOCLASS ProcessInformationClass', 'PVOID ProcessInformation', 'ULONG ProcessInformationLength', 'PULONG ReturnLength']
 	case 154: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2796,6 +2951,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 155 NTSTATUS NtQueryInformationThread ['HANDLE ThreadHandle', 'THREADINFOCLASS ThreadInformationClass', 'PVOID ThreadInformation', 'ULONG ThreadInformationLength', 'PULONG ReturnLength']
 	case 155: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2815,6 +2971,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 156 NTSTATUS NtQueryInformationToken ['HANDLE TokenHandle', 'TOKEN_INFORMATION_CLASS TokenInformationClass', 'PVOID TokenInformation', 'ULONG TokenInformationLength', 'PULONG ReturnLength']
 	case 156: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2834,6 +2991,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 157 NTSTATUS NtQueryInstallUILanguage ['LANGID *InstallUILanguageId']
 	case 157: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -2845,6 +3003,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 158 NTSTATUS NtQueryIntervalProfile ['KPROFILE_SOURCE ProfileSource', 'PULONG Interval']
 	case 158: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2858,6 +3017,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 159 NTSTATUS NtQueryIoCompletion ['HANDLE IoCompletionHandle', 'IO_COMPLETION_INFORMATION_CLASS IoCompletionInformationClass', 'PVOID IoCompletionInformation', 'ULONG IoCompletionInformationLength', 'PULONG ReturnLength']
 	case 159: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2877,6 +3037,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 160 NTSTATUS NtQueryKey ['HANDLE KeyHandle', 'KEY_INFORMATION_CLASS KeyInformationClass', 'PVOID KeyInformation', 'ULONG Length', 'PULONG ResultLength']
 	case 160: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2896,6 +3057,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 161 NTSTATUS NtQueryMultipleValueKey ['HANDLE KeyHandle', 'PKEY_VALUE_ENTRY ValueEntries', 'ULONG EntryCount', 'PVOID ValueBuffer', 'PULONG BufferLength', 'PULONG RequiredBufferLength']
 	case 161: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2917,6 +3079,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 162 NTSTATUS NtQueryMutant ['HANDLE MutantHandle', 'MUTANT_INFORMATION_CLASS MutantInformationClass', 'PVOID MutantInformation', 'ULONG MutantInformationLength', 'PULONG ReturnLength']
 	case 162: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2936,6 +3099,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 163 NTSTATUS NtQueryObject ['HANDLE Handle', 'OBJECT_INFORMATION_CLASS ObjectInformationClass', 'PVOID ObjectInformation', 'ULONG ObjectInformationLength', 'PULONG ReturnLength']
 	case 163: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -2955,6 +3119,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 164 NTSTATUS NtQueryOpenSubKeys ['POBJECT_ATTRIBUTES TargetKey', 'PULONG HandleCount']
 	case 164: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2968,6 +3133,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 165 NTSTATUS NtQueryPerformanceCounter ['PLARGE_INTEGER PerformanceCounter', 'PLARGE_INTEGER PerformanceFrequency']
 	case 165: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -2981,6 +3147,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 166 NTSTATUS NtQueryQuotaInformationFile ['HANDLE FileHandle', 'PIO_STATUS_BLOCK IoStatusBlock', 'PVOID Buffer', 'ULONG Length', 'BOOLEAN ReturnSingleEntry', 'PVOID SidList', 'ULONG SidListLength', 'PULONG StartSid', 'BOOLEAN RestartScan']
 	case 166: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3008,6 +3175,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 167 NTSTATUS NtQuerySection ['HANDLE SectionHandle', 'SECTION_INFORMATION_CLASS SectionInformationClass', 'PVOID SectionInformation', 'SIZE_T SectionInformationLength', 'PSIZE_T ReturnLength']
 	case 167: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3027,6 +3195,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 168 NTSTATUS NtQuerySecurityObject ['HANDLE Handle', 'SECURITY_INFORMATION SecurityInformation', 'PSECURITY_DESCRIPTOR SecurityDescriptor', 'ULONG Length', 'PULONG LengthNeeded']
 	case 168: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3046,6 +3215,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 169 NTSTATUS NtQuerySemaphore ['HANDLE SemaphoreHandle', 'SEMAPHORE_INFORMATION_CLASS SemaphoreInformationClass', 'PVOID SemaphoreInformation', 'ULONG SemaphoreInformationLength', 'PULONG ReturnLength']
 	case 169: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3065,6 +3235,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 170 NTSTATUS NtQuerySymbolicLinkObject ['HANDLE LinkHandle', 'PUNICODE_STRING LinkTarget', 'PULONG ReturnedLength']
 	case 170: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3080,6 +3251,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 171 NTSTATUS NtQuerySystemEnvironmentValue ['PUNICODE_STRING VariableName', 'PWSTR VariableValue', 'USHORT ValueLength', 'PUSHORT ReturnLength']
 	case 171: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3097,6 +3269,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 172 NTSTATUS NtQuerySystemEnvironmentValueEx ['PUNICODE_STRING VariableName', 'LPGUID VendorGuid', 'PVOID Value', 'PULONG ValueLength', 'PULONG Attributes']
 	case 172: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3116,6 +3289,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 173 NTSTATUS NtQuerySystemInformation ['SYSTEM_INFORMATION_CLASS SystemInformationClass', 'PVOID SystemInformation', 'ULONG SystemInformationLength', 'PULONG ReturnLength']
 	case 173: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3133,6 +3307,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 174 NTSTATUS NtQuerySystemTime ['PLARGE_INTEGER SystemTime']
 	case 174: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -3144,6 +3319,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 175 NTSTATUS NtQueryTimer ['HANDLE TimerHandle', 'TIMER_INFORMATION_CLASS TimerInformationClass', 'PVOID TimerInformation', 'ULONG TimerInformationLength', 'PULONG ReturnLength']
 	case 175: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3163,6 +3339,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 176 NTSTATUS NtQueryTimerResolution ['PULONG MaximumTime', 'PULONG MinimumTime', 'PULONG CurrentTime']
 	case 176: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3178,6 +3355,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 177 NTSTATUS NtQueryValueKey ['HANDLE KeyHandle', 'PUNICODE_STRING ValueName', 'KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass', 'PVOID KeyValueInformation', 'ULONG Length', 'PULONG ResultLength']
 	case 177: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3199,6 +3377,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 178 NTSTATUS NtQueryVirtualMemory ['HANDLE ProcessHandle', 'PVOID BaseAddress', 'MEMORY_INFORMATION_CLASS MemoryInformationClass', 'PVOID MemoryInformation', 'SIZE_T MemoryInformationLength', 'PSIZE_T ReturnLength']
 	case 178: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3220,6 +3399,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 179 NTSTATUS NtQueryVolumeInformationFile ['HANDLE FileHandle', 'PIO_STATUS_BLOCK IoStatusBlock', 'PVOID FsInformation', 'ULONG Length', 'FS_INFORMATION_CLASS FsInformationClass']
 	case 179: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3239,6 +3419,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 180 NTSTATUS NtQueueApcThread ['HANDLE ThreadHandle', 'PPS_APC_ROUTINE ApcRoutine', 'PVOID ApcArgument1', 'PVOID ApcArgument2', 'PVOID ApcArgument3']
 	case 180: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3258,6 +3439,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 181 NTSTATUS NtRaiseException ['PEXCEPTION_RECORD ExceptionRecord', 'PCONTEXT ContextRecord', 'BOOLEAN FirstChance']
 	case 181: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3273,6 +3455,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 182 NTSTATUS NtRaiseHardError ['NTSTATUS ErrorStatus', 'ULONG NumberOfParameters', 'ULONG UnicodeStringParameterMask', 'PULONG_PTR Parameters', 'ULONG ValidResponseOptions', 'PULONG Response']
 	case 182: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3294,6 +3477,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 183 NTSTATUS NtReadFile ['HANDLE FileHandle', 'HANDLE Event', 'PIO_APC_ROUTINE ApcRoutine', 'PVOID ApcContext', 'PIO_STATUS_BLOCK IoStatusBlock', 'PVOID Buffer', 'ULONG Length', 'PLARGE_INTEGER ByteOffset', 'PULONG Key']
 	case 183: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3321,6 +3505,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 184 NTSTATUS NtReadFileScatter ['HANDLE FileHandle', 'HANDLE Event', 'PIO_APC_ROUTINE ApcRoutine', 'PVOID ApcContext', 'PIO_STATUS_BLOCK IoStatusBlock', 'PFILE_SEGMENT_ELEMENT SegmentArray', 'ULONG Length', 'PLARGE_INTEGER ByteOffset', 'PULONG Key']
 	case 184: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3348,6 +3533,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 185 NTSTATUS NtReadRequestData ['HANDLE PortHandle', 'PPORT_MESSAGE Message', 'ULONG DataEntryIndex', 'PVOID Buffer', 'SIZE_T BufferSize', 'PSIZE_T NumberOfBytesRead']
 	case 185: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3369,6 +3555,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 186 NTSTATUS NtReadVirtualMemory ['HANDLE ProcessHandle', 'PVOID BaseAddress', 'PVOID Buffer', 'SIZE_T BufferSize', 'PSIZE_T NumberOfBytesRead']
 	case 186: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3388,6 +3575,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 187 NTSTATUS NtRegisterThreadTerminatePort ['HANDLE PortHandle']
 	case 187: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -3399,6 +3587,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 188 NTSTATUS NtReleaseMutant ['HANDLE MutantHandle', 'PLONG PreviousCount']
 	case 188: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3412,6 +3601,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 189 NTSTATUS NtReleaseSemaphore ['HANDLE SemaphoreHandle', 'LONG ReleaseCount', 'PLONG PreviousCount']
 	case 189: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		int32_t arg1 = get_s32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3427,6 +3617,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 190 NTSTATUS NtRemoveIoCompletion ['HANDLE IoCompletionHandle', 'PVOID *KeyContext', 'PVOID *ApcContext', 'PIO_STATUS_BLOCK IoStatusBlock', 'PLARGE_INTEGER Timeout']
 	case 190: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3446,6 +3637,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 191 NTSTATUS NtRemoveProcessDebug ['HANDLE ProcessHandle', 'HANDLE DebugObjectHandle']
 	case 191: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3459,6 +3651,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 192 NTSTATUS NtRenameKey ['HANDLE KeyHandle', 'PUNICODE_STRING NewName']
 	case 192: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3472,6 +3665,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 193 NTSTATUS NtReplaceKey ['POBJECT_ATTRIBUTES NewFile', 'HANDLE TargetHandle', 'POBJECT_ATTRIBUTES OldFile']
 	case 193: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3487,6 +3681,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 194 NTSTATUS NtReplyPort ['HANDLE PortHandle', 'PPORT_MESSAGE ReplyMessage']
 	case 194: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3500,6 +3695,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 195 NTSTATUS NtReplyWaitReceivePort ['HANDLE PortHandle', 'PVOID *PortContext', 'PPORT_MESSAGE ReplyMessage', 'PPORT_MESSAGE ReceiveMessage']
 	case 195: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3517,6 +3713,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 196 NTSTATUS NtReplyWaitReceivePortEx ['HANDLE PortHandle', 'PVOID *PortContext', 'PPORT_MESSAGE ReplyMessage', 'PPORT_MESSAGE ReceiveMessage', 'PLARGE_INTEGER Timeout']
 	case 196: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3536,6 +3733,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 197 NTSTATUS NtReplyWaitReplyPort ['HANDLE PortHandle', 'PPORT_MESSAGE ReplyMessage']
 	case 197: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3549,6 +3747,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 199 NTSTATUS NtRequestPort ['HANDLE PortHandle', 'PPORT_MESSAGE RequestMessage']
 	case 199: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3562,6 +3761,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 200 NTSTATUS NtRequestWaitReplyPort ['HANDLE PortHandle', 'PPORT_MESSAGE RequestMessage', 'PPORT_MESSAGE ReplyMessage']
 	case 200: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3577,6 +3777,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 202 NTSTATUS NtResetEvent ['HANDLE EventHandle', 'PLONG PreviousState']
 	case 202: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3590,6 +3791,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 203 NTSTATUS NtResetWriteWatch ['HANDLE ProcessHandle', 'PVOID BaseAddress', 'SIZE_T RegionSize']
 	case 203: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3605,6 +3807,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 204 NTSTATUS NtRestoreKey ['HANDLE KeyHandle', 'HANDLE FileHandle', 'ULONG Flags']
 	case 204: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3620,6 +3823,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 205 NTSTATUS NtResumeProcess ['HANDLE ProcessHandle']
 	case 205: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -3631,6 +3835,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 206 NTSTATUS NtResumeThread ['HANDLE ThreadHandle', 'PULONG PreviousSuspendCount']
 	case 206: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3644,6 +3849,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 207 NTSTATUS NtSaveKey ['HANDLE KeyHandle', 'HANDLE FileHandle']
 	case 207: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3657,6 +3863,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 208 NTSTATUS NtSaveKeyEx ['HANDLE KeyHandle', 'HANDLE FileHandle', 'ULONG Format']
 	case 208: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3672,6 +3879,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 209 NTSTATUS NtSaveMergedKeys ['HANDLE HighPrecedenceKeyHandle', 'HANDLE LowPrecedenceKeyHandle', 'HANDLE FileHandle']
 	case 209: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3687,6 +3895,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 210 NTSTATUS NtSecureConnectPort ['PHANDLE PortHandle', 'PUNICODE_STRING PortName', 'PSECURITY_QUALITY_OF_SERVICE SecurityQos', 'PPORT_VIEW ClientView', 'PSID RequiredServerSid', 'PREMOTE_PORT_VIEW ServerView', 'PULONG MaxMessageLength', 'PVOID ConnectionInformation', 'PULONG ConnectionInformationLength']
 	case 210: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3714,6 +3923,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 211 NTSTATUS NtSetBootEntryOrder ['PULONG Ids', 'ULONG Count']
 	case 211: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3727,6 +3937,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 212 NTSTATUS NtSetBootOptions ['PBOOT_OPTIONS BootOptions', 'ULONG FieldsToChange']
 	case 212: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3740,6 +3951,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 213 NTSTATUS NtSetContextThread ['HANDLE ThreadHandle', 'PCONTEXT ThreadContext']
 	case 213: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3753,6 +3965,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 214 NTSTATUS NtSetDebugFilterState ['ULONG ComponentId', 'ULONG Level', 'BOOLEAN State']
 	case 214: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3768,6 +3981,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 215 NTSTATUS NtSetDefaultHardErrorPort ['HANDLE DefaultHardErrorPort']
 	case 215: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -3779,6 +3993,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 216 NTSTATUS NtSetDefaultLocale ['BOOLEAN UserProfile', 'LCID DefaultLocaleId']
 	case 216: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3792,6 +4007,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 217 NTSTATUS NtSetDefaultUILanguage ['LANGID DefaultUILanguageId']
 	case 217: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -3803,6 +4019,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 218 NTSTATUS NtSetEaFile ['HANDLE FileHandle', 'PIO_STATUS_BLOCK IoStatusBlock', 'PVOID Buffer', 'ULONG Length']
 	case 218: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3820,6 +4037,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 219 NTSTATUS NtSetEvent ['HANDLE EventHandle', 'PLONG PreviousState']
 	case 219: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -3833,6 +4051,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 220 NTSTATUS NtSetEventBoostPriority ['HANDLE EventHandle']
 	case 220: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -3844,6 +4063,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 221 NTSTATUS NtSetHighEventPair ['HANDLE EventPairHandle']
 	case 221: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -3855,6 +4075,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 222 NTSTATUS NtSetHighWaitLowEventPair ['HANDLE EventPairHandle']
 	case 222: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -3866,6 +4087,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 223 NTSTATUS NtSetInformationDebugObject ['HANDLE DebugObjectHandle', 'DEBUGOBJECTINFOCLASS DebugObjectInformationClass', 'PVOID DebugInformation', 'ULONG DebugInformationLength', 'PULONG ReturnLength']
 	case 223: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3885,6 +4107,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 224 NTSTATUS NtSetInformationFile ['HANDLE FileHandle', 'PIO_STATUS_BLOCK IoStatusBlock', 'PVOID FileInformation', 'ULONG Length', 'FILE_INFORMATION_CLASS FileInformationClass']
 	case 224: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3904,6 +4127,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 225 NTSTATUS NtSetInformationJobObject ['HANDLE JobHandle', 'JOBOBJECTINFOCLASS JobObjectInformationClass', 'PVOID JobObjectInformation', 'ULONG JobObjectInformationLength']
 	case 225: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3921,6 +4145,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 226 NTSTATUS NtSetInformationKey ['HANDLE KeyHandle', 'KEY_SET_INFORMATION_CLASS KeySetInformationClass', 'PVOID KeySetInformation', 'ULONG KeySetInformationLength']
 	case 226: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3938,6 +4163,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 227 NTSTATUS NtSetInformationObject ['HANDLE Handle', 'OBJECT_INFORMATION_CLASS ObjectInformationClass', 'PVOID ObjectInformation', 'ULONG ObjectInformationLength']
 	case 227: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3955,6 +4181,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 228 NTSTATUS NtSetInformationProcess ['HANDLE ProcessHandle', 'PROCESSINFOCLASS ProcessInformationClass', 'PVOID ProcessInformation', 'ULONG ProcessInformationLength']
 	case 228: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3972,6 +4199,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 229 NTSTATUS NtSetInformationThread ['HANDLE ThreadHandle', 'THREADINFOCLASS ThreadInformationClass', 'PVOID ThreadInformation', 'ULONG ThreadInformationLength']
 	case 229: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -3989,6 +4217,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 230 NTSTATUS NtSetInformationToken ['HANDLE TokenHandle', 'TOKEN_INFORMATION_CLASS TokenInformationClass', 'PVOID TokenInformation', 'ULONG TokenInformationLength']
 	case 230: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4006,6 +4235,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 231 NTSTATUS NtSetIntervalProfile ['ULONG Interval', 'KPROFILE_SOURCE Source']
 	case 231: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -4019,6 +4249,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 232 NTSTATUS NtSetIoCompletion ['HANDLE IoCompletionHandle', 'PVOID KeyContext', 'PVOID ApcContext', 'NTSTATUS IoStatus', 'ULONG_PTR IoStatusInformation']
 	case 232: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4038,6 +4269,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 233 NTSTATUS NtSetLdtEntries ['ULONG Selector0', 'ULONG Entry0Low', 'ULONG Entry0Hi', 'ULONG Selector1', 'ULONG Entry1Low', 'ULONG Entry1Hi']
 	case 233: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4059,6 +4291,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 234 NTSTATUS NtSetLowEventPair ['HANDLE EventPairHandle']
 	case 234: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -4070,6 +4303,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 235 NTSTATUS NtSetLowWaitHighEventPair ['HANDLE EventPairHandle']
 	case 235: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -4081,6 +4315,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 236 NTSTATUS NtSetQuotaInformationFile ['HANDLE FileHandle', 'PIO_STATUS_BLOCK IoStatusBlock', 'PVOID Buffer', 'ULONG Length']
 	case 236: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4098,6 +4333,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 237 NTSTATUS NtSetSecurityObject ['HANDLE Handle', 'SECURITY_INFORMATION SecurityInformation', 'PSECURITY_DESCRIPTOR SecurityDescriptor']
 	case 237: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4113,6 +4349,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 238 NTSTATUS NtSetSystemEnvironmentValue ['PUNICODE_STRING VariableName', 'PUNICODE_STRING VariableValue']
 	case 238: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -4126,6 +4363,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 239 NTSTATUS NtSetSystemEnvironmentValueEx ['PUNICODE_STRING VariableName', 'LPGUID VendorGuid', 'PVOID Value', 'ULONG ValueLength', 'ULONG Attributes']
 	case 239: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4145,6 +4383,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 240 NTSTATUS NtSetSystemInformation ['SYSTEM_INFORMATION_CLASS SystemInformationClass', 'PVOID SystemInformation', 'ULONG SystemInformationLength']
 	case 240: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4160,6 +4399,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 241 NTSTATUS NtSetSystemPowerState ['POWER_ACTION SystemAction', 'SYSTEM_POWER_STATE MinSystemState', 'ULONG Flags']
 	case 241: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4175,6 +4415,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 242 NTSTATUS NtSetSystemTime ['PLARGE_INTEGER SystemTime', 'PLARGE_INTEGER PreviousTime']
 	case 242: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -4188,6 +4429,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 243 NTSTATUS NtSetThreadExecutionState ['EXECUTION_STATE esFlags', 'PEXECUTION_STATE PreviousFlags']
 	case 243: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -4201,6 +4443,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 244 NTSTATUS NtSetTimer ['HANDLE TimerHandle', 'PLARGE_INTEGER DueTime', 'PTIMER_APC_ROUTINE TimerApcRoutine', 'PVOID TimerContext', 'BOOLEAN WakeTimer', 'LONG Period', 'PBOOLEAN PreviousState']
 	case 244: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4224,6 +4467,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 245 NTSTATUS NtSetTimerResolution ['ULONG DesiredTime', 'BOOLEAN SetResolution', 'PULONG ActualTime']
 	case 245: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4239,6 +4483,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 246 NTSTATUS NtSetUuidSeed ['PCHAR Seed']
 	case 246: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -4250,6 +4495,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 247 NTSTATUS NtSetValueKey ['HANDLE KeyHandle', 'PUNICODE_STRING ValueName', 'ULONG TitleIndex', 'ULONG Type', 'PVOID Data', 'ULONG DataSize']
 	case 247: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4271,6 +4517,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 248 NTSTATUS NtSetVolumeInformationFile ['HANDLE FileHandle', 'PIO_STATUS_BLOCK IoStatusBlock', 'PVOID FsInformation', 'ULONG Length', 'FS_INFORMATION_CLASS FsInformationClass']
 	case 248: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4290,6 +4537,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 249 NTSTATUS NtShutdownSystem ['SHUTDOWN_ACTION Action']
 	case 249: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -4301,6 +4549,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 250 NTSTATUS NtSignalAndWaitForSingleObject ['HANDLE SignalHandle', 'HANDLE WaitHandle', 'BOOLEAN Alertable', 'PLARGE_INTEGER Timeout']
 	case 250: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4318,6 +4567,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 251 NTSTATUS NtStartProfile ['HANDLE ProfileHandle']
 	case 251: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -4329,6 +4579,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 252 NTSTATUS NtStopProfile ['HANDLE ProfileHandle']
 	case 252: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -4340,6 +4591,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 253 NTSTATUS NtSuspendProcess ['HANDLE ProcessHandle']
 	case 253: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -4351,6 +4603,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 254 NTSTATUS NtSuspendThread ['HANDLE ThreadHandle', 'PULONG PreviousSuspendCount']
 	case 254: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -4364,6 +4617,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 255 NTSTATUS NtSystemDebugControl ['SYSDBG_COMMAND Command', 'PVOID InputBuffer', 'ULONG InputBufferLength', 'PVOID OutputBuffer', 'ULONG OutputBufferLength', 'PULONG ReturnLength']
 	case 255: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4385,6 +4639,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 256 NTSTATUS NtTerminateJobObject ['HANDLE JobHandle', 'NTSTATUS ExitStatus']
 	case 256: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -4398,6 +4653,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 257 NTSTATUS NtTerminateProcess ['HANDLE ProcessHandle', 'NTSTATUS ExitStatus']
 	case 257: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -4411,6 +4667,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 258 NTSTATUS NtTerminateThread ['HANDLE ThreadHandle', 'NTSTATUS ExitStatus']
 	case 258: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -4424,11 +4681,13 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 259 NTSTATUS NtTestAlert ['']
 	case 259: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_NtTestAlert_enter, cpu, pc);
 	}; break;
 	// 260 NTSTATUS NtTraceEvent ['HANDLE TraceHandle', 'ULONG Flags', 'ULONG FieldSize', 'PVOID Fields']
 	case 260: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4446,6 +4705,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 261 NTSTATUS NtTranslateFilePath ['PFILE_PATH InputFilePath', 'ULONG OutputType', 'PFILE_PATH OutputFilePath', 'PULONG OutputFilePathLength']
 	case 261: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4463,6 +4723,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 262 NTSTATUS NtUnloadDriver ['PUNICODE_STRING DriverServiceName']
 	case 262: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -4474,6 +4735,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 263 NTSTATUS NtUnloadKey ['POBJECT_ATTRIBUTES TargetKey']
 	case 263: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -4485,6 +4747,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 264 NTSTATUS NtUnloadKeyEx ['POBJECT_ATTRIBUTES TargetKey', 'HANDLE Event']
 	case 264: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -4498,6 +4761,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 265 NTSTATUS NtUnlockFile ['HANDLE FileHandle', 'PIO_STATUS_BLOCK IoStatusBlock', 'PLARGE_INTEGER ByteOffset', 'PLARGE_INTEGER Length', 'ULONG Key']
 	case 265: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4517,6 +4781,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 266 NTSTATUS NtUnlockVirtualMemory ['HANDLE ProcessHandle', 'PVOID *BaseAddress', 'PSIZE_T RegionSize', 'ULONG MapType']
 	case 266: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4534,6 +4799,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 267 NTSTATUS NtUnmapViewOfSection ['HANDLE ProcessHandle', 'PVOID BaseAddress']
 	case 267: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -4547,6 +4813,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 268 NTSTATUS NtVdmControl ['VDMSERVICECLASS Service', 'PVOID ServiceData']
 	case 268: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
@@ -4560,6 +4827,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 269 NTSTATUS NtWaitForDebugEvent ['HANDLE DebugObjectHandle', 'BOOLEAN Alertable', 'PLARGE_INTEGER Timeout', 'PDBGUI_WAIT_STATE_CHANGE WaitStateChange']
 	case 269: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4577,6 +4845,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 270 NTSTATUS NtWaitForMultipleObjects ['ULONG Count', 'HANDLE Handles[]', 'WAIT_TYPE WaitType', 'BOOLEAN Alertable', 'PLARGE_INTEGER Timeout']
 	case 270: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4596,6 +4865,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 271 NTSTATUS NtWaitForSingleObject ['HANDLE Handle', 'BOOLEAN Alertable', 'PLARGE_INTEGER Timeout']
 	case 271: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4611,6 +4881,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 272 NTSTATUS NtWaitHighEventPair ['HANDLE EventPairHandle']
 	case 272: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -4622,6 +4893,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 273 NTSTATUS NtWaitLowEventPair ['HANDLE EventPairHandle']
 	case 273: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		if (PPP_CHECK_CB(on_all_sys_enter2) ||
 			(!panda_noreturn && (PPP_CHECK_CB(on_all_sys_return2) ||
@@ -4633,6 +4905,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 274 NTSTATUS NtWriteFile ['HANDLE FileHandle', 'HANDLE Event', 'PIO_APC_ROUTINE ApcRoutine', 'PVOID ApcContext', 'PIO_STATUS_BLOCK IoStatusBlock', 'PVOID Buffer', 'ULONG Length', 'PLARGE_INTEGER ByteOffset', 'PULONG Key']
 	case 274: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4660,6 +4933,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 275 NTSTATUS NtWriteFileGather ['HANDLE FileHandle', 'HANDLE Event', 'PIO_APC_ROUTINE ApcRoutine', 'PVOID ApcContext', 'PIO_STATUS_BLOCK IoStatusBlock', 'PFILE_SEGMENT_ELEMENT SegmentArray', 'ULONG Length', 'PLARGE_INTEGER ByteOffset', 'PULONG Key']
 	case 275: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4687,6 +4961,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 276 NTSTATUS NtWriteRequestData ['HANDLE PortHandle', 'PPORT_MESSAGE Message', 'ULONG DataEntryIndex', 'PVOID Buffer', 'SIZE_T BufferSize', 'PSIZE_T NumberOfBytesWritten']
 	case 276: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4708,6 +4983,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 277 NTSTATUS NtWriteVirtualMemory ['HANDLE ProcessHandle', 'PVOID BaseAddress', 'PVOID Buffer', 'SIZE_T BufferSize', 'PSIZE_T NumberOfBytesWritten']
 	case 277: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4727,11 +5003,13 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 278 NTSTATUS NtYieldExecution ['']
 	case 278: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_NtYieldExecution_enter, cpu, pc);
 	}; break;
 	// 279 NTSTATUS NtCreateKeyedEvent ['PHANDLE KeyedEventHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes', 'ULONG Flags']
 	case 279: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4749,6 +5027,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 280 NTSTATUS NtOpenKeyedEvent ['PHANDLE KeyedEventHandle', 'ACCESS_MASK DesiredAccess', 'POBJECT_ATTRIBUTES ObjectAttributes']
 	case 280: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4764,6 +5043,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 281 NTSTATUS NtReleaseKeyedEvent ['HANDLE KeyedEventHandle', 'PVOID KeyValue', 'BOOLEAN Alertable', 'PLARGE_INTEGER Timeout']
 	case 281: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4781,6 +5061,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 282 NTSTATUS NtWaitForKeyedEvent ['HANDLE KeyedEventHandle', 'PVOID KeyValue', 'BOOLEAN Alertable', 'PLARGE_INTEGER Timeout']
 	case 282: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		uint32_t arg0 = get_32(cpu, 0);
 		uint32_t arg1 = get_32(cpu, 1);
 		uint32_t arg2 = get_32(cpu, 2);
@@ -4798,6 +5079,7 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 	// 283 NTSTATUS NtQueryPortInformationProcess ['']
 	case 283: {
 		panda_noreturn = false;
+		ctx.double_return = false;
 		PPP_RUN_CB(on_NtQueryPortInformationProcess_enter, cpu, pc);
 	}; break;
 	default:
diff --git a/panda/plugins/syscalls2/generated/syscalls_ext_typedefs.h b/panda/plugins/syscalls2/generated/syscalls_ext_typedefs.h
index c98e60f5bbf..5585c180ba0 100644
--- a/panda/plugins/syscalls2/generated/syscalls_ext_typedefs.h
+++ b/panda/plugins/syscalls2/generated/syscalls_ext_typedefs.h
@@ -43,6 +43,7 @@ struct syscall_ctx {
     target_ptr_t retaddr; /**< return address */
     uint8_t args[GLOBAL_MAX_SYSCALL_ARGS]
                 [GLOBAL_MAX_SYSCALL_ARG_SIZE]; /**< arguments */
+    bool double_return;
 };
 typedef struct syscall_ctx syscall_ctx_t;
 
diff --git a/panda/plugins/syscalls2/scripts/syscall_parser.py b/panda/plugins/syscalls2/scripts/syscall_parser.py
index 53f179db9a7..ac895a11a94 100755
--- a/panda/plugins/syscalls2/scripts/syscall_parser.py
+++ b/panda/plugins/syscalls2/scripts/syscall_parser.py
@@ -343,6 +343,8 @@ def __init__(self, line, target_context={}):
         self.arch_bits = target_context['arch_conf']['bits']
         panda_noreturn_names = target_context.get('panda_noreturn', {})
         self.panda_noreturn = True if self.name in panda_noreturn_names else False
+        panda_doublereturn_names = target_context.get('panda_doublereturn', {})
+        self.panda_double_return = True if self.name in panda_doublereturn_names else False
 
         # process raw args
         self.args = []
diff --git a/panda/plugins/syscalls2/syscalls2.cpp b/panda/plugins/syscalls2/syscalls2.cpp
index d253a0693de..81836b87da6 100644
--- a/panda/plugins/syscalls2/syscalls2.cpp
+++ b/panda/plugins/syscalls2/syscalls2.cpp
@@ -798,11 +798,20 @@ void hook_syscall_return(CPUState *cpu, TranslationBlock *tb, struct hook* h) {
     auto k = std::make_pair(tb->pc, panda_current_asid(cpu));
     auto ctxi = running_syscalls.find(k);
     int UNUSED(no) = -1;
+    if (unlikely(ctxi == running_syscalls.end())) {
+        k = std::make_pair(tb->pc, 0);
+        ctxi = running_syscalls.find(k);
+    }
     if (likely(ctxi != running_syscalls.end())) {
         syscall_ctx_t *ctx = &ctxi->second;
         no = ctx->no;
         syscalls_profile->return_switch(cpu, tb->pc, ctx);
-        running_syscalls.erase(ctxi);
+        if (ctx->double_return){
+            ctx->double_return = false;
+            return;
+        }else{
+            running_syscalls.erase(ctxi);
+        }
     }
 #if defined(SYSCALL_RETURN_DEBUG)
     if (no >= 0) {

From 6e31c7e704c0f07e675a2b124214e8e0d9ce5377 Mon Sep 17 00:00:00 2001
From: Luke Craig <lacraig3@gmail.com>
Date: Fri, 17 Dec 2021 12:08:04 -0500
Subject: [PATCH 025/140] adding physical_mem_r/w wrappers (#1148)

---
 panda/include/panda/common.h          | 17 +++++++++++++++++
 panda/plugins/memsavep/memsavep.c     |  2 +-
 panda/plugins/pri_taint/pri_taint.cpp |  2 +-
 panda/src/panda_api.c                 |  4 ++--
 4 files changed, 21 insertions(+), 4 deletions(-)

diff --git a/panda/include/panda/common.h b/panda/include/panda/common.h
index 61794ac6a8a..2950668e18b 100644
--- a/panda/include/panda/common.h
+++ b/panda/include/panda/common.h
@@ -95,6 +95,23 @@ static inline int panda_physical_memory_rw(hwaddr addr, uint8_t *buf, int len,
     return MEMTX_OK;
 }
 
+/**
+ * @brief Reads data into \p buf from guest physical address \p addr.
+ */
+static inline int panda_physical_memory_read(hwaddr addr,
+                                            uint8_t *buf, int len) {
+    return panda_physical_memory_rw(addr, buf, len, 0);
+}
+
+/**
+ * @brief Writes data from \p buf data to guest physical address \p addr.
+ */
+static inline int panda_physical_memory_write(hwaddr addr,
+                                             uint8_t *buf, int len) {
+    return panda_physical_memory_rw(addr, buf, len, 1);
+}
+
+
 /**
  * @brief Translates guest virtual addres \p addr to a guest physical address.
  */
diff --git a/panda/plugins/memsavep/memsavep.c b/panda/plugins/memsavep/memsavep.c
index c574c717b9e..1999d385394 100644
--- a/panda/plugins/memsavep/memsavep.c
+++ b/panda/plugins/memsavep/memsavep.c
@@ -49,7 +49,7 @@ static void actually_dump_physical_memory(FILE* out, size_t len)
         size_t l = sizeof(block);
         if (l > len)
             l = len;
-        if (panda_physical_memory_rw(addr, block, l, false) == MEMTX_OK)
+        if (panda_physical_memory_read(addr, block, l) == MEMTX_OK)
             fwrite(block, 1, l, out);
         else
             fwrite(_zero_block, 1, l, out);
diff --git a/panda/plugins/pri_taint/pri_taint.cpp b/panda/plugins/pri_taint/pri_taint.cpp
index e4296de6b36..64de47b8b81 100644
--- a/panda/plugins/pri_taint/pri_taint.cpp
+++ b/panda/plugins/pri_taint/pri_taint.cpp
@@ -129,7 +129,7 @@ void lava_taint_query(target_ulong buf, LocType loc_t, target_ulong buf_len, con
     uint8_t bytes[LAVA_TAINT_QUERY_MAX_LEN] = {0};
     uint32_t len = std::min(buf_len, LAVA_TAINT_QUERY_MAX_LEN);
     if (is_strnlen) {
-        panda_physical_memory_rw(phys, bytes, LAVA_TAINT_QUERY_MAX_LEN, false);
+        panda_physical_memory_read(phys, bytes, LAVA_TAINT_QUERY_MAX_LEN);
         for (int i = 0; i < LAVA_TAINT_QUERY_MAX_LEN; i++) {
             if (bytes[i] == '\0') {
                 len = i;
diff --git a/panda/src/panda_api.c b/panda/src/panda_api.c
index 86ac3614e5d..c6e02af9d6f 100644
--- a/panda/src/panda_api.c
+++ b/panda/src/panda_api.c
@@ -144,11 +144,11 @@ int panda_virtual_memory_write_external(CPUState *env, target_ulong addr, char *
 }
 
 int panda_physical_memory_read_external(hwaddr addr, uint8_t *buf, int len){
-	return panda_physical_memory_rw(addr, buf, len, 0);
+	return panda_physical_memory_read(addr, buf, len);
 }
 
 int panda_physical_memory_write_external(hwaddr addr, uint8_t *buf, int len){
-	return panda_physical_memory_rw(addr,buf,len, 1);
+	return panda_physical_memory_write(addr,buf,len);
 }
 
 bool panda_in_kernel_external(const CPUState *cpu){

From aaf6ac490ba169232ea870f880a1efb5ef663e05 Mon Sep 17 00:00:00 2001
From: Luke Craig <lacraig3@gmail.com>
Date: Mon, 20 Dec 2021 13:24:30 -0500
Subject: [PATCH 026/140] Fix pypanda exceptions (#1149)

---
 panda/python/core/pandare/panda.py | 209 +++++++++++++++++------------
 1 file changed, 124 insertions(+), 85 deletions(-)

diff --git a/panda/python/core/pandare/panda.py b/panda/python/core/pandare/panda.py
index 93ea3d72952..b552f6bb09e 100755
--- a/panda/python/core/pandare/panda.py
+++ b/panda/python/core/pandare/panda.py
@@ -534,21 +534,9 @@ def run(self):
         #self.libpanda.panda_cleanup_record()
         if self._in_replay:
             self.reset()
-        if hasattr(self, "end_run_raise_signal"):
-            saved_exception = self.end_run_raise_signal
-            del self.end_run_raise_signal
-            raise saved_exception
-        if hasattr(self, "callback_exit_exception"):
-            saved_exception = self.callback_exit_exception
-            del self.callback_exit_exception
-            raise saved_exception
-        if hasattr(self, "blocking_queue_error"):
-            saved_exception = self.blocking_queue_error
-            del self.blocking_queue_error
-            raise saved_exception
-        if hasattr(self, "hook_exit_exception"):
-            saved_exception = self.hook_exit_exception
-            del self.hook_exit_exception
+        if hasattr(self, "exit_exception"):
+            saved_exception = self.exit_exception
+            del self.exit_exception
             raise saved_exception
 
 
@@ -946,11 +934,15 @@ def queue_async(self, f, internal=False):
         # this takes the blocking function and handles errors
         @blocking
         def wrapper():
-            try:
-                f()
-            except Exception as e:
-                self.blocking_queue_error = e
-                self.end_analysis()
+            if not hasattr(self, "exit_exception"):
+                try:
+                    f()
+                except Exception as e:
+                    if self.catch_exceptions:
+                        self.callback_exit_exception = e
+                        self.end_analysis()
+                    else:
+                        raise e
 
 
         # Keep the original function name instead of replacing it with 'wrapper'
@@ -2586,21 +2578,22 @@ def decorator(fun):
             return_from_exception = 0
 
             def _run_and_catch(*args, **kwargs): # Run function but if it raises an exception, stop panda and raise it
-                try:
-                    r = fun(*args, **kwargs)
-                    #print(pandatype, type(r)) # XXX Can we use pandatype to determine requried return and assert if incorrect
-                    #assert(isinstance(r, int)), "Invalid return type?"
-                    #print(fun, r) # Stuck with TypeError in _run_and_catch? Enable this to find where the bug is.
-                    return r
-                except Exception as e:
-                    # exceptions wont work in our thread. Therefore we print it here and then throw it after the
-                    # machine exits.
-                    if self.catch_exceptions:
-                        self.callback_exit_exception = e
-                        self.end_analysis()
-                    else:
-                        raise e
-                    return return_from_exception
+                if not hasattr(self, "exit_exception"):
+                    try:
+                        r = fun(*args, **kwargs)
+                        #print(pandatype, type(r)) # XXX Can we use pandatype to determine requried return and assert if incorrect
+                        #assert(isinstance(r, int)), "Invalid return type?"
+                        #print(fun, r) # Stuck with TypeError in _run_and_catch? Enable this to find where the bug is.
+                        return r
+                    except Exception as e:
+                        # exceptions wont work in our thread. Therefore we print it here and then throw it after the
+                        # machine exits.
+                        if self.catch_exceptions:
+                            self.callback_exit_exception = e
+                            self.end_analysis()
+                        else:
+                            raise e
+                        return return_from_exception
 
             cast_rc = pandatype(_run_and_catch)
             cast_rc_string = str(self.ffi.typeof(cast_rc))
@@ -2826,20 +2819,21 @@ def decorator(fun):
                 local_name = fun.__name__
 
             def _run_and_catch(*args, **kwargs): # Run function but if it raises an exception, stop panda and raise it
-                try:
-                    r = fun(*args, **kwargs)
-                    #print(pandatype, type(r)) # XXX Can we use pandatype to determine requried return and assert if incorrect
-                    #assert(isinstance(r, int)), "Invalid return type?"
-                    return r
-                except Exception as e:
-                    # exceptions wont work in our thread. Therefore we print it here and then throw it after the
-                    # machine exits.
-                    if self.catch_exceptions:
-                        self.callback_exit_exception = e
-                        self.end_analysis()
-                    else:
-                        raise e
-                    # this works in all current callback cases. CFFI auto-converts to void, bool, int, and int32_t
+                if not hasattr(self, "exit_exception"):
+                    try:
+                        r = fun(*args, **kwargs)
+                        #print(pandatype, type(r)) # XXX Can we use pandatype to determine requried return and assert if incorrect
+                        #assert(isinstance(r, int)), "Invalid return type?"
+                        return r
+                    except Exception as e:
+                        # exceptions wont work in our thread. Therefore we print it here and then throw it after the
+                        # machine exits.
+                        if self.catch_exceptions:
+                            self.callback_exit_exception = e
+                            self.end_analysis()
+                        else:
+                            raise e
+                        # this works in all current callback cases. CFFI auto-converts to void, bool, int, and int32_t
 
             cast_rc = self.ffi.callback(attr+"_t")(_run_and_catch)  # Wrap the python fn in a c-callback.
             if local_name == "<lambda>":
@@ -2933,9 +2927,27 @@ def decorator(fun):
 
             if debug:
                 print("Registering breakpoint at 0x{:x} -> {} == {}".format(addr, fun, 'cdata_cb'))
+            
+            def _run_and_catch(*args, **kwargs): # Run function but if it raises an exception, stop panda and raise it
+                if not hasattr(self, "exit_exception"):
+                    try:
+                        r = fun(*args, **kwargs)
+                        #print(pandatype, type(r)) # XXX Can we use pandatype to determine requried return and assert if incorrect
+                        #assert(isinstance(r, int)), "Invalid return type?"
+                        #print(fun, r) # Stuck with TypeError in _run_and_catch? Enable this to find where the bug is.
+                        return r
+                    except Exception as e:
+                        # exceptions wont work in our thread. Therefore we print it here and then throw it after the
+                        # machine exits.
+                        if self.catch_exceptions:
+                            self.callback_exit_exception = e
+                            self.end_analysis()
+                        else:
+                            raise e
+                        return 0
 
             # Inform the plugin that it has a new breakpoint at addr
-            hook_cb_passed = hook_cb_type(fun)
+            hook_cb_passed = hook_cb_type(_run_and_catch)
             new_hook = self.ffi.new("struct hook*")
             new_hook.type = type_num
             new_hook.addr = addr
@@ -2956,20 +2968,8 @@ def decorator(fun):
             self.plugins['hooks'].add_hook(new_hook)
             self.hook_list.append((new_hook, hook_cb_passed))
 
-            @hook_cb_type # Make CFFI know it's a callback. Different from _generated_callback for some reason?
             def wrapper(*args, **kw):
-                try:
-                    r = fun(*args, **kw)
-                    #assert(isinstance(r, int)), "Invalid return type?"
-                    return r
-                except Exception as e:
-                    # exceptions wont work in our thread. Therefore we print it here and then throw it after the
-                    # machine exits.
-                    self.hook_exit_exception = e
-                    self.end_analysis()
-                    # this works in all current callback cases. CFFI auto-converts to void, bool, int, and int32_t
-                    return 0
-
+                return _run_and_catch(args,kw)
             return wrapper
         return decorator
 
@@ -3004,8 +3004,26 @@ def decorator(fun):
                 print("function type not supported")
                 return
 
+            def _run_and_catch(*args, **kwargs): # Run function but if it raises an exception, stop panda and raise it
+                if not hasattr(self, "exit_exception"):
+                    try:
+                        r = fun(*args, **kwargs)
+                        return r
+                    except Exception as e:
+                        # exceptions wont work in our thread. Therefore we print it here and then throw it after the
+                        # machine exits.
+                        if self.catch_exceptions:
+                            self.callback_exit_exception = e
+                            self.end_analysis()
+                        else:
+                            raise e
+                        if cb_type == "before_block_exec_invalidate_opt":
+                            return False
+                        return None
+
+
             # Inform the plugin that it has a new breakpoint at addr
-            hook_cb_passed = hook_cb_type(fun)
+            hook_cb_passed = hook_cb_type(_run_and_catch)
             new_hook = self.ffi.new("struct symbol_hook*")
             type_num = getattr(self.libpanda, "PANDA_CB_"+cb_type.upper())
             new_hook.type = type_num
@@ -3033,20 +3051,8 @@ def decorator(fun):
                 self.named_hooks[name] = hook_ptr
             self.hook_list.append((fun, new_hook,hook_cb_passed, hook_ptr))
 
-            @hook_cb_type # Make CFFI know it's a callback. Different from _generated_callback for some reason?
             def wrapper(*args, **kw):
-                try:
-                    r = fun(*args, **kw)
-                    #assert(isinstance(r, int)), "Invalid return type?"
-                    return r
-                except Exception as e:
-                    # exceptions wont work in our thread. Therefore we print it here and then throw it after the
-                    # machine exits.
-                    self.hook_exit_exception = e
-                    self.end_analysis()
-                    # this works in all current callback cases. CFFI auto-converts to void, bool, int, and int32_t
-                    return 0
-
+                _run_and_catch(args,kw)
             return wrapper
         return decorator
 
@@ -3117,7 +3123,26 @@ def decorator(fun):
             hook_cb_type = self.ffi.callback("bool (CPUState*, TranslationBlock*, void*)")
             # Inform the plugin that it has a new breakpoint at addr
 
-            hook_cb_passed = hook_cb_type(fun)
+            def _run_and_catch(*args, **kwargs): # Run function but if it raises an exception, stop panda and raise it
+                if not hasattr(self, "exit_exception"):
+                    try:
+                        r = fun(*args, **kwargs)
+                        #print(pandatype, type(r)) # XXX Can we use pandatype to determine requried return and assert if incorrect
+                        #assert(isinstance(r, int)), "Invalid return type?"
+                        #print(fun, r) # Stuck with TypeError in _run_and_catch? Enable this to find where the bug is.
+                        return r
+                    except Exception as e:
+                        # exceptions wont work in our thread. Therefore we print it here and then throw it after the
+                        # machine exits.
+                        if self.catch_exceptions:
+                            self.callback_exit_exception = e
+                            self.end_analysis()
+                        else:
+                            raise e
+                        return True
+
+
+            hook_cb_passed = hook_cb_type(_run_and_catch)
             if not hasattr(self, "hook_gc_list"):
                 self.hook_gc_list = [hook_cb_passed]
             else:
@@ -3130,10 +3155,8 @@ def decorator(fun):
 
             self.hook_list2[name] = hook_number
 
-            @hook_cb_type # Make CFFI know it's a callback. Different from _generated_callback for some reason?
             def wrapper(*args, **kw):
-                return fun(*args, **kw)
-
+                return _run_and_catch(*args, **kw)
             return wrapper
         return decorator
 
@@ -3154,8 +3177,23 @@ def _hook_mem(self, start_address, end_address, before, after, read, write, virt
         def decorator(fun):
             mem_hook_cb_type = self.ffi.callback("mem_hook_func_t")
             # Inform the plugin that it has a new breakpoint at addr
-
-            hook_cb_passed = mem_hook_cb_type(fun)
+            
+            def _run_and_catch(*args, **kwargs): # Run function but if it raises an exception, stop panda and raise it
+                if not hasattr(self, "exit_exception"):
+                    try:
+                        r = fun(*args, **kwargs)
+                        return r
+                    except Exception as e:
+                        # exceptions wont work in our thread. Therefore we print it here and then throw it after the
+                        # machine exits.
+                        if self.catch_exceptions:
+                            self.callback_exit_exception = e
+                            self.end_analysis()
+                        else:
+                            raise e
+                        return None
+
+            hook_cb_passed = mem_hook_cb_type(_run_and_catch)
             mem_reg = self.ffi.new("struct memory_hooks_region*")
             mem_reg.start_address = start_address
             mem_reg.stop_address = end_address
@@ -3172,9 +3210,10 @@ def decorator(fun):
 
             self.mem_hooks[hook] = [mem_reg, hook_cb_passed]
 
-            @mem_hook_cb_type # Make CFFI know it's a callback. Different from _generated_callback for some reason?
+
             def wrapper(*args, **kw):
-                return fun(*args, **kw)
+                _run_and_catch(args,kw)
+
 
             return wrapper
         return decorator

From 8647549afddf5ebebd7e724728958a0a408e8f20 Mon Sep 17 00:00:00 2001
From: Luke Craig <lacraig3@gmail.com>
Date: Tue, 28 Dec 2021 22:16:48 -0500
Subject: [PATCH 027/140] fix up exceptions

---
 panda/python/core/pandare/panda.py | 36 ++++++++++++++----------------
 1 file changed, 17 insertions(+), 19 deletions(-)

diff --git a/panda/python/core/pandare/panda.py b/panda/python/core/pandare/panda.py
index b552f6bb09e..7f9a7a6eb37 100755
--- a/panda/python/core/pandare/panda.py
+++ b/panda/python/core/pandare/panda.py
@@ -462,13 +462,13 @@ def _setup_internal_signal_handler(self, signal_handler=None):
         def SigHandler(SIG,a,b):
             from signal import SIGINT, SIGHUP, SIGTERM
             if SIG == SIGINT:
-                self.end_run_raise_signal = KeyboardInterrupt
+                self.exit_exception = KeyboardInterrupt
                 self.end_analysis()
             elif SIG == SIGHUP:
-                self.end_run_raise_signal = KeyboardInterrupt
+                self.exit_exception = KeyboardInterrupt
                 self.end_analysis()
             elif SIG == SIGTERM:
-                self.end_run_raise_signal = KeyboardInterrupt
+                self.exit_exception = KeyboardInterrupt
                 self.end_analysis()
             else:
                 print(f"PyPanda Signal handler received unhandled signal {SIG}")
@@ -934,16 +934,14 @@ def queue_async(self, f, internal=False):
         # this takes the blocking function and handles errors
         @blocking
         def wrapper():
-            if not hasattr(self, "exit_exception"):
-                try:
-                    f()
-                except Exception as e:
-                    if self.catch_exceptions:
-                        self.callback_exit_exception = e
-                        self.end_analysis()
-                    else:
-                        raise e
-
+            try:
+                f()
+            except Exception as e:
+                if self.catch_exceptions:
+                    self.exit_exception = e
+                    self.end_analysis()
+                else:
+                    raise e
 
         # Keep the original function name instead of replacing it with 'wrapper'
         wrapper.__name__ = f.__name__
@@ -2589,7 +2587,7 @@ def _run_and_catch(*args, **kwargs): # Run function but if it raises an exceptio
                         # exceptions wont work in our thread. Therefore we print it here and then throw it after the
                         # machine exits.
                         if self.catch_exceptions:
-                            self.callback_exit_exception = e
+                            self.exit_exception = e
                             self.end_analysis()
                         else:
                             raise e
@@ -2829,7 +2827,7 @@ def _run_and_catch(*args, **kwargs): # Run function but if it raises an exceptio
                         # exceptions wont work in our thread. Therefore we print it here and then throw it after the
                         # machine exits.
                         if self.catch_exceptions:
-                            self.callback_exit_exception = e
+                            self.exit_exception = e
                             self.end_analysis()
                         else:
                             raise e
@@ -2940,7 +2938,7 @@ def _run_and_catch(*args, **kwargs): # Run function but if it raises an exceptio
                         # exceptions wont work in our thread. Therefore we print it here and then throw it after the
                         # machine exits.
                         if self.catch_exceptions:
-                            self.callback_exit_exception = e
+                            self.exit_exception = e
                             self.end_analysis()
                         else:
                             raise e
@@ -3013,7 +3011,7 @@ def _run_and_catch(*args, **kwargs): # Run function but if it raises an exceptio
                         # exceptions wont work in our thread. Therefore we print it here and then throw it after the
                         # machine exits.
                         if self.catch_exceptions:
-                            self.callback_exit_exception = e
+                            self.exit_exception = e
                             self.end_analysis()
                         else:
                             raise e
@@ -3135,7 +3133,7 @@ def _run_and_catch(*args, **kwargs): # Run function but if it raises an exceptio
                         # exceptions wont work in our thread. Therefore we print it here and then throw it after the
                         # machine exits.
                         if self.catch_exceptions:
-                            self.callback_exit_exception = e
+                            self.exit_exception = e
                             self.end_analysis()
                         else:
                             raise e
@@ -3187,7 +3185,7 @@ def _run_and_catch(*args, **kwargs): # Run function but if it raises an exceptio
                         # exceptions wont work in our thread. Therefore we print it here and then throw it after the
                         # machine exits.
                         if self.catch_exceptions:
-                            self.callback_exit_exception = e
+                            self.exit_exception = e
                             self.end_analysis()
                         else:
                             raise e

From 98d0b10956d761aa455c68ad7b1cf422e756599f Mon Sep 17 00:00:00 2001
From: Ben Dumas <bendumas95@gmail.com>
Date: Wed, 5 Jan 2022 14:11:13 -0500
Subject: [PATCH 028/140] Use libosi to handle windows introspection (#1138)

Co-authored-by: Luke Craig <lacraig3@gmail.com>
---
 Dockerfile                                    |   7 +
 panda/dependencies/ubuntu:18.04_build.txt     |   5 +
 panda/dependencies/ubuntu:20.04_build.txt     |   5 +
 panda/include/panda/common.h                  |   5 +
 .../callstack_instr/callstack_instr.cpp       |   2 -
 panda/plugins/config.panda                    |   3 -
 panda/plugins/file_taint/file_taint.cpp       |   5 +-
 panda/plugins/syscalls2/syscalls2.cpp         |   2 +-
 panda/plugins/win2000x86intro/Makefile        |   9 -
 panda/plugins/win2000x86intro/README.md       |  30 -
 .../win2000x86intro/win2000x86intro.cpp       | 156 ----
 .../win2000x86intro/win2000x86intro_int.h     |   6 -
 .../win2000x86intro/win2000x86intro_int_fns.h |   8 -
 panda/plugins/win7x86intro/Makefile           |   9 -
 panda/plugins/win7x86intro/README.md          |  33 -
 panda/plugins/win7x86intro/win7x86intro.cpp   | 165 ----
 panda/plugins/win7x86intro/win7x86intro_int.h |   6 -
 .../win7x86intro/win7x86intro_int_fns.h       |   8 -
 panda/plugins/wintrospection/Makefile         |  13 +-
 panda/plugins/wintrospection/pandamemory.cpp  |  77 ++
 panda/plugins/wintrospection/pandamemory.h    |  21 +
 panda/plugins/wintrospection/wintrospection.c | 877 ------------------
 .../plugins/wintrospection/wintrospection.cpp | 734 +++++++++++++++
 panda/plugins/wintrospection/wintrospection.h |  35 -
 .../wintrospection/wintrospection_int.h       |  14 +-
 .../wintrospection/wintrospection_int_fns.h   |  99 +-
 panda/plugins/winxpx86intro/Makefile          |   9 -
 panda/plugins/winxpx86intro/README.md         |  30 -
 panda/plugins/winxpx86intro/winxpx86intro.cpp | 179 ----
 .../plugins/winxpx86intro/winxpx86intro_int.h |   6 -
 .../winxpx86intro/winxpx86intro_int_fns.h     |   8 -
 panda/python/examples/example_win.py          |  36 +
 panda/scripts/install_ubuntu.sh               |  16 +
 panda/src/common.c                            |  30 +-
 34 files changed, 953 insertions(+), 1695 deletions(-)
 delete mode 100644 panda/plugins/win2000x86intro/Makefile
 delete mode 100644 panda/plugins/win2000x86intro/README.md
 delete mode 100644 panda/plugins/win2000x86intro/win2000x86intro.cpp
 delete mode 100644 panda/plugins/win2000x86intro/win2000x86intro_int.h
 delete mode 100644 panda/plugins/win2000x86intro/win2000x86intro_int_fns.h
 delete mode 100644 panda/plugins/win7x86intro/Makefile
 delete mode 100644 panda/plugins/win7x86intro/README.md
 delete mode 100644 panda/plugins/win7x86intro/win7x86intro.cpp
 delete mode 100644 panda/plugins/win7x86intro/win7x86intro_int.h
 delete mode 100644 panda/plugins/win7x86intro/win7x86intro_int_fns.h
 create mode 100644 panda/plugins/wintrospection/pandamemory.cpp
 create mode 100644 panda/plugins/wintrospection/pandamemory.h
 delete mode 100644 panda/plugins/wintrospection/wintrospection.c
 create mode 100644 panda/plugins/wintrospection/wintrospection.cpp
 delete mode 100644 panda/plugins/wintrospection/wintrospection.h
 delete mode 100644 panda/plugins/winxpx86intro/Makefile
 delete mode 100644 panda/plugins/winxpx86intro/README.md
 delete mode 100644 panda/plugins/winxpx86intro/winxpx86intro.cpp
 delete mode 100644 panda/plugins/winxpx86intro/winxpx86intro_int.h
 delete mode 100644 panda/plugins/winxpx86intro/winxpx86intro_int_fns.h
 create mode 100755 panda/python/examples/example_win.py

diff --git a/Dockerfile b/Dockerfile
index 1b6ded13dab..074eba55502 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -40,6 +40,13 @@ ENV PATH="/root/.cargo/bin:${PATH}"
 # Sanity check to ensure cargo is installed
 RUN cargo --help
 
+# install libosi
+RUN cd /tmp && \
+    git clone https://github.com/panda-re/libosi && \
+    mkdir /tmp/libosi/build && cd /tmp/libosi/build && \
+    cmake -GNinja .. && ninja && ninja package && dpkg -i libosi*.deb && \
+    cd /tmp && rm -rf libosi/
+
 # Build and install panda
 # Copy repo root directory to /panda, note we explicitly copy in .git directory
 # Note .dockerignore file keeps us from copying things we don't need
diff --git a/panda/dependencies/ubuntu:18.04_build.txt b/panda/dependencies/ubuntu:18.04_build.txt
index b284ce0b4cc..b0695e00e85 100644
--- a/panda/dependencies/ubuntu:18.04_build.txt
+++ b/panda/dependencies/ubuntu:18.04_build.txt
@@ -71,3 +71,8 @@ texinfo
 uuid-dev
 xfslibs-dev
 zlib1g-dev
+
+# libosi install deps
+cmake
+ninja-build
+rapidjson-dev
diff --git a/panda/dependencies/ubuntu:20.04_build.txt b/panda/dependencies/ubuntu:20.04_build.txt
index c9bd9e14bbf..57a682f20da 100644
--- a/panda/dependencies/ubuntu:20.04_build.txt
+++ b/panda/dependencies/ubuntu:20.04_build.txt
@@ -83,3 +83,8 @@ libc6.1-dev-alpha-cross
 
 # rust install deps
 curl
+
+# libosi install deps
+cmake
+ninja-build
+rapidjson-dev
diff --git a/panda/include/panda/common.h b/panda/include/panda/common.h
index 2950668e18b..e5b14a5a84f 100644
--- a/panda/include/panda/common.h
+++ b/panda/include/panda/common.h
@@ -70,6 +70,11 @@ target_ulong panda_current_pc(CPUState *cpu);
 
 // END_PYPANDA_NEEDS_THIS -- do not delete this comment!
 
+/**
+ * @brief Return the max address of system memory that maps to RAM.
+ */
+Int128 panda_find_max_ram_address(void);
+
 /**
  * @brief Reads/writes data into/from \p buf from/to guest physical address \p addr.
  */
diff --git a/panda/plugins/callstack_instr/callstack_instr.cpp b/panda/plugins/callstack_instr/callstack_instr.cpp
index 743b175aea0..375242e98b6 100644
--- a/panda/plugins/callstack_instr/callstack_instr.cpp
+++ b/panda/plugins/callstack_instr/callstack_instr.cpp
@@ -47,8 +47,6 @@ PANDAENDCOMMENT */
 // needed for the threaded stack_type
 #include "osi/osi_types.h"
 #include "osi/osi_ext.h"
-#include "wintrospection/wintrospection.h"
-#include "wintrospection/wintrospection_ext.h"
 #include "osi_linux/osi_linux_ext.h"
 
 #include "callstack_instr.h"
diff --git a/panda/plugins/config.panda b/panda/plugins/config.panda
index 72db6034cd5..d3ec7d5d669 100644
--- a/panda/plugins/config.panda
+++ b/panda/plugins/config.panda
@@ -46,7 +46,4 @@ textprinter
 trace
 track_intexc
 unigrams
-win2000x86intro
-win7x86intro
 wintrospection
-winxpx86intro
diff --git a/panda/plugins/file_taint/file_taint.cpp b/panda/plugins/file_taint/file_taint.cpp
index 61ecdbf1c1f..bd55f1b25ff 100644
--- a/panda/plugins/file_taint/file_taint.cpp
+++ b/panda/plugins/file_taint/file_taint.cpp
@@ -22,7 +22,6 @@ PANDAENDCOMMENT */
 #include "osi/osi_types.h"
 #include "osi/osi_ext.h"
 
-#include "wintrospection/wintrospection.h"
 #include "wintrospection/wintrospection_ext.h"
 
 #include "osi_linux/osi_linux_ext.h"
@@ -207,7 +206,7 @@ void windows_read_enter(CPUState *cpu, target_ulong pc, uint32_t FileHandle,
                         uint32_t ByteOffset, uint32_t Key)
 {
     // get_handle_name will assert if the filename is null
-    char *filename = get_handle_name(cpu, get_current_proc(cpu), FileHandle);
+    char *filename = get_handle_name(cpu, FileHandle);
     std::string ob_path = filename;
     // Check if the file handle is absolute, if not we need to make it absolute.
     if (filename[0] != '\\') {
@@ -221,7 +220,7 @@ void windows_read_enter(CPUState *cpu, target_ulong pc, uint32_t FileHandle,
         g_free(cwd);
     }
     verbose_printf("file_taint windows object path: %s\n", ob_path.c_str());
-    int64_t pos = get_file_handle_pos(cpu, get_current_proc(cpu), FileHandle);
+    int64_t pos = get_file_handle_pos(cpu, FileHandle);
     read_enter(ob_path, FileHandle, pos);
     g_free(filename);
 }
diff --git a/panda/plugins/syscalls2/syscalls2.cpp b/panda/plugins/syscalls2/syscalls2.cpp
index 81836b87da6..47976598f3e 100644
--- a/panda/plugins/syscalls2/syscalls2.cpp
+++ b/panda/plugins/syscalls2/syscalls2.cpp
@@ -1068,7 +1068,7 @@ bool init_plugin(void *self) {
             std::cerr << PANDA_MSG "using profile for windows sp3 x86 32-bit" << std::endl;
             syscalls_profile = &profiles[PROFILE_WINDOWS_XPSP3_X86];
         }
-        if (0 == strcmp(panda_os_variant, "7")) {
+        if (0 == strncmp(panda_os_variant, "7", 1)) {
             std::cerr << PANDA_MSG "using profile for windows 7 x86 32-bit" << std::endl;
             syscalls_profile = &profiles[PROFILE_WINDOWS_7_X86];
         }
diff --git a/panda/plugins/win2000x86intro/Makefile b/panda/plugins/win2000x86intro/Makefile
deleted file mode 100644
index f3982d849ad..00000000000
--- a/panda/plugins/win2000x86intro/Makefile
+++ /dev/null
@@ -1,9 +0,0 @@
-# Don't forget to add your plugin to config.panda!
-
-# If you need custom CFLAGS or LIBS, set them up here
-# CFLAGS+=
-# LIBS+=
-
-# The main rule for your plugin. List all object-file dependencies.
-$(PLUGIN_TARGET_DIR)/panda_$(PLUGIN_NAME).so: \
-	$(PLUGIN_OBJ_DIR)/$(PLUGIN_NAME).o
diff --git a/panda/plugins/win2000x86intro/README.md b/panda/plugins/win2000x86intro/README.md
deleted file mode 100644
index 842757402c6..00000000000
--- a/panda/plugins/win2000x86intro/README.md
+++ /dev/null
@@ -1,30 +0,0 @@
-Plugin: win2000x86intro
-===========
-
-Summary
--------
-
-`win2000x86intro` is an introspection provider for Windows 2000 guests, supplying information for the OSI API. Not much more to say about it; it should Just Work as long as the guest OS is Windows 2000.
-
-Arguments
----------
-
-None.
-
-Dependencies
-------------
-
-`win2000x86intro` is an introspection provider for the `osi` plugin.
-
-APIs and Callbacks
-------------------
-
-None.
-
-Example
--------
-
-Running `osi_test` on an Windows 2000 32-bit replay:
-
-    $PANDA_PATH/x86_64-softmmu/panda-system-x86_64 -replay foo \
-        -panda osi -panda win2000x86intro -panda osi_test
diff --git a/panda/plugins/win2000x86intro/win2000x86intro.cpp b/panda/plugins/win2000x86intro/win2000x86intro.cpp
deleted file mode 100644
index 83631804555..00000000000
--- a/panda/plugins/win2000x86intro/win2000x86intro.cpp
+++ /dev/null
@@ -1,156 +0,0 @@
-/* PANDABEGINCOMMENT
- *
- * Authors:
- *  Tim Leek               tleek@ll.mit.edu
- *  Ryan Whelan            rwhelan@ll.mit.edu
- *  Joshua Hodosh          josh.hodosh@ll.mit.edu
- *  Michael Zhivich        mzhivich@ll.mit.edu
- *  Brendan Dolan-Gavitt   brendandg@gatech.edu
- *
- * This work is licensed under the terms of the GNU GPL, version 2.
- * See the COPYING file in the top-level directory.
- *
-PANDAENDCOMMENT */
-#define __STDC_FORMAT_MACROS
-
-#include <glib.h>
-#include "panda/plugin.h"
-#include "panda/plugin_plugin.h"
-
-extern "C" {
-
-#include "osi/osi_types.h"
-#include "osi/os_intro.h"
-
-#include "qemu/rcu.h"
-#include "qemu/rcu_queue.h"
-
-#include "exec/address-spaces.h"
-
-#include "wintrospection/wintrospection.h"
-#include "wintrospection/wintrospection_ext.h"
-
-bool init_plugin(void *);
-void uninit_plugin(void *);
-void on_get_mappings(CPUState *cpu, OsiProc *p, GArray **out);
-PTR get_win2000_kpcr(CPUState *cpu);
-HandleObject *get_win2000_handle_object(CPUState *cpu, uint32_t eproc, uint32_t handle);
-PTR get_win2000_kddebugger_data(CPUState *cpu);
-}
-
-#include <cstdio>
-#include <cstdlib>
-
-#ifdef TARGET_I386
-
-#define HANDLE_TABLE_L1_OFF    0x008    // _HANDLE_TABLE.Layer1
-#define KDDEBUGGER_DATA_SIZE   0x208
-
-#define HANDLE_LOCK_FLAG 0x80000000
-
-// Windows 2000 has a fixed location for the KPCR
-PTR get_win2000_kpcr(CPUState *cpu) {
-    return 0xFFDFF000;
-}
-
-// i.e. return pointer to the object represented by this handle
-static uint32_t get_handle_table_entry(CPUState *cpu, uint32_t pHandleTable, uint32_t handle) {
-    uint32_t L1_index = (handle & HANDLE_MASK3) >> HANDLE_SHIFT3;
-    uint32_t L1_table_off = handle_table_L1_addr(cpu, pHandleTable, L1_index);
-    uint32_t L1_table;
-    if(panda_virtual_memory_rw(cpu, L1_table_off, (uint8_t *) &L1_table, 4, false) == -1) return 0;
-
-    uint32_t L2_index = (handle & HANDLE_MASK2) >> HANDLE_SHIFT2;
-    uint32_t L2_table_off = handle_table_L2_addr(L1_table, L2_index);
-    uint32_t L2_table;
-    if(panda_virtual_memory_rw(cpu, L2_table_off, (uint8_t *) &L2_table, 4, false) == -1) return 0;
-
-    uint32_t index = (handle & HANDLE_MASK1) >> HANDLE_SHIFT1;
-    uint32_t pEntry = handle_table_L3_entry(pHandleTable, L2_table, index);
-    uint32_t pObjectHeader;
-    if ((panda_virtual_memory_rw(cpu, pEntry, (uint8_t *) &pObjectHeader, 4, false)) == -1) return 0;
-
-    // In Windows 2000 (and supposedly Windows NT 4), the three low-order and
-    // highest-order bit are flags.
-    //
-    // The remaining bits make up the pointer - sometimes. The lock flag must be
-    // set get a valid pointer to the object since these are kernel objects and
-    // they will always live in memory that is greater than 0x80000000. So to
-    // get the pointer you have to set the high bit if it is not already locked
-    // and mask off the lower three bits.
-    //
-    // Ref: Inside Microsoft Windows 2000, Third Edition, David A. Solomon, Mark
-    // E. Russinovich.
-    pObjectHeader |= HANDLE_LOCK_FLAG;
-    pObjectHeader &= TABLE_MASK;
-
-    return pObjectHeader;
-}
-
-
-HandleObject *get_win2000_handle_object(CPUState *cpu, uint32_t eproc, uint32_t handle) {
-    uint32_t pObjectTable;
-    uint32_t handleTable;
-    if (-1 == panda_virtual_memory_rw(cpu, eproc+get_eproc_objtable_off(), (uint8_t *)&pObjectTable, 4, false)) {
-        return NULL;
-    }
-    if (-1 == panda_virtual_memory_read(cpu, pObjectTable + HANDLE_TABLE_L1_OFF,
-                                        (uint8_t *)&handleTable,
-                                        sizeof(handleTable))) {
-        return NULL;
-    }
-    uint32_t pObjHeader = get_handle_table_entry(cpu, handleTable, handle);
-    if (pObjHeader == 0) return NULL;
-    uint32_t pObj = pObjHeader + OBJECT_HEADER_BODY_OFFSET;
-    uint8_t objType = 0;
-    if (-1 == panda_virtual_memory_rw(cpu, pObjHeader+get_obj_type_offset(), (uint8_t *)&objType, 1, false)) {
-        return NULL;
-    }
-    HandleObject *ho = (HandleObject *)g_malloc(sizeof(HandleObject));
-    ho->objType = objType;
-    ho->pObj = pObj;
-    return ho;
-}
-
-// Returns the physical address of KDDEBUGGER_DATA64.
-PTR get_win2000_kddebugger_data(CPUState *cpu)
-{
-    static PTR cached_kdbg = -1;
-    if (cached_kdbg != -1) {
-        return cached_kdbg;
-    }
-
-    MemoryRegion *mr = memory_region_find(get_system_memory(), 0x2000000, 1).mr;
-    rcu_read_lock();
-    uint8_t *host_ptr = (uint8_t *)qemu_map_ram_ptr(mr->ram_block, 0);
-    uint8_t signature[] = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0,
-                           0x0, 0x0, 'K', 'D', 'B', 'G'};
-
-    for (int i = 0; i < int128_get64(mr->size) - KDDEBUGGER_DATA_SIZE; i++) {
-        if (0 == memcmp(signature, host_ptr + i, sizeof(signature))) {
-            // We subtract eight bytes from the current position because of the
-            // list entry field size. This gives us the start of the
-            // KDDEBUGGER_DATA structure.
-            cached_kdbg = i - 8;
-            break;
-        }
-    }
-    rcu_read_unlock();
-
-    return cached_kdbg;
-}
-
-#endif
-
-bool init_plugin(void *self) {
-#if defined(TARGET_I386) && !defined(TARGET_X86_64)
-    assert(init_wintrospection_api());
-    return true;
-#else
-    return false;
-#endif
-
-}
-
-void uninit_plugin(void *self) {
-}
diff --git a/panda/plugins/win2000x86intro/win2000x86intro_int.h b/panda/plugins/win2000x86intro/win2000x86intro_int.h
deleted file mode 100644
index 96600663733..00000000000
--- a/panda/plugins/win2000x86intro/win2000x86intro_int.h
+++ /dev/null
@@ -1,6 +0,0 @@
-typedef void PTR;
-typedef void CPUState;
-typedef void HandleObject;
-typedef void uint32_t;
-
-#include "win2000x86intro_int_fns.h"
diff --git a/panda/plugins/win2000x86intro/win2000x86intro_int_fns.h b/panda/plugins/win2000x86intro/win2000x86intro_int_fns.h
deleted file mode 100644
index a710934b727..00000000000
--- a/panda/plugins/win2000x86intro/win2000x86intro_int_fns.h
+++ /dev/null
@@ -1,8 +0,0 @@
-#ifndef __WIN2000X86INTRO_INT_FNS_H__
-#define __WIN2000X86INTRO_INT_FNS_H__
-
-PTR get_win2000_kpcr(CPUState *cpu);
-HandleObject *get_win2000_handle_object(CPUState *cpu, uint32_t eproc, uint32_t handle);
-PTR get_win2000_kddebugger_data(CPUState *cpu);
-
-#endif
diff --git a/panda/plugins/win7x86intro/Makefile b/panda/plugins/win7x86intro/Makefile
deleted file mode 100644
index f3982d849ad..00000000000
--- a/panda/plugins/win7x86intro/Makefile
+++ /dev/null
@@ -1,9 +0,0 @@
-# Don't forget to add your plugin to config.panda!
-
-# If you need custom CFLAGS or LIBS, set them up here
-# CFLAGS+=
-# LIBS+=
-
-# The main rule for your plugin. List all object-file dependencies.
-$(PLUGIN_TARGET_DIR)/panda_$(PLUGIN_NAME).so: \
-	$(PLUGIN_OBJ_DIR)/$(PLUGIN_NAME).o
diff --git a/panda/plugins/win7x86intro/README.md b/panda/plugins/win7x86intro/README.md
deleted file mode 100644
index a8790aa5c25..00000000000
--- a/panda/plugins/win7x86intro/README.md
+++ /dev/null
@@ -1,33 +0,0 @@
-Plugin: win7x86intro
-===========
-
-Summary
--------
-
-`win7x86intro` is an introspection provider for Windows 7 guests, supplying information for the OSI API. Not much more to say about it; it should Just Work as long as the guest OS is Windows 7 32-bit.
-
-Arguments
----------
-
-None.
-
-Dependencies
-------------
-
-`win7x86intro` is an introspection provider for the `osi` plugin.
-
-APIs and Callbacks
-------------------
-
-None.
-
-Example
--------
-
-Running `osi_test` on an Windows 7 32-bit replay:
-
-    $PANDA_PATH/x86_64-softmmu/panda-system-x86_64 -replay foo \
-        -panda osi -panda win7x86intro -panda osi_test
-
-Bugs
-----
diff --git a/panda/plugins/win7x86intro/win7x86intro.cpp b/panda/plugins/win7x86intro/win7x86intro.cpp
deleted file mode 100644
index d68d947abc7..00000000000
--- a/panda/plugins/win7x86intro/win7x86intro.cpp
+++ /dev/null
@@ -1,165 +0,0 @@
-/* PANDABEGINCOMMENT
- *
- * Authors:
- *  Tim Leek               tleek@ll.mit.edu
- *  Ryan Whelan            rwhelan@ll.mit.edu
- *  Joshua Hodosh          josh.hodosh@ll.mit.edu
- *  Michael Zhivich        mzhivich@ll.mit.edu
- *  Brendan Dolan-Gavitt   brendandg@gatech.edu
- *
- * This work is licensed under the terms of the GNU GPL, version 2.
- * See the COPYING file in the top-level directory.
- *
-PANDAENDCOMMENT */
-#define __STDC_FORMAT_MACROS
-
-#include "panda/plugin.h"
-#include "panda/plugin_plugin.h"
-
-extern "C" {
-
-#include "osi/osi_types.h"
-#include "osi/os_intro.h"
-
-#include "wintrospection/wintrospection.h"
-#include "wintrospection/wintrospection_ext.h"
-
-bool init_plugin(void *);
-void uninit_plugin(void *);
-void on_get_mappings(CPUState *, OsiProc *p, GArray **out);
-PTR get_win7_kpcr(CPUState *cpu);
-HandleObject *get_win7_handle_object(CPUState *cpu, uint32_t eproc, uint32_t handle);
-PTR get_win7_kdbg(CPUState *cpu);
-}
-
-#include <cstdio>
-#include <cstdlib>
-
-#ifdef TARGET_I386
-
-#define KMODE_FS               0x030 // Segment number of FS in kernel mode
-#define KPCR_KDVERSION_OFF     0x034  // _KPCR.KdVersionBlock
-#define KDVERSION_DDL_OFF      0x020  // _DBGKD_GET_VERSION64.DebuggerDataList
-
-// XXX: this will have to change for 64-bit
-PTR get_win7_kpcr(CPUState *cpu) {
-    // Read the kernel-mode FS segment base
-    uint32_t e1, e2;
-    PTR fs_base;
-
-    CPUArchState *env = (CPUArchState *)cpu->env_ptr;
-    // Read out the two 32-bit ints that make up a segment descriptor
-    panda_virtual_memory_rw(cpu, env->gdt.base + KMODE_FS, (uint8_t *)&e1, sizeof(PTR), false);
-    panda_virtual_memory_rw(cpu, env->gdt.base + KMODE_FS + 4, (uint8_t *)&e2, sizeof(PTR), false);
-
-    // Turn wacky segment into base
-    fs_base = (e1 >> 16) | ((e2 & 0xff) << 16) | (e2 & 0xff000000);
-
-    return fs_base;
-}
-
-// i.e. return pointer to the object represented by this handle
-static uint32_t get_handle_table_entry(CPUState *cpu, uint32_t pHandleTable, uint32_t handle) {
-    uint32_t tableCode, tableLevels;
-    // get tablecode
-    panda_virtual_memory_rw(cpu, pHandleTable, (uint8_t *)&tableCode, 4, false);
-    // extract levels
-    tableLevels = tableCode & LEVEL_MASK;
-    if (tableLevels > 2) {
-        return 0;
-    }
-    uint32_t pEntry=0;
-    if (tableLevels == 0) {
-        uint32_t index = (handle & HANDLE_MASK1) >> HANDLE_SHIFT1;
-        pEntry = handle_table_L1_entry(cpu, pHandleTable, index);
-    }
-    if (tableLevels == 1) {
-        uint32_t L1_index = (handle & HANDLE_MASK2) >> HANDLE_SHIFT2;
-        uint32_t L1_table_off = handle_table_L1_addr(cpu, pHandleTable, L1_index);
-        uint32_t L1_table;
-        panda_virtual_memory_rw(cpu, L1_table_off, (uint8_t *) &L1_table, 4, false);
-        uint32_t index = (handle & HANDLE_MASK1) >> HANDLE_SHIFT1;
-        pEntry = handle_table_L2_entry(pHandleTable, L1_table, index);
-    }
-    if (tableLevels == 2) {
-        uint32_t L1_index = (handle & HANDLE_MASK3) >> HANDLE_SHIFT3;
-        uint32_t L1_table_off = handle_table_L1_addr(cpu, pHandleTable, L1_index);
-        uint32_t L1_table;
-        panda_virtual_memory_rw(cpu, L1_table_off, (uint8_t *) &L1_table, 4, false);
-        uint32_t L2_index = (handle & HANDLE_MASK2) >> HANDLE_SHIFT2;
-        uint32_t L2_table_off = handle_table_L2_addr(L1_table, L2_index);
-        uint32_t L2_table;
-        panda_virtual_memory_rw(cpu, L2_table_off, (uint8_t *) &L2_table, 4, false);
-        uint32_t index = (handle & HANDLE_MASK1) >> HANDLE_SHIFT1;
-        pEntry = handle_table_L3_entry(pHandleTable, L2_table, index);
-    }
-    uint32_t pObjectHeader;
-    if ((panda_virtual_memory_rw(cpu, pEntry, (uint8_t *) &pObjectHeader, 4, false)) == -1) {
-        return 0;
-    }
-
-    // Like in Windows 2000, the entry here needs to be masked off. However, it
-    // appears that starting in Windows XP, they've done away with the lock
-    // flag. The lower three bits mask should be consistent across Windows
-    // versions because of the object alignment.
-    //
-    // No obvious reference.
-    pObjectHeader &= TABLE_MASK;
-
-    return pObjectHeader;
-}
-
-
-HandleObject *get_win7_handle_object(CPUState *cpu, uint32_t eproc, uint32_t handle) {
-    uint32_t pObjectTable;
-    if (-1 == panda_virtual_memory_rw(cpu, eproc+get_eproc_objtable_off(), (uint8_t *)&pObjectTable, 4, false)) {
-        return NULL;
-    }
-    uint32_t pObjHeader = get_handle_table_entry(cpu, pObjectTable, handle);
-    if (pObjHeader == 0) return NULL;
-    uint32_t pObj = pObjHeader + OBJECT_HEADER_BODY_OFFSET;
-    uint8_t objType = 0;
-    if (-1 == panda_virtual_memory_rw(cpu, pObjHeader+get_obj_type_offset(), &objType, 1, false)) {
-        return NULL;
-    }
-    HandleObject *ho = (HandleObject *) malloc(sizeof(HandleObject));
-    ho->objType = objType;
-    ho->pObj = pObj;
-    return ho;
-}
-
-PTR get_win7_kdbg(CPUState *cpu)
-{
-    PTR kpcr = get_win7_kpcr(cpu);
-    PTR kdversion, kddl, kddlp;
-    if (-1 == panda_virtual_memory_rw(cpu, kpcr + KPCR_KDVERSION_OFF,
-                                      (uint8_t *)&kdversion, sizeof(PTR),
-                                      false)) {
-        return 0;
-    }
-    // DebuggerDataList is a pointer to a pointer to the _KDDEBUGGER_DATA64
-    // So we need to dereference it twice.
-    if (-1 == panda_virtual_memory_rw(cpu, kdversion + KDVERSION_DDL_OFF,
-                                      (uint8_t *)&kddlp, sizeof(PTR), false)) {
-        return 0;
-    }
-    if (-1 == panda_virtual_memory_rw(cpu, kddlp, (uint8_t *)&kddl, sizeof(PTR),
-                                      false)) {
-        return 0;
-    }
-    return panda_virt_to_phys(cpu, kddl);
-}
-
-#endif
-
-bool init_plugin(void *self) {
-#ifdef TARGET_I386
-    init_wintrospection_api();
-    return true;
-#else
-    return false;
-#endif
-
-}
-
-void uninit_plugin(void *self) { }
diff --git a/panda/plugins/win7x86intro/win7x86intro_int.h b/panda/plugins/win7x86intro/win7x86intro_int.h
deleted file mode 100644
index dc42d09f2fb..00000000000
--- a/panda/plugins/win7x86intro/win7x86intro_int.h
+++ /dev/null
@@ -1,6 +0,0 @@
-typedef void PTR;
-typedef void CPUState;
-typedef void HandleObject;
-typedef void uint32_t;
-
-#include "win7x86intro_int_fns.h"
diff --git a/panda/plugins/win7x86intro/win7x86intro_int_fns.h b/panda/plugins/win7x86intro/win7x86intro_int_fns.h
deleted file mode 100644
index b7d7686e3ed..00000000000
--- a/panda/plugins/win7x86intro/win7x86intro_int_fns.h
+++ /dev/null
@@ -1,8 +0,0 @@
-#ifndef __WIN7X86INTRO_INT_FNS_H__
-#define __WIN7X86INTRO_INT_FNS_H__
-
-PTR get_win7_kpcr(CPUState *cpu);
-HandleObject *get_win7_handle_object(CPUState *cpu, uint32_t eproc, uint32_t handle);
-PTR get_win7_kdbg(CPUState *cpu);
-
-#endif
diff --git a/panda/plugins/wintrospection/Makefile b/panda/plugins/wintrospection/Makefile
index f3982d849ad..adea5382e7c 100644
--- a/panda/plugins/wintrospection/Makefile
+++ b/panda/plugins/wintrospection/Makefile
@@ -2,8 +2,17 @@
 
 # If you need custom CFLAGS or LIBS, set them up here
 # CFLAGS+=
-# LIBS+=
+LIBS += -losi -liohal -loffset
+
+# Example: this plugin has runtime symbol dependencies on plugin_x:
+# LIBS+=-L$(PLUGIN_TARGET_DIR) -l:panda_plugin_x.so
+# Also create a plugin_plugin.d file in this directory to ensure plugin_x
+# gets compiled before this plugin, example contents:
+# plugin-this_plugins_name : plugin-plugin_x
+# or if you're using the extra plugins dir:
+# extra-plugin-this_plugins_name : extra-plugin-plugin_x
 
 # The main rule for your plugin. List all object-file dependencies.
 $(PLUGIN_TARGET_DIR)/panda_$(PLUGIN_NAME).so: \
-	$(PLUGIN_OBJ_DIR)/$(PLUGIN_NAME).o
+	$(PLUGIN_OBJ_DIR)/$(PLUGIN_NAME).o \
+	$(PLUGIN_OBJ_DIR)/pandamemory.o
diff --git a/panda/plugins/wintrospection/pandamemory.cpp b/panda/plugins/wintrospection/pandamemory.cpp
new file mode 100644
index 00000000000..2805ab73773
--- /dev/null
+++ b/panda/plugins/wintrospection/pandamemory.cpp
@@ -0,0 +1,77 @@
+#include "panda/plugin.h"
+#include "panda/common.h"
+
+#include <cstdlib>
+#include <cstring>
+
+#include <iohal/memory/common.h>
+#include <iohal/memory/physical_memory.h>
+
+#include "pandamemory.h"
+
+class PandaPhysicalMemory {
+private:
+  pm_addr_t m_max_address;
+
+public:
+  static const uint32_t PAPM_TAG = 0x5041504d;
+
+  PandaPhysicalMemory() {
+    rcu_read_lock();
+    m_max_address = panda_find_max_ram_address();
+    rcu_read_unlock();
+  }
+
+  pm_addr_t get_max_address() { return m_max_address; }
+};
+
+pm_addr_t get_panda_physical_memory_upper_bound(struct PhysicalMemory *pmem) {
+  auto papm = (PandaPhysicalMemory *)pmem->opaque;
+  return papm->get_max_address();
+}
+
+bool read_panda_physical_memory(struct PhysicalMemory *pmem, pm_addr_t addr,
+                                uint8_t *buffer, uint64_t size) {
+  auto papm = (PandaPhysicalMemory *)pmem->opaque;
+  auto max_addr = papm->get_max_address();
+
+  if ((addr + size) > max_addr) {
+    return false;
+  }
+  return 0 == panda_physical_memory_read(addr, buffer, size);
+}
+
+void free_panda_physical_memory(struct PhysicalMemory *pmem) {
+  auto papm = (PandaPhysicalMemory *)pmem->opaque;
+  delete papm;
+  // Memset here for a few reasons:
+  //  - Ensure use-after-free bugs fail early (i.e. on a null pointer deref
+  //  rather
+  //    than on stale data)
+  //  - The caller will still have an invalid pointer to pmem, so mistakes are
+  //  more
+  //    likely
+  std::memset(pmem, 0, sizeof(PhysicalMemory));
+  std::free(pmem);
+}
+
+struct PhysicalMemory *create_panda_physical_memory() {
+  // Allocate the backing physical memory object
+  PandaPhysicalMemory *papm = new PandaPhysicalMemory();
+
+  // Allocate the wrapper object
+  auto pmem =
+      (struct PhysicalMemory *)std::calloc(1, sizeof(struct PhysicalMemory));
+  if (!pmem) {
+    delete papm;
+    return nullptr;
+  }
+
+  pmem->tagvalue = PandaPhysicalMemory::PAPM_TAG;
+  pmem->opaque = papm;
+  pmem->upper_bound = get_panda_physical_memory_upper_bound;
+  pmem->read = read_panda_physical_memory;
+  pmem->free = free_panda_physical_memory;
+
+  return pmem;
+}
diff --git a/panda/plugins/wintrospection/pandamemory.h b/panda/plugins/wintrospection/pandamemory.h
new file mode 100644
index 00000000000..071113ae3bd
--- /dev/null
+++ b/panda/plugins/wintrospection/pandamemory.h
@@ -0,0 +1,21 @@
+#ifndef __PANDA_PHYSICAL_MEMORY_H
+#define __PANDA_PHYSICAL_MEMORY_H
+
+#include <iohal/memory/physical_memory.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/**
+ * \brief Use PANDA as a physical memory reader for the HAL
+ *
+ * \return struct PhysicalMemory*
+ */
+struct PhysicalMemory* create_panda_physical_memory();
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/panda/plugins/wintrospection/wintrospection.c b/panda/plugins/wintrospection/wintrospection.c
deleted file mode 100644
index 5c2f516c891..00000000000
--- a/panda/plugins/wintrospection/wintrospection.c
+++ /dev/null
@@ -1,877 +0,0 @@
-/* PANDABEGINCOMMENT
- *
- * Authors:
- *  Tim Leek               tleek@ll.mit.edu
- *  Ryan Whelan            rwhelan@ll.mit.edu
- *  Joshua Hodosh          josh.hodosh@ll.mit.edu
- *  Michael Zhivich        mzhivich@ll.mit.edu
- *  Brendan Dolan-Gavitt   brendandg@gatech.edu
- *  Tom Boning             tboning@mit.edu
- *
- * This work is licensed under the terms of the GNU GPL, version 2.
- * See the COPYING file in the top-level directory.
- *
-PANDAENDCOMMENT */
-#define __STDC_FORMAT_MACROS
-
-#include <sys/types.h>
-#include <dirent.h>
-#include <sys/stat.h>
-#include <sys/types.h>
-
-#include <iconv.h>
-
-#include "panda/rr/rr_log.h"
-#include "panda/tcg-utils.h"
-
-#include "osi/osi_types.h"
-#include "osi/os_intro.h"
-#include "osi/osi_ext.h"
-
-#include "panda/plugin.h"
-#include "panda/plugin_plugin.h"
-#include "panda/plog.h"
-
-#include "syscalls2/syscalls_ext_typedefs.h"
-
-#include "wintrospection.h"
-#include "wintrospection_int_fns.h"
-
-#include "win2000x86intro/win2000x86intro_ext.h"
-#include "win7x86intro/win7x86intro_ext.h"
-#include "winxpx86intro/winxpx86intro_ext.h"
-
-#include "glib.h"
-
-bool init_plugin(void *);
-void uninit_plugin(void *);
-
-// this stuff only makes sense for win x86 32-bit
-#ifdef TARGET_I386
-
-// Constants that are the same in all supported versions of windows
-// Supports: Windows 2000 SP4, XP SP3, and Windows 7 SP1.
-#define KPCR_CURTHREAD_OFF   0x124 // _KPCR.PrcbData.CurrentThread
-#define EPROC_DTB_OFF        0x018 // _EPROCESS.Pcb.DirectoryTableBase
-#define EPROC_TYPE_OFF       0x000 // _EPROCESS.Pcb.Header.Type
-#define EPROC_SIZE_OFF       0x002 // _EPROCESS.Pcb.Header.Size
-#define EPROC_TYPE           0x003 // Value of Type
-#define EPROC_DTB_OFF        0x018 // _EPROCESS.Pcb.DirectoryTableBase
-#define PEB_PEB_LDR_DATA_OFF 0x00c // _PEB.Ldr
-#define PEB_LDR_DATA_LOAD_LIST_OFF 0x00c // _PEB_LDR_DATA.InLoadOrderModuleList
-#define LDR_LOAD_LINKS_OFF   0x000 // _LDR_DATA_TABLE_ENTRY.InLoadOrderLinks
-#define LDR_BASE_OFF         0x018 // _LDR_DATA_TABLE_ENTRY.DllBase
-#define LDR_SIZE_OFF         0x020 // _LDR_DATA_TABLE_ENTRY.SizeOfImage
-#define LDR_BASENAME_OFF     0x02c // _LDR_DATA_TABLE_ENTRY.BaseDllName
-#define LDR_FILENAME_OFF     0x024 // _LDR_DATA_TABLE_ENTRY.FullDllName
-#define OBJNAME_OFF          0x008
-#define FILE_OBJECT_NAME_OFF 0x030
-#define FILE_OBJECT_POS_OFF  0x038
-#define PROCESS_PARAMETERS_OFF 0x010 // PEB.ProcessParameters
-#define UNICODE_WORKDIR_OFF 0x24     // ProcessParameters.WorkingDirectory
-// KDDEBUGGER_DATA64.PsActiveProcessHead
-#define KDDBG64_LOADED_MOD_HEAD_OFF 0x048
-// KDDEBUGGER_DATA64.PsLoadedModuleList
-#define KDDBG64_ACTIVE_PROCESS_HEAD_OFF 0x50
-// _CLIENT_ID.UniqueThread
-#define CLIENT_ID_UNIQUE_THREAD 0x4
-
-// "Constants" specific to the guest operating system.
-// These are initialized in the init_plugin function.
-static uint32_t task_change_hook_addr; // Address within nt!SwapContext call
-                                       // that is after control registers have
-                                       // been updated.
-static uint32_t task_change_hook_offset; // Offset within ntoskrnl.exe that
-                                         // is used to compute an address in
-                                         // nt!SwapContext  after the control
-                                         // registers have been updated.
-static uint32_t kthread_kproc_off;  // _KTHREAD.Process
-static uint32_t kthread_cid_off;    // _ETHREAD._KTHREAD.Cid
-static uint32_t eproc_pid_off;      // _EPROCESS.UniqueProcessId
-static uint32_t eproc_ppid_off;     // _EPROCESS.InheritedFromUniqueProcessId
-static uint32_t eproc_name_off;     // _EPROCESS.ImageFileName
-static uint32_t eproc_objtable_off; // _EPROCESS.ObjectTable
-static uint32_t
-    eproc_ppeb_off; // _EPROCESS.Peb (pointer to process environment block)
-static uint32_t eproc_size;         // Value of Size
-static uint32_t eproc_links_off;    // _EPROCESS.ActiveProcessLinks
-static uint32_t obj_type_file;      // FILE object type
-static uint32_t obj_type_key;       // KEY object type
-static uint32_t obj_type_process;   // PROCESS object type
-static uint32_t obj_type_offset;    // XXX_OBJECT.Type (offset from start of OBJECT_TYPE_HEADER)
-static uint32_t ntreadfile_esp_off; // Number of bytes left on stack when NtReadFile returns
-
-// Function pointer, returns location of KPCR structure.  OS-specific.
-static PTR(*get_kpcr)(CPUState *cpu);
-
-// Function pointer, returns handle table entry.  OS-specific.
-static HandleObject *(*get_handle_object)(CPUState *cpu, PTR eproc, uint32_t handle);
-
-// Function pointer, returns location of KDDEBUGGER_DATA<32|64> data structure.
-// OS-specific.
-static PTR (*get_kddebugger_data)(CPUState *cpu);
-
-char *make_pagedstr(void) {
-    char *m = g_strdup("(paged)");
-    assert(m);
-    return m;
-}
-
-// Gets a unicode string. Does its own mem allocation.
-// Output is a null-terminated UTF8 string
-char *get_unicode_str(CPUState *cpu, PTR ustr) {
-    uint16_t size = 0;
-    PTR str_ptr = 0;
-    if (-1 == panda_virtual_memory_rw(cpu, ustr, (uint8_t *)&size, 2, false)) {
-        return make_pagedstr();
-    }
-
-    // Unicode Strings can be zero length. In this case, just return an empty
-    // string.
-    if (size == 0) {
-        return g_strdup("");
-    }
-
-    // Clamp size
-    if (size > 1024) size = 1024;
-    if (-1 == panda_virtual_memory_rw(cpu, ustr+4, (uint8_t *)&str_ptr, 4, false)) {
-        return make_pagedstr();
-    }
-
-    gchar *in_str = (gchar *)g_malloc0(size);
-    if (-1 == panda_virtual_memory_rw(cpu, str_ptr, (uint8_t *)in_str, size, false)) {
-        g_free(in_str);
-        return make_pagedstr();
-    }
-
-    gsize bytes_written = 0;
-    gchar *out_str = g_convert(in_str, size,
-            "UTF-8", "UTF-16LE", NULL, &bytes_written, NULL);
-
-    // An abundance of caution: we copy it over to something allocated
-    // with our own malloc. In the future we need to provide a way for
-    // someone else to free the memory allocated in here...
-    char *ret = (char *)g_malloc(bytes_written+1);
-    memcpy(ret, out_str, bytes_written+1);
-    g_free(in_str);
-    g_free(out_str);
-    return ret;
-}
-
-void add_mod(CPUState *cpu, GArray *ms, PTR mod, bool ignore_basename) {
-    OsiModule m;
-    memset(&m, 0, sizeof(OsiModule));
-    fill_osimod(cpu, &m, mod, ignore_basename);
-    g_array_append_val(ms, m);
-}
-
-void on_get_current_process(CPUState *cpu, OsiProc **out) {
-    PTR eproc = get_current_proc(cpu);
-    if(eproc) {
-        OsiProc *p = (OsiProc *)g_malloc(sizeof(OsiProc));
-        fill_osiproc(cpu, p, eproc);
-        *out = p;
-    } else {
-        *out = NULL;
-    }
-}
-
-void on_get_current_process_handle(CPUState *cpu, OsiProcHandle **out) {
-    PTR eproc = get_current_proc(cpu);
-    if(eproc) {
-        OsiProcHandle *h = (OsiProcHandle *)g_malloc(sizeof(OsiProcHandle));
-        fill_osiprochandle(cpu, h, eproc);
-        *out = h;
-    } else {
-        *out = NULL;
-    }
-}
-
-void on_get_mappings(CPUState *cpu, OsiProc *p, GArray **out)
-{
-    *out = NULL;
-    if (p == NULL) {
-        return;
-    }
-
-    PTR eproc = p->taskd;
-    PTR ptr_peb;
-    // EPROCESS is allocated from the non-paged pool, so it should
-    // accessible at any time via its virtual address.
-    if (-1 == panda_virtual_memory_read(cpu, eproc + eproc_ppeb_off,
-                                        (uint8_t *)&ptr_peb, sizeof(ptr_peb))) {
-        fprintf(stderr, "Could not read PEB Pointer from _EPROCESS!\n");
-        return;
-    }
-
-    // Since we are getting the libraries for a specified process, we have to
-    // make sure that we are looking in the address space of the process that
-    // was passed in. We will temporarily override CR3 with the value specified
-    // in _EPROCESS.Pcb.DirectoryTableBase. Again, since EPROCESS is allocated
-    // from the non-paged pool this shouldn't fail.
-    uint32_t dtb = -1;
-    if (panda_virtual_memory_read(cpu, eproc + EPROC_DTB_OFF, (uint8_t *)&dtb,
-                                  sizeof(dtb))) {
-        fprintf(stderr, "Could not read DirectoryTableBase from _EPROCESS!\n");
-        return;
-    }
-#ifdef TARGET_I386
-    CPUArchState *env = (CPUArchState *)cpu->env_ptr;
-    target_ulong cur_cr3 = env->cr[3];
-    env->cr[3] = dtb;
-#endif
-
-    // Get the location of the _PEB_LDR_DATA structure which contains the head
-    // of the DLL listing.
-    PTR ptr_peb_ldr_data;
-    if (-1 == panda_virtual_memory_read(cpu, ptr_peb + PEB_PEB_LDR_DATA_OFF,
-                                        (uint8_t *)&ptr_peb_ldr_data,
-                                        sizeof(ptr_peb_ldr_data))) {
-        // We fail silently here - _PEB is part of the paged pool, so its
-        // possible that this is paged out and nothing is wrong.
-#ifdef TARGET_I386
-        env->cr[3] = cur_cr3;
-#endif
-        return;
-    }
-
-    bool reached_paged_entry = false;
-    PTR sentinel = ptr_peb_ldr_data + PEB_LDR_DATA_LOAD_LIST_OFF;
-    PTR cur_entry = sentinel;
-    do {
-        // Read the current list entry Flink pointer.
-        if (-1 == panda_virtual_memory_read(cpu, cur_entry,
-                                            (uint8_t *)&cur_entry,
-                                            sizeof(cur_entry))) {
-            fprintf(stderr, "Could not read next entry in module list.\n");
-            break;
-        }
-
-        // If we've reached the sentinel, we're done.
-        if (cur_entry == sentinel) {
-            break;
-        }
-
-        // We're reasonbly sure we've found a library, add it to the list.
-        // Note, the library may be paged out and if so, we stop iterating.
-        PTR ptr_ldr_data_table_entry = cur_entry - LDR_LOAD_LINKS_OFF;
-        char *name =
-            get_unicode_str(cpu, ptr_ldr_data_table_entry + LDR_BASENAME_OFF);
-        char *filename =
-            get_unicode_str(cpu, ptr_ldr_data_table_entry + LDR_FILENAME_OFF);
-        PTR base = -1;
-        if (-1 == panda_virtual_memory_read(
-                      cpu, ptr_ldr_data_table_entry + LDR_BASE_OFF,
-                      (uint8_t *)&base, sizeof(base))) {
-            // If this fails, we assume that this LDR_DATA_TABLE_ENTRY is paged
-            reached_paged_entry = true;
-        }
-        PTR size = -1;
-        if (-1 == panda_virtual_memory_read(
-                      cpu, ptr_ldr_data_table_entry + LDR_SIZE_OFF,
-                      (uint8_t *)&size, sizeof(size))) {
-            // If this fails, we assume that this LDR_DATA_TABLE_ENTRY is paged
-            reached_paged_entry = true;
-        }
-
-        OsiModule mod;
-        if (NULL == *out) {
-            *out = g_array_sized_new(false, false, sizeof(mod), 128);
-            g_array_set_clear_func(*out,
-                                   (GDestroyNotify)free_osimodule_contents);
-        }
-        mod.modd = ptr_ldr_data_table_entry;
-        mod.base = base;
-        mod.size = size;
-        mod.name = name;
-        mod.file = filename;
-        g_array_append_val(*out, mod);
-    } while (false == reached_paged_entry);
-
-    // Now that we've gotten the libraries, we need to restore CR3.
-#ifdef TARGET_I386
-    env->cr[3] = cur_cr3;
-#endif
-}
-
-void on_get_modules(CPUState *cpu, GArray **out)
-{
-    PTR kdbg = get_kddebugger_data(cpu);
-    PTR PsLoadedModuleList = 0xFFFFFFFF;
-    PTR mod_current = 0x0;
-
-    // Dbg.PsLoadedModuleList
-    if (-1 == panda_physical_memory_rw(kdbg + KDDBG64_LOADED_MOD_HEAD_OFF,
-                                       (uint8_t *)&PsLoadedModuleList,
-                                       sizeof(PTR), false))
-        goto error;
-
-    if (*out == NULL) {
-        // g_array_sized_new() args: zero_term, clear, element_sz, reserved_sz
-        *out = g_array_sized_new(false, false, sizeof(OsiModule), 128);
-        g_array_set_clear_func(*out, (GDestroyNotify)free_osimodule_contents);
-    }
-
-    mod_current = get_next_mod(cpu, PsLoadedModuleList);
-
-    // We want while loop here -- we are starting at the head,
-    // which is not a valid module
-    while (mod_current != 0x0 && mod_current != PsLoadedModuleList) {
-        add_mod(cpu, *out, mod_current, false);
-        mod_current = get_next_mod(cpu, mod_current);
-    }
-    return;
-
-error:
-    *out = NULL;
-    return;
-}
-
-void on_get_processes(CPUState *cpu, GArray **out) {
-    // The process list in NT can be iterated by starting at the
-    // nt!PsActiveProcessHead symbol. The symbol points to an nt!_LIST_ENTRY
-    // that acts as a sentinel node for the process list, so we can use it as a
-    // reference point to start and stop iterating.
-
-    // Assume failure until we reach the first process, so set the output to
-    // null.
-    *out = NULL;
-
-    // Try to get the nt!PsActiveProcessHead from the KDDEBUGGER_DATA64 struct.
-    // Note that the result of kddebugger_data returns a physical address.
-    PTR kddebugger_data = get_kddebugger_data(cpu);
-    PTR sentinel = -1;
-    if (-1 == panda_physical_memory_rw(
-                  kddebugger_data + KDDBG64_ACTIVE_PROCESS_HEAD_OFF,
-                  (uint8_t *)&sentinel, sizeof(sentinel), 0)) {
-        fprintf(stderr, "Could not get PsActiveProcessHead!\n");
-        return;
-    }
-    PTR cur_entry = sentinel;
-    do {
-        // Read the current list entry Flink pointer.
-        if (-1 == panda_virtual_memory_read(cpu, cur_entry,
-                                            (uint8_t *)&cur_entry,
-                                            sizeof(cur_entry))) {
-            fprintf(stderr, "Error reading process list entry!\n");
-            break;
-        }
-
-
-        // If we've reached the sentinel, we're done.
-        if (cur_entry == sentinel) {
-            break;
-        }
-
-        // We've found the procss, if this is the first one go ahead and create
-        // the array.
-        OsiProc cur_proc;
-        if (*out == NULL) {
-            *out = g_array_sized_new(false, false, sizeof(cur_proc), 128);
-            g_array_set_clear_func(*out, (GDestroyNotify)free_osiproc_contents);
-        }
-        PTR cur_eproc = cur_entry - eproc_links_off;
-        fill_osiproc(cpu, &cur_proc, cur_eproc);
-        g_array_append_val(*out, cur_proc);
-    } while (true);
-}
-
-void on_get_current_thread(CPUState *cpu, OsiThread **out) {
-    // Get current process.
-    OsiProc *p = NULL;
-    on_get_current_process(cpu, &p);
-    if (NULL == p) {
-        goto error;
-    }
-
-    OsiThread tmp;
-    tmp.pid = p->pid;
-    free_osiproc(p);
-
-    PTR ethread;
-    if (-1 == panda_virtual_memory_read(cpu, get_kpcr(cpu) + KPCR_CURTHREAD_OFF,
-                                        (uint8_t *)&ethread, sizeof(ethread))) {
-        goto error;
-    }
-
-    // Cid contains thread ID
-    if (-1 == panda_virtual_memory_read(
-                  cpu, ethread + kthread_cid_off + CLIENT_ID_UNIQUE_THREAD,
-                  (uint8_t *)&tmp.tid, sizeof(tmp.tid))) {
-        goto error;
-    }
-
-    if (NULL == *out) {
-        *out = (OsiThread *)g_malloc(sizeof(**out));
-    }
-
-    **out = tmp;
-error:
-    return;
-}
-
-/**
- * @brief PPP callback to retrieve the process pid from a handle.
- */
-void on_get_process_pid(CPUState *cpu, const OsiProcHandle *h, target_pid_t *pid) {
-	if (h->taskd == (intptr_t)(NULL) || h->taskd == (target_ptr_t)-1) {
-		*pid = (target_pid_t)-1;
-	} else {
-		*pid = get_pid(cpu, h->taskd);
-	}
-}
-
-/**
- * @brief PPP callback to retrieve the process parent pid from a handle.
- */
-void on_get_process_ppid(CPUState *cpu, const OsiProcHandle *h, target_pid_t *ppid) {
-	if (h->taskd == (intptr_t)(NULL) || h->taskd == (target_ptr_t)-1) {
-		*ppid = (target_pid_t)-1;
-	} else {
-		*ppid = get_ppid(cpu, h->taskd);
-	}
-}
-
-uint32_t get_ntreadfile_esp_off(void) { return ntreadfile_esp_off; }
-
-uint32_t get_kthread_kproc_off(void) { return kthread_kproc_off; }
-
-uint32_t get_eproc_pid_off(void) { return eproc_pid_off; }
-
-uint32_t get_eproc_name_off(void) { return eproc_name_off; }
-
-uint32_t get_eproc_objtable_off(void) { return eproc_objtable_off; }
-
-uint32_t get_obj_type_offset(void) { return obj_type_offset; }
-
-uint32_t get_pid(CPUState *cpu, PTR eproc) {
-    uint32_t pid;
-    if(-1 == panda_virtual_memory_rw(cpu, eproc+eproc_pid_off, (uint8_t *)&pid, 4, false)) return 0;
-    return pid;
-}
-
-PTR get_ppid(CPUState *cpu, PTR eproc) {
-    PTR ppid;
-    if(-1 == panda_virtual_memory_rw(cpu, eproc+eproc_ppid_off, (uint8_t *)&ppid, sizeof(PTR), false)) return 0;
-    return ppid;
-}
-
-PTR get_dtb(CPUState *cpu, PTR eproc) {
-    PTR dtb = 0;
-    assert(!panda_virtual_memory_rw(cpu, eproc+EPROC_DTB_OFF, (uint8_t *)&dtb, sizeof(PTR), false));
-    assert(dtb);
-    return dtb;
-}
-
-
-void get_procname(CPUState *cpu, PTR eproc, char **name) {
-    assert(name);
-    *name = (char *)g_malloc(17);
-    assert(*name);
-    assert(!panda_virtual_memory_rw(cpu, eproc+eproc_name_off, (uint8_t *)*name, 16, false));
-    (*name)[16] = '\0';
-}
-
-char *get_cwd(CPUState *cpu)
-{
-    PTR eproc = get_current_proc(cpu);
-
-    // Get pointer to PEB
-    target_ulong ppeb = 0x0;
-    assert(!panda_virtual_memory_read(cpu, eproc + eproc_ppeb_off,
-                                      (uint8_t *)&ppeb, sizeof(ppeb)));
-    // Get pointer to PROCESS_PARAMETERS
-    target_ulong pprocess_params = 0x0;
-    assert(!panda_virtual_memory_read(cpu, ppeb + PROCESS_PARAMETERS_OFF,
-                                      (uint8_t *)&pprocess_params,
-                                      sizeof(pprocess_params)));
-
-    // Get the work dir handle
-    uint32_t cwd_handle = 0x0;
-    assert(!panda_virtual_memory_read(cpu, pprocess_params + 0x2C,
-                                      (uint8_t *)&cwd_handle,
-                                      sizeof(cwd_handle)));
-
-    char *cwd_handle_name = get_handle_name(cpu, eproc, cwd_handle);
-
-    return cwd_handle_name;
-}
-
-bool is_valid_process(CPUState *cpu, PTR eproc) {
-    uint8_t type;
-    uint8_t size;
-
-    if(eproc == 0) return false;
-
-    if(-1 == panda_virtual_memory_rw(cpu, eproc+EPROC_TYPE_OFF, (uint8_t *)&type, 1, false)) return false;
-    if(-1 == panda_virtual_memory_rw(cpu, eproc+EPROC_SIZE_OFF, (uint8_t *)&size, 1, false)) return false;
-
-    return type == EPROC_TYPE && size == eproc_size &&
-        get_next_proc(cpu, eproc);
-}
-
-
-uint32_t get_current_proc(CPUState *cpu) {
-    PTR thread, proc;
-    PTR kpcr = get_kpcr(cpu);
-
-    // Read KPCR->CurrentThread->Process
-    if (-1 == panda_virtual_memory_rw(cpu, kpcr+KPCR_CURTHREAD_OFF, (uint8_t *)&thread, sizeof(PTR), false)) return 0;
-    if (-1 == panda_virtual_memory_rw(cpu, thread+get_kthread_kproc_off(), (uint8_t *)&proc, sizeof(PTR), false)) return 0;
-
-    // Sometimes, proc == 0 here.  Is there a better way to do this?
-
-    return is_valid_process(cpu, proc) ? proc : 0;
-}
-
-// Process introspection
-PTR get_next_proc(CPUState *cpu, PTR eproc) {
-    PTR next;
-    if (-1 == panda_virtual_memory_rw(cpu, eproc+eproc_links_off, (uint8_t *)&next, sizeof(PTR), false))
-        return 0;
-    next -= eproc_links_off;
-    return next;
-}
-
-
-
-// Win7 Obj Type Indices
-/*
-typedef enum {
-    OBJ_TYPE_Type = 2,
-    OBJ_TYPE_Directory = 3,
-    OBJ_TYPE_SymbolicLink = 4,
-    OBJ_TYPE_Token = 5,
-    OBJ_TYPE_Job = 6,
-    OBJ_TYPE_Process = 7,
-    OBJ_TYPE_Thread = 8,
-    OBJ_TYPE_UserApcReserve = 9,
-    OBJ_TYPE_IoCompletionReserve = 10,
-    OBJ_TYPE_DebugObject = 11,
-    OBJ_TYPE_Event = 12,
-    OBJ_TYPE_EventPair = 13,
-    OBJ_TYPE_Mutant = 14,
-    OBJ_TYPE_Callback = 15,
-    OBJ_TYPE_Semaphore = 16,
-    OBJ_TYPE_Timer = 17,
-    OBJ_TYPE_Profile = 18,
-    OBJ_TYPE_KeyedEvent = 19,
-    OBJ_TYPE_WindowStation = 20,
-    OBJ_TYPE_Desktop = 21,
-    OBJ_TYPE_TpWorkerFactory = 22,
-    OBJ_TYPE_Adapter = 23,
-    OBJ_TYPE_Controller = 24,
-    OBJ_TYPE_Device = 25,
-    OBJ_TYPE_Driver = 26,
-    OBJ_TYPE_IoCompletion = 27,
-    OBJ_TYPE_File = 28,
-    OBJ_TYPE_TmTm = 29,
-    OBJ_TYPE_TmTx = 30,
-    OBJ_TYPE_TmRm = 31,
-    OBJ_TYPE_TmEn = 32,
-    OBJ_TYPE_Section = 33,
-    OBJ_TYPE_Session = 34,
-    OBJ_TYPE_Key = 35,
-    OBJ_TYPE_ALPCPort = 36,
-    OBJ_TYPE_PowerRequest = 37,
-    OBJ_TYPE_WmiGuid = 38,
-    OBJ_TYPE_EtwRegistration = 39,
-    OBJ_TYPE_EtwConsumer = 40,
-    OBJ_TYPE_FilterConnectionPort = 41,
-    OBJ_TYPE_FilterCommunicationPort = 42,
-    OBJ_TYPE_PcwObject = 43
-} OBJ_TYPES;
-*/
-
-
-uint32_t handle_table_code(CPUState *cpu, uint32_t table_vaddr) {
-    uint32_t tableCode;
-    // HANDLE_TABLE.TableCode is offest 0
-    assert(!panda_virtual_memory_rw(cpu, table_vaddr, (uint8_t *)&tableCode, 4, false));
-    return (tableCode & TABLE_MASK);
-}
-
-
-uint32_t handle_table_L1_addr(CPUState *cpu, uint32_t table_vaddr, uint32_t entry_num) {
-    return table_vaddr + ADDR_SIZE * entry_num;
-}
-
-
-uint32_t handle_table_L2_addr(uint32_t L1_table, uint32_t L2) {
-    if (L1_table != 0x0) {
-        uint32_t L2_entry = L1_table + ADDR_SIZE * L2;
-        return L2_entry;
-    }
-    return 0;
-}
-
-
-uint32_t handle_table_L1_entry(CPUState *cpu, uint32_t table_vaddr, uint32_t entry_num) {
-    return (handle_table_code(cpu, table_vaddr) +
-            HANDLE_TABLE_ENTRY_SIZE * entry_num);
-}
-
-
-uint32_t handle_table_L2_entry(uint32_t table_vaddr, uint32_t L1_table, uint32_t L2) {
-    if (L1_table == 0) return 0;
-    return L1_table + HANDLE_TABLE_ENTRY_SIZE * L2;
-}
-
-
-uint32_t handle_table_L3_entry(uint32_t table_vaddr, uint32_t L2_table, uint32_t L3) {
-    if (L2_table == 0) return 0;
-    return L2_table + HANDLE_TABLE_ENTRY_SIZE * L3;
-}
-
-uint32_t get_eproc_peb_off(void) {
-    return eproc_ppeb_off;
-}
-
-
-
-// Module stuff
-const char *get_mod_basename(CPUState *cpu, PTR mod) {
-    return get_unicode_str(cpu, mod+LDR_BASENAME_OFF);
-}
-
-const char *get_mod_filename(CPUState *cpu, PTR mod) {
-    return get_unicode_str(cpu, mod+LDR_FILENAME_OFF);
-}
-
-PTR get_mod_base(CPUState *cpu, PTR mod) {
-    PTR base;
-    assert(!panda_virtual_memory_rw(cpu, mod+LDR_BASE_OFF, (uint8_t *)&base, sizeof(PTR), false));
-    return base;
-}
-
-PTR get_mod_size(CPUState *cpu, PTR mod) {
-    uint32_t size;
-    assert(!panda_virtual_memory_rw(cpu, mod+LDR_SIZE_OFF, (uint8_t *)&size, sizeof(uint32_t), false));
-    return size;
-}
-
-PTR get_next_mod(CPUState *cpu, PTR mod) {
-    PTR next;
-    if (-1 == panda_virtual_memory_rw(cpu, mod+LDR_LOAD_LINKS_OFF, (uint8_t *)&next, sizeof(PTR), false))
-        return 0;
-    next -= LDR_LOAD_LINKS_OFF;
-    return next;
-}
-
-char *read_unicode_string(CPUState *cpu, uint32_t pUstr)
-{
-    return get_unicode_str(cpu, pUstr);
-}
-
-char *get_objname(CPUState *cpu, uint32_t obj) {
-  uint32_t pObjectName;
-  assert(-1 != panda_virtual_memory_rw(cpu, obj+OBJNAME_OFF, (uint8_t *)&pObjectName, sizeof(pObjectName), false));
-  return read_unicode_string(cpu, pObjectName);
-}
-
-char *get_file_obj_name(CPUState *cpu, uint32_t fobj) {
-    return read_unicode_string(cpu, fobj + FILE_OBJECT_NAME_OFF);
-}
-
-int64_t get_file_obj_pos(CPUState *cpu, uint32_t fobj) {
-    int64_t file_pos;
-	if (-1 == panda_virtual_memory_rw(cpu, fobj+FILE_OBJECT_POS_OFF, (uint8_t *)&file_pos, sizeof(file_pos), false)) {
-	  return -1;
-	} else {
-	  return file_pos;
-	}
-}
-
-char *get_handle_object_name(CPUState *cpu, HandleObject *ho) {
-    char *name;
-    if (ho == NULL) {
-        name = g_strdup("unknown");
-    } else if(ho->objType == obj_type_file) {
-        name = get_file_obj_name(cpu, ho->pObj);
-    } else if(ho->objType == obj_type_key) {
-        name = g_strdup_printf("_CM_KEY_BODY@%08x", ho->pObj);
-    } else if(ho->objType == obj_type_process) {
-        get_procname(cpu, ho->pObj, &name);
-    } else {
-        name=g_strdup_printf("unknown object type %d", ho->objType);
-    }
-    assert(name);
-    return name;
-}
-
-
-char *get_handle_name(CPUState *cpu, PTR eproc, uint32_t handle) {
-    HandleObject *ho = get_handle_object(cpu, eproc, handle);
-    return get_handle_object_name(cpu, ho);
-}
-
-int64_t get_file_handle_pos(CPUState *cpu, PTR eproc, uint32_t handle) {
-    HandleObject *ho = get_handle_object(cpu, eproc, handle);
-    if (!ho) {
-        return -1;
-    } else {
-        return get_file_obj_pos(cpu, ho->pObj);
-    }
-}
-
-void fill_osiproc(CPUState *cpu, OsiProc *p, PTR eproc) {
-    p->taskd = eproc;
-    get_procname(cpu, eproc, &p->name);
-    p->asid = get_dtb(cpu, eproc);
-    p->pages = NULL;
-    p->pid = get_pid(cpu, eproc);
-    p->ppid = get_ppid(cpu, eproc);
-}
-
-void fill_osiprochandle(CPUState *cpu, OsiProcHandle *h, PTR eproc) {
-    h->taskd = eproc;
-    h->asid = get_dtb(cpu, eproc);
-}
-
-void fill_osimod(CPUState *cpu, OsiModule *m, PTR mod, bool ignore_basename) {
-    m->modd = mod;
-    m->file = (char *)get_mod_filename(cpu, mod);
-    m->base = get_mod_base(cpu, mod);
-    m->size = get_mod_size(cpu, mod);
-    m->name = ignore_basename ? g_strdup("-") : (char *)get_mod_basename(cpu, mod);
-    assert(m->name);
-}
-
-static void before_tcg_codegen(CPUState *cpu, TranslationBlock *tb)
-{
-    if (0x0 == task_change_hook_addr && 0 == strcmp(panda_os_variant, "7")) {
-        // On Windows 7, we have to compute the task change hook address
-        // relative to the ntoskrnl.exe base (because ASLR).
-        GArray *mods = get_modules(cpu);
-        for (int i = 0; i < mods->len; i++) {
-            OsiModule *mod = &g_array_index(mods, OsiModule, i);
-            if (0 == strcmp("ntoskrnl.exe", mod->name)) {
-                task_change_hook_addr = mod->base + task_change_hook_offset;
-                printf("task change hook address = %lX\n", (uint64_t)task_change_hook_addr);
-            }
-        }
-        if (NULL != mods) {
-            g_array_free(mods, true);
-        }
-    }
-
-    if ((tb->pc <= task_change_hook_addr) && (task_change_hook_addr < tb->pc + tb->size)) {
-        TCGOp *op = find_guest_insn_by_addr(task_change_hook_addr);
-        if (op) {
-            insert_call_1p(&op, (void(*)(void*))notify_task_change, cpu);
-        }
-    }
-}
-
-#endif
-
-
-bool init_plugin(void *self) {
-#ifdef TARGET_I386
-    // this stuff only currently works for win7 or win2000, 32-bit
-    assert (panda_os_familyno == OS_WINDOWS);
-    assert (panda_os_bits == 32);
-    assert (panda_os_variant);
-
-    if(0 == strcmp(panda_os_variant, "7")) {
-        task_change_hook_addr = 0x0;
-        task_change_hook_offset = 0x55209;
-        kthread_kproc_off=0x150;
-        kthread_cid_off = 0x22c;
-        eproc_pid_off=0x0b4;
-        eproc_ppid_off=0x140;
-        eproc_name_off=0x16c;
-        eproc_objtable_off=0xf4;
-        eproc_ppeb_off = 0x1a8;
-        obj_type_file = 28;
-        obj_type_key = 35;
-        obj_type_process = 7;
-        obj_type_offset = 0xc;
-        eproc_size = 0x26;
-        eproc_links_off = 0x0b8;
-        ntreadfile_esp_off = 0;
-        panda_require("win7x86intro");
-        assert(init_win7x86intro_api());
-        get_kpcr = get_win7_kpcr;
-        get_handle_object = get_win7_handle_object;
-        get_kddebugger_data = get_win7_kdbg;
-    } else if (0 == strcmp(panda_os_variant, "2000")) {
-        task_change_hook_addr = 0x804043E3;
-        task_change_hook_offset = 0x0;
-        kthread_kproc_off = 0x22c;
-        kthread_cid_off = 0x1e0;
-        eproc_pid_off=0x09c;
-        eproc_ppid_off=0x1c8;
-        eproc_name_off=0x1fc;
-        eproc_objtable_off=0x128;
-        eproc_ppeb_off = 0x1b0;
-        obj_type_file = 0x05;
-        obj_type_key = 0x32;
-        obj_type_process = 0x03;
-        obj_type_offset = 0x18;
-        eproc_size = 0x1b;
-        eproc_links_off = 0x0a0;
-        ntreadfile_esp_off = 0x24;
-        panda_require("win2000x86intro");
-        assert(init_win2000x86intro_api());
-        get_kpcr = get_win2000_kpcr;
-        get_handle_object = get_win2000_handle_object;
-        get_kddebugger_data = get_win2000_kddebugger_data;
-    } else if (0 == strcmp(panda_os_variant, "xpsp3")) {
-        task_change_hook_addr = 0x804DB9D7;
-        task_change_hook_offset = 0x0;
-        kthread_kproc_off = 0x044;
-        kthread_cid_off = 0x1ec;
-        eproc_pid_off = 0x084;
-        eproc_ppid_off = 0x14c;
-        eproc_name_off = 0x174;
-        eproc_objtable_off = 0x0c4;
-        eproc_ppeb_off = 0x1b0;
-        obj_type_file = 28;
-        obj_type_key = 20;
-        obj_type_process = 5;
-        obj_type_offset = 0x8;
-        eproc_size = 0x1b; // why???
-        eproc_links_off = 0x088;
-        ntreadfile_esp_off = 0;
-        panda_require("winxpx86intro");
-        assert(init_winxpx86intro_api());
-        get_kpcr = get_winxp_kpcr;
-        get_handle_object = get_winxp_handle_object;
-        get_kddebugger_data = get_winxp_kdbg;
-    } else {
-        fprintf(stderr, "Plugin is not supported for this windows "
-            "version (%s).\n", panda_os_variant);
-    }
-
-    PPP_REG_CB("osi", on_get_current_process, on_get_current_process);
-    PPP_REG_CB("osi", on_get_current_process_handle, on_get_current_process_handle);
-    PPP_REG_CB("osi", on_get_processes, on_get_processes);
-    PPP_REG_CB("osi", on_get_current_thread, on_get_current_thread);
-    PPP_REG_CB("osi", on_get_process_pid, on_get_process_pid);
-    PPP_REG_CB("osi", on_get_process_ppid, on_get_process_ppid);
-    PPP_REG_CB("osi", on_get_mappings, on_get_mappings);
-    PPP_REG_CB("osi", on_get_modules, on_get_modules);
-
-    assert(init_osi_api());
-
-    panda_cb pcb;
-    pcb.before_tcg_codegen = &before_tcg_codegen;
-    panda_register_callback(self, PANDA_CB_BEFORE_TCG_CODEGEN, pcb);
-
-    return true;
-#else
-    fprintf(stderr, "Plugin is not supported on this platform.\n");
-    return false;
-#endif
-
-}
-
-void uninit_plugin(void *self) {
-    printf("Unloading wintrospection plugin\n");
-    // if we don't clear tb's when this exits we have TBs which can call
-    // into our exited plugin.
-    panda_do_flush_tb();
-}
-
-/* vim: set tabstop=4 softtabstop=4 expandtab: */
diff --git a/panda/plugins/wintrospection/wintrospection.cpp b/panda/plugins/wintrospection/wintrospection.cpp
new file mode 100644
index 00000000000..2a575750828
--- /dev/null
+++ b/panda/plugins/wintrospection/wintrospection.cpp
@@ -0,0 +1,734 @@
+/* PANDABEGINCOMMENT
+ *
+ * Authors:
+ *  Ben Dumas              benjamin.dumas@ll.mit.edu
+ *  Nick Gillum            nicholas.gillum@ll.mit.edu
+ *  Lisa Baer              lisa.baer@ll.mit.edu
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2.
+ * See the COPYING file in the top-level directory.
+ *
+PANDAENDCOMMENT */
+// This needs to be defined before anything is included in order to get
+// the PRIx64 macro
+#define __STDC_FORMAT_MACROS
+
+#include <dirent.h>
+#include <sys/stat.h>
+#include <sys/types.h>
+
+#include <offset/i_t.h>
+#include <offset/offset.h>
+
+#include <osi/windows/iterator.h>
+#include <osi/windows/manager.h>
+#include <osi/windows/ustring.h>
+#include <osi/windows/wintrospection.h>
+
+#include <iconv.h>
+#include <memory>
+#include <sstream>
+#include <string>
+#include <vector>
+
+#include "glib.h"
+
+#include "panda/plugin.h"
+#include "panda/plugin_plugin.h"
+#include "panda/tcg-utils.h"
+
+#include "../osi/osi_types.h"
+#include "../osi/osi_ext.h"
+#include "../osi/os_intro.h"
+#include <hooks/hooks_int_fns.h>
+
+#include "pandamemory.h"
+
+// These need to be extern "C" so that the ABI is compatible with
+// QEMU/PANDA, which is written in C
+void (*hooks_add_hook)(struct hook*);
+extern "C" {
+bool init_plugin(void *);
+void uninit_plugin(void *);
+
+int64_t get_file_handle_pos(uint64_t handle);
+char *get_cwd(void);
+char *get_handle_name(uint64_t handle);
+}
+
+void on_get_current_thread(CPUState *cpu, OsiThread *out);
+void on_get_process_pid(CPUState *cpu, const OsiProcHandle *h,
+                        target_pid_t *pid);
+void on_get_current_process_handle(CPUState *cpu, OsiProcHandle **out);
+void on_get_process_handles(CPUState *cpu, GArray **out);
+void on_get_process_ppid(CPUState *cpu, const OsiProcHandle *h,
+                         target_pid_t *ppid);
+void on_get_current_process(CPUState *cpu, OsiProc **out);
+void on_get_process(CPUState *cpu, const OsiProcHandle *h, OsiProc **out);
+void on_get_processes(CPUState *cpu, GArray **out);
+void on_get_modules(CPUState *cpu, GArray **out);
+void on_get_mappings(CPUState *cpu, OsiProc *p, GArray **out);
+
+void initialize_introspection(CPUState *cpu);
+
+std::unique_ptr<WindowsKernelManager> g_kernel_manager;
+std::unique_ptr<WindowsProcessManager> g_process_manager;
+
+bool g_initialized_kernel;
+uint64_t swapcontext_address;
+
+// globals for toggling callbacks
+void* self = NULL;
+panda_cb pcb_asid;
+panda_cb pcb_startblock;
+
+static std::map<std::string, uint64_t> system_asid_lookup = {
+  {"windows-32-2000", 0x30000},
+  {"windows-32-xpsp2", 0x39000},
+  {"windows-32-xpsp3", 0x39000},
+  {"windows-32-7sp0", 0x185000},
+  {"windows-64-7sp0", 0x187000},
+  {"windows-32-7sp1", 0x185000},
+  {"windows-64-7sp1", 0x187000},
+};
+
+/* ******************************************************************
+ Helpers
+****************************************************************** */
+void fill_process(OsiProc *p, WindowsProcess *win_proc) {
+  p->taskd = process_get_eprocess(win_proc);
+  p->asid = process_get_asid(win_proc);
+  p->pid = process_get_pid(win_proc);
+  p->ppid = process_get_ppid(win_proc);
+  p->pages = NULL;
+
+  p->name = (char *)g_malloc(17);
+  strncpy(p->name, process_get_shortname(win_proc), 17);
+}
+
+void fill_module(OsiModule *m, struct WindowsModuleEntry *win_mod) {
+  m->modd = module_entry_get_module_entry(win_mod);
+  m->size = module_entry_get_modulesize(win_mod);
+  m->base = module_entry_get_base_address(win_mod);
+  m->file = strdup(module_entry_get_dllpath(win_mod));
+  m->name = strdup(module_entry_get_dllname(win_mod));
+}
+
+std::string get_key_name(uint64_t ptr) {
+  if (strncmp(panda_os_name, "windows-32-2000", 15) == 0) {
+    // just keep previous functionality for windows 2k,
+    // as we couldn't verify the fancy functionality works
+    return std::string("_CM_KEY_BODY@0x") + std::to_string(ptr);
+  }
+
+  auto object = g_process_manager->get_type(ptr, "_CM_KEY_BODY");
+
+  osi::i_t nameblock;
+  uint8_t compressed;
+  uint16_t size;
+
+  std::vector<std::string> keyname;
+
+  auto kcb = object("KeyControlBlock");
+  while (kcb.get_address()) {
+    nameblock = kcb("NameBlock");
+    compressed = nameblock["Compressed"].get8();
+    size = nameblock["NameLength"].get16();
+
+    if (compressed) {
+      char *temp = new char[size + 1]{'\0'};
+      nameblock["Name"].getx(*temp, size);
+
+      size_t total = strnlen(temp, size);
+      if (total == size) {
+        temp[size] = '\0';
+      }
+
+      for (size_t idx = 0; idx < total; idx++) {
+        if (!isprint(temp[idx])) {
+          temp[idx] = '?';
+        }
+      }
+
+      keyname.push_back(std::string(temp, total));
+      delete temp;
+    } else {
+      auto raw_name =
+          osi::ustring(nameblock["Name"].set_type("_UNICODE_STRING"));
+      keyname.push_back(raw_name.as_utf8());
+    }
+    kcb = kcb("ParentKcb");
+  }
+
+  std::string full_key;
+  for (auto it = keyname.rbegin(); it != keyname.rend(); it++) {
+    full_key += "\\" + *it;
+  }
+
+  return full_key;
+}
+
+std::string extract_handle_name(struct WindowsHandleObject *handle) {
+  auto ptr = handle_get_pointer(handle);
+  if (!ptr) {
+    return "unknown";
+  }
+
+  std::stringstream ss;
+
+  const char *type_name = handle_get_typename(handle);
+  if (strcmp(type_name, "Key") == 0) {
+    ss << get_key_name(ptr);
+  } else if (strcmp(type_name, "File") == 0) {
+    auto file = g_process_manager->get_type(ptr, "_FILE_OBJECT");
+    osi::ustring uname(file["FileName"]);
+    ss << uname.as_utf8();
+  } else if (strcmp(type_name, "Process") == 0) {
+    struct WindowsProcess *p =
+        create_process(g_kernel_manager->get_kernel_object(), ptr);
+    ss << process_get_shortname(p);
+    free_process(p);
+  } else {
+    ss << "unknown object type " << handle_get_type(handle);
+  }
+
+  return ss.str();
+}
+
+/* ******************************************************************
+ Our Callbacks
+****************************************************************** */
+
+int64_t get_file_handle_pos(CPUState *cpu, uint64_t handle) {
+  if (!g_initialized_kernel) {
+    initialize_introspection(cpu);
+  }
+
+  auto kernel = g_kernel_manager->get_kernel_object();
+  WindowsHandleObject *h = resolve_handle(kernel, handle);
+
+  uint64_t ptr;
+  int64_t file_pos = -1;
+  if (h != nullptr && (ptr = handle_get_pointer(h))) {
+    try {
+      auto file = g_process_manager->get_type(ptr, "_FILE_OBJECT");
+      file_pos = file["CurrentByteOffset"].get64();
+    } catch (std::runtime_error const &) {
+      // runtime_error is raised when a virtual memory read fails
+      // it's the equiv of (-1 == panda_virtual_memory_rw(...))
+    }
+  }
+
+  free_handle(h);
+  return file_pos;
+}
+
+char *get_cwd(CPUState *cpu) {
+  if (!g_initialized_kernel) {
+    initialize_introspection(cpu);
+  }
+
+  osi::i_t eproc = g_process_manager->get_process();
+
+  bool wow = false;
+  if (panda_os_bits == 64 && eproc["Wow64Process"].getu())
+    wow = true;
+
+  osi::i_t peb;
+  if (wow) {
+    peb = eproc("Wow64Process").set_type("_PEB32");
+  } else {
+    peb = eproc("Peb");
+  }
+
+  osi::i_t params;
+  if (wow) {
+    params = g_process_manager->get_type(peb["ProcessParameters"].get32(),
+                                         "_RTL_USER_PROCESS_PARAMETERS");
+  } else {
+    params = peb("ProcessParameters");
+  }
+
+  auto dospath = osi::ustring(params["CurrentDirectory"]["DosPath"]);
+  std::string path = dospath.as_utf8();
+  return strdup(path.c_str());
+}
+
+char *get_handle_name(CPUState *cpu, uint64_t handle) {
+  if (!g_initialized_kernel) {
+    initialize_introspection(cpu);
+  }
+
+  auto kernel = g_kernel_manager->get_kernel_object();
+  WindowsHandleObject *h = resolve_handle(kernel, handle);
+  if (!h)
+    return strdup("unknown");
+
+  auto tmp = extract_handle_name(h);
+  char *name = strdup(tmp.c_str());
+
+  free_handle(h);
+  return name;
+}
+
+/* ******************************************************************
+ PPP Callbacks
+****************************************************************** */
+
+void on_get_current_thread(CPUState *cpu, OsiThread **out) {
+  if (!g_initialized_kernel) {
+    initialize_introspection(cpu);
+  }
+
+  OsiThread *t = (OsiThread *)g_malloc(sizeof(OsiThread));
+
+  auto proc = g_process_manager->get_process_object();
+  auto kernel = g_kernel_manager->get_kernel_object();
+
+  t->pid = proc->pid;
+  t->tid = kosi_get_current_tid(kernel);
+
+  *out = t;
+}
+
+void on_get_process_pid(CPUState *cpu, const OsiProcHandle *h,
+                        target_pid_t *pid) {
+  if (!g_initialized_kernel) {
+    initialize_introspection(cpu);
+  }
+
+  if (h->taskd == (intptr_t)(NULL) || h->taskd == (target_ptr_t)-1) {
+    *pid = (target_pid_t)-1;
+  } else {
+    *pid = g_process_manager->get_process_object()->pid;
+  }
+}
+
+void on_get_current_process_handle(CPUState *cpu, OsiProcHandle **out) {
+  if (!g_initialized_kernel) {
+    initialize_introspection(cpu);
+  }
+
+  OsiProcHandle *p = (OsiProcHandle *)g_malloc(sizeof(OsiProcHandle));
+
+  auto process = g_process_manager->get_process_object();
+  p->taskd = process->eprocess_address;
+  p->asid = process->vmem->get_asid();
+
+  *out = p;
+}
+
+void on_get_process_handles(CPUState *cpu, GArray **out) {
+  if (!g_initialized_kernel) {
+    initialize_introspection(cpu);
+  }
+
+  if (*out == NULL) {
+    *out = g_array_sized_new(false, false, sizeof(OsiProcHandle), 128);
+    g_array_set_clear_func(*out, (GDestroyNotify)free_osiprochandle_contents);
+  }
+
+  auto kernel = g_kernel_manager->get_kernel_object();
+
+  struct WindowsProcessList *plist = get_process_list(kernel);
+  struct WindowsProcess *process;
+  while ((process = process_list_next(plist)) != nullptr) {
+    OsiProcHandle cur_handle;
+    cur_handle.taskd = process_get_eprocess(process);
+    cur_handle.asid = process_get_asid(process);
+    g_array_append_val(*out, cur_handle);
+
+    free_process(process);
+  }
+  free_process_list(plist);
+}
+
+void on_get_process_ppid(CPUState *cpu, const OsiProcHandle *h,
+                         target_pid_t *ppid) {
+  if (!g_initialized_kernel) {
+    initialize_introspection(cpu);
+  }
+
+  if (h->taskd == (intptr_t)(NULL) || h->taskd == (target_ptr_t)-1) {
+    *ppid = (target_pid_t)-1;
+  } else {
+    auto kernel = g_kernel_manager->get_kernel_object();
+    auto process = kosi_get_current_process(kernel);
+    *ppid = process_get_ppid(process);
+    free_process(process);
+  }
+}
+
+void on_get_current_process(CPUState *cpu, OsiProc **out) {
+  if (!g_initialized_kernel) {
+    initialize_introspection(cpu);
+  }
+
+  OsiProc *p = (OsiProc *)g_malloc(sizeof(OsiProc));
+
+  auto proc = g_process_manager->get_process_object();
+  if (proc->eprocess_address == 0) {
+    *out = NULL;
+    return;
+  }
+
+  auto kernel = g_kernel_manager->get_kernel_object();
+  WindowsProcess *process = create_process(kernel, proc->eprocess_address);
+  fill_process(p, process);
+  free_process(process);
+
+  *out = p;
+}
+
+void on_get_process(CPUState *cpu, const OsiProcHandle *h, OsiProc **out) {
+  if (!g_initialized_kernel) {
+    initialize_introspection(cpu);
+  }
+
+  OsiProc *p = NULL;
+  if (h != NULL && h->taskd != (target_ptr_t)NULL) {
+    p = (OsiProc *)g_malloc(sizeof(OsiProc));
+
+    auto kernel = g_kernel_manager->get_kernel_object();
+    auto proc = create_process(kernel, h->taskd);
+    fill_process(p, proc);
+    free_process(proc);
+  }
+  *out = p;
+}
+
+void on_get_processes(CPUState *cpu, GArray **out) {
+  if (!g_initialized_kernel) {
+    initialize_introspection(cpu);
+  }
+
+  if (*out == NULL) {
+    *out = g_array_sized_new(false, false, sizeof(OsiProc), 128);
+    g_array_set_clear_func(*out, (GDestroyNotify)free_osiproc_contents);
+  }
+
+  auto kernel = g_kernel_manager->get_kernel_object();
+
+  struct WindowsProcessList *plist = get_process_list(kernel);
+  struct WindowsProcess *process;
+  while ((process = process_list_next(plist)) != nullptr) {
+    OsiProc cur_proc;
+    fill_process(&cur_proc, process);
+    g_array_append_val(*out, cur_proc);
+
+    free_process(process);
+  }
+  free_process_list(plist);
+}
+
+void on_get_modules(CPUState *cpu, GArray **out) {
+  if (!g_initialized_kernel) {
+    initialize_introspection(cpu);
+  }
+
+  if (*out == NULL) {
+    // g_array_sized_new() args: zero_term, clear, element_sz, reserved_sz
+    *out = g_array_sized_new(false, false, sizeof(OsiModule), 128);
+    g_array_set_clear_func(*out, (GDestroyNotify)free_osimodule_contents);
+  }
+
+  auto kernel = g_kernel_manager->get_kernel_object();
+
+  auto ldr_table = g_kernel_manager->get_type(
+      kernel->details.PsLoadedModuleList, "_LDR_DATA_TABLE_ENTRY");
+  osi::iterator pitr(ldr_table, "InLoadOrderLinks");
+  do {
+    auto entry = *pitr;
+
+    OsiModule m;
+    memset(&m, 0, sizeof(OsiModule));
+
+    m.modd = entry.get_address();
+    m.size = entry["SizeOfImage"].get32();
+    m.base = entry["DllBase"].getu();
+
+    try {
+      osi::ustring dllname(entry["BaseDllName"]);
+      std::string dllname_utf8 = dllname.as_utf8().c_str();
+      m.name = strdup(dllname_utf8.c_str());
+
+      osi::ustring dllpath(entry["FullDllName"]);
+      std::string dllpath_utf8 = dllpath.as_utf8();
+      m.file = strdup(dllpath_utf8.c_str());
+    } catch (std::runtime_error const &) {
+      // runtime_error is thrown when virtual memory
+      // cannot read the struct attribute
+      m.name = strdup("-");
+      m.file = strdup("-");
+    }
+
+    g_array_append_val(*out, m);
+
+    pitr++;
+  } while (*pitr != ldr_table);
+}
+
+void on_get_mappings(CPUState *cpu, OsiProc *p, GArray **out) {
+  if (!g_initialized_kernel) {
+    initialize_introspection(cpu);
+  }
+
+  if (p == NULL) {
+    return;
+  }
+
+  if (*out == NULL) {
+    // g_array_sized_new() args: zero_term, clear, element_sz, reserved_sz
+    *out = g_array_sized_new(false, false, sizeof(OsiModule), 128);
+    g_array_set_clear_func(*out, (GDestroyNotify)free_osimodule_contents);
+  }
+
+  auto kernel = g_kernel_manager->get_kernel_object();
+
+  auto proc = create_process(kernel, p->taskd);
+  struct WindowsModuleList *mlist =
+      get_module_list(kernel, p->taskd, process_is_wow64(proc));
+  free_process(proc);
+
+  if (mlist) {
+    struct WindowsModuleEntry *mentry;
+    while ((mentry = module_list_next(mlist)) != nullptr) {
+      OsiModule m;
+      memset(&m, 0, sizeof(OsiModule));
+      fill_module(&m, mentry);
+      g_array_append_val(*out, m);
+
+      free_module_entry(mentry);
+    }
+  }
+
+  // this is guarded from nullptr, so safe here
+  free_module_list(mlist);
+}
+
+/* ******************************************************************
+ Initialization logic
+****************************************************************** */
+
+void task_change(CPUState *cpu) {
+  g_process_manager.reset(new WindowsProcessManager());
+
+  auto kernel = g_kernel_manager->get_kernel_object();
+  g_process_manager->initialize(kernel,
+                                kosi_get_current_process_address(kernel));
+
+  notify_task_change(cpu);
+}
+
+void start_block_exec(CPUState *cpu, TranslationBlock *tb) {
+  task_change(cpu);
+  panda_disable_callback(self, PANDA_CB_START_BLOCK_EXEC, pcb_startblock);
+}
+
+bool asid_changed(CPUState *cpu, target_ulong old_pgd, target_ulong new_pgd) {
+  if (!g_initialized_kernel) {
+    initialize_introspection(cpu);
+  }
+
+  if (old_pgd != new_pgd)
+    panda_enable_callback(self, PANDA_CB_START_BLOCK_EXEC, pcb_startblock);
+
+  return false;
+}
+
+void task_change_hook(CPUState *cpu, TranslationBlock *tb, struct hook* h){
+  task_change(cpu);
+}
+
+/**
+ * Get the Kernel Processor Control Region (KPCR) on a 32-bit system
+ *
+ * The KPCR should be accessible from FS. FS is stored at selector 0x30
+ * in the Global Descriptor Table (GDT), so we look here to load it.
+ * The base of this segment contains the KPCR.
+ *
+ */
+uint64_t get_kpcr_i386(CPUState *cpu) {
+#if defined(TARGET_I386)
+  CPUArchState *env = (CPUArchState *)cpu->env_ptr;
+
+  // read the FS segment descriptor from the GDT
+  uint32_t e1 = 0, e2 = 0;
+  panda_virtual_memory_rw(cpu, env->gdt.base + 0x30, (uint8_t *)&e1, 4, false);
+  panda_virtual_memory_rw(cpu, env->gdt.base + 0x30 + 4, (uint8_t *)&e2, 4,
+                          false);
+
+  // get base address from wacky segment
+  // see https://wiki.osdev.org/Global_Descriptor_Table
+  // for a layout -- we need the upper 16 bits of the first word, and
+  // the lowest and highest byte of the second word all together
+  uint32_t addr = ((e1 >> 16) | ((e2 & 0xff) << 16) | (e2 & 0xff000000));
+
+  return addr;
+#endif
+  return 0;
+}
+
+/**
+ * Get the Kernel Processor Control Region (KPCR) on a 64-bit system
+ *
+ * The KPCR should be stored in the Model Specific Register, KernelGSBase. If
+ * it is not there, then it has already been swapped into GS (with swapgs). We
+ * know if a KPCR has been found, because a KPCR struct has a pointer to itself
+ * at offset 0x18.
+ */
+uint64_t get_kpcr_amd64(CPUState *cpu) {
+#if defined(TARGET_X86_64)
+  CPUArchState *env = (CPUArchState *)cpu->env_ptr;
+
+  uint64_t kpcr = env->kernelgsbase;
+
+  auto tlib = load_type_library(panda_os_name);
+  auto mr = offset_of(tlib, translate(tlib, "_KPCR"), "Self");
+
+  // check if the SelfPcr member is a pointer to itself. if so, we found the
+  // KPCR.
+  uint64_t base_self;
+  panda_virtual_memory_rw(cpu, kpcr + mr->offset, (uint8_t *)&base_self, 8,
+                          false);
+  if (kpcr != base_self) {
+    // it has been swapped into GS
+    kpcr = env->segs[R_GS].base;
+  }
+
+  free_member_result(mr);
+  return kpcr;
+#endif
+  return 0;
+}
+
+bool is_windows_pae_enabled(CPUState* cpu) {
+#if defined(TARGET_I386)
+  // windows only uses PAE on 32-bit systems for x86
+  if (panda_os_bits == 32) {
+    CPUArchState *env = (CPUArchState *)cpu->env_ptr;
+
+    bool cr0_paging_enabled = env->cr[0] & 0x80000000;
+    bool cr4_pae_enabled = env->cr[4] & 0x20;
+
+    return cr0_paging_enabled && cr4_pae_enabled;
+  }
+#endif
+  return false;
+}
+
+void initialize_introspection(CPUState *cpu) {
+  auto pmem = create_panda_physical_memory();
+  if (!pmem) {
+    fprintf(stderr, "Error creating physical memory interface\n");
+    exit(1);
+  }
+
+  auto asid_entry = system_asid_lookup.find(std::string(panda_os_name));
+  if (asid_entry == system_asid_lookup.end()) {
+    fprintf(stderr, "%s is an unsupported profile\n", panda_os_name);
+    exit(2);
+  }
+
+  auto kpcr = (panda_os_bits == 64) ? get_kpcr_amd64(cpu) : get_kpcr_i386(cpu);
+  auto width = (panda_os_bits == 64) ? 8 : 4;
+
+  auto success = g_kernel_manager->initialize(pmem, width, asid_entry->second,
+                                              kpcr, is_windows_pae_enabled(cpu));
+  if (!success) {
+    fprintf(stderr, "Error initializing kernel manager\n");
+    exit(3);
+  }
+  g_initialized_kernel = true;
+
+  g_process_manager =
+      std::unique_ptr<WindowsProcessManager>(new WindowsProcessManager());
+  task_change(cpu);
+
+  uint64_t swapcontext_offset = g_kernel_manager->get_swapcontext_offset();
+
+  // we do not know exactly when a nt!SwapContext executes, and we must use the
+  // ASID change heuristic.
+  if (swapcontext_offset == 0x0) {
+    return;
+  }
+
+  GArray *mods = get_modules(cpu);
+  for (int i = 0; i < mods->len; i++) {
+      OsiModule *mod = &g_array_index(mods, OsiModule, i);
+      if (0 == strcmp("ntoskrnl.exe", mod->name)) {
+          swapcontext_address = mod->base + swapcontext_offset;
+      }
+  }
+  if (NULL != mods) {
+      g_array_free(mods, true);
+  }
+
+  if (swapcontext_address == 0x0) {
+    fprintf(stderr, "Error finding ntoskrnl! Defaulting to ASID change heuristic.\n");
+  } else {
+    // disable ASID change heuristic
+    panda_disable_callback(self, PANDA_CB_ASID_CHANGED, pcb_asid);
+
+    // add hook for swapcontext_address
+    void *hooks = panda_get_plugin_by_name("hooks");
+    if (hooks == NULL){
+      panda_require("hooks");
+      hooks = panda_get_plugin_by_name("hooks");
+    }
+    hooks_add_hook = (void(*)(struct hook*)) dlsym(hooks, "add_hook");
+
+    // create hook for swapcontext_address
+    struct hook h;
+		h.addr = swapcontext_address;
+		h.asid = 0; // match any asid
+		h.cb.start_block_exec = task_change_hook;
+		h.type = PANDA_CB_START_BLOCK_EXEC;
+		h.enabled = true;
+		h.km = MODE_ANY;
+		hooks_add_hook(&h);
+  }
+}
+
+bool init_plugin(void *_self) {
+#if defined(TARGET_I386) // only supports i386 and x86_64
+  panda_require("osi");
+  assert(init_osi_api());
+  self = _self;
+
+  pcb_startblock.start_block_exec = start_block_exec;
+  panda_register_callback(self, PANDA_CB_START_BLOCK_EXEC, pcb_startblock);
+  panda_disable_callback(self, PANDA_CB_START_BLOCK_EXEC, pcb_startblock);
+
+  pcb_asid.asid_changed = asid_changed;
+  panda_register_callback(self, PANDA_CB_ASID_CHANGED, pcb_asid);
+
+  PPP_REG_CB("osi", on_get_current_thread, on_get_current_thread);
+  PPP_REG_CB("osi", on_get_process_pid, on_get_process_pid);
+  PPP_REG_CB("osi", on_get_current_process_handle,
+             on_get_current_process_handle);
+  PPP_REG_CB("osi", on_get_process_handles, on_get_process_handles);
+  PPP_REG_CB("osi", on_get_process_ppid, on_get_process_ppid);
+  PPP_REG_CB("osi", on_get_current_process, on_get_current_process);
+  PPP_REG_CB("osi", on_get_process, on_get_process);
+  PPP_REG_CB("osi", on_get_processes, on_get_processes);
+  PPP_REG_CB("osi", on_get_modules, on_get_modules);
+  PPP_REG_CB("osi", on_get_mappings, on_get_mappings);
+
+  // globals
+  g_kernel_manager = std::unique_ptr<WindowsKernelManager>(
+      new WindowsKernelManager(std::string(panda_os_name)));
+  swapcontext_address = 0;
+  g_initialized_kernel = false;
+
+  return true;
+#endif
+  return false;
+}
+
+void uninit_plugin(void *_self) {
+  printf("Unloading wintrospection plugin\n");
+  // if we don't clear tb's when this exits we have TBs which can call
+  // into our exited plugin.
+  panda_do_flush_tb();
+}
diff --git a/panda/plugins/wintrospection/wintrospection.h b/panda/plugins/wintrospection/wintrospection.h
deleted file mode 100644
index 71c23229d90..00000000000
--- a/panda/plugins/wintrospection/wintrospection.h
+++ /dev/null
@@ -1,35 +0,0 @@
-#pragma once
-
-typedef struct handle_object_struct {
-    uint8_t objType;
-    uint32_t pObj;
-} HandleObject;
-
-
-// See: https://msdn.microsoft.com/en-us/library/windows/desktop/aa380518(v=vs.85).aspx
-typedef struct {
-    uint16_t Length;        // length excluding terminator in bytes
-    uint16_t MaximumLength; // allocated memory for buffer
-    target_ulong Buffer;    // pointer to allocated memory
-} win_unicode_string_t;
-
-// Size of guest pointer.
-// Note that this can't just be target_ulong since
-// a 32-bit OS will run on x86_64-softmmu
-// To add support for a 64-bit OS, consider creating a wintrospection64 plugin.
-#define PTR uint32_t
-
-#define HANDLE_MASK1  0x000007fc
-#define HANDLE_SHIFT1 2
-#define HANDLE_MASK2  0x001ff800
-#define HANDLE_SHIFT2  11
-#define HANDLE_MASK3  0x7fe00000
-#define HANDLE_SHIFT3  21
-#define LEVEL_MASK 0x00000007
-#define TABLE_MASK ~LEVEL_MASK
-#define ADDR_SIZE 4
-#define HANDLE_TABLE_ENTRY_SIZE 8
-
-// Given an object header, we can find the body of the object at this offset.
-// This seems stable across versions of Windows (at least Win 2k SP4 - 7 SP1).
-#define OBJECT_HEADER_BODY_OFFSET 0x18
diff --git a/panda/plugins/wintrospection/wintrospection_int.h b/panda/plugins/wintrospection/wintrospection_int.h
index c572e6d9907..ae70a800dd0 100644
--- a/panda/plugins/wintrospection/wintrospection_int.h
+++ b/panda/plugins/wintrospection/wintrospection_int.h
@@ -1,15 +1,5 @@
-typedef void HandleObject;
-typedef void CPUState;
-typedef void uint32_t;
+typedef void uint64_t;
 typedef void int64_t;
-typedef void bool;
-typedef void PTR;
-typedef void OsiProc;
-typedef void OsiProcHandle;
-typedef void OsiModule;
-typedef void OsiThread;
-typedef void GArray;
-typedef void target_pid_t;
+typedef void CPUState;
 
 #include "wintrospection_int_fns.h"
-
diff --git a/panda/plugins/wintrospection/wintrospection_int_fns.h b/panda/plugins/wintrospection/wintrospection_int_fns.h
index 34e5dab1adb..bbedc475d09 100644
--- a/panda/plugins/wintrospection/wintrospection_int_fns.h
+++ b/panda/plugins/wintrospection/wintrospection_int_fns.h
@@ -1,102 +1,7 @@
 #pragma once
 
-char *make_pagedstr(void);
-
-char *get_unicode_str(CPUState *cpu, PTR ustr);
-
-// returns virtual address of EPROCESS data structure of currently running process
-PTR get_current_proc(CPUState *cpu);
-
-// returns next process in process list
-PTR get_next_proc(CPUState *cpu, PTR eproc);
-
-// returns true if eproc points to an EPROCESS structure
-bool is_valid_process(CPUState *cpu, PTR eproc);
-
-// returns pid,given virtual address of EPROCESS data structure
-uint32_t get_pid(CPUState *cpu, PTR eproc);
-
-// returns parent pid,given virtual address of EPROCESS data structure
-uint32_t get_ppid(CPUState *cpu, PTR eproc);
-
-PTR get_dtb(CPUState *cpu, PTR eproc);
-
-// fills name (assumed alloced) for process given virtual address of EPROCESS data structure
-void get_procname(CPUState *cpu, PTR eproc, char **name);
+char *get_handle_name(CPUState *cpu, uint64_t handle);
 
 char *get_cwd(CPUState *cpu);
 
-char *get_handle_object_name(CPUState *cpu, HandleObject *ho);
-
-int64_t get_file_handle_pos(CPUState *cpu, PTR eproc, uint32_t handle);
-
-char *get_handle_name(CPUState *cpu, PTR eproc, uint32_t handle);
-
-char * get_objname(CPUState *cpu, uint32_t obj);
-
-char *get_file_obj_name(CPUState *cpu, uint32_t fobj);
-
-int64_t get_file_obj_pos(CPUState *cpu, uint32_t fobj);
-
-char *read_unicode_string(CPUState *cpu, uint32_t pUstr);
-
-const char *get_mod_basename(CPUState *cpu, PTR mod);
-
-const char *get_mod_filename(CPUState *cpu, PTR mod);
-
-PTR get_mod_base(CPUState *cpu, PTR mod);
-
-PTR get_mod_size(CPUState *cpu, PTR mod);
-
-PTR get_next_mod(CPUState *cpu, PTR mod);
-
-void fill_osiproc(CPUState *cpu, OsiProc *p, PTR eproc);
-
-void fill_osiprochandle(CPUState *cpu, OsiProcHandle *h, PTR eproc);
-
-void fill_osimod(CPUState *cpu, OsiModule *m, PTR mod, bool ignore_basename);
-
-void add_mod(CPUState *cpu, GArray *ms, PTR mod, bool ignore_basename);
-
-void on_get_current_process(CPUState *cpu, OsiProc **out);
-
-void on_get_current_process_handle(CPUState *cpu, OsiProcHandle **out);
-
-void on_get_modules(CPUState *cpu, GArray **out);
-
-void on_get_mappings(CPUState *cpu, OsiProc *p, GArray **out);
-
-void on_get_processes(CPUState *cpu, GArray **out);
-
-void on_get_current_thread(CPUState *cpu, OsiThread **t);
-
-void on_get_process_pid(CPUState *cpu, const OsiProcHandle *h, target_pid_t *pid);
-
-void on_get_process_ppid(CPUState *cpu, const OsiProcHandle *h, target_pid_t *ppid);
-
-// Getters for os-specific constants
-uint32_t get_ntreadfile_esp_off(void);
-
-uint32_t get_eproc_pid_off(void);
-
-uint32_t get_eproc_name_off(void);
-
-uint32_t get_kthread_kproc_off(void);
-
-uint32_t get_eproc_objtable_off(void);
-
-uint32_t get_obj_type_offset(void);
-
-uint32_t handle_table_code(CPUState *cpu, uint32_t table_vaddr);
-
-uint32_t handle_table_L1_addr(CPUState *cpu, uint32_t table_vaddr, uint32_t entry_num);
-
-uint32_t handle_table_L2_addr(uint32_t L1_table, uint32_t L2);
-
-uint32_t handle_table_L1_entry(CPUState *cpu, uint32_t table_vaddr, uint32_t entry_num);
-
-uint32_t handle_table_L2_entry(uint32_t table_vaddr, uint32_t L1_table, uint32_t L2);
-
-uint32_t handle_table_L3_entry(uint32_t table_vaddr, uint32_t L2_table, uint32_t L3);
-
-uint32_t get_eproc_peb_off(void);
+int64_t get_file_handle_pos(CPUState *cpu, uint64_t handle);
diff --git a/panda/plugins/winxpx86intro/Makefile b/panda/plugins/winxpx86intro/Makefile
deleted file mode 100644
index f3982d849ad..00000000000
--- a/panda/plugins/winxpx86intro/Makefile
+++ /dev/null
@@ -1,9 +0,0 @@
-# Don't forget to add your plugin to config.panda!
-
-# If you need custom CFLAGS or LIBS, set them up here
-# CFLAGS+=
-# LIBS+=
-
-# The main rule for your plugin. List all object-file dependencies.
-$(PLUGIN_TARGET_DIR)/panda_$(PLUGIN_NAME).so: \
-	$(PLUGIN_OBJ_DIR)/$(PLUGIN_NAME).o
diff --git a/panda/plugins/winxpx86intro/README.md b/panda/plugins/winxpx86intro/README.md
deleted file mode 100644
index 126092342f8..00000000000
--- a/panda/plugins/winxpx86intro/README.md
+++ /dev/null
@@ -1,30 +0,0 @@
-Plugin: winxpx86intro
-===========
-
-Summary
--------
-
-`winxpx86intro` is an introspection provider for Windows XP guests, supplying information for the OSI API. Not much more to say about it; it should just work as long as the guest OS is Windows XP SP3.
-
-Arguments
----------
-
-None.
-
-Dependencies
-------------
-
-`winxpx86intro` is an introspection provider for the `osi` plugin.
-
-APIs and Callbacks
-------------------
-
-None.
-
-Example
--------
-
-Running `osi_test` on an Windows XP 32-bit replay:
-
-    $PANDA_PATH/i386-softmmu/panda-system-i386 -replay foo \
-        -panda osi -panda win7x86intro -panda osi_test
diff --git a/panda/plugins/winxpx86intro/winxpx86intro.cpp b/panda/plugins/winxpx86intro/winxpx86intro.cpp
deleted file mode 100644
index 8d8940f2e8b..00000000000
--- a/panda/plugins/winxpx86intro/winxpx86intro.cpp
+++ /dev/null
@@ -1,179 +0,0 @@
-/* PANDABEGINCOMMENT
- *
- * Authors:
- *  Tim Leek               tleek@ll.mit.edu
- *  Ryan Whelan            rwhelan@ll.mit.edu
- *  Joshua Hodosh          josh.hodosh@ll.mit.edu
- *  Michael Zhivich        mzhivich@ll.mit.edu
- *  Brendan Dolan-Gavitt   brendandg@gatech.edu
- *
- * This work is licensed under the terms of the GNU GPL, version 2.
- * See the COPYING file in the top-level directory.
- *
-PANDAENDCOMMENT */
-#define __STDC_FORMAT_MACROS
-
-#include "panda/plugin.h"
-#include "panda/plugin_plugin.h"
-
-extern "C" {
-
-#include "osi/osi_types.h"
-#include "osi/os_intro.h"
-
-#include "wintrospection/wintrospection.h"
-#include "wintrospection/wintrospection_ext.h"
-
-bool init_plugin(void *);
-void uninit_plugin(void *);
-void on_get_mappings(CPUState *, OsiProc *p, GArray **out);
-PTR get_winxp_kpcr(CPUState *cpu);
-HandleObject *get_winxp_handle_object(CPUState *cpu, uint32_t eproc,
-                                      uint32_t handle);
-PTR get_winxp_kdbg(CPUState *cpu);
-}
-
-#include <cstdio>
-#include <cstdlib>
-
-#ifdef TARGET_I386
-
-#define KPCR_KDVERSION_OFF     0x034 // _KPCR.KdVersionBlock
-#define KDVERSION_DDL_OFF      0x020 // _DBGKD_GET_VERSION64.DebuggerDataList
-#define OBJ_TYPE_INDEX_OFF     0x04c // _OBJECT_TYPE.Index
-
-// XXX: this will have to change for 64-bit
-PTR get_winxp_kpcr(CPUState *cpu)
-{
-    return 0xFFDFF000;
-}
-
-// i.e. return pointer to the object represented by this handle
-static uint32_t get_handle_table_entry(CPUState *cpu, uint32_t pHandleTable, uint32_t handle) {
-    uint32_t tableCode, tableLevels;
-    // get tablecode
-    panda_virtual_memory_rw(cpu, pHandleTable, (uint8_t *)&tableCode, 4, false);
-    // extract levels
-    tableLevels = tableCode & LEVEL_MASK;
-    if (tableLevels > 2) {
-        return 0;
-    }
-    uint32_t pEntry=0;
-    if (tableLevels == 0) {
-        uint32_t index = (handle & HANDLE_MASK1) >> HANDLE_SHIFT1;
-        pEntry = handle_table_L1_entry(cpu, pHandleTable, index);
-    }
-    if (tableLevels == 1) {
-        uint32_t L1_index = (handle & HANDLE_MASK2) >> HANDLE_SHIFT2;
-        uint32_t L1_table_off = handle_table_L1_addr(cpu, pHandleTable, L1_index);
-        uint32_t L1_table;
-        panda_virtual_memory_rw(cpu, L1_table_off, (uint8_t *) &L1_table, 4, false);
-        uint32_t index = (handle & HANDLE_MASK1) >> HANDLE_SHIFT1;
-        pEntry = handle_table_L2_entry(pHandleTable, L1_table, index);
-    }
-    if (tableLevels == 2) {
-        uint32_t L1_index = (handle & HANDLE_MASK3) >> HANDLE_SHIFT3;
-        uint32_t L1_table_off = handle_table_L1_addr(cpu, pHandleTable, L1_index);
-        uint32_t L1_table;
-        panda_virtual_memory_rw(cpu, L1_table_off, (uint8_t *) &L1_table, 4, false);
-        uint32_t L2_index = (handle & HANDLE_MASK2) >> HANDLE_SHIFT2;
-        uint32_t L2_table_off = handle_table_L2_addr(L1_table, L2_index);
-        uint32_t L2_table;
-        panda_virtual_memory_rw(cpu, L2_table_off, (uint8_t *) &L2_table, 4, false);
-        uint32_t index = (handle & HANDLE_MASK1) >> HANDLE_SHIFT1;
-        pEntry = handle_table_L3_entry(pHandleTable, L2_table, index);
-    }
-    uint32_t pObjectHeader;
-    if ((panda_virtual_memory_rw(cpu, pEntry, (uint8_t *) &pObjectHeader, 4, false)) == -1) {
-        return 0;
-    }
-
-    // Like in Windows 2000, the entry here needs to be masked off. However, the
-    // lock flag was moved to the low-order bit. So we only need to mask off the
-    // lower three bits of the entry.
-    //
-    // Russinovich, Mark E., and David A. Solomon. Microsoft Windows
-    //     Internals, Fourth Edition: Microsoft Windows Server 2003, Windows XP,
-    //     and Windows 2000. Microsoft Press, 2005, pp. 139.
-    pObjectHeader &= TABLE_MASK;
-
-    return pObjectHeader;
-}
-
-HandleObject *get_winxp_handle_object(CPUState *cpu, uint32_t eproc,
-                                      uint32_t handle)
-{
-    // Obtain the handle table (also called the object table).
-    uint32_t pObjectTable;
-    if (-1 == panda_virtual_memory_rw(cpu, eproc+get_eproc_objtable_off(), (uint8_t *)&pObjectTable, 4, false)) {
-        return NULL;
-    }
-
-    // Given the handle, lookup the object's header in the table.
-    uint32_t pObjHeader = get_handle_table_entry(cpu, pObjectTable, handle);
-    if (pObjHeader == 0) {
-        return NULL;
-    }
-
-    // Once we have the header, we can get the object's body.
-    uint32_t pObj = pObjHeader + OBJECT_HEADER_BODY_OFFSET;
-
-    // In Windows XP, we need to look at the _OBJECT_TYPE struct to get the type
-    // index.
-    uint32_t pObjType;
-    if (-1 == panda_virtual_memory_read(cpu, pObjHeader + get_obj_type_offset(),
-                                        (uint8_t *)&pObjType,
-                                        sizeof(pObjType))) {
-        return NULL;
-    }
-    uint8_t objType = 0;
-    if (-1 == panda_virtual_memory_read(cpu, pObjType + OBJ_TYPE_INDEX_OFF,
-                                        (uint8_t *)&objType, sizeof(objType))) {
-        return NULL;
-    }
-
-    // Construct our handle object and return.
-    HandleObject *ho = (HandleObject *) malloc(sizeof(HandleObject));
-    ho->objType = objType;
-    ho->pObj = pObj;
-    return ho;
-}
-
-PTR get_winxp_kdbg(CPUState *cpu)
-{
-    PTR kpcr = get_winxp_kpcr(cpu);
-    PTR kdversion, kddl, kddlp;
-    if (-1 == panda_virtual_memory_rw(cpu, kpcr + KPCR_KDVERSION_OFF,
-                                      (uint8_t *)&kdversion, sizeof(PTR),
-                                      false)) {
-        return 0;
-    }
-    // DebuggerDataList is a pointer to a pointer to the _KDDEBUGGER_DATA64
-    // So we need to dereference it twice.
-    if (-1 == panda_virtual_memory_rw(cpu, kdversion + KDVERSION_DDL_OFF,
-                                      (uint8_t *)&kddlp, sizeof(PTR), false)) {
-        return 0;
-    }
-    if (-1 == panda_virtual_memory_rw(cpu, kddlp, (uint8_t *)&kddl, sizeof(PTR),
-                                      false)) {
-        return 0;
-    }
-
-    kddl = panda_virt_to_phys(cpu, kddl);
-
-    return kddl;
-}
-
-#endif
-
-bool init_plugin(void *self) {
-#ifdef TARGET_I386
-    init_wintrospection_api();
-    return true;
-#else
-    return false;
-#endif
-
-}
-
-void uninit_plugin(void *self) { }
diff --git a/panda/plugins/winxpx86intro/winxpx86intro_int.h b/panda/plugins/winxpx86intro/winxpx86intro_int.h
deleted file mode 100644
index 1ba861e3c26..00000000000
--- a/panda/plugins/winxpx86intro/winxpx86intro_int.h
+++ /dev/null
@@ -1,6 +0,0 @@
-typedef void PTR;
-typedef void CPUState;
-typedef void HandleObject;
-typedef void uint32_t;
-
-#include "winxpx86intro_int_fns.h"
diff --git a/panda/plugins/winxpx86intro/winxpx86intro_int_fns.h b/panda/plugins/winxpx86intro/winxpx86intro_int_fns.h
deleted file mode 100644
index d1b9e439e72..00000000000
--- a/panda/plugins/winxpx86intro/winxpx86intro_int_fns.h
+++ /dev/null
@@ -1,8 +0,0 @@
-#ifndef __WIN7X86INTRO_INT_FNS_H__
-#define __WIN7X86INTRO_INT_FNS_H__
-
-PTR get_winxp_kpcr(CPUState *cpu);
-HandleObject *get_winxp_handle_object(CPUState *cpu, uint32_t eproc, uint32_t handle);
-PTR get_winxp_kdbg(CPUState *cpu);
-
-#endif
diff --git a/panda/python/examples/example_win.py b/panda/python/examples/example_win.py
new file mode 100755
index 00000000000..bd153dab8d1
--- /dev/null
+++ b/panda/python/examples/example_win.py
@@ -0,0 +1,36 @@
+#!/usr/bin/env python3
+'''
+example_win.py
+
+This is an example for taking a recording of windows and then replaying it and 
+using it to do analysis.
+'''
+from pandare import Panda
+
+rec = False
+
+if rec:
+    panda = Panda(qcow="win7pro_x86.qcow2",mem="4G", extra_args=["-vnc", "127.0.0.1:5900", "-monitor","telnet:127.0.0.1:55555,server,nowait"])
+else:
+    panda = Panda(qcow="win7pro_x86.qcow2",mem="4G", extra_args=["-nographic"],os_version="windows-32-7")
+
+first = True
+
+@panda.cb_asid_changed
+def asidchange(cpu, old_asid, new_asid):
+    if old_asid != new_asid:
+        global first
+        if first:
+            print("processes:")
+            for proc in panda.get_processes(cpu):
+                print(f"{panda.ffi.string(proc.name)} {proc.pid} {proc.ppid}")
+            first = False
+        else:
+            print(f"process: {panda.get_process_name(cpu)}")
+    return 0
+
+if rec:
+    panda.run()
+else:
+    panda.run_replay("rec_name")
+
diff --git a/panda/scripts/install_ubuntu.sh b/panda/scripts/install_ubuntu.sh
index 42b42b74c0f..8cad2a52f63 100755
--- a/panda/scripts/install_ubuntu.sh
+++ b/panda/scripts/install_ubuntu.sh
@@ -116,6 +116,22 @@ if [[ !$(ldconfig -p | grep -q libcapstone.so.4) ]]; then
   popd
 fi
 
+# if the windows introspection library is not installed, clone and install
+if [[ !$(dpkg -l | grep -q libosi) ]]; then
+  libosi_name=libosi-$(date +"%Y%m%d")
+  libosi_branch=master
+  libosi_repo=https://github.com/panda-re/libosi
+
+  echo "Installing libosi"
+  pushd .
+  git clone -b $libosi_branch $libosi_repo $libosi_name && cd $_
+  mkdir build && cd $_
+  cmake -GNinja .. && \
+    ninja && ninja package && \
+    $SUDO dpkg -i libosi*.deb
+  popd && rm -rf $libosi_name
+fi
+
 # PyPANDA needs CFFI from pip (the version in apt is too old)
 # Install system-wide since PyPANDA install will also be system-wide
 $SUDO python3 -m pip install pip
diff --git a/panda/src/common.c b/panda/src/common.c
index 560f3b87887..d29be2e2b0d 100644
--- a/panda/src/common.c
+++ b/panda/src/common.c
@@ -163,8 +163,9 @@ void panda_disas(FILE *out, void *code, unsigned long size) {
 // regular expressions used to validate the -os option
 const char * valid_os_re[] = {
     "windows[-_]32[-_]xpsp[23]",
-    "windows[-_]32[-_]7",
     "windows[-_]32[-_]2000",
+    "windows[-_]32[-_]7sp[01]",
+    "windows[-_]64[-_]7sp[01]",
     "linux[-_]32[-_].+",
     "linux[-_]64[-_].+",
     "freebsd[-_]32[-_].+",
@@ -256,6 +257,33 @@ MemoryRegion* panda_find_ram(void) {
     return ram;
 }
 
+/* Return the max address of system memory that maps to RAM. */
+Int128 panda_find_max_ram_address(void) {
+  Int128 curr_max = 0;
+  Int128 mr_check_max;
+
+  MemoryRegion *sys_mem = get_system_memory();
+  MemoryRegion *mr_check;
+  MemoryRegion *mr_iter;
+
+  QTAILQ_FOREACH(mr_iter, &(sys_mem->subregions), subregions_link) {
+    mr_check = mr_iter;
+
+    // if this region is a RAM region OR is aliased to a RAM region, check the max address
+    if ((mr_iter->alias && memory_region_is_ram(mr_iter->alias)) || memory_region_is_ram(mr_check)) {
+      mr_check_max = mr_check->addr + memory_region_size(mr_check);
+    } else {
+      mr_check_max = 0;
+    }
+
+    if (mr_check_max > curr_max) {
+      curr_max = mr_check_max;
+    }
+  }
+
+  return curr_max;
+}
+
 #ifdef TARGET_ARM
 #define CPSR_M (0x1fU)
 #define ARM_CPU_MODE_SVC 0x13

From 703cb9e911624da5ecea6092acf91ffea2538989 Mon Sep 17 00:00:00 2001
From: Luke Craig <lacraig3@gmail.com>
Date: Tue, 11 Jan 2022 22:51:02 -0500
Subject: [PATCH 029/140] fix dockerfile implementation in multi-stage build
 process for libosi (#1165)

---
 Dockerfile | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 074eba55502..b18ed1cdccb 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -31,9 +31,9 @@ RUN [ -e /tmp/${BASE_IMAGE}_build.txt ] && \
 
 # Then install capstone from source
 RUN cd /tmp && \
-    curl -o cap.tgz -L https://github.com/aquynh/capstone/archive/4.0.2.tar.gz && \
-    tar xvf cap.tgz && cd capstone-4.0.2/ && ./make.sh && make install && cd /tmp && \
-    rm -rf /tmp/capstone-4.0.2 && ldconfig
+    git clone https://github.com/capstone-engine/capstone/ -b 4.0.2 && \
+    cd capstone/ && ./make.sh && make install && cd /tmp && \
+    rm -rf /tmp/capstone && ldconfig
 
 ENV PATH="/root/.cargo/bin:${PATH}"
 
@@ -45,7 +45,7 @@ RUN cd /tmp && \
     git clone https://github.com/panda-re/libosi && \
     mkdir /tmp/libosi/build && cd /tmp/libosi/build && \
     cmake -GNinja .. && ninja && ninja package && dpkg -i libosi*.deb && \
-    cd /tmp && rm -rf libosi/
+    cd /tmp && rm -rf libosi/ && ldconfig 
 
 # Build and install panda
 # Copy repo root directory to /panda, note we explicitly copy in .git directory
@@ -82,9 +82,10 @@ RUN cd /panda/panda/python/core && \
 ### Copy files for panda+pypanda from installer  - Stage 5
 FROM base as panda
 
-# Copy panda + libcapstone.so*
+# Copy panda + libcapstone.so* + libosi libraries
 COPY --from=installer /usr/local /usr/local
 COPY --from=installer /usr/lib/libcapstone* /usr/lib/
+COPY --from=installer /lib/libosi.so /lib/libiohal.so /lib/liboffset.so /lib/
 
 # Workaround issue #901 - ensure LD_LIBRARY_PATH contains the panda plugins directories
 #ARG TARGET_LIST="x86_64-softmmu,i386-softmmu,arm-softmmu,ppc-softmmu,mips-softmmu,mipsel-softmmu"

From 416b76cec570b7068dc3b41a699c1ed8c1c48ac9 Mon Sep 17 00:00:00 2001
From: Leander <8344540+Coffeeri@users.noreply.github.com>
Date: Wed, 12 Jan 2022 04:51:52 +0100
Subject: [PATCH 030/140] Fix windows 7 os naming convention in examples
 (#1162)

---
 panda/plugins/syscalls2/README.md     | 2 +-
 panda/plugins/syscalls2/syscalls2.cpp | 2 +-
 panda/python/examples/example_win.py  | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/panda/plugins/syscalls2/README.md b/panda/plugins/syscalls2/README.md
index d1c71340f1b..7f7b4dcc678 100644
--- a/panda/plugins/syscalls2/README.md
+++ b/panda/plugins/syscalls2/README.md
@@ -172,7 +172,7 @@ And then invoke it as:
 
 ```sh
 $PANDA_PATH/x86_64-softmmu/panda-system-x86_64 -replay foo \
-    -os windows-32-7 -panda syscalls2 -panda filereadmon
+    -os windows-32-7sp1 -panda syscalls2 -panda filereadmon
 ```
 
 If you'd like more examples, you can have a look at `loaded`, `filereadmon` and `file_taint`, all of which use `syscalls2`.
diff --git a/panda/plugins/syscalls2/syscalls2.cpp b/panda/plugins/syscalls2/syscalls2.cpp
index 47976598f3e..01ece9b3bfe 100644
--- a/panda/plugins/syscalls2/syscalls2.cpp
+++ b/panda/plugins/syscalls2/syscalls2.cpp
@@ -1026,7 +1026,7 @@ bool init_plugin(void *self) {
 // Don't bother if we're not on a supported target
 #if defined(TARGET_I386) || defined(TARGET_ARM) || defined(TARGET_MIPS)
     if(panda_os_familyno == OS_UNKNOWN){
-        std::cerr << PANDA_MSG "ERROR No OS profile specified. You can choose one with the -os switch, eg: '-os linux-32-debian-3.2.81-486' or '-os  windows-32-7' " << std::endl;
+        std::cerr << PANDA_MSG "ERROR No OS profile specified. You can choose one with the -os switch, eg: '-os linux-32-debian-3.2.81-486' or '-os  windows-32-7sp[01]' " << std::endl;
         return false;
     }
     else if (panda_os_familyno == OS_LINUX) {
diff --git a/panda/python/examples/example_win.py b/panda/python/examples/example_win.py
index bd153dab8d1..e7885f299ad 100755
--- a/panda/python/examples/example_win.py
+++ b/panda/python/examples/example_win.py
@@ -12,7 +12,7 @@
 if rec:
     panda = Panda(qcow="win7pro_x86.qcow2",mem="4G", extra_args=["-vnc", "127.0.0.1:5900", "-monitor","telnet:127.0.0.1:55555,server,nowait"])
 else:
-    panda = Panda(qcow="win7pro_x86.qcow2",mem="4G", extra_args=["-nographic"],os_version="windows-32-7")
+    panda = Panda(qcow="win7pro_x86.qcow2",mem="4G", extra_args=["-nographic"],os_version="windows-32-7sp1")
 
 first = True
 

From 5fb8a5098d0647a13e5e7d39d20ff9f04242572d Mon Sep 17 00:00:00 2001
From: Marius Muench <m.muench@vu.nl>
Date: Wed, 12 Jan 2022 05:56:41 +0100
Subject: [PATCH 031/140] Configurable Machine: Additional Features (#1161)

Co-authored-by: RobertBuhren <robert@robertbuhren.de>
---
 hw/avatar/configurable_machine.c | 40 ++++++++++++++++++++++++++++----
 1 file changed, 36 insertions(+), 4 deletions(-)

diff --git a/hw/avatar/configurable_machine.c b/hw/avatar/configurable_machine.c
index 482f263bbfe..f010b6b7b6f 100644
--- a/hw/avatar/configurable_machine.c
+++ b/hw/avatar/configurable_machine.c
@@ -253,7 +253,7 @@ static void init_memory_area(QDict *mapping, const char *kernel_filename)
     char * data = NULL;
     const char * name;
     MemoryRegion * ram;
-    uint64_t address;
+    uint64_t address, alias_address;
     int is_rom;
     MemoryRegion *sysmem = get_system_memory();
 
@@ -288,12 +288,24 @@ static void init_memory_area(QDict *mapping, const char *kernel_filename)
            PRIx64 ") at address 0x%" PRIx64 "\n", name, size, address);
     memory_region_add_subregion(sysmem, address, ram);
 
+    if(qdict_haskey(mapping, "alias_at")) {
+        QDICT_ASSERT_KEY_TYPE(mapping, "alias_at", QTYPE_QINT);
+        alias_address = qdict_get_int(mapping, "alias_at");
+
+        printf("Configurable: Adding alias to region %s at address 0x%" PRIx64 "\n", name, alias_address);
+        MemoryRegion *alias;
+        alias =  g_new(MemoryRegion, 1);
+        memory_region_init_alias(alias, NULL, name, ram, 0, size);
+        memory_region_add_subregion(sysmem, alias_address, alias);
+    }
+
     if (qdict_haskey(mapping, "file"))
     {
         int file;
         const char * filename;
         int dirname_len = get_dirname_len(kernel_filename);
         ssize_t err;
+        uint64_t file_offset = 0;
 
         g_assert(qobject_type(qdict_get(mapping, "file")) == QTYPE_QSTRING);
         filename = qdict_get_str(mapping, "file");
@@ -316,7 +328,26 @@ static void init_memory_area(QDict *mapping, const char *kernel_filename)
             data_size = get_file_size(filename);
         }
 
-        printf("Configurable: Inserting %"
+        if (qdict_haskey(mapping, "file_offset")) {
+          off_t sbytes;
+          g_assert(qobject_type(qdict_get(mapping, "file_offset")) == QTYPE_QINT);
+          file_offset = qdict_get_int(mapping, "file_offset");
+          sbytes = lseek(file,file_offset,SEEK_SET);
+          g_assert(sbytes > 0);
+          data_size -= sbytes;
+
+        }
+
+        if (qdict_haskey(mapping,"file_bytes")) {
+          ssize_t file_bytes;
+          g_assert(qobject_type(qdict_get(mapping, "file_bytes")) == QTYPE_QINT);
+          file_bytes = qdict_get_int(mapping, "file_bytes");
+          data_size = file_bytes;
+          printf("File bytes: 0x%lx\n",data_size);
+
+        }
+
+        printf("Configurable: Inserting 0x%"
                PRIx64 " bytes of data in memory region %s\n", data_size, name);
         //Size of data to put into a RAM region needs to fit in the RAM region
         g_assert(data_size <= size);
@@ -331,8 +362,9 @@ static void init_memory_area(QDict *mapping, const char *kernel_filename)
 
         //And copy the data to the memory, if it is initialized
         printf("Configurable: Copying 0x%" PRIx64
-               " byte of data from file %s to address 0x%" PRIx64
-               "\n", data_size, filename, address);
+               " byte of data from file %s beginning at offset 0x%" PRIx64
+               " to address 0x%" PRIx64
+               "\n", data_size, filename, file_offset,address);
         cpu_physical_memory_write_rom(&address_space_memory,
                                       address, (uint8_t *) data, data_size);
         g_free(data);

From a229fb03c4cd6b8cbd3b12487a935b8f5e5f4cbd Mon Sep 17 00:00:00 2001
From: Luke Craig <lacraig3@gmail.com>
Date: Wed, 12 Jan 2022 10:08:57 -0500
Subject: [PATCH 032/140] apigen support no args for function (#1159)

---
 panda/scripts/apigen.py | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/panda/scripts/apigen.py b/panda/scripts/apigen.py
index f0eec15f686..afbbfd2fd79 100755
--- a/panda/scripts/apigen.py
+++ b/panda/scripts/apigen.py
@@ -28,9 +28,12 @@ def get_arglists(pf):
             #print "function name = [%s]" % function_name
             fundec = d.children()[0][1]
             args[function_name] = []
-            for arg in fundec.args.params:
-                if not (arg.name is None):
-                    args[function_name].append(arg.name)
+            # if a function does not have args it will not have params
+            # member
+            if hasattr(fundec.args,"params"):
+                for arg in fundec.args.params:
+                    if not (arg.name is None):
+                        args[function_name].append(arg.name)
     return args
 
 

From 3ed009fe1630a76037f7890a38f3642da91220eb Mon Sep 17 00:00:00 2001
From: Luke Craig <lacraig3@gmail.com>
Date: Wed, 12 Jan 2022 11:25:26 -0500
Subject: [PATCH 033/140] new hw_proc_id plugin and fixed up r28 logic (#1156)

Co-authored-by: Andrew Fasano <fasano@mit.edu>
---
 panda/include/panda/common.h                  |  18 +++-
 panda/plugins/config.panda                    |   1 +
 panda/plugins/hw_proc_id/Makefile             |  17 +++
 panda/plugins/hw_proc_id/README.md            |  25 +++++
 panda/plugins/hw_proc_id/hw_proc_id.cpp       | 100 ++++++++++++++++++
 panda/plugins/hw_proc_id/hw_proc_id_int.h     |   4 +
 panda/plugins/hw_proc_id/hw_proc_id_int_fns.h |  15 +++
 panda/plugins/osi_linux/default_profile.cpp   |   6 +-
 panda/plugins/osi_linux/osi_linux.cpp         |  52 +++++----
 panda/plugins/osi_linux/osi_linux.h           |   4 +
 panda/python/core/pandare/arch.py             |  38 ++++++-
 panda/python/core/pandare/panda.py            |   2 +-
 panda/python/core/pandare/qcows.py            |   6 +-
 13 files changed, 250 insertions(+), 38 deletions(-)
 create mode 100644 panda/plugins/hw_proc_id/Makefile
 create mode 100644 panda/plugins/hw_proc_id/README.md
 create mode 100644 panda/plugins/hw_proc_id/hw_proc_id.cpp
 create mode 100644 panda/plugins/hw_proc_id/hw_proc_id_int.h
 create mode 100644 panda/plugins/hw_proc_id/hw_proc_id_int_fns.h

diff --git a/panda/include/panda/common.h b/panda/include/panda/common.h
index e5b14a5a84f..3165fe2ed8b 100644
--- a/panda/include/panda/common.h
+++ b/panda/include/panda/common.h
@@ -343,24 +343,32 @@ static inline bool panda_in_kernel(const CPUState *cpu) {
 }
 
 /**
- * @brief Determines if guest is currently executing kernelspace code, regardless of privilege level.
- * Necessary because there's a small bit of kernelspace code that runs AFTER a switch to usermode privileges.
- * Therefore, certain analysis logic can't rely on panda_in_kernel_mode() alone.
+ * @brief Checks the top bit of the address to determine if the address
+ * is in kernel space.
  * Checking the MSB means this should work even if KASLR is enabled.
  */
-static inline bool panda_in_kernel_code_linux(CPUState *cpu) {
+static inline bool address_in_kernel_code_linux(target_ulong addr){
     // https://www.kernel.org/doc/html/latest/vm/highmem.html
     // https://github.com/torvalds/linux/blob/master/Documentation/x86/x86_64/mm.rst
     // If addr MSB set -> kernelspace!
 
     target_ulong msb_mask = ((target_ulong)1 << ((sizeof(target_long) * 8) - 1));
-    if (msb_mask & cpu->panda_guest_pc) {
+    if (msb_mask & addr) {
         return true;
     } else {
         return false;
     }
 }
 
+/**
+ * @brief Determines if guest is currently executing kernelspace code, regardless of privilege level.
+ * Necessary because there's a small bit of kernelspace code that runs AFTER a switch to usermode privileges.
+ * Therefore, certain analysis logic can't rely on panda_in_kernel_mode() alone.
+ */
+static inline bool panda_in_kernel_code_linux(CPUState *cpu) {
+    return address_in_kernel_code_linux(cpu->panda_guest_pc);
+}
+
 /**
  * @brief Returns the guest kernel stack pointer.
  */
diff --git a/panda/plugins/config.panda b/panda/plugins/config.panda
index d3ec7d5d669..60b8166f4af 100644
--- a/panda/plugins/config.panda
+++ b/panda/plugins/config.panda
@@ -15,6 +15,7 @@ forcedexec
 gdb
 hooks
 hooks2
+hw_proc_id
 libfi
 lighthouse_coverage
 loaded
diff --git a/panda/plugins/hw_proc_id/Makefile b/panda/plugins/hw_proc_id/Makefile
new file mode 100644
index 00000000000..897a6cccb53
--- /dev/null
+++ b/panda/plugins/hw_proc_id/Makefile
@@ -0,0 +1,17 @@
+# Don't forget to add your plugin to config.panda!
+
+# If you need custom CFLAGS or LIBS, set them up here
+# CFLAGS+=
+# LIBS+=
+
+# Example: this plugin has runtime symbol dependencies on plugin_x:
+# LIBS+=-L$(PLUGIN_TARGET_DIR) -l:panda_plugin_x.so
+# Also create a plugin_plugin.d file in this directory to ensure plugin_x
+# gets compiled before this plugin, example contents:
+# plugin-this_plugins_name : plugin-plugin_x
+# or if you're using the extra plugins dir:
+# extra-plugin-this_plugins_name : extra-plugin-plugin_x
+
+# The main rule for your plugin. List all object-file dependencies.
+$(PLUGIN_TARGET_DIR)/panda_$(PLUGIN_NAME).so: \
+	$(PLUGIN_OBJ_DIR)/$(PLUGIN_NAME).o
diff --git a/panda/plugins/hw_proc_id/README.md b/panda/plugins/hw_proc_id/README.md
new file mode 100644
index 00000000000..0567711d7c4
--- /dev/null
+++ b/panda/plugins/hw_proc_id/README.md
@@ -0,0 +1,25 @@
+Plugin: `HW_PROC_ID`
+===========
+
+Summary
+-------
+This plugin aims to provide an architecture-agnostic way to uniquely identify processes through a single API.
+
+For non-MIPS architectures, this plugin is equivalent to using the `panda_current_asid()` function. However, on MIPS guests, the ASID changes frequently for the same process so a different implementation is needed. For these guests, we return the address of the `current` `task_struct` object which will be different for different processes. But, (like with ASIDs) after a process is terminated, another process could end up with it's `task_struct` object in the same location.
+
+
+Arguments
+---------
+None
+
+Dependencies
+------------
+None
+
+APIs and Callbacks
+------------------
+
+`int procid(CPUState*)`: Returns an integer that represents the current process running on the CPU.
+
+Example
+-------
diff --git a/panda/plugins/hw_proc_id/hw_proc_id.cpp b/panda/plugins/hw_proc_id/hw_proc_id.cpp
new file mode 100644
index 00000000000..1e01249df38
--- /dev/null
+++ b/panda/plugins/hw_proc_id/hw_proc_id.cpp
@@ -0,0 +1,100 @@
+/* PANDABEGINCOMMENT
+ * 
+ * Authors:
+ *  Andrew Fasano          fasano@mit.edu
+ *  Luke Craig             luke.craig@ll.mit.edu
+ * 
+ * This work is licensed under the terms of the GNU GPL, version 2. 
+ * See the COPYING file in the top-level directory. 
+ * 
+PANDAENDCOMMENT */
+
+// Simple plugin to provide an architecture-agnostic, generic capability
+// for uniquely identifying a process withotu OSI.
+//
+// For non-mips architectures, we simply return the ASID. For MIPS
+// we cache the address of the current processes' task_struct and return
+// that.
+
+#include "panda/plugin.h"
+
+// These need to be extern "C" so that the ABI is compatible with
+// QEMU/PANDA, which is written in C
+extern "C" {
+bool init_plugin(void *);
+void uninit_plugin(void *);
+#include "hw_proc_id_int_fns.h"
+}
+
+
+#ifdef TARGET_MIPS
+target_ulong last_r28 = 0;
+bool initialized = false;
+
+/**
+ * @brief Cache the last R28 observed while in kernel for MIPS
+ * 
+ * On MIPS in kernel mode r28 a pointer to the location of the current
+ * task_struct. We need to cache this value for use in usermode. 
+ */
+inline void check_cache_r28(CPUState *cpu){
+  if (panda_in_kernel(cpu) && unlikely(((CPUMIPSState*)cpu->env_ptr)->active_tc.gpr[28] != last_r28)) {
+      target_ulong potential = ((CPUMIPSState*)cpu->env_ptr)->active_tc.gpr[28];
+      // XXX: af: While in kernel mode, r28 may be used to contain non-pointer 
+      // values
+      // make sure we don't cache one of those so we check if r28 contains 
+      // a pointer to kernel memory
+        if (likely(address_in_kernel_code_linux(potential))) {
+            last_r28 = potential;
+            initialized = true;
+        }
+  }
+}
+
+void r28_cache(CPUState *cpu, TranslationBlock *tb) {
+  check_cache_r28(cpu);
+}
+#endif
+
+/**
+ * @brief Returns true if all prerequisite values to determine hwid cached.
+ * 
+ * Realistically this is only relevant for MIPS.
+ */
+bool id_is_initialized(void){
+  #ifdef TARGET_MIPS
+  return initialized;
+  #else
+  return true;
+  #endif
+}
+
+/**
+ * @brief Returns a hardware-based process ID for the current process.
+ * 
+ * This is a wrapper around ASID that takes into the oddity that is MIPS.
+ * 
+ * @param cpu 
+ * @return target_ulong
+ */
+target_ulong get_id(CPUState * cpu) {
+#ifdef TARGET_MIPS
+  if (!id_is_initialized()) {
+    // try to initialize before returning
+    check_cache_r28(cpu);
+  }
+  return last_r28;
+#else
+  return panda_current_asid(cpu);
+#endif
+}
+
+bool init_plugin(void *self) {
+#if defined(TARGET_MIPS)
+    panda_cb pcb = { .start_block_exec = r28_cache };
+    panda_register_callback(self, PANDA_CB_START_BLOCK_EXEC, pcb);
+#endif
+    return true;
+}
+
+void uninit_plugin(void *self) { }
diff --git a/panda/plugins/hw_proc_id/hw_proc_id_int.h b/panda/plugins/hw_proc_id/hw_proc_id_int.h
new file mode 100644
index 00000000000..cc2e5087bab
--- /dev/null
+++ b/panda/plugins/hw_proc_id/hw_proc_id_int.h
@@ -0,0 +1,4 @@
+// Need this for PPP calls to get_id()
+typedef void CPUState;
+typedef void target_ulong;
+#include "hw_proc_id_int_fns.h"
diff --git a/panda/plugins/hw_proc_id/hw_proc_id_int_fns.h b/panda/plugins/hw_proc_id/hw_proc_id_int_fns.h
new file mode 100644
index 00000000000..a7194e72570
--- /dev/null
+++ b/panda/plugins/hw_proc_id/hw_proc_id_int_fns.h
@@ -0,0 +1,15 @@
+#pragma once
+
+#include <stdbool.h>
+
+// BEGIN_PYPANDA_NEEDS_THIS -- do not delete this comment bc pypanda
+// api autogen needs it.  And don't put any compiler directives
+// between this and END_PYPANDA_NEEDS_THIS except includes of other
+// files in this directory that contain subsections like this one.
+
+target_ulong get_id(CPUState *cpu);
+
+bool id_is_initialized(void);
+
+// END_PYPANDA_NEEDS_THIS -- do not delete this comment!
+/* vim:set tabstop=4 softtabstop=4 expandtab: */
diff --git a/panda/plugins/osi_linux/default_profile.cpp b/panda/plugins/osi_linux/default_profile.cpp
index ce204d6e082..48b082dc603 100644
--- a/panda/plugins/osi_linux/default_profile.cpp
+++ b/panda/plugins/osi_linux/default_profile.cpp
@@ -1,10 +1,6 @@
 #include "osi_linux.h"
 #include "default_profile.h"
 
-#ifdef TARGET_MIPS
-extern target_ulong last_r28;
-#endif
-
 
 /**
  * @brief Retrieves the task_struct address using per cpu information.
@@ -53,7 +49,7 @@ target_ptr_t default_get_current_task_struct(CPUState *cpu)
     // __current_thread_info is stored in KERNEL r28
     // userspace clobbers it but kernel restores (somewhow?)
     // First field of struct is task - no offset needed
-    current_task_addr=last_r28;
+    current_task_addr = get_id(cpu); // HWID returned by hw_proc_id is the cached r28 value
 
 #else // x86/64
     current_task_addr = ki.task.current_task_addr;
diff --git a/panda/plugins/osi_linux/osi_linux.cpp b/panda/plugins/osi_linux/osi_linux.cpp
index 3c8c27d2804..7ba2a3b2f22 100644
--- a/panda/plugins/osi_linux/osi_linux.cpp
+++ b/panda/plugins/osi_linux/osi_linux.cpp
@@ -31,6 +31,10 @@
 
 #define KERNEL_CONF "/" TARGET_NAME "-softmmu/panda/plugins/osi_linux/kernelinfo.conf"
 
+#ifdef TARGET_MIPS
+#include "hw_proc_id/hw_proc_id_ext.h"
+#endif
+
 /*
  * Functions interfacing with QEMU/PANDA should be linked as C.
  * C++ function name mangling breaks linkage.
@@ -266,6 +270,19 @@ inline bool can_read_current(CPUState *cpu) {
     return 0x0 != ts;
 }
 
+#ifdef TARGET_MIPS
+// on MIPS, we need to get the value of r28 from the kernel before
+// we can read the current task struct. If osi_guest_is_ready is called
+// before r28 is set we won't check until the first syscall. This
+// significantly increases the number of instructions we need to
+// wait before we can read the current task struct. Instead, we
+// wait until r28 is set and then proceed on MIPS. The intended use case
+// (on boot) should work fine because r28 will be set immediately and then
+// won't check again until the first syscall.
+bool r28_set = false;
+inline void check_cache_r28(CPUState *cpu);
+#endif
+
 /**
  * @brief Check if we've successfully initialized OSI for the guest.
  * Returns true if introspection is available.
@@ -285,6 +302,16 @@ bool osi_guest_is_ready(CPUState *cpu, void** ret) {
     // If it's the very first time, try reading current, if we can't
     // wait until first sycall and try again
     if (first_osi_check) {
+        #ifdef TARGET_MIPS
+        if (!get_id(cpu)){
+            // If we're on MIPS, we need to wait until r28 is set before
+            // moving to a syscall strategy
+            if (!id_is_initialized()){
+                ret = NULL;
+                return false;
+            }
+        }
+        #endif
         first_osi_check = false;
 
         init_per_cpu_offsets(cpu); // Formerly in _machine_init callback, but now it will work with loading OSI after init and snapshots
@@ -688,27 +715,6 @@ void restore_after_snapshot(CPUState* cpu) {
     PPP_REG_CB("syscalls2", on_all_sys_enter, on_first_syscall);
 }
 
-
-/**
- * @brief Cache the last R28 observed while in kernel for MIPS
- */
-
-#ifdef TARGET_MIPS
-target_ulong last_r28 = 0;
-
-void r28_cache(CPUState *cpu, TranslationBlock *tb) {
-
-  if (unlikely(((CPUMIPSState*)cpu->env_ptr)->active_tc.gpr[28] != last_r28) && panda_in_kernel(cpu)) {
-
-      target_ulong potential = ((CPUMIPSState*)cpu->env_ptr)->active_tc.gpr[28];
-      // XXX: af: We need this filter but I have no idea why
-      if (potential > 0x80000000) {
-        last_r28 = potential;
-      }
-  }
-}
-#endif
-
 #if defined(TARGET_I386) || defined(TARGET_ARM) || (defined(TARGET_MIPS) && !defined(TARGET_MIPS64))
 
 // Keep track of which tasks have entered execve. Note that we simply track
@@ -782,8 +788,8 @@ bool init_plugin(void *self) {
     }
 
 #if defined(TARGET_MIPS)
-        panda_cb pcb2 = { .before_block_exec = r28_cache };
-        panda_register_callback(self, PANDA_CB_BEFORE_BLOCK_EXEC, pcb2);
+        panda_require("hw_proc_id");
+        assert(init_hw_proc_id_api());
 #endif
 
 #if defined(OSI_LINUX_TEST)
diff --git a/panda/plugins/osi_linux/osi_linux.h b/panda/plugins/osi_linux/osi_linux.h
index 9eabec151ec..4af763b3182 100644
--- a/panda/plugins/osi_linux/osi_linux.h
+++ b/panda/plugins/osi_linux/osi_linux.h
@@ -28,6 +28,10 @@
 #include "kernel_profile.h"
 #include "endian_helpers.h"
 
+#ifdef TARGET_MIPS
+#include "hw_proc_id/hw_proc_id_ext.h"
+#endif
+
 extern struct kernelinfo ki;
 extern struct KernelProfile const *kernel_profile;
 
diff --git a/panda/python/core/pandare/arch.py b/panda/python/core/pandare/arch.py
index ad3563fa063..bb695b9857a 100644
--- a/panda/python/core/pandare/arch.py
+++ b/panda/python/core/pandare/arch.py
@@ -7,6 +7,7 @@
 
 '''
 import binascii
+import struct
 from .utils import telescope
 
 class PandaArch():
@@ -137,8 +138,12 @@ def set_arg(self, cpu, idx, val, convention='default'):
 
         Note for syscalls we define arg[0] as syscall number and then 1-index the actual args
         '''
-        reg = self._get_arg_loc(idx, convention)
-        return self.set_reg(cpu, reg, val)
+        argloc = self._get_arg_loc(idx, convention)
+
+        if self._is_stack_loc(argloc):
+            return self._write_stack(cpu, argloc, val)
+        else:
+            return self.set_reg(cpu, argloc, val)
 
     def get_arg(self, cpu, idx, convention='default'):
         '''
@@ -170,6 +175,33 @@ def _is_stack_loc(argloc):
         '''
         return argloc.startswith("stack_")
 
+    def _write_stack(self, cpu, argloc, val):
+        '''
+        Given a name like stack_X, calculate where
+        the X-th value on the stack is, then write val
+        to that location
+
+        May raise a ValueError if the memory write fails
+        '''
+
+        if isinstance(val, int):
+            # Encode as word-size with endianness
+            bits, endianness, reg_sz = self._determine_bits()
+            val = val.to_bytes(reg_sz, byteorder=endianness)
+
+        if not isinstance(val, bytes):
+            raise ValueError("_write_stack needs an int or bytes")
+
+
+        # Stack based - get stack base, calculate offset, then try to read it
+        assert(self._is_stack_loc(argloc)), f"Can't get stack offset of {argloc}"
+
+        stack_idx = int(argloc.split("stack_")[1])
+        stack_base = self.get_reg(cpu, self.reg_sp)
+        offset = reg_sz * (stack_idx+1)
+        if self.panda.virtual_memory_write(cpu, stack_base + offset, val):
+            raise ValueError
+
     def _read_stack(self, cpu, argloc):
         '''
         Given a name like stack_X, calculate where
@@ -425,7 +457,7 @@ def __init__(self, panda):
         self.reg_retaddr = regnames.index("ra")
         # Default syscall/args are for mips o32
         self.call_conventions = {"mips":          ["A0", "A1", "A2", "A3"],
-                                 "syscall": ["V0", "A0", "A1", "A2", "A3", "stack_1", "stack_2", "stack_3", "stack_4"]}
+                "syscall": ["V0", "A0", "A1", "A2", "A3", "stack_3", "stack_4", "stack_5", "stack_6"]} # XXX: Note it's not 0-indexed for stack args, I guess the syscall pushes stuff too
         self.call_conventions['default'] = self.call_conventions['mips']
 
         self.reg_retval =  {"default":    "V0",
diff --git a/panda/python/core/pandare/panda.py b/panda/python/core/pandare/panda.py
index 7f9a7a6eb37..760124553c4 100755
--- a/panda/python/core/pandare/panda.py
+++ b/panda/python/core/pandare/panda.py
@@ -2437,7 +2437,7 @@ def copy_to_guest(self, copy_directory, iso_name=None, absolute_paths=False, set
 
         if isfile(pjoin(copy_directory, setup_script)):
             setup_result = self.run_serial_cmd(f"{mount_dir}/{setup_script}", timeout=timeout)
-            progress("[Setup command]: {setup_result}")
+            progress(f"[Setup command]: {setup_result}")
 
     @blocking
     def record_cmd(self, guest_command, copy_directory=None, iso_name=None, setup_command=None, recording_name="recording", snap_name="root", ignore_errors=False):
diff --git a/panda/python/core/pandare/qcows.py b/panda/python/core/pandare/qcows.py
index 62d9f6b3c55..29598c4a3db 100644
--- a/panda/python/core/pandare/qcows.py
+++ b/panda/python/core/pandare/qcows.py
@@ -343,7 +343,11 @@ def cli(target):
 
         panda_args.extend(['-loadvm', q.snapshot])
 
-        return " ".join(panda_args)
+        ret = " ".join(panda_args)
+
+        if "-display none" in ret:
+            ret = ret.replace("-display none", "-nographic")
+        return ret
 
 if __name__ == "__main__":
     from sys import argv, stdout

From a11d77510d3ffda72bf747fbb2c63bcefd7a010d Mon Sep 17 00:00:00 2001
From: Luke Craig <lacraig3@gmail.com>
Date: Wed, 12 Jan 2022 21:45:14 -0500
Subject: [PATCH 034/140] Add shared library path API (#1157)

---
 panda/include/panda/plugin.h             |  2 +
 panda/plugins/syscalls2/syscalls2_info.c |  9 ++++-
 panda/src/callbacks.c                    | 47 +++++++++++++++++-------
 3 files changed, 43 insertions(+), 15 deletions(-)

diff --git a/panda/include/panda/plugin.h b/panda/include/panda/plugin.h
index 83b186805ea..0940f99b319 100644
--- a/panda/include/panda/plugin.h
+++ b/panda/include/panda/plugin.h
@@ -154,7 +154,9 @@ char** str_split(char *a_str, const char a_delim);
 extern gchar *panda_argv[MAX_PANDA_PLUGIN_ARGS];
 extern int panda_argc;
 
+char* resolve_file_from_plugin_directory(const char* file_name_fmt, const char* name);
 char *panda_plugin_path(const char *name);
+char* panda_shared_library_path(const char* name);
 void panda_require_from_library(const char *plugin_name, char **plugin_args, uint32_t num_args);
 void panda_require(const char *plugin_name);
 bool panda_is_callback_enabled(void *plugin, panda_cb_type type, panda_cb cb);
diff --git a/panda/plugins/syscalls2/syscalls2_info.c b/panda/plugins/syscalls2/syscalls2_info.c
index ff18c185a65..c50d6cf1120 100644
--- a/panda/plugins/syscalls2/syscalls2_info.c
+++ b/panda/plugins/syscalls2/syscalls2_info.c
@@ -42,7 +42,14 @@ int load_syscall_info(void) {
     }
 
     dlerror();  // clear errors
-    void *syscall_info_dl = dlopen(syscall_info_dlname, RTLD_NOW|RTLD_NODELETE);
+
+    char* sys_info_dlname_path = panda_shared_library_path(syscall_info_dlname);
+    if (sys_info_dlname_path == NULL) {
+        fprintf(stderr, "Could not find %s\n", syscall_info_dlname);
+        return -1;
+    }
+
+    void *syscall_info_dl = dlopen(sys_info_dlname_path, RTLD_NOW|RTLD_NODELETE);
     if (syscall_info_dl == NULL) {
         LOG_ERROR("%s", dlerror());
         g_free(syscall_info_dlname);
diff --git a/panda/src/callbacks.c b/panda/src/callbacks.c
index e7198a10d6f..e497e977bab 100644
--- a/panda/src/callbacks.c
+++ b/panda/src/callbacks.c
@@ -250,23 +250,26 @@ bool _panda_load_plugin(const char *filename, const char *plugin_name, bool libr
 
 extern const char *qemu_file;
 
-// Resolve a plugin to a path. If the plugin doesn't exist in any of the search
-// paths, then NULL is returned. The search order for plugins is as follows:
+// Resolve a file in the plugin directory to a path. If the file doesn't
+// exist in any of the search paths, then NULL is returned. The search order 
+// for files is as follows:
 //
 //   - Relative to the PANDA_DIR environment variable.
 //   - Relative to the QEMU binary
 //   - Relative to the install prefix directory.
-char *panda_plugin_path(const char *plugin_name) {
-char *plugin_path;
+char* resolve_file_from_plugin_directory(const char* file_name_fmt, const char* name){
+    char *plugin_path, *name_formatted;
+    // makes "taint2" -> "panda_taint2"
+    name_formatted = g_strdup_printf(file_name_fmt, name);
     // First try relative to PANDA_PLUGIN_DIR
 #ifdef PLUGIN_DIR
     if (g_getenv("PANDA_DIR") != NULL) {
-      plugin_path = g_strdup_printf(
-          "%s/%s/panda_%s" HOST_DSOSUF, g_getenv("PANDA_DIR"), PLUGIN_DIR, plugin_name);
-      if (TRUE == g_file_test(plugin_path, G_FILE_TEST_EXISTS)) {
-          return plugin_path;
-      }
-      g_free(plugin_path);
+        plugin_path = g_strdup_printf(
+            "%s/%s/%s" , g_getenv("PANDA_DIR"), PLUGIN_DIR, name_formatted);
+        if (TRUE == g_file_test(plugin_path, G_FILE_TEST_EXISTS)) {
+            return plugin_path;
+        }
+        g_free(plugin_path);
     }
 #endif
 
@@ -276,8 +279,8 @@ char *plugin_path;
 
     // Second, try relative to PANDA binary as it would be in the build or install directory
     char *dir = g_path_get_dirname(qemu_file);
-    plugin_path = g_strdup_printf("%s/panda/plugins/panda_%s" HOST_DSOSUF, dir,
-                                  plugin_name);
+    plugin_path = g_strdup_printf("%s/panda/plugins/%s", dir,
+                                  name_formatted);
 
     g_free(dir);
     if (TRUE == g_file_test(plugin_path, G_FILE_TEST_EXISTS)) {
@@ -287,8 +290,8 @@ char *plugin_path;
 
     // Finally, try relative to the installation path.
     plugin_path =
-        g_strdup_printf("%s/%s/panda_%s" HOST_DSOSUF, CONFIG_PANDA_PLUGINDIR,
-                        TARGET_NAME, plugin_name);
+        g_strdup_printf("%s/%s/%s", CONFIG_PANDA_PLUGINDIR,
+                        TARGET_NAME, name_formatted);
     if (TRUE == g_file_test(plugin_path, G_FILE_TEST_EXISTS)) {
         return plugin_path;
     }
@@ -298,6 +301,22 @@ char *plugin_path;
     return NULL;
 }
 
+// Resolve a shared library in the plugins directory to a path. If the shared
+// object doesn't exist in any of paths, then NULL is returned. The search
+// order is the same as panda_plugin_path.
+// example: "libso.so" might resolve to to
+// /path/to/build/x86_64-softmmu/panda/plugins/libso.so
+char* panda_shared_library_path(const char* name){
+    return resolve_file_from_plugin_directory("%s", name);
+}
+
+// Resolve a plugin in the plugins directory to a path.
+// example: "taint2" might resolve to
+// /path/to/build/x86_64-softmmu/panda/plugins/panda_taint2.so
+char *panda_plugin_path(const char *plugin_name) {
+    return resolve_file_from_plugin_directory("panda_%s" HOST_DSOSUF, plugin_name);
+}
+
 void panda_require_from_library(const char *plugin_name, char **plugin_args, uint32_t num_args) {
     // If we're printing help, panda_require will be a no-op.
     if (panda_help_wanted) return;

From 5a805f8cf253a8a098f98bf341e4babac7bce884 Mon Sep 17 00:00:00 2001
From: Andrew Fasano <fasano@mit.edu>
Date: Sat, 15 Jan 2022 18:46:19 -0500
Subject: [PATCH 035/140] Bugfix in recreate_root_snapshot

The PyPANDA option name is `serial_kwargs` not `expect_kwargs`
---
 panda/scripts/recreate_root_snapshot.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/panda/scripts/recreate_root_snapshot.py b/panda/scripts/recreate_root_snapshot.py
index 0b752da13c8..e83a7d61daa 100644
--- a/panda/scripts/recreate_root_snapshot.py
+++ b/panda/scripts/recreate_root_snapshot.py
@@ -6,7 +6,7 @@
 arch="x86_64"
 
 qi = qcows.Qcows.get_qcow_info(arch)
-panda = Panda(arch=qi.arch, mem="1G", expect_prompt=qi.prompt, os=qi.os, qcow=sys.argv[1], extra_args="-nographic", expect_kwargs={"unansi": False})
+panda = Panda(arch=qi.arch, mem="1G", expect_prompt=qi.prompt, os=qi.os, qcow=sys.argv[1], extra_args="-nographic", serial_kwargs={"unansi": False})
 
 
 @panda.queue_blocking

From 4cb5e66c2f02b091adc3aeb0da8f162a5df9f1dc Mon Sep 17 00:00:00 2001
From: Mark Mankins <31133733+MarkMankins@users.noreply.github.com>
Date: Tue, 1 Feb 2022 15:51:16 -0500
Subject: [PATCH 036/140] Update function prototypes in extern "C" block to
 match function definitions. (#1169)

---
 panda/plugins/wintrospection/wintrospection.cpp | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/panda/plugins/wintrospection/wintrospection.cpp b/panda/plugins/wintrospection/wintrospection.cpp
index 2a575750828..c23e984afdc 100644
--- a/panda/plugins/wintrospection/wintrospection.cpp
+++ b/panda/plugins/wintrospection/wintrospection.cpp
@@ -51,9 +51,9 @@ extern "C" {
 bool init_plugin(void *);
 void uninit_plugin(void *);
 
-int64_t get_file_handle_pos(uint64_t handle);
-char *get_cwd(void);
-char *get_handle_name(uint64_t handle);
+int64_t get_file_handle_pos(CPUState *cpu, uint64_t handle);
+char *get_cwd(CPUState *cpu);
+char *get_handle_name(CPUState *cpu, uint64_t handle);
 }
 
 void on_get_current_thread(CPUState *cpu, OsiThread *out);

From 24681b0dfa80f780d1de4be9bd8b47a286331f55 Mon Sep 17 00:00:00 2001
From: luglo <luglo@mailbox.org>
Date: Thu, 3 Feb 2022 14:21:31 +0100
Subject: [PATCH 037/140] Fix byte-to-interrupt number conversions in
 armv7m_nvic This is a backport of qemu upstream patch
 qemu/qemu@12fbf1a1639ed916fda948718dac0d30b82b954e

---
 hw/intc/armv7m_nvic.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index 32ffa0bf353..400b0c15c14 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -659,7 +659,7 @@ static uint64_t nvic_sysreg_read(void *opaque, hwaddr addr,
         /* fall through */
     case 0x180 ... 0x1bf: /* NVIC Clear enable */
         val = 0;
-        startvec = offset - 0x180 + NVIC_FIRST_IRQ; /* vector # */
+        startvec = 8 * (offset - 0x180) + NVIC_FIRST_IRQ; /* vector # */
 
         for (i = 0, end = size * 8; i < end && startvec + i < s->num_irq; i++) {
             if (s->vectors[startvec + i].enabled) {
@@ -672,7 +672,7 @@ static uint64_t nvic_sysreg_read(void *opaque, hwaddr addr,
         /* fall through */
     case 0x280 ... 0x2bf: /* NVIC Clear pend */
         val = 0;
-        startvec = offset - 0x280 + NVIC_FIRST_IRQ; /* vector # */
+        startvec = 8 * (offset - 0x280) + NVIC_FIRST_IRQ; /* vector # */
         for (i = 0, end = size * 8; i < end && startvec + i < s->num_irq; i++) {
             if (s->vectors[startvec + i].pending) {
                 val |= (1 << i);
@@ -681,7 +681,7 @@ static uint64_t nvic_sysreg_read(void *opaque, hwaddr addr,
         break;
     case 0x300 ... 0x33f: /* NVIC Active */
         val = 0;
-        startvec = offset - 0x300 + NVIC_FIRST_IRQ; /* vector # */
+        startvec = 8 * (offset - 0x300) + NVIC_FIRST_IRQ; /* vector # */
 
         for (i = 0, end = size * 8; i < end && startvec + i < s->num_irq; i++) {
             if (s->vectors[startvec + i].active) {
@@ -770,7 +770,7 @@ static void nvic_sysreg_write(void *opaque, hwaddr addr,
     case 0x300 ... 0x33f: /* NVIC Active */
         return; /* R/O */
     case 0x400 ... 0x5ef: /* NVIC Priority */
-        startvec = 8 * (offset - 0x400) + NVIC_FIRST_IRQ; /* vector # */
+        startvec = (offset - 0x400) + NVIC_FIRST_IRQ; /* vector # */
 
         for (i = 0; i < size && startvec + i < s->num_irq; i++) {
             set_prio(s, startvec + i, (value >> (i * 8)) & 0xff);

From 2d4d22be8ff176261fed0b73bdbd3ff601abb5f2 Mon Sep 17 00:00:00 2001
From: Andrew Fasano <fasano@mit.edu>
Date: Mon, 27 Dec 2021 22:31:58 -0500
Subject: [PATCH 038/140] backport vhost support: filter memory sections

Backports the following commit from upstream:

commit 988a27754bbbc45698f7acb54352e5a1ae699514
Author: Tiwei Bie <tiwei.bie@intel.com>
Date:   Thu May 24 18:33:31 2018 +0800

    vhost: allow backends to filter memory sections

    This patch introduces a vhost op for vhost backends to allow
    them to filter the memory sections that they can handle.

    Signed-off-by: Tiwei Bie <tiwei.bie@intel.com>
    Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
    Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/virtio/vhost-user.c            | 18 ++++++++++++++++++
 hw/virtio/vhost.c                 | 24 ++++++++++++++++++++----
 include/hw/virtio/vhost-backend.h |  5 +++++
 3 files changed, 43 insertions(+), 4 deletions(-)

diff --git a/hw/virtio/vhost-user.c b/hw/virtio/vhost-user.c
index 32a95a8c698..8a2b8e3e3f6 100644
--- a/hw/virtio/vhost-user.c
+++ b/hw/virtio/vhost-user.c
@@ -723,6 +723,22 @@ static int vhost_user_net_set_mtu(struct vhost_dev *dev, uint16_t mtu)
     return 0;
 }
 
+static bool vhost_user_mem_section_filter(struct vhost_dev *dev,
+                                          MemoryRegionSection *section)
+{
+    bool result;
+
+    result = memory_region_get_fd(section->mr) >= 0;
+
+    return result;
+}
+
+
+static void vhost_user_set_iotlb_callback(struct vhost_dev *dev, int enabled)
+{
+    /* No-op as the receive channel is not dedicated to IOTLB messages. */
+}
+
 const VhostOps user_ops = {
         .backend_type = VHOST_BACKEND_TYPE_USER,
         .vhost_backend_init = vhost_user_init,
@@ -747,4 +763,6 @@ const VhostOps user_ops = {
         .vhost_migration_done = vhost_user_migration_done,
         .vhost_backend_can_merge = vhost_user_can_merge,
         .vhost_net_set_mtu = vhost_user_net_set_mtu,
+        .vhost_set_iotlb_callback = vhost_user_set_iotlb_callback,
+        .vhost_backend_mem_section_filter = vhost_user_mem_section_filter,
 };
diff --git a/hw/virtio/vhost.c b/hw/virtio/vhost.c
index 613494dcc24..e7cc5729349 100644
--- a/hw/virtio/vhost.c
+++ b/hw/virtio/vhost.c
@@ -608,12 +608,28 @@ static void vhost_set_memory(MemoryListener *listener,
     used_memslots = dev->mem->nregions;
 }
 
-static bool vhost_section(MemoryRegionSection *section)
+static bool vhost_section(struct vhost_dev *dev, MemoryRegionSection *section)
 {
-    return memory_region_is_ram(section->mr) &&
+    bool result;
+    bool log_dirty = memory_region_get_dirty_log_mask(section->mr) &
+                     ~(1 << DIRTY_MEMORY_MIGRATION);
+    result = memory_region_is_ram(section->mr) &&
         !memory_region_is_rom(section->mr);
+    /* Vhost doesn't handle any block which is doing dirty-tracking other
+     * than migration; this typically fires on VGA areas.
+     */
+    result &= !log_dirty;
+
+    if (result && dev->vhost_ops->vhost_backend_mem_section_filter) {
+        result &=
+            dev->vhost_ops->vhost_backend_mem_section_filter(dev, section);
+    }
+
+    //trace_vhost_section(section->mr->name, result);
+    return result;
 }
 
+
 static void vhost_begin(MemoryListener *listener)
 {
     struct vhost_dev *dev = container_of(listener, struct vhost_dev,
@@ -682,7 +698,7 @@ static void vhost_region_add(MemoryListener *listener,
     struct vhost_dev *dev = container_of(listener, struct vhost_dev,
                                          memory_listener);
 
-    if (!vhost_section(section)) {
+    if (!vhost_section(dev, section)) {
         return;
     }
 
@@ -701,7 +717,7 @@ static void vhost_region_del(MemoryListener *listener,
                                          memory_listener);
     int i;
 
-    if (!vhost_section(section)) {
+    if (!vhost_section(dev, section)) {
         return;
     }
 
diff --git a/include/hw/virtio/vhost-backend.h b/include/hw/virtio/vhost-backend.h
index c3cf4a72bc3..266dd458522 100644
--- a/include/hw/virtio/vhost-backend.h
+++ b/include/hw/virtio/vhost-backend.h
@@ -88,6 +88,10 @@ typedef int (*vhost_update_device_iotlb_op)(struct vhost_dev *dev,
 typedef int (*vhost_invalidate_device_iotlb_op)(struct vhost_dev *dev,
                                                 uint64_t iova, uint64_t len);
 
+typedef bool (*vhost_backend_mem_section_filter_op)(struct vhost_dev *dev,
+                                                MemoryRegionSection *section);
+
+
 typedef struct VhostOps {
     VhostBackendType backend_type;
     vhost_backend_init vhost_backend_init;
@@ -122,6 +126,7 @@ typedef struct VhostOps {
     vhost_set_iotlb_callback_op vhost_set_iotlb_callback;
     vhost_update_device_iotlb_op vhost_update_device_iotlb;
     vhost_invalidate_device_iotlb_op vhost_invalidate_device_iotlb;
+    vhost_backend_mem_section_filter_op vhost_backend_mem_section_filter;
 } VhostOps;
 
 extern const VhostOps user_ops;

From 6a13ddca8191570df526580e4419542348ed335d Mon Sep 17 00:00:00 2001
From: Andrew Fasano <fasano@mit.edu>
Date: Mon, 27 Dec 2021 22:34:01 -0500
Subject: [PATCH 039/140] backport vhost support: support running without kvm
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Prior to this upstream commit, vhost would only work correctly when
running under kvm.

commit 083b9bd7a1c526d57ec17b23dd6eca414e808886
Author: Alex Bennée <alex.bennee@linaro.org>
Date:   Fri Jun 5 16:49:25 2020 +0100

    hw/virtio/vhost: re-factor vhost-section and allow DIRTY_MEMORY_CODE

    The purpose of vhost_section is to identify RAM regions that need to
    be made available to a vhost client. However when running under TCG
    all RAM sections have DIRTY_MEMORY_CODE set which leads to problems
    down the line.

    Re-factor the code so:

      - steps are clearer to follow
      - reason for rejection is recorded in the trace point
      - we allow DIRTY_MEMORY_CODE

    We expand the comment to explain that kernel based vhost has specific
    support for migration tracking.

    Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
    Tested-by: Fabiano Rosas <farosas@linux.ibm.com>
    Cc: Michael S. Tsirkin <mst@redhat.com>
    Cc: Dr. David Alan Gilbert <dgilbert@redhat.com>
    Cc: Stefan Hajnoczi <stefanha@redhat.com>
    Message-Id: <20200605154929.26910-11-alex.bennee@linaro.org>
---
 hw/virtio/vhost.c | 53 ++++++++++++++++++++++++++++++++---------------
 util/memfd.c      |  2 +-
 2 files changed, 37 insertions(+), 18 deletions(-)

diff --git a/hw/virtio/vhost.c b/hw/virtio/vhost.c
index e7cc5729349..cfa2b9bbae0 100644
--- a/hw/virtio/vhost.c
+++ b/hw/virtio/vhost.c
@@ -610,26 +610,45 @@ static void vhost_set_memory(MemoryListener *listener,
 
 static bool vhost_section(struct vhost_dev *dev, MemoryRegionSection *section)
 {
-    bool result;
-    bool log_dirty = memory_region_get_dirty_log_mask(section->mr) &
-                     ~(1 << DIRTY_MEMORY_MIGRATION);
-    result = memory_region_is_ram(section->mr) &&
-        !memory_region_is_rom(section->mr);
-    /* Vhost doesn't handle any block which is doing dirty-tracking other
-     * than migration; this typically fires on VGA areas.
-     */
-    result &= !log_dirty;
-
-    if (result && dev->vhost_ops->vhost_backend_mem_section_filter) {
-        result &=
-            dev->vhost_ops->vhost_backend_mem_section_filter(dev, section);
-    }
-
-    //trace_vhost_section(section->mr->name, result);
-    return result;
+   MemoryRegion *mr = section->mr;
+
+   if (memory_region_is_ram(mr) && !memory_region_is_rom(mr)) {
+       uint8_t dirty_mask = memory_region_get_dirty_log_mask(mr);
+       uint8_t handled_dirty;
+
+       /*
+        * Kernel based vhost doesn't handle any block which is doing
+        * dirty-tracking other than migration for which it has
+        * specific logging support. However for TCG the kernel never
+        * gets involved anyway so we can also ignore it's
+        * self-modiying code detection flags. However a vhost-user
+        * client could still confuse a TCG guest if it re-writes
+        * executable memory that has already been translated.
+        */
+       handled_dirty = (1 << DIRTY_MEMORY_MIGRATION) |
+           (1 << DIRTY_MEMORY_CODE);
+
+       if (dirty_mask & ~handled_dirty) {
+           //trace_vhost_reject_section(mr->name, 1);
+           return false;
+       }
+
+       if (dev->vhost_ops->vhost_backend_mem_section_filter &&
+           !dev->vhost_ops->vhost_backend_mem_section_filter(dev, section)) {
+           //trace_vhost_reject_section(mr->name, 2);
+           return false;
+       }
+
+       //trace_vhost_section(mr->name);
+       return true;
+   } else {
+       //trace_vhost_reject_section(mr->name, 3);
+       return false;
+   }
 }
 
 
+
 static void vhost_begin(MemoryListener *listener)
 {
     struct vhost_dev *dev = container_of(listener, struct vhost_dev,
diff --git a/util/memfd.c b/util/memfd.c
index 412e94a405f..108e71941fd 100644
--- a/util/memfd.c
+++ b/util/memfd.c
@@ -35,7 +35,7 @@
 #include <sys/syscall.h>
 #include <asm/unistd.h>
 
-static int memfd_create(const char *name, unsigned int flags)
+int memfd_create(const char *name, unsigned int flags)
 {
 #ifdef __NR_memfd_create
     return syscall(__NR_memfd_create, name, flags);

From f7686051d4fb3d27e63c89cf8ad696157c86c544 Mon Sep 17 00:00:00 2001
From: Andrew Fasano <fasano@mit.edu>
Date: Tue, 28 Dec 2021 11:44:23 -0500
Subject: [PATCH 040/140] backport vhost support: changes by Dr David Alan
 Gilbert

This commit backports the follolwing 5 commits from usptream
which appear to be necessary for vhost support

commit c44317efecb240b9b0951ad46ba56eb547114f1d
Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
Date:   Fri Jan 19 10:39:18 2018 +0000

    vhost: Build temporary section list and deref after commit

    Igor spotted that there's a race, where a region that's unref'd
    in a _del callback might be free'd before the set_mem_table call in
    the _commit callback, and thus the vhost might end up using free memory.

    Fix this by building a complete temporary sections list, ref'ing every
    section (during add and nop) and then unref'ing the whole list right
    at the end of commit.

    Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
    Reviewed-by: Igor Mammedov <imammedo@redhat.com>
    Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
    Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

commit 48d7c97577498657f9ccbcbf1f990fdb4b79501f
Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
Date:   Fri Jan 19 10:39:20 2018 +0000

    vhost: Merge sections added to temporary list

    As sections are reported by the listener to the _nop and _add
    methods, add them to the temporary section list but now merge them
    with the previous section if the new one abuts and the backend allows.

    Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
    Reviewed-by: Igor Mammedov <imammedo@redhat.com>
    Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
    Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

commit ade6d081fc33948e56e655ee37b1306b6de6e0ef
Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
Date:   Fri Jan 19 10:39:21 2018 +0000

    vhost: Regenerate region list from changed sections list

    Compare the sections list that's just been generated, and if it's
    different from the old one regenerate the region list.

    Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
    Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
    Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
    Reviewed-by: Igor Mammedov <imammedo@redhat.com>

commit 06709c120ca3bae9fa243783b89005c08b71a440
Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
Date:   Fri Jan 19 10:39:22 2018 +0000

    vhost: Clean out old vhost_set_memory and friends

    Remove the old update mechanism, vhost_set_memory, and the functions
    and flags it used.

    Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
    Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
    Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

commit 938eeb640c0a006a3a53ea6f8b409cad56b80a55
Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
Date:   Fri Jan 19 10:39:23 2018 +0000

    vhost: Merge and delete unused callbacks

    Now that the olf vhost_set_memory code is gone, the _nop and _add
    callbacks are identical and can be merged.  The _del callback is
    no longer needed.

    Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
    Reviewed-by: Igor Mammedov <imammedo@redhat.com>
    Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
    Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/block/dataplane/virtio-blk.c |   2 +
 hw/scsi/virtio-scsi-dataplane.c |   2 +
 hw/virtio/trace-events          |   6 +
 hw/virtio/vhost.c               | 489 +++++++++++---------------------
 hw/virtio/virtio-bus.c          |  14 +-
 hw/virtio/virtio.c              |  22 +-
 include/hw/virtio/vhost.h       |   5 +-
 include/hw/virtio/virtio-bus.h  |   2 +
 8 files changed, 209 insertions(+), 333 deletions(-)

diff --git a/hw/block/dataplane/virtio-blk.c b/hw/block/dataplane/virtio-blk.c
index 5556f0e64e5..5d9ce24d260 100644
--- a/hw/block/dataplane/virtio-blk.c
+++ b/hw/block/dataplane/virtio-blk.c
@@ -190,6 +190,7 @@ int virtio_blk_data_plane_start(VirtIODevice *vdev)
             fprintf(stderr, "virtio-blk failed to set host notifier (%d)\n", r);
             while (i--) {
                 virtio_bus_set_host_notifier(VIRTIO_BUS(qbus), i, false);
+                virtio_bus_cleanup_host_notifier(VIRTIO_BUS(qbus), i);
             }
             goto fail_guest_notifiers;
         }
@@ -265,6 +266,7 @@ void virtio_blk_data_plane_stop(VirtIODevice *vdev)
 
     for (i = 0; i < nvqs; i++) {
         virtio_bus_set_host_notifier(VIRTIO_BUS(qbus), i, false);
+        virtio_bus_cleanup_host_notifier(VIRTIO_BUS(qbus), i);
     }
 
     /* Clean up guest notifier (irq) */
diff --git a/hw/scsi/virtio-scsi-dataplane.c b/hw/scsi/virtio-scsi-dataplane.c
index 944ea4eb535..d6326804557 100644
--- a/hw/scsi/virtio-scsi-dataplane.c
+++ b/hw/scsi/virtio-scsi-dataplane.c
@@ -175,6 +175,7 @@ int virtio_scsi_dataplane_start(VirtIODevice *vdev)
     aio_context_release(s->ctx);
     for (i = 0; i < vs->conf.num_queues + 2; i++) {
         virtio_bus_set_host_notifier(VIRTIO_BUS(qbus), i, false);
+        virtio_bus_cleanup_host_notifier(VIRTIO_BUS(qbus), i);
     }
     k->set_guest_notifiers(qbus->parent, vs->conf.num_queues + 2, false);
 fail_guest_notifiers:
@@ -213,6 +214,7 @@ void virtio_scsi_dataplane_stop(VirtIODevice *vdev)
 
     for (i = 0; i < vs->conf.num_queues + 2; i++) {
         virtio_bus_set_host_notifier(VIRTIO_BUS(qbus), i, false);
+        virtio_bus_cleanup_host_notifier(VIRTIO_BUS(qbus), i);
     }
 
     /* Clean up guest notifier (irq) */
diff --git a/hw/virtio/trace-events b/hw/virtio/trace-events
index 6926eedd3fd..9062efb43da 100644
--- a/hw/virtio/trace-events
+++ b/hw/virtio/trace-events
@@ -1,5 +1,11 @@
 # See docs/tracing.txt for syntax documentation.
 
+# hw/virtio/vhost.c
+vhost_commit(bool started, bool changed) "Started: %d Changed: %d"
+vhost_region_add_section(const char *name, uint64_t gpa, uint64_t size, uint64_t host) "%s: 0x%"PRIx64"+0x%"PRIx64" @ 0x%"PRIx64
+vhost_region_add_section_abut(const char *name, uint64_t new_size) "%s: 0x%"PRIx64
+vhost_section(const char *name, int r) "%s:%d"
+
 # hw/virtio/virtio.c
 virtqueue_fill(void *vq, const void *elem, unsigned int len, unsigned int idx) "vq %p elem %p len %u idx %u"
 virtqueue_flush(void *vq, unsigned int count) "vq %p count %u"
diff --git a/hw/virtio/vhost.c b/hw/virtio/vhost.c
index cfa2b9bbae0..d9430ff5283 100644
--- a/hw/virtio/vhost.c
+++ b/hw/virtio/vhost.c
@@ -155,160 +155,6 @@ static void vhost_log_sync_range(struct vhost_dev *dev,
     }
 }
 
-/* Assign/unassign. Keep an unsorted array of non-overlapping
- * memory regions in dev->mem. */
-static void vhost_dev_unassign_memory(struct vhost_dev *dev,
-                                      uint64_t start_addr,
-                                      uint64_t size)
-{
-    int from, to, n = dev->mem->nregions;
-    /* Track overlapping/split regions for sanity checking. */
-    int overlap_start = 0, overlap_end = 0, overlap_middle = 0, split = 0;
-
-    for (from = 0, to = 0; from < n; ++from, ++to) {
-        struct vhost_memory_region *reg = dev->mem->regions + to;
-        uint64_t reglast;
-        uint64_t memlast;
-        uint64_t change;
-
-        /* clone old region */
-        if (to != from) {
-            memcpy(reg, dev->mem->regions + from, sizeof *reg);
-        }
-
-        /* No overlap is simple */
-        if (!ranges_overlap(reg->guest_phys_addr, reg->memory_size,
-                            start_addr, size)) {
-            continue;
-        }
-
-        /* Split only happens if supplied region
-         * is in the middle of an existing one. Thus it can not
-         * overlap with any other existing region. */
-        assert(!split);
-
-        reglast = range_get_last(reg->guest_phys_addr, reg->memory_size);
-        memlast = range_get_last(start_addr, size);
-
-        /* Remove whole region */
-        if (start_addr <= reg->guest_phys_addr && memlast >= reglast) {
-            --dev->mem->nregions;
-            --to;
-            ++overlap_middle;
-            continue;
-        }
-
-        /* Shrink region */
-        if (memlast >= reglast) {
-            reg->memory_size = start_addr - reg->guest_phys_addr;
-            assert(reg->memory_size);
-            assert(!overlap_end);
-            ++overlap_end;
-            continue;
-        }
-
-        /* Shift region */
-        if (start_addr <= reg->guest_phys_addr) {
-            change = memlast + 1 - reg->guest_phys_addr;
-            reg->memory_size -= change;
-            reg->guest_phys_addr += change;
-            reg->userspace_addr += change;
-            assert(reg->memory_size);
-            assert(!overlap_start);
-            ++overlap_start;
-            continue;
-        }
-
-        /* This only happens if supplied region
-         * is in the middle of an existing one. Thus it can not
-         * overlap with any other existing region. */
-        assert(!overlap_start);
-        assert(!overlap_end);
-        assert(!overlap_middle);
-        /* Split region: shrink first part, shift second part. */
-        memcpy(dev->mem->regions + n, reg, sizeof *reg);
-        reg->memory_size = start_addr - reg->guest_phys_addr;
-        assert(reg->memory_size);
-        change = memlast + 1 - reg->guest_phys_addr;
-        reg = dev->mem->regions + n;
-        reg->memory_size -= change;
-        assert(reg->memory_size);
-        reg->guest_phys_addr += change;
-        reg->userspace_addr += change;
-        /* Never add more than 1 region */
-        assert(dev->mem->nregions == n);
-        ++dev->mem->nregions;
-        ++split;
-    }
-}
-
-/* Called after unassign, so no regions overlap the given range. */
-static void vhost_dev_assign_memory(struct vhost_dev *dev,
-                                    uint64_t start_addr,
-                                    uint64_t size,
-                                    uint64_t uaddr)
-{
-    int from, to;
-    struct vhost_memory_region *merged = NULL;
-    for (from = 0, to = 0; from < dev->mem->nregions; ++from, ++to) {
-        struct vhost_memory_region *reg = dev->mem->regions + to;
-        uint64_t prlast, urlast;
-        uint64_t pmlast, umlast;
-        uint64_t s, e, u;
-
-        /* clone old region */
-        if (to != from) {
-            memcpy(reg, dev->mem->regions + from, sizeof *reg);
-        }
-        prlast = range_get_last(reg->guest_phys_addr, reg->memory_size);
-        pmlast = range_get_last(start_addr, size);
-        urlast = range_get_last(reg->userspace_addr, reg->memory_size);
-        umlast = range_get_last(uaddr, size);
-
-        /* check for overlapping regions: should never happen. */
-        assert(prlast < start_addr || pmlast < reg->guest_phys_addr);
-        /* Not an adjacent or overlapping region - do not merge. */
-        if ((prlast + 1 != start_addr || urlast + 1 != uaddr) &&
-            (pmlast + 1 != reg->guest_phys_addr ||
-             umlast + 1 != reg->userspace_addr)) {
-            continue;
-        }
-
-        if (dev->vhost_ops->vhost_backend_can_merge &&
-            !dev->vhost_ops->vhost_backend_can_merge(dev, uaddr, size,
-                                                     reg->userspace_addr,
-                                                     reg->memory_size)) {
-            continue;
-        }
-
-        if (merged) {
-            --to;
-            assert(to >= 0);
-        } else {
-            merged = reg;
-        }
-        u = MIN(uaddr, reg->userspace_addr);
-        s = MIN(start_addr, reg->guest_phys_addr);
-        e = MAX(pmlast, prlast);
-        uaddr = merged->userspace_addr = u;
-        start_addr = merged->guest_phys_addr = s;
-        size = merged->memory_size = e - s + 1;
-        assert(merged->memory_size);
-    }
-
-    if (!merged) {
-        struct vhost_memory_region *reg = dev->mem->regions + to;
-        memset(reg, 0, sizeof *reg);
-        reg->memory_size = size;
-        assert(reg->memory_size);
-        reg->guest_phys_addr = start_addr;
-        reg->userspace_addr = uaddr;
-        ++to;
-    }
-    assert(to <= dev->mem->nregions + 1);
-    dev->mem->nregions = to;
-}
-
 static uint64_t vhost_get_log_size(struct vhost_dev *dev)
 {
     uint64_t log_size = 0;
@@ -448,35 +294,37 @@ static void vhost_memory_unmap(struct vhost_dev *dev, void *buffer,
     }
 }
 
-static int vhost_verify_ring_part_mapping(struct vhost_dev *dev,
-                                          void *part,
-                                          uint64_t part_addr,
-                                          uint64_t part_size,
-                                          uint64_t start_addr,
-                                          uint64_t size)
+static int vhost_verify_ring_part_mapping(void *ring_hva,
+                                          uint64_t ring_gpa,
+                                          uint64_t ring_size,
+                                          void *reg_hva,
+                                          uint64_t reg_gpa,
+                                          uint64_t reg_size)
 {
-    hwaddr l;
-    void *p;
-    int r = 0;
+    uint64_t hva_ring_offset;
+    uint64_t ring_last = range_get_last(ring_gpa, ring_size);
+    uint64_t reg_last = range_get_last(reg_gpa, reg_size);
 
-    if (!ranges_overlap(start_addr, size, part_addr, part_size)) {
+    if (ring_last < reg_gpa || ring_gpa > reg_last) {
         return 0;
     }
-    l = part_size;
-    p = vhost_memory_map(dev, part_addr, &l, 1);
-    if (!p || l != part_size) {
-        r = -ENOMEM;
+    /* check that whole ring's is mapped */
+    if (ring_last > reg_last) {
+        return -ENOMEM;
     }
-    if (p != part) {
-        r = -EBUSY;
+    /* check that ring's MemoryRegion wasn't replaced */
+    hva_ring_offset = ring_gpa - reg_gpa;
+    if (ring_hva != reg_hva + hva_ring_offset) {
+        return -EBUSY;
     }
-    vhost_memory_unmap(dev, p, l, 0, 0);
-    return r;
+
+    return 0;
 }
 
 static int vhost_verify_ring_mappings(struct vhost_dev *dev,
-                                      uint64_t start_addr,
-                                      uint64_t size)
+                                      void *reg_hva,
+                                      uint64_t reg_gpa,
+                                      uint64_t reg_size)
 {
     int i, j;
     int r = 0;
@@ -490,23 +338,26 @@ static int vhost_verify_ring_mappings(struct vhost_dev *dev,
         struct vhost_virtqueue *vq = dev->vqs + i;
 
         j = 0;
-        r = vhost_verify_ring_part_mapping(dev, vq->desc, vq->desc_phys,
-                                           vq->desc_size, start_addr, size);
-        if (!r) {
+        r = vhost_verify_ring_part_mapping(
+                vq->desc, vq->desc_phys, vq->desc_size,
+                reg_hva, reg_gpa, reg_size);
+        if (r) {
             break;
         }
 
         j++;
-        r = vhost_verify_ring_part_mapping(dev, vq->avail, vq->avail_phys,
-                                           vq->avail_size, start_addr, size);
-        if (!r) {
+        r = vhost_verify_ring_part_mapping(
+                vq->desc, vq->desc_phys, vq->desc_size,
+                reg_hva, reg_gpa, reg_size);
+        if (r) {
             break;
         }
 
         j++;
-        r = vhost_verify_ring_part_mapping(dev, vq->used, vq->used_phys,
-                                           vq->used_size, start_addr, size);
-        if (!r) {
+        r = vhost_verify_ring_part_mapping(
+                vq->desc, vq->desc_phys, vq->desc_size,
+                reg_hva, reg_gpa, reg_size);
+        if (r) {
             break;
         }
     }
@@ -519,95 +370,6 @@ static int vhost_verify_ring_mappings(struct vhost_dev *dev,
     return r;
 }
 
-static struct vhost_memory_region *vhost_dev_find_reg(struct vhost_dev *dev,
-						      uint64_t start_addr,
-						      uint64_t size)
-{
-    int i, n = dev->mem->nregions;
-    for (i = 0; i < n; ++i) {
-        struct vhost_memory_region *reg = dev->mem->regions + i;
-        if (ranges_overlap(reg->guest_phys_addr, reg->memory_size,
-                           start_addr, size)) {
-            return reg;
-        }
-    }
-    return NULL;
-}
-
-static bool vhost_dev_cmp_memory(struct vhost_dev *dev,
-                                 uint64_t start_addr,
-                                 uint64_t size,
-                                 uint64_t uaddr)
-{
-    struct vhost_memory_region *reg = vhost_dev_find_reg(dev, start_addr, size);
-    uint64_t reglast;
-    uint64_t memlast;
-
-    if (!reg) {
-        return true;
-    }
-
-    reglast = range_get_last(reg->guest_phys_addr, reg->memory_size);
-    memlast = range_get_last(start_addr, size);
-
-    /* Need to extend region? */
-    if (start_addr < reg->guest_phys_addr || memlast > reglast) {
-        return true;
-    }
-    /* userspace_addr changed? */
-    return uaddr != reg->userspace_addr + start_addr - reg->guest_phys_addr;
-}
-
-static void vhost_set_memory(MemoryListener *listener,
-                             MemoryRegionSection *section,
-                             bool add)
-{
-    struct vhost_dev *dev = container_of(listener, struct vhost_dev,
-                                         memory_listener);
-    hwaddr start_addr = section->offset_within_address_space;
-    ram_addr_t size = int128_get64(section->size);
-    bool log_dirty =
-        memory_region_get_dirty_log_mask(section->mr) & ~(1 << DIRTY_MEMORY_MIGRATION);
-    int s = offsetof(struct vhost_memory, regions) +
-        (dev->mem->nregions + 1) * sizeof dev->mem->regions[0];
-    void *ram;
-
-    dev->mem = g_realloc(dev->mem, s);
-
-    if (log_dirty) {
-        add = false;
-    }
-
-    assert(size);
-
-    /* Optimize no-change case. At least cirrus_vga does this a lot at this time. */
-    ram = memory_region_get_ram_ptr(section->mr) + section->offset_within_region;
-    if (add) {
-        if (!vhost_dev_cmp_memory(dev, start_addr, size, (uintptr_t)ram)) {
-            /* Region exists with same address. Nothing to do. */
-            return;
-        }
-    } else {
-        if (!vhost_dev_find_reg(dev, start_addr, size)) {
-            /* Removing region that we don't access. Nothing to do. */
-            return;
-        }
-    }
-
-    vhost_dev_unassign_memory(dev, start_addr, size);
-    if (add) {
-        /* Add given mapping, merging adjacent regions if any */
-        vhost_dev_assign_memory(dev, start_addr, size, (uintptr_t)ram);
-    } else {
-        /* Remove old mapping for this memory, if any. */
-        vhost_dev_unassign_memory(dev, start_addr, size);
-    }
-    dev->mem_changed_start_addr = MIN(dev->mem_changed_start_addr, start_addr);
-    dev->mem_changed_end_addr = MAX(dev->mem_changed_end_addr, start_addr + size - 1);
-    dev->memory_changed = true;
-    used_memslots = dev->mem->nregions;
-}
-
 static bool vhost_section(struct vhost_dev *dev, MemoryRegionSection *section)
 {
    MemoryRegion *mr = section->mr;
@@ -653,35 +415,74 @@ static void vhost_begin(MemoryListener *listener)
 {
     struct vhost_dev *dev = container_of(listener, struct vhost_dev,
                                          memory_listener);
-    dev->mem_changed_end_addr = 0;
-    dev->mem_changed_start_addr = -1;
+    dev->tmp_sections = NULL;
+    dev->n_tmp_sections = 0;
 }
 
 static void vhost_commit(MemoryListener *listener)
 {
     struct vhost_dev *dev = container_of(listener, struct vhost_dev,
                                          memory_listener);
-    hwaddr start_addr = 0;
-    ram_addr_t size = 0;
+    MemoryRegionSection *old_sections;
+    int n_old_sections;
     uint64_t log_size;
+    size_t regions_size;
     int r;
+    int i;
+    bool changed = false;
 
-    if (!dev->memory_changed) {
-        return;
+    /* Note we can be called before the device is started, but then
+     * starting the device calls set_mem_table, so we need to have
+     * built the data structures.
+     */
+    old_sections = dev->mem_sections;
+    n_old_sections = dev->n_mem_sections;
+    dev->mem_sections = dev->tmp_sections;
+    dev->n_mem_sections = dev->n_tmp_sections;
+
+    if (dev->n_mem_sections != n_old_sections) {
+        changed = true;
+    } else {
+        /* Same size, lets check the contents */
+        changed = n_old_sections && memcmp(dev->mem_sections, old_sections,
+                         n_old_sections * sizeof(old_sections[0])) != 0;
     }
-    if (!dev->started) {
-        return;
+
+    //trace_vhost_commit(dev->started, changed);
+    if (!changed) {
+        goto out;
     }
-    if (dev->mem_changed_start_addr > dev->mem_changed_end_addr) {
-        return;
+
+    /* Rebuild the regions list from the new sections list */
+    regions_size = offsetof(struct vhost_memory, regions) +
+                       dev->n_mem_sections * sizeof dev->mem->regions[0];
+    dev->mem = g_realloc(dev->mem, regions_size);
+    dev->mem->nregions = dev->n_mem_sections;
+    used_memslots = dev->mem->nregions;
+    for (i = 0; i < dev->n_mem_sections; i++) {
+        struct vhost_memory_region *cur_vmr = dev->mem->regions + i;
+        struct MemoryRegionSection *mrs = dev->mem_sections + i;
+
+        cur_vmr->guest_phys_addr = mrs->offset_within_address_space;
+        cur_vmr->memory_size     = int128_get64(mrs->size);
+        cur_vmr->userspace_addr  =
+            (uintptr_t)memory_region_get_ram_ptr(mrs->mr) +
+            mrs->offset_within_region;
+        cur_vmr->flags_padding   = 0;
     }
 
-    if (dev->started) {
-        start_addr = dev->mem_changed_start_addr;
-        size = dev->mem_changed_end_addr - dev->mem_changed_start_addr + 1;
+    if (!dev->started) {
+        goto out;
+    }
 
-        r = vhost_verify_ring_mappings(dev, start_addr, size);
-        assert(r >= 0);
+    for (i = 0; i < dev->mem->nregions; i++) {
+        if (vhost_verify_ring_mappings(dev,
+                       (void *)(uintptr_t)dev->mem->regions[i].userspace_addr,
+                       dev->mem->regions[i].guest_phys_addr,
+                       dev->mem->regions[i].memory_size)) {
+            error_report("Verify ring failure on region %d", i);
+            abort();
+        }
     }
 
     if (!dev->log_enabled) {
@@ -689,8 +490,7 @@ static void vhost_commit(MemoryListener *listener)
         if (r < 0) {
             VHOST_OPS_DEBUG("vhost_set_mem_table failed");
         }
-        dev->memory_changed = false;
-        return;
+        goto out;
     }
     log_size = vhost_get_log_size(dev);
     /* We allocate an extra 4K bytes to log,
@@ -708,49 +508,93 @@ static void vhost_commit(MemoryListener *listener)
     if (dev->log_size > log_size + VHOST_LOG_BUFFER) {
         vhost_dev_log_resize(dev, log_size);
     }
-    dev->memory_changed = false;
+
+out:
+    /* Deref the old list of sections, this must happen _after_ the
+     * vhost_set_mem_table to ensure the client isn't still using the
+     * section we're about to unref.
+     */
+    while (n_old_sections--) {
+        memory_region_unref(old_sections[n_old_sections].mr);
+    }
+    g_free(old_sections);
+    return;
 }
 
-static void vhost_region_add(MemoryListener *listener,
-                             MemoryRegionSection *section)
-{
-    struct vhost_dev *dev = container_of(listener, struct vhost_dev,
-                                         memory_listener);
 
-    if (!vhost_section(dev, section)) {
-        return;
+/* Adds the section data to the tmp_section structure.
+ * It relies on the listener calling us in memory address order
+ * and for each region (via the _add and _nop methods) to
+ * join neighbours.
+ */
+static void vhost_region_add_section(struct vhost_dev *dev,
+                                     MemoryRegionSection *section)
+{
+   bool need_add = true;
+   uint64_t mrs_size = int128_get64(section->size);
+   uint64_t mrs_gpa = section->offset_within_address_space;
+   uintptr_t mrs_host = (uintptr_t)memory_region_get_ram_ptr(section->mr) +
+                        section->offset_within_region;
+
+   //trace_vhost_region_add_section(section->mr->name, mrs_gpa, mrs_size,
+   //                               mrs_host);
+
+   if (dev->n_tmp_sections) {
+       /* Since we already have at least one section, lets see if
+        * this extends it; since we're scanning in order, we only
+        * have to look at the last one, and the FlatView that calls
+        * us shouldn't have overlaps.
+        */
+       MemoryRegionSection *prev_sec = dev->tmp_sections +
+                                              (dev->n_tmp_sections - 1);
+       uint64_t prev_gpa_start = prev_sec->offset_within_address_space;
+       uint64_t prev_size = int128_get64(prev_sec->size);
+       uint64_t prev_gpa_end   = range_get_last(prev_gpa_start, prev_size);
+       uint64_t prev_host_start =
+                       (uintptr_t)memory_region_get_ram_ptr(prev_sec->mr) +
+                       prev_sec->offset_within_region;
+       uint64_t prev_host_end   = range_get_last(prev_host_start, prev_size);
+
+       if (prev_gpa_end + 1 == mrs_gpa &&
+           prev_host_end + 1 == mrs_host &&
+           section->mr == prev_sec->mr &&
+           (!dev->vhost_ops->vhost_backend_can_merge ||
+               dev->vhost_ops->vhost_backend_can_merge(dev,
+                   mrs_host, mrs_size,
+                   prev_host_start, prev_size))) {
+           /* The two sections abut */
+           need_add = false;
+           prev_sec->size = int128_add(prev_sec->size, section->size);
+           //trace_vhost_region_add_section_abut(section->mr->name,
+           //                                    mrs_size + prev_size);
+       }
     }
 
-    ++dev->n_mem_sections;
-    dev->mem_sections = g_renew(MemoryRegionSection, dev->mem_sections,
-                                dev->n_mem_sections);
-    dev->mem_sections[dev->n_mem_sections - 1] = *section;
-    memory_region_ref(section->mr);
-    vhost_set_memory(listener, section, true);
+    if (need_add) {
+        ++dev->n_tmp_sections;
+        dev->tmp_sections = g_renew(MemoryRegionSection, dev->tmp_sections,
+                                    dev->n_tmp_sections);
+        dev->tmp_sections[dev->n_tmp_sections - 1] = *section;
+        /* The flatview isn't stable and we don't use it, making it NULL
+         * means we can memcmp the list.
+         */
+        dev->tmp_sections[dev->n_tmp_sections - 1].fv = NULL;
+        memory_region_ref(section->mr);
+    }
 }
 
-static void vhost_region_del(MemoryListener *listener,
+/* Used for both add and nop callbacks */
+static void vhost_region_addnop(MemoryListener *listener,
                              MemoryRegionSection *section)
 {
     struct vhost_dev *dev = container_of(listener, struct vhost_dev,
                                          memory_listener);
-    int i;
 
     if (!vhost_section(dev, section)) {
         return;
     }
 
-    vhost_set_memory(listener, section, false);
-    memory_region_unref(section->mr);
-    for (i = 0; i < dev->n_mem_sections; ++i) {
-        if (dev->mem_sections[i].offset_within_address_space
-            == section->offset_within_address_space) {
-            --dev->n_mem_sections;
-            memmove(&dev->mem_sections[i], &dev->mem_sections[i+1],
-                    (dev->n_mem_sections - i) * sizeof(*dev->mem_sections));
-            break;
-        }
-    }
+    vhost_region_add_section(dev, section);
 }
 
 static void vhost_iommu_unmap_notify(IOMMUNotifier *n, IOMMUTLBEntry *iotlb)
@@ -810,11 +654,6 @@ static void vhost_iommu_region_del(MemoryListener *listener,
     }
 }
 
-static void vhost_region_nop(MemoryListener *listener,
-                             MemoryRegionSection *section)
-{
-}
-
 static int vhost_virtqueue_set_addr(struct vhost_dev *dev,
                                     struct vhost_virtqueue *vq,
                                     unsigned idx, bool enable_log)
@@ -1310,9 +1149,8 @@ int vhost_dev_init(struct vhost_dev *hdev, void *opaque,
     hdev->memory_listener = (MemoryListener) {
         .begin = vhost_begin,
         .commit = vhost_commit,
-        .region_add = vhost_region_add,
-        .region_del = vhost_region_del,
-        .region_nop = vhost_region_nop,
+        .region_add = vhost_region_addnop,
+        .region_nop = vhost_region_addnop,
         .log_start = vhost_log_start,
         .log_stop = vhost_log_stop,
         .log_sync = vhost_log_sync,
@@ -1354,7 +1192,6 @@ int vhost_dev_init(struct vhost_dev *hdev, void *opaque,
     hdev->log_size = 0;
     hdev->log_enabled = false;
     hdev->started = false;
-    hdev->memory_changed = false;
     memory_listener_register(&hdev->memory_listener, &address_space_memory);
     QLIST_INSERT_HEAD(&vhost_devices, hdev, entry);
     return 0;
@@ -1430,6 +1267,7 @@ int vhost_dev_enable_notifiers(struct vhost_dev *hdev, VirtIODevice *vdev)
             error_report("vhost VQ %d notifier cleanup error: %d", i, -r);
         }
         assert (e >= 0);
+        virtio_bus_cleanup_host_notifier(VIRTIO_BUS(qbus), hdev->vq_index + i);
     }
     virtio_device_release_ioeventfd(vdev);
 fail:
@@ -1453,6 +1291,7 @@ void vhost_dev_disable_notifiers(struct vhost_dev *hdev, VirtIODevice *vdev)
             error_report("vhost VQ %d notifier cleanup failed: %d", i, -r);
         }
         assert (r >= 0);
+        virtio_bus_cleanup_host_notifier(VIRTIO_BUS(qbus), hdev->vq_index + i);
     }
     virtio_device_release_ioeventfd(vdev);
 }
diff --git a/hw/virtio/virtio-bus.c b/hw/virtio/virtio-bus.c
index 3042232daf8..f9bc9ea46d7 100644
--- a/hw/virtio/virtio-bus.c
+++ b/hw/virtio/virtio-bus.c
@@ -283,20 +283,26 @@ int virtio_bus_set_host_notifier(VirtioBusState *bus, int n, bool assign)
         r = k->ioeventfd_assign(proxy, notifier, n, true);
         if (r < 0) {
             error_report("%s: unable to assign ioeventfd: %d", __func__, r);
-            goto cleanup_event_notifier;
+            virtio_bus_cleanup_host_notifier(bus, n);
         }
-        return 0;
     } else {
         k->ioeventfd_assign(proxy, notifier, n, false);
     }
 
-cleanup_event_notifier:
+    return r;
+}
+
+void virtio_bus_cleanup_host_notifier(VirtioBusState *bus, int n)
+{
+    VirtIODevice *vdev = virtio_bus_get_device(bus);
+    VirtQueue *vq = virtio_get_queue(vdev, n);
+    EventNotifier *notifier = virtio_queue_get_host_notifier(vq);
+
     /* Test and clear notifier after disabling event,
      * in case poll callback didn't have time to run.
      */
     virtio_queue_host_notifier_read(notifier);
     event_notifier_cleanup(notifier);
-    return r;
 }
 
 static char *virtio_bus_get_dev_path(DeviceState *dev)
diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c
index 890b4d7eb75..31670421deb 100644
--- a/hw/virtio/virtio.c
+++ b/hw/virtio/virtio.c
@@ -2554,8 +2554,9 @@ static Property virtio_properties[] = {
 static int virtio_device_start_ioeventfd_impl(VirtIODevice *vdev)
 {
     VirtioBusState *qbus = VIRTIO_BUS(qdev_get_parent_bus(DEVICE(vdev)));
-    int n, r, err;
+    int i, n, r, err;
 
+    memory_region_transaction_begin();
     for (n = 0; n < VIRTIO_QUEUE_MAX; n++) {
         VirtQueue *vq = &vdev->vq[n];
         if (!virtio_queue_get_num(vdev, n)) {
@@ -2578,9 +2579,11 @@ static int virtio_device_start_ioeventfd_impl(VirtIODevice *vdev)
         }
         event_notifier_set(&vq->host_notifier);
     }
+    memory_region_transaction_commit();
     return 0;
 
 assign_error:
+    i = n; /* save n for a second iteration after transaction is committed. */
     while (--n >= 0) {
         VirtQueue *vq = &vdev->vq[n];
         if (!virtio_queue_get_num(vdev, n)) {
@@ -2591,6 +2594,14 @@ static int virtio_device_start_ioeventfd_impl(VirtIODevice *vdev)
         r = virtio_bus_set_host_notifier(qbus, n, false);
         assert(r >= 0);
     }
+    memory_region_transaction_commit();
+
+    while (--i >= 0) {
+        if (!virtio_queue_get_num(vdev, i)) {
+            continue;
+        }
+        virtio_bus_cleanup_host_notifier(qbus, i);
+    }
     return err;
 }
 
@@ -2607,6 +2618,7 @@ static void virtio_device_stop_ioeventfd_impl(VirtIODevice *vdev)
     VirtioBusState *qbus = VIRTIO_BUS(qdev_get_parent_bus(DEVICE(vdev)));
     int n, r;
 
+    memory_region_transaction_begin();
     for (n = 0; n < VIRTIO_QUEUE_MAX; n++) {
         VirtQueue *vq = &vdev->vq[n];
 
@@ -2617,6 +2629,14 @@ static void virtio_device_stop_ioeventfd_impl(VirtIODevice *vdev)
         r = virtio_bus_set_host_notifier(qbus, n, false);
         assert(r >= 0);
     }
+    memory_region_transaction_commit();
+
+    for (n = 0; n < VIRTIO_QUEUE_MAX; n++) {
+        if (!virtio_queue_get_num(vdev, n)) {
+            continue;
+        }
+        virtio_bus_cleanup_host_notifier(qbus, n);
+    }
 }
 
 void virtio_device_stop_ioeventfd(VirtIODevice *vdev)
diff --git a/include/hw/virtio/vhost.h b/include/hw/virtio/vhost.h
index a45032163d6..0f2d8073fcb 100644
--- a/include/hw/virtio/vhost.h
+++ b/include/hw/virtio/vhost.h
@@ -54,6 +54,8 @@ struct vhost_dev {
     struct vhost_memory *mem;
     int n_mem_sections;
     MemoryRegionSection *mem_sections;
+    int n_tmp_sections;
+    MemoryRegionSection *tmp_sections;
     struct vhost_virtqueue *vqs;
     int nvqs;
     /* the first virtqueue which would be used by this vhost dev */
@@ -67,9 +69,6 @@ struct vhost_dev {
     bool log_enabled;
     uint64_t log_size;
     Error *migration_blocker;
-    bool memory_changed;
-    hwaddr mem_changed_start_addr;
-    hwaddr mem_changed_end_addr;
     const VhostOps *vhost_ops;
     void *opaque;
     struct vhost_log *log;
diff --git a/include/hw/virtio/virtio-bus.h b/include/hw/virtio/virtio-bus.h
index a63c1d216d2..ced3d2d2b04 100644
--- a/include/hw/virtio/virtio-bus.h
+++ b/include/hw/virtio/virtio-bus.h
@@ -148,5 +148,7 @@ int virtio_bus_grab_ioeventfd(VirtioBusState *bus);
 void virtio_bus_release_ioeventfd(VirtioBusState *bus);
 /* Switch from/to the generic ioeventfd handler */
 int virtio_bus_set_host_notifier(VirtioBusState *bus, int n, bool assign);
+/* Tell the bus that the ioeventfd handler is no longer required. */
+void virtio_bus_cleanup_host_notifier(VirtioBusState *bus, int n);
 
 #endif /* VIRTIO_BUS_H */

From 716b782f3f604d990f361cbab3186b4e0c73540f Mon Sep 17 00:00:00 2001
From: Andrew Fasano <fasano@mit.edu>
Date: Tue, 28 Dec 2021 11:53:42 -0500
Subject: [PATCH 041/140] backport vhost support: Update struct field
 references

MemoryRegionSection should reference address_space over flatview
---
 hw/virtio/vhost.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/virtio/vhost.c b/hw/virtio/vhost.c
index d9430ff5283..b78d1483af3 100644
--- a/hw/virtio/vhost.c
+++ b/hw/virtio/vhost.c
@@ -578,7 +578,7 @@ static void vhost_region_add_section(struct vhost_dev *dev,
         /* The flatview isn't stable and we don't use it, making it NULL
          * means we can memcmp the list.
          */
-        dev->tmp_sections[dev->n_tmp_sections - 1].fv = NULL;
+        dev->tmp_sections[dev->n_tmp_sections - 1].address_space = NULL;
         memory_region_ref(section->mr);
     }
 }

From 3c04fd44c3e480cdac65585b17c48b4223ada5ae Mon Sep 17 00:00:00 2001
From: Andrew Fasano <fasano@mit.edu>
Date: Fri, 18 Feb 2022 19:59:49 -0500
Subject: [PATCH 042/140] Add QEMU logging to PyPANDA (#1114)

Co-authored-by: Luke Craig <lacraig3@gmail.com>
---
 include/qemu/log.h                            |   1 +
 panda/python/core/create_panda_datatypes.py   |   8 +
 .../core/pandare/include/libc_includes.h      |   6 +-
 panda/python/core/pandare/panda.py            |   2 +
 panda/python/core/pandare/qemu_logging.py     | 151 ++++++++++++++++++
 panda/python/examples/qlog_example.py         |  47 ++++++
 util/log.c                                    |   2 +
 7 files changed, 216 insertions(+), 1 deletion(-)
 create mode 100644 panda/python/core/pandare/qemu_logging.py
 create mode 100755 panda/python/examples/qlog_example.py

diff --git a/include/qemu/log.h b/include/qemu/log.h
index 871d435bc20..cf7226362f0 100644
--- a/include/qemu/log.h
+++ b/include/qemu/log.h
@@ -43,6 +43,7 @@ static inline bool qemu_log_separate(void)
 #define CPU_LOG_PAGE       (1 << 14)
 #define LOG_TRACE          (1 << 15)
 #define CPU_LOG_TB_OP_IND  (1 << 16)
+#define LOG_PANDA          (1 << 17)
 #define CPU_LOG_TAINT_OPS  (1 << 28)
 #define CPU_LOG_RR         (1 << 29)
 #define CPU_LOG_LLVM_IR    (1 << 30)
diff --git a/panda/python/core/create_panda_datatypes.py b/panda/python/core/create_panda_datatypes.py
index 4446a08ba35..0285a655eeb 100755
--- a/panda/python/core/create_panda_datatypes.py
+++ b/panda/python/core/create_panda_datatypes.py
@@ -231,6 +231,11 @@ def expand_ppp_def(line):
     ffi.cdef("typedef uint"+str(bits)+"_t target_ulong;")
     ffi.cdef("typedef int"+str(bits)+"_t target_long;")
 
+    # For direct access to -d logging flags
+    # unsigned is a lie. but it's the way QEMU treats it.
+    ffi.cdef("extern unsigned int qemu_loglevel;")
+    ffi.cdef("extern FILE* qemu_logfile;")
+
     # PPP Headers
     # Syscalls - load architecture-specific headers
     if arch == "i386":
@@ -269,6 +274,9 @@ def expand_ppp_def(line):
 
     # get some libc functionality
     define_clean_header(ffi, include_dir + "/libc_includes.h")
+    
+    # QEMU logging functionality
+    define_clean_header(ffi, include_dir + "/qlog.h")
 
     # Now syscalls2 common:
     define_clean_header(ffi, include_dir + "/syscalls2_info.h")
diff --git a/panda/python/core/pandare/include/libc_includes.h b/panda/python/core/pandare/include/libc_includes.h
index fa9d94aaac5..41387bbc913 100644
--- a/panda/python/core/pandare/include/libc_includes.h
+++ b/panda/python/core/pandare/include/libc_includes.h
@@ -1,4 +1,8 @@
 // Sometimes it is convenient to call C functions. They go here.
 // from the C <stdio.h>
 FILE *fdopen(int, const char *);   
-int fclose(FILE *);
\ No newline at end of file
+FILE *fopen(const char *, const char*);   
+int fileno(FILE *);
+int fclose(FILE *);
+extern FILE *stderr;
+extern FILE *stdout;
\ No newline at end of file
diff --git a/panda/python/core/pandare/panda.py b/panda/python/core/pandare/panda.py
index 760124553c4..b1bff912dd8 100755
--- a/panda/python/core/pandare/panda.py
+++ b/panda/python/core/pandare/panda.py
@@ -37,6 +37,7 @@
 from .panda_expect import Expect
 from .asyncthread import AsyncThread
 from .qcows import Qcows
+from .qemu_logging import QEMU_Log_Manager
 from .arch import ArmArch, Aarch64Arch, MipsArch, Mips64Arch, X86Arch, X86_64Arch
 
 # Might be worth importing and auto-initilizing a PLogReader
@@ -96,6 +97,7 @@ def __init__(self, arch="i386", mem="128M",
         self.ending = False # True during end_analysis
         self.cdrom = None
         self.catch_exceptions=catch_exceptions
+        self.qlog = QEMU_Log_Manager(self)
 
         self.serial_unconsumed_data = b''
 
diff --git a/panda/python/core/pandare/qemu_logging.py b/panda/python/core/pandare/qemu_logging.py
new file mode 100644
index 00000000000..beadcd13d2c
--- /dev/null
+++ b/panda/python/core/pandare/qemu_logging.py
@@ -0,0 +1,151 @@
+class QEMU_Log_Manager:
+    '''
+    QEMU_Log_Manager
+
+    This class manages the QEMU log. It does so by manipulating two key QEMU
+    variables:
+    - qemu_loglevel: int mask of the log levels to be logged
+    - qemu_logfile: FILE* to the log file
+
+    It provides an equivalent method for setting the log file of the form:
+    - enable("[MEMBER_NAME]")
+    - disable("[MEMBER_NAME]")
+
+    It also accepts a comma separated list of strings:
+    - enable("[MEMBER_NAME],[MEMBER2_NAME],[MEMBER3_NAME]")
+    - enable("[MEMBER_NAME],[MEMBER2_NAME],[MEMBER3_NAME]")
+
+    It also provides methods for setting a file to log to and a method to remove
+    the current log file.
+    
+    The following log types are supported:
+    
+        - TB_OUT_ASM
+        - TB_IN_ASM
+        - TB_OP,
+        - TB_OP_OPT
+        - EXTERNAL
+        - INT
+        - EXEC
+        - PCALL
+        - TB_CPU
+        - RESET
+        - UNIMP
+        - GUEST_ERROR
+        - MMU
+        - TB_NOCHAIN
+        - PAGE
+        - TRACE
+        - TB_OP_IND
+        - PANDA
+        - TAINT_OPS
+        - RR
+        - LLVM_IR
+        - LLVM_ASM
+
+    '''
+    def __init__(self, panda):
+        self.panda = panda
+
+        log_members = {
+            "TB_OUT_ASM": 0,
+            "TB_IN_ASM": 1,
+            "TB_OP": 2,
+            "TB_OP_OPT": 3,
+            "INT": 4,
+            "EXEC": 5,
+            "PCALL": 6,
+            "TB_CPU": 8,
+            "RESET": 9,
+            "UNIMP":10,
+            "GUEST_ERROR":11,
+            "MMU":12,
+            "TB_NOCHAIN":13,
+            "PAGE":14,
+            "TRACE":15,
+            "TB_OP_IND":16,
+            "PANDA":17,
+            "TAINT_OPS":28,
+            "RR":29,
+            "LLVM_IR":30,
+            "LLVM_ASM":31,
+        }
+        self.log_members = log_members
+
+    def _set_log_level(self, log_level):
+        self.panda.libpanda.qemu_set_log(log_level)
+    
+    def _get_log_level(self):
+        return self.panda.libpanda.qemu_loglevel
+
+    def _set_log_bit(self, bit):
+        self._set_log_level(self._get_log_level() | (1 << bit))
+    
+    def _unset_log_bit(self, bit):
+        self._set_log_level(self._get_log_level() & ~(1 << bit))
+    
+    def enable(self, name):
+        """Enables the specified log level.
+
+        Args:
+            name (str): name of the log type (for list -d ?) or comma
+            separated list of names.
+
+        Raises:
+            Exception: no such log member
+        """
+        if name.upper() in self.log_members:
+            self._set_log_bit(self.log_members[name.upper()])
+        else:
+            raise Exception("no such log member: " + name)
+    
+    def disable(self, name):
+        """Disables the specified log level.
+
+        Args:
+            name (str): name of log type (for list -d ?) or comma
+            separated list of names.
+
+        Raises:
+            Exception: no such log member
+        """
+        if name.upper() in self.log_members:
+            self._unset_log_bit(self.log_members[name.upper()])
+        else:
+            raise Exception("no such log member: " + name)
+
+    def output_to_file(self, file_name, append=True):
+        """Change qemu log file to file_name. If append is True, output will
+        be appended to the file. Otherwise, the file will be overwritten.
+
+        Args:
+            file_name ([str]): path to the file to output to
+            append (bool, optional): File append setting
+        """
+        # qemu_logfile out previous file (if any)
+        self.remove_log_file()
+
+        # open new file
+        mode = b"a" if append else b"w"
+        self.panda.libpanda.qemu_logfile = self.panda.libpanda.fopen(file_name.encode(),  mode)
+        
+    def remove_log_file(self):
+        """Removes the current log file. By default outputs to stdout."""
+        self.panda.libpanda.qemu_log_close()
+    
+    def output_to_stderr(self):
+        """Removes the current log file and outputs to stderr"""
+        self.remove_log_file()
+        self.panda.libpanda.qemu_logfile = self.panda.libpanda.stderr
+    
+    def output_to_stout(self):
+        """Removes the current log file and outputs to stdout"""
+        self.remove_log_file()
+        self.panda.libpanda.qemu_logfile = self.panda.libpanda.stdout
+    
+    def log(self, msg):
+        """Output message to PANDA log"""
+        # it's actually cheaper than asking if it is then setting it
+        self.enable("panda")
+        msg += "\n"
+        self.panda.libpanda.qemu_log(msg.encode())
\ No newline at end of file
diff --git a/panda/python/examples/qlog_example.py b/panda/python/examples/qlog_example.py
new file mode 100755
index 00000000000..454a2e1ffa3
--- /dev/null
+++ b/panda/python/examples/qlog_example.py
@@ -0,0 +1,47 @@
+#!/usr/bin/env python3
+'''
+qlog_example.py
+
+This file demonstrates the qlog functionality:
+- Dynamically enable/disable various types of logging
+- Dynamically set/remove/replace the log file
+
+Run with: python3 after_init.py
+'''
+from sys import argv
+from pandare import Panda
+
+# Single arg of arch, defaults to i386
+arch = "i386" if len(argv) <= 1 else argv[1]
+panda = Panda(generic=arch)
+
+@panda.queue_blocking
+def run_cmd():
+    panda.revert_sync("root")
+    print(panda.run_serial_cmd("uname -a"))
+    panda.end_analysis()
+
+counter = 0
+on = False
+
+panda.qlog.enable("panda")
+
+@panda.cb_asid_changed
+def asidchange(cpu, tb,asdf):
+    global counter, on
+    panda.qlog.log("hello from pypanda")
+    if counter == 0:
+        if not on:
+            print("file")
+            panda.qlog.output_to_file("fout")
+        else:
+            print("screen")
+            # panda.qlog.tb_op_disable()
+            panda.qlog.output_to_stderr()
+        on = not on
+    counter = (counter + 1) % 2
+    from time import sleep
+    sleep(1)
+    return 0
+
+panda.run()
diff --git a/util/log.c b/util/log.c
index b676732b9f8..f8022b3eb71 100644
--- a/util/log.c
+++ b/util/log.c
@@ -263,6 +263,8 @@ const QEMULogItem qemu_log_items[] = {
       "show micro ops after optimization" },
     { CPU_LOG_TB_OP_IND, "op_ind",
       "show micro ops before indirect lowering" },
+    { LOG_PANDA, "panda",
+        "Provides QEMU logging for some PANDA things. This is not pandalog. RR is separate as well."},
     { CPU_LOG_INT, "int",
       "show interrupts/exceptions in short format" },
     { CPU_LOG_EXEC, "exec",

From ccfa7e590e632b454c5e6db5deb3813ec3bd615a Mon Sep 17 00:00:00 2001
From: Andrew Fasano <fasano@mit.edu>
Date: Mon, 21 Feb 2022 22:59:16 -0500
Subject: [PATCH 043/140] Proc_trace bugfix: fix missing import

---
 panda/plugins/proc_trace/graph.py | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/panda/plugins/proc_trace/graph.py b/panda/plugins/proc_trace/graph.py
index 007a41db8bc..2e7bd2a0d5a 100644
--- a/panda/plugins/proc_trace/graph.py
+++ b/panda/plugins/proc_trace/graph.py
@@ -7,6 +7,8 @@
     panda-system-x86_64 -m 1g -os linux-64-ubuntu:4.15.0-72-generic-noaslr-nokaslr -replay trace_test -panda snake_hook:files=graph.py
 '''
 
+from pandare import PyPlugin
+
 class ProcGraph(PyPlugin):
     def __init__(self, panda):
         # Data collection

From 047266e26ae4f1a9644ced9878fce3639fd14f80 Mon Sep 17 00:00:00 2001
From: Luke Craig <lacraig3@gmail.com>
Date: Wed, 23 Feb 2022 10:28:06 -0500
Subject: [PATCH 044/140] add qlog missing from 1114

---
 panda/python/core/pandare/include/qlog.h | 3 +++
 1 file changed, 3 insertions(+)
 create mode 100644 panda/python/core/pandare/include/qlog.h

diff --git a/panda/python/core/pandare/include/qlog.h b/panda/python/core/pandare/include/qlog.h
new file mode 100644
index 00000000000..d3a97a531a9
--- /dev/null
+++ b/panda/python/core/pandare/include/qlog.h
@@ -0,0 +1,3 @@
+void qemu_log_close(void);
+void qemu_set_log(unsigned int log_flags);
+int qemu_log(const char *fmt, ...);
\ No newline at end of file

From 14dd6aa966e6838c9e92a9e2197b6534762adf0e Mon Sep 17 00:00:00 2001
From: Marius Muench <m.muench@vu.nl>
Date: Fri, 25 Feb 2022 17:21:57 +0100
Subject: [PATCH 045/140] move avatar output (i.e., configurable machine)
 behind log flag (#1175)

Co-authored-by: Luke Craig <lacraig3@gmail.com>
---
 hw/avatar/configurable_machine.c          | 27 ++++++++++++-----------
 include/qemu/log.h                        |  1 +
 panda/python/core/pandare/qemu_logging.py |  2 ++
 util/log.c                                |  2 ++
 4 files changed, 19 insertions(+), 13 deletions(-)

diff --git a/hw/avatar/configurable_machine.c b/hw/avatar/configurable_machine.c
index f010b6b7b6f..d77cb8d6e1b 100644
--- a/hw/avatar/configurable_machine.c
+++ b/hw/avatar/configurable_machine.c
@@ -22,6 +22,7 @@
 
 //general imports
 #include "qemu/osdep.h"
+#include "qemu/log.h"
 #include "sysemu/sysemu.h"
 #include "exec/address-spaces.h"
 #include "hw/hw.h"
@@ -218,7 +219,7 @@ static off_t get_file_size(const char * path)
 
     if (stat(path, &stats))
     {
-        printf("ERROR: Getting file size for file %s\n", path);
+        fprintf(stderr, "ERROR: Getting file size for file %s\n", path);
         return 0;
     }
 
@@ -284,7 +285,7 @@ static void init_memory_area(QDict *mapping, const char *kernel_filename)
     QDICT_ASSERT_KEY_TYPE(mapping, "address", QTYPE_QINT);
     address = qdict_get_int(mapping, "address");
 
-    printf("Configurable: Adding memory region %s (size: 0x%"
+    qemu_log_mask(LOG_AVATAR, "Configurable: Adding memory region %s (size: 0x%"
            PRIx64 ") at address 0x%" PRIx64 "\n", name, size, address);
     memory_region_add_subregion(sysmem, address, ram);
 
@@ -292,7 +293,7 @@ static void init_memory_area(QDict *mapping, const char *kernel_filename)
         QDICT_ASSERT_KEY_TYPE(mapping, "alias_at", QTYPE_QINT);
         alias_address = qdict_get_int(mapping, "alias_at");
 
-        printf("Configurable: Adding alias to region %s at address 0x%" PRIx64 "\n", name, alias_address);
+        qemu_log_mask(LOG_AVATAR, "Configurable: Adding alias to region %s at address 0x%" PRIx64 "\n", name, alias_address);
         MemoryRegion *alias;
         alias =  g_new(MemoryRegion, 1);
         memory_region_init_alias(alias, NULL, name, ram, 0, size);
@@ -343,12 +344,12 @@ static void init_memory_area(QDict *mapping, const char *kernel_filename)
           g_assert(qobject_type(qdict_get(mapping, "file_bytes")) == QTYPE_QINT);
           file_bytes = qdict_get_int(mapping, "file_bytes");
           data_size = file_bytes;
-          printf("File bytes: 0x%lx\n",data_size);
+          qemu_log_mask(LOG_AVATAR, "File bytes: 0x%lx\n",data_size);
 
         }
 
-        printf("Configurable: Inserting 0x%"
-               PRIx64 " bytes of data in memory region %s\n", data_size, name);
+        qemu_log_mask(LOG_AVATAR, "Configurable: Inserting %"
+               PRIx64 " bytes of data from %" PRIx64 " in memory region %s\n", data_size, file_offset, name);
         //Size of data to put into a RAM region needs to fit in the RAM region
         g_assert(data_size <= size);
 
@@ -361,10 +362,9 @@ static void init_memory_area(QDict *mapping, const char *kernel_filename)
         close(file);
 
         //And copy the data to the memory, if it is initialized
-        printf("Configurable: Copying 0x%" PRIx64
-               " byte of data from file %s beginning at offset 0x%" PRIx64
-               " to address 0x%" PRIx64
-               "\n", data_size, filename, file_offset,address);
+        qemu_log_mask(LOG_AVATAR, "Configurable: Copying 0x%" PRIx64
+               " byte of data from file %s to address 0x%" PRIx64
+               "\n", data_size, filename, address);
         cpu_physical_memory_write_rom(&address_space_memory,
                                       address, (uint8_t *) data, data_size);
         g_free(data);
@@ -389,7 +389,7 @@ static void init_peripheral(QDict *device)
     address = qdict_get_int(device, "address");
     name = qdict_get_str(device, "name");
 
-    printf("Configurable: Adding peripheral[%s] region %s at address 0x%" PRIx64 "\n", 
+    qemu_log_mask(LOG_AVATAR, "Configurable: Adding peripheral[%s] region %s at address 0x%" PRIx64 "\n",
             qemu_name, name, address);
     if (strcmp(bus, "sysbus") == 0)
     {
@@ -404,6 +404,7 @@ static void init_peripheral(QDict *device)
 
         sb = make_configurable_device(qemu_name, address, properties);
         qdict_put_obj(peripherals, name, (QObject *)sb);
+        qemu_log_mask(LOG_AVATAR, "putting %s\n", name);
     }
     else
     {
@@ -438,7 +439,7 @@ static void set_entry_point(QDict *conf, THISCPU *cpuu)
 
 #elif defined(TARGET_PPC)
     //Not implemented yet
-    printf("Not yet implemented- can't start execution at 0x%x\n", entry);
+    fprintf(stderr, "Not yet implemented- can't start execution at 0x%x\n", entry);
 #endif
 
 }
@@ -465,7 +466,7 @@ static THISCPU *create_cpu(MachineState * ms, QDict *conf)
     if (!cpu_model) cpu_model = "arm926";
 #endif
 
-    printf("Configurable: Adding processor %s\n", cpu_model);
+    qemu_log_mask(LOG_AVATAR, "Configurable: Adding processor %s\n", cpu_model);
 
     cpu_oc = cpu_class_by_name(TYPE_ARM_CPU, cpu_model);
     if (!cpu_oc) {
diff --git a/include/qemu/log.h b/include/qemu/log.h
index cf7226362f0..95a992c740c 100644
--- a/include/qemu/log.h
+++ b/include/qemu/log.h
@@ -44,6 +44,7 @@ static inline bool qemu_log_separate(void)
 #define LOG_TRACE          (1 << 15)
 #define CPU_LOG_TB_OP_IND  (1 << 16)
 #define LOG_PANDA          (1 << 17)
+#define LOG_AVATAR         (1 << 18)
 #define CPU_LOG_TAINT_OPS  (1 << 28)
 #define CPU_LOG_RR         (1 << 29)
 #define CPU_LOG_LLVM_IR    (1 << 30)
diff --git a/panda/python/core/pandare/qemu_logging.py b/panda/python/core/pandare/qemu_logging.py
index beadcd13d2c..97bd919edec 100644
--- a/panda/python/core/pandare/qemu_logging.py
+++ b/panda/python/core/pandare/qemu_logging.py
@@ -38,6 +38,7 @@ class QEMU_Log_Manager:
         - TRACE
         - TB_OP_IND
         - PANDA
+        - AVATAR
         - TAINT_OPS
         - RR
         - LLVM_IR
@@ -65,6 +66,7 @@ def __init__(self, panda):
             "TRACE":15,
             "TB_OP_IND":16,
             "PANDA":17,
+            "AVATAR":18,
             "TAINT_OPS":28,
             "RR":29,
             "LLVM_IR":30,
diff --git a/util/log.c b/util/log.c
index f8022b3eb71..4a5fa81a7a9 100644
--- a/util/log.c
+++ b/util/log.c
@@ -265,6 +265,8 @@ const QEMULogItem qemu_log_items[] = {
       "show micro ops before indirect lowering" },
     { LOG_PANDA, "panda",
         "Provides QEMU logging for some PANDA things. This is not pandalog. RR is separate as well."},
+    { LOG_AVATAR, "avatar",
+      "Show avatar related events (including configurable machine)" },
     { CPU_LOG_INT, "int",
       "show interrupts/exceptions in short format" },
     { CPU_LOG_EXEC, "exec",

From 6512ecde58e8d55299685206a438720d6b6ec9e2 Mon Sep 17 00:00:00 2001
From: Luke Craig <lacraig3@gmail.com>
Date: Fri, 25 Feb 2022 11:32:33 -0500
Subject: [PATCH 046/140] add checks for stdout in tty

---
 panda/python/core/pandare/utils.py | 18 +++++++++++++-----
 1 file changed, 13 insertions(+), 5 deletions(-)

diff --git a/panda/python/core/pandare/utils.py b/panda/python/core/pandare/utils.py
index d110a6ca194..8ca3bf87eae 100644
--- a/panda/python/core/pandare/utils.py
+++ b/panda/python/core/pandare/utils.py
@@ -7,7 +7,7 @@
 from functools import wraps
 from os import devnull
 from subprocess import check_call, STDOUT
-from sys import platform
+from sys import platform, stdout
 from threading import current_thread, main_thread
 
 # Set to enable pypanda debugging
@@ -15,15 +15,23 @@
 
 def progress(msg):
     """
-    Print a message with a green "[PYPANDA]" prefix
+    Print a message with a green "[PYPANDA]" prefix if in a tty
+    otherwise just print the message
     """
-    print(Fore.GREEN + '[PYPANDA] ' + Fore.RESET + Style.BRIGHT + msg +Style.RESET_ALL)
+    if stdout.isatty():
+        print(Fore.GREEN + '[PYPANDA] ' + Fore.RESET + Style.BRIGHT + msg +Style.RESET_ALL)
+    else:
+        print(f"[PYPANDA] {msg}")
 
 def warn(msg):
     """
-    Print a message with a red "[PYPANDA]" prefix
+    Print a message with a red "[PYPANDA]" prefix if in a tty
+    otherwise just print the message
     """
-    print(Fore.RED + '[PYPANDA] ' + Fore.RESET + Style.BRIGHT + msg +Style.RESET_ALL)
+    if stdout.isatty():
+        print(Fore.RED + '[PYPANDA] ' + Fore.RESET + Style.BRIGHT + msg +Style.RESET_ALL)
+    else:
+        print(f"[PYPANDA] {msg}")
 
 def make_iso(directory, iso_path):
     '''

From a28e40bd27c2752443c9d5eb76a74accfd5b2570 Mon Sep 17 00:00:00 2001
From: Mark Mankins <31133733+MarkMankins@users.noreply.github.com>
Date: Tue, 1 Mar 2022 12:19:34 -0500
Subject: [PATCH 047/140] Expose windows process manager so it can be leveraged
 by other plugins. (#1182)

---
 panda/plugins/wintrospection/wintrospection.cpp       | 5 +++++
 panda/plugins/wintrospection/wintrospection_int_fns.h | 2 ++
 2 files changed, 7 insertions(+)

diff --git a/panda/plugins/wintrospection/wintrospection.cpp b/panda/plugins/wintrospection/wintrospection.cpp
index c23e984afdc..93e28e624d8 100644
--- a/panda/plugins/wintrospection/wintrospection.cpp
+++ b/panda/plugins/wintrospection/wintrospection.cpp
@@ -54,6 +54,7 @@ void uninit_plugin(void *);
 int64_t get_file_handle_pos(CPUState *cpu, uint64_t handle);
 char *get_cwd(CPUState *cpu);
 char *get_handle_name(CPUState *cpu, uint64_t handle);
+void *get_windows_process_manager(void);
 }
 
 void on_get_current_thread(CPUState *cpu, OsiThread *out);
@@ -92,6 +93,10 @@ static std::map<std::string, uint64_t> system_asid_lookup = {
   {"windows-64-7sp1", 0x187000},
 };
 
+void *get_windows_process_manager(void) {
+  return g_process_manager.get();
+}
+
 /* ******************************************************************
  Helpers
 ****************************************************************** */
diff --git a/panda/plugins/wintrospection/wintrospection_int_fns.h b/panda/plugins/wintrospection/wintrospection_int_fns.h
index bbedc475d09..495bc660154 100644
--- a/panda/plugins/wintrospection/wintrospection_int_fns.h
+++ b/panda/plugins/wintrospection/wintrospection_int_fns.h
@@ -5,3 +5,5 @@ char *get_handle_name(CPUState *cpu, uint64_t handle);
 char *get_cwd(CPUState *cpu);
 
 int64_t get_file_handle_pos(CPUState *cpu, uint64_t handle);
+
+void *get_windows_process_manager(void);

From 9bb57d0d75c86372d94449c1f7d50cf1d7a3c5ab Mon Sep 17 00:00:00 2001
From: Luke Craig <lacraig3@gmail.com>
Date: Wed, 9 Mar 2022 21:17:12 -0500
Subject: [PATCH 048/140] Fix taint inconsistency (#1185)

---
 panda/python/core/pandare/panda.py | 161 ++++++++++++++---------------
 1 file changed, 75 insertions(+), 86 deletions(-)

diff --git a/panda/python/core/pandare/panda.py b/panda/python/core/pandare/panda.py
index b1bff912dd8..b2064c69844 100755
--- a/panda/python/core/pandare/panda.py
+++ b/panda/python/core/pandare/panda.py
@@ -220,8 +220,6 @@ def __init__(self, arch="i386", mem="128M",
 
         self._initialized_panda = False
         self.disabled_tb_chaining = False
-        self.taint_enabled = False
-        self.taint_sym_enabled = False
         self.named_hooks = {}
         self.hook_list = []
         self.hook_list2 = {}
@@ -655,6 +653,10 @@ def require(self, name):
         Load a C plugin with no arguments. Deprecated. Use load_plugin
         '''
         self.load_plugin(name, args={})
+    
+    def _plugin_loaded(self, name):
+        name_c = self.ffi.new("char[]", bytes(name, "utf-8"))
+        return self.libpanda.panda_get_plugin_by_name(name_c) != self.ffi.NULL
 
     def load_plugin(self, name, args={}):
         '''
@@ -1868,71 +1870,65 @@ def unregister_pyperipheral(self, pyperiph):
             self.disable_callback("pyperipheral_write_callback", forever=True)
             self.pyperipherals_registered_cb = False
         return True
+    
 
     ############## TAINT FUNCTIONS ###############
     # Convenience methods for interacting with the taint subsystem.
-    def taint_enable(self, cont=True):
-        """
-        Inform python that taint is enabled.
-        """
-        if not self.taint_enabled:
-            progress("taint not enabled -- enabling")
-            self.vm_stop()
-            self.load_plugin("taint2")
-#            self.queue_main_loop_wait_fn(self.load_plugin, ["taint2"])
-            self.queue_main_loop_wait_fn(self.plugins['taint2'].taint2_enable_taint, [])
-            if cont:
-                self.queue_main_loop_wait_fn(self.libpanda.panda_cont, [])
-            self.taint_enabled = True
-
-    # label all bytes in this register.
-    # or at least four of them
-    def taint_label_reg(self, reg_num, label):
-        self.taint_enable(cont=False)
-        #if debug:
-        #    progress("taint_reg reg=%d label=%d" % (reg_num, label))
 
-        # XXX must ensure labeling is done in a before_block_invalidate that rets 1
-        #     or some other safe way where the main_loop_wait code will always be run
-        #self.stop()
+    def taint_enabled(self):
+        '''
+        Checks to see if taint2 plugin has been loaded
+        '''
+        return self._plugin_loaded("taint2") and self.plugins["taint2"].taint2_enabled()
+
+    def taint_enable(self):
+        '''
+        Enable taint.
+        '''
+        self.plugins["taint2"].taint2_enable_taint()
+    
+    def _assert_taint_enabled(self):
+        if not self.taint_enabled():
+            raise Exception("taint2 must be loaded before tainting values")
+
+    def taint_label_reg(self, reg_num, label):
+        '''
+        Labels taint register reg_num with label.
+        '''
+        self._assert_taint_enabled()
         for i in range(self.register_size):
-            self.queue_main_loop_wait_fn(self.plugins['taint2'].taint2_label_reg, [reg_num, i, label])
-        self.queue_main_loop_wait_fn(self.libpanda.panda_cont, [])
+            self.plugins["taint2"].taint2_label_reg(reg_num, i, label)
 
     def taint_label_ram(self, addr, label):
-        self.taint_enable(cont=False)
-        #if debug:
-            #progress("taint_ram addr=0x%x label=%d" % (addr, label))
-
-        # XXX must ensure labeling is done in a before_block_invalidate that rets 1
-        #     or some other safe way where the main_loop_wait code will always be run
-        #self.stop()
-        self.queue_main_loop_wait_fn(self.plugins['taint2'].taint2_label_ram, [addr, label])
-        self.queue_main_loop_wait_fn(self.libpanda.panda_cont, [])
+        '''
+        Labels ram at address with label.
+        '''
+        self._assert_taint_enabled()
+        self.plugins["taint2"].taint2_label_ram(addr, label)
 
-    # returns true if any bytes in this register have any taint labels
     def taint_check_reg(self, reg_num):
-        if not self.taint_enabled: return False
-#        if debug:
-#            progress("taint_check_reg %d" % (reg_num))
+        '''
+        Checks if register reg_num is tainted. Returns boolean.
+        '''
+        self._assert_taint_enabled()
         for offset in range(self.register_size):
             if self.plugins['taint2'].taint2_query_reg(reg_num, offset) > 0:
                 return True
+        return False
 
-    # returns true if this physical address is tainted
     def taint_check_ram(self, addr):
-        if not self.taint_enabled: return False
-        if self.plugins['taint2'].taint2_query_ram(addr) > 0:
-            return True
+        '''
+        returns boolean representing if physical address is tainted.
+        '''
+        self._assert_taint_enabled()
+        return self.plugins['taint2'].taint2_query_ram(addr) > 0
 
     def taint_get_reg(self, reg_num):
         '''
         Returns array of results, one for each byte in this register
         None if no taint.  QueryResult struct otherwise
         '''
-        if not self.taint_enabled: return None
-        if debug:
-            progress("taint_get_reg %d" % (reg_num))
+        self._assert_taint_enabled()
         res = []
         for offset in range(self.register_size):
             if self.plugins['taint2'].taint2_query_reg(reg_num, offset) > 0:
@@ -1944,10 +1940,12 @@ def taint_get_reg(self, reg_num):
                 res.append(None)
         return res
 
-    # returns array of results, one for each byte in this register
-    # None if no taint.  QueryResult struct otherwise
     def taint_get_ram(self, addr):
-        if not self.taint_enabled: return None
+        '''
+        returns array of results, one for each byte in this register
+        None if no taint.  QueryResult struct otherwise
+        '''
+        self._assert_taint_enabled()
         if self.plugins['taint2'].taint2_query_ram(addr) > 0:
             query_res = self.ffi.new("QueryResult *")
             self.plugins['taint2'].taint2_query_ram_full(addr, query_res)
@@ -1956,16 +1954,19 @@ def taint_get_ram(self, addr):
         else:
             return None
 
-    # returns true if this laddr is tainted
     def taint_check_laddr(self, addr, off):
-        if not self.taint_enabled: return False
-        if self.plugins['taint2'].taint2_query_laddr(addr, off) > 0:
-            return True
+        '''
+        returns boolean result checking if this laddr is tainted
+        '''
+        self._assert_taint_enabled()
+        return self.plugins['taint2'].taint2_query_laddr(addr, off) > 0
 
-    # returns array of results, one for each byte in this laddr
-    # None if no taint.  QueryResult struct otherwise
     def taint_get_laddr(self, addr, offset):
-        if not self.taint_enabled: return None
+        '''
+        returns array of results, one for each byte in this laddr
+        None if no taint.  QueryResult struct otherwise
+        '''
+        self._assert_taint_enabled()
         if self.plugins['taint2'].taint2_query_laddr(addr, offset) > 0:
             query_res = self.ffi.new("QueryResult *")
             self.plugins['taint2'].taint2_query_laddr_full(addr, offset, query_res)
@@ -1975,43 +1976,31 @@ def taint_get_laddr(self, addr, offset):
             return None
 
     # enables symbolic tracing
-    def taint_sym_enable(self, cont=True):
+    def taint_sym_enable(self):
         """
         Inform python that taint is enabled.
         """
-        if not self.taint_enabled:
+        if not self.taint_enabled():
+            self.taint_enable()
             progress("taint symbolic not enabled -- enabling")
-            self.vm_stop()
-            self.load_plugin("taint2")
-#            self.queue_main_loop_wait_fn(self.load_plugin, ["taint2"])
-        if not self.taint_sym_enabled:
-            self.queue_main_loop_wait_fn(self.plugins['taint2'].taint2_enable_sym, [])
-            if cont:
-                self.queue_main_loop_wait_fn(self.libpanda.panda_cont, [])
-            self.taint_enabled = True
+        self.plugins["taint2"].taint2_enable_sym()
+    
+    def _assert_taint_sym_enabled(self):
+        self._assert_taint_enabled()
+        self.plugins['taint2'].taint2_enable_sym()
 
     def taint_sym_label_ram(self, addr, label):
-        self.taint_sym_enable(cont=False)
-        #if debug:
-            #progress("taint_ram addr=0x%x label=%d" % (addr, label))
-
-        # XXX must ensure labeling is done in a before_block_invalidate that rets 1
-        #     or some other safe way where the main_loop_wait code will always be run
-        #self.stop()
-        self.queue_main_loop_wait_fn(self.plugins['taint2'].taint2_sym_label_ram, [addr, label])
-        self.queue_main_loop_wait_fn(self.libpanda.panda_cont, [])
-
-    # label all bytes in this register.
-    # or at least four of them
-    # XXX label must increment by panda.register_size after the call
+        self._assert_taint_sym_enabled()
+        self.plugins['taint2'].taint2_sym_label_ram(addr,label)
+
     def taint_sym_label_reg(self, reg_num, label):
-        self.taint_sym_enable(cont=False)
-        # XXX must ensure labeling is done in a before_block_invalidate that rets 1
-        #     or some other safe way where the main_loop_wait code will always be run
-        #self.stop()
+        # label all bytes in this register.
+        # or at least four of them
+        # XXX label must increment by panda.register_size after the call
+        self._assert_taint_sym_enabled()
+        self.taint_sym_enable()
         for i in range(self.register_size):
-            self.queue_main_loop_wait_fn(self.plugins['taint2'].taint2_sym_label_reg, [reg_num, i, label+i])
-        self.queue_main_loop_wait_fn(self.libpanda.panda_cont, [])
+            self.plugins['taint2'].taint2_sym_label_reg(reg_num, i, label+i)
     
     # Deserialize a z3 solver
     # Lazy import z3. 

From 4ec9d3153cb2a97078c215680f21da691aa02dcc Mon Sep 17 00:00:00 2001
From: Luke Craig <lacraig3@gmail.com>
Date: Wed, 16 Mar 2022 17:08:21 -0400
Subject: [PATCH 049/140] Change panda_current_pc to use precise pc if enabled
 (#1176)

---
 cputlb.c                                         |  3 +++
 memory.c                                         |  7 +++++--
 panda/docs/manual.md                             |  6 +++++-
 panda/include/panda/common.h                     |  2 +-
 .../plugins/callstack_instr/callstack_instr.cpp  |  2 +-
 panda/plugins/func_stats/func_stats.cpp          |  2 +-
 panda/plugins/ida_taint2/ida_taint2.cpp          |  2 +-
 panda/plugins/mmio_trace/mmio_trace.cpp          |  4 ++--
 panda/plugins/taint2/taint_sym_api.cpp           |  2 +-
 panda/src/cb-support.c                           | 16 ++++++++--------
 panda/src/common.c                               | 15 ++++++++++-----
 softmmu_template.h                               | 16 ++++++++--------
 12 files changed, 46 insertions(+), 31 deletions(-)

diff --git a/cputlb.c b/cputlb.c
index a7a1a672987..168f9488eca 100644
--- a/cputlb.c
+++ b/cputlb.c
@@ -36,6 +36,9 @@
 #include "panda/rr/rr_log.h"
 #include "panda/callbacks/cb-support.h"
 
+// less frustrating than importing common.h
+extern target_ulong panda_current_pc(CPUState *cpu);
+
 /* DEBUG defines, enable DEBUG_TLB_LOG to log to the CPU_LOG_MMU target */
 /* #define DEBUG_TLB */
 /* #define DEBUG_TLB_LOG */
diff --git a/memory.c b/memory.c
index 4dccb537a77..d7680d841e9 100644
--- a/memory.c
+++ b/memory.c
@@ -34,6 +34,9 @@
 #include "panda/rr/rr_log_all.h"
 #include "panda/callbacks/cb-support.h"
 
+// less annoying than importing all common.h
+extern target_ulong panda_current_pc(CPUState *cpu);
+
 static unsigned memory_region_transaction_depth;
 static bool memory_region_update_pending;
 static bool ioeventfd_update_pending;
@@ -1103,7 +1106,7 @@ static uint64_t _unassigned_mem_read(void *opaque, hwaddr addr,
     if (current_cpu != NULL) {
         // PANDA callback may create a value. If so, avoid error-handling code
         if (panda_callbacks_unassigned_io_read(current_cpu,
-                    current_cpu->panda_guest_pc, addr, size, &val)) { // Modifies val
+                    panda_current_pc(current_cpu), addr, size, &val)) { // Modifies val
             *changed = true; // Indicates a callback has changed the value
             return val;
         }
@@ -1127,7 +1130,7 @@ static bool _unassigned_mem_write(void *opaque, hwaddr addr,
 #endif
 
     if (current_cpu != NULL) {
-        if (panda_callbacks_unassigned_io_write(current_cpu, current_cpu->panda_guest_pc, addr, size, val)) {
+        if (panda_callbacks_unassigned_io_write(current_cpu, panda_current_pc(current_cpu), addr, size, val)) {
             // A plugin has decided to make this write look like it's valid
             return true;
         }
diff --git a/panda/docs/manual.md b/panda/docs/manual.md
index ddebfad5b4b..16f5ac506e2 100644
--- a/panda/docs/manual.md
+++ b/panda/docs/manual.md
@@ -273,7 +273,7 @@ void panda_disable_precise_pc(void);
 ```
 These functions enable or disable precise tracking of the program counter.
 After enabling precise PC tracking, the program counter will be available in
-`env->panda_guest_pc` and can be assumed to accurately reflect the guest state.
+`env->panda_guest_pc` and can be assumed to accurately reflect the guest state. In most cases the helper function `panda_current_pc` should be used. It will provide the precise PC if enabled.
 
 Some plugins (`taint2`, `callstack_instr`, etc) add instrumentation that runs
 *inside* a basic block of emulated code.  If such a plugin is enabled mid-replay
@@ -375,6 +375,10 @@ Possible return values are:
     ```
     Writes a textual representation of disassembly of the guest code
     at virtual address `code` of `size` bytes.
+  * ```C
+    target_ulong panda_current_pc(CPUState *cpu);
+    ```
+    Returns current program counter. If `panda_precise_pc` has been enabled it returns the precise value.
 
 ## Record/Replay Details
 
diff --git a/panda/include/panda/common.h b/panda/include/panda/common.h
index 3165fe2ed8b..fe7038e56b8 100644
--- a/panda/include/panda/common.h
+++ b/panda/include/panda/common.h
@@ -366,7 +366,7 @@ static inline bool address_in_kernel_code_linux(target_ulong addr){
  * Therefore, certain analysis logic can't rely on panda_in_kernel_mode() alone.
  */
 static inline bool panda_in_kernel_code_linux(CPUState *cpu) {
-    return address_in_kernel_code_linux(cpu->panda_guest_pc);
+    return address_in_kernel_code_linux(panda_current_pc(cpu));
 }
 
 /**
diff --git a/panda/plugins/callstack_instr/callstack_instr.cpp b/panda/plugins/callstack_instr/callstack_instr.cpp
index 375242e98b6..93fcac6cedb 100644
--- a/panda/plugins/callstack_instr/callstack_instr.cpp
+++ b/panda/plugins/callstack_instr/callstack_instr.cpp
@@ -459,7 +459,7 @@ void get_prog_point(CPUState* cpu, prog_point *p) {
 
     }
 
-    p->pc = cpu->panda_guest_pc;
+    p->pc = panda_current_pc(cpu);
 }
 
 // prepare OSI support that is needed for the threaded stack type
diff --git a/panda/plugins/func_stats/func_stats.cpp b/panda/plugins/func_stats/func_stats.cpp
index a4682d3b24b..7c05e17e720 100755
--- a/panda/plugins/func_stats/func_stats.cpp
+++ b/panda/plugins/func_stats/func_stats.cpp
@@ -330,7 +330,7 @@ target_ulong get_current_function(CPUState *cpu){
 void initialize_call_obj(CPUState *cpu, Asid curr_asid, target_ulong entrypoint){
     call_infos[entrypoint].asid = curr_asid;
     call_infos[entrypoint].entrypoint =  entrypoint;
-    call_infos[entrypoint].pc = cpu->panda_guest_pc; //same as the passed pc to mem callbacks, get_prog_point, but diferent than tb->pc, since tb->pc is the start of the block, while pc is the trigger
+    call_infos[entrypoint].pc = panda_current_pc(cpu); //same as the passed pc to mem callbacks, get_prog_point, but diferent than tb->pc, since tb->pc is the start of the block, while pc is the trigger
     call_infos[entrypoint].rr_instr_count =  rr_get_guest_instr_count();
 
     // Get the callstack and functionstack for each call.
diff --git a/panda/plugins/ida_taint2/ida_taint2.cpp b/panda/plugins/ida_taint2/ida_taint2.cpp
index 95a07cfb467..13e8f9dd7d4 100644
--- a/panda/plugins/ida_taint2/ida_taint2.cpp
+++ b/panda/plugins/ida_taint2/ida_taint2.cpp
@@ -78,7 +78,7 @@ void taint_state_changed(Addr a, uint64_t size)
 
     // Get current PID (if in user-mode and OSI gave us a process) and PC.
     IDATaintReport report;
-    report.pc = first_cpu->panda_guest_pc;
+    report.pc = panda_current_pc(first_cpu);
     report.pid = 0;
     char *process_name = NULL;
     if (false == panda_in_kernel(first_cpu)) {
diff --git a/panda/plugins/mmio_trace/mmio_trace.cpp b/panda/plugins/mmio_trace/mmio_trace.cpp
index 3d062f402d6..2955890ffe5 100644
--- a/panda/plugins/mmio_trace/mmio_trace.cpp
+++ b/panda/plugins/mmio_trace/mmio_trace.cpp
@@ -34,14 +34,14 @@ extern "C" {
 
 // PANDA_CB_MMIO_AFTER_READ callback
 void buffer_mmio_read(CPUState *env, target_ptr_t physaddr, target_ptr_t vaddr, size_t size, uint64_t *val) {
-    mmio_event_t new_event{'R', env->panda_guest_pc, physaddr, vaddr, size, *val, default_dev_name};
+    mmio_event_t new_event{'R', panda_current_pc(env), physaddr, vaddr, size, *val, default_dev_name};
     mmio_events.push_back(new_event);
     return;
 }
 
 // PANDA_CB_MMIO_BEFORE_WRITE callback
 void buffer_mmio_write(CPUState *env, target_ptr_t physaddr, target_ptr_t vaddr, size_t size, uint64_t *val) {
-    mmio_event_t new_event{'W', env->panda_guest_pc, physaddr, vaddr, size, *val, default_dev_name};
+    mmio_event_t new_event{'W', panda_current_pc(env), physaddr, vaddr, size, *val, default_dev_name};
     mmio_events.push_back(new_event);
     return;
 }
diff --git a/panda/plugins/taint2/taint_sym_api.cpp b/panda/plugins/taint2/taint_sym_api.cpp
index 648a1b3bf94..c8b21297a9b 100644
--- a/panda/plugins/taint2/taint_sym_api.cpp
+++ b/panda/plugins/taint2/taint_sym_api.cpp
@@ -133,7 +133,7 @@ void reg_branch_pc(z3::expr condition, bool concrete) {
     if(!symexEnabled) taint2_enable_sym();
 
     z3::expr pc(context);
-    target_ulong current_pc = first_cpu->panda_guest_pc;
+    target_ulong current_pc = panda_current_pc(first_cpu);
 
     pc = (concrete ? condition : !condition);
 #ifndef SYM_NOOPT
diff --git a/panda/src/cb-support.c b/panda/src/cb-support.c
index 781cd7fd9ab..158a61ebb7f 100644
--- a/panda/src/cb-support.c
+++ b/panda/src/cb-support.c
@@ -306,7 +306,7 @@ void PCB(mem_before_read)(CPUState *env, target_ptr_t pc, target_ptr_t addr,
     panda_cb_list *plist;
     for(plist = panda_cbs[PANDA_CB_VIRT_MEM_BEFORE_READ]; plist != NULL;
         plist = panda_cb_list_next(plist)) {
-        if (plist->enabled) plist->entry.virt_mem_before_read(plist->context, env, env->panda_guest_pc, addr,
+        if (plist->enabled) plist->entry.virt_mem_before_read(plist->context, env, panda_current_pc(env), addr,
                                                               data_size);
     }
     if (panda_cbs[PANDA_CB_PHYS_MEM_BEFORE_READ]) {
@@ -314,7 +314,7 @@ void PCB(mem_before_read)(CPUState *env, target_ptr_t pc, target_ptr_t addr,
         if (paddr == -1) return;
         for(plist = panda_cbs[PANDA_CB_PHYS_MEM_BEFORE_READ]; plist != NULL;
             plist = panda_cb_list_next(plist)) {
-            if (plist->enabled) plist->entry.phys_mem_before_read(plist->context, env, env->panda_guest_pc,
+            if (plist->enabled) plist->entry.phys_mem_before_read(plist->context, env, panda_current_pc(env),
                                                                   paddr, data_size);
         }
     }
@@ -327,7 +327,7 @@ void PCB(mem_after_read)(CPUState *env, target_ptr_t pc, target_ptr_t addr,
     for(plist = panda_cbs[PANDA_CB_VIRT_MEM_AFTER_READ]; plist != NULL;
         plist = panda_cb_list_next(plist)) {
         /* mstamat: Passing &result as the last cb arg doesn't make much sense. */
-        if (plist->enabled) plist->entry.virt_mem_after_read(plist->context, env, env->panda_guest_pc, addr,
+        if (plist->enabled) plist->entry.virt_mem_after_read(plist->context, env, panda_current_pc(env), addr,
                                          data_size, (uint8_t *)&result);
     }
     if (panda_cbs[PANDA_CB_PHYS_MEM_AFTER_READ]) {
@@ -336,7 +336,7 @@ void PCB(mem_after_read)(CPUState *env, target_ptr_t pc, target_ptr_t addr,
         for(plist = panda_cbs[PANDA_CB_PHYS_MEM_AFTER_READ]; plist != NULL;
             plist = panda_cb_list_next(plist)) {
             /* mstamat: Passing &result as the last cb arg doesn't make much sense. */
-            if (plist->enabled) plist->entry.phys_mem_after_read(plist->context, env, env->panda_guest_pc, paddr,
+            if (plist->enabled) plist->entry.phys_mem_after_read(plist->context, env, panda_current_pc(env), paddr,
                                              data_size, (uint8_t *)&result);
         }
     }
@@ -349,7 +349,7 @@ void PCB(mem_before_write)(CPUState *env, target_ptr_t pc, target_ptr_t addr,
     for(plist = panda_cbs[PANDA_CB_VIRT_MEM_BEFORE_WRITE]; plist != NULL;
         plist = panda_cb_list_next(plist)) {
         /* mstamat: Passing &val as the last arg doesn't make much sense. */
-        if (plist->enabled) plist->entry.virt_mem_before_write(plist->context, env, env->panda_guest_pc, addr,
+        if (plist->enabled) plist->entry.virt_mem_before_write(plist->context, env, panda_current_pc(env), addr,
                                            data_size, (uint8_t *)&val);
     }
     if (panda_cbs[PANDA_CB_PHYS_MEM_BEFORE_WRITE]) {
@@ -358,7 +358,7 @@ void PCB(mem_before_write)(CPUState *env, target_ptr_t pc, target_ptr_t addr,
         for(plist = panda_cbs[PANDA_CB_PHYS_MEM_BEFORE_WRITE]; plist != NULL;
             plist = panda_cb_list_next(plist)) {
             /* mstamat: Passing &val as the last cb arg doesn't make much sense. */
-            if (plist->enabled) plist->entry.phys_mem_before_write(plist->context, env, env->panda_guest_pc, paddr,
+            if (plist->enabled) plist->entry.phys_mem_before_write(plist->context, env, panda_current_pc(env), paddr,
                                                data_size, (uint8_t *)&val);
         }
     }
@@ -371,7 +371,7 @@ void PCB(mem_after_write)(CPUState *env, target_ptr_t pc, target_ptr_t addr,
     for (plist = panda_cbs[PANDA_CB_VIRT_MEM_AFTER_WRITE]; plist != NULL;
          plist = panda_cb_list_next(plist)) {
         /* mstamat: Passing &val as the last cb arg doesn't make much sense. */
-        if (plist->enabled) plist->entry.virt_mem_after_write(plist->context, env, env->panda_guest_pc, addr,
+        if (plist->enabled) plist->entry.virt_mem_after_write(plist->context, env, panda_current_pc(env), addr,
                                           data_size, (uint8_t *)&val);
     }
     if (panda_cbs[PANDA_CB_PHYS_MEM_AFTER_WRITE]) {
@@ -380,7 +380,7 @@ void PCB(mem_after_write)(CPUState *env, target_ptr_t pc, target_ptr_t addr,
         for (plist = panda_cbs[PANDA_CB_PHYS_MEM_AFTER_WRITE]; plist != NULL;
              plist = panda_cb_list_next(plist)) {
             /* mstamat: Passing &val as the last cb arg doesn't make much sense. */
-            if (plist->enabled) plist->entry.phys_mem_after_write(plist->context, env, env->panda_guest_pc, paddr,
+            if (plist->enabled) plist->entry.phys_mem_after_write(plist->context, env, panda_current_pc(env), paddr,
                                               data_size, (uint8_t *)&val);
         }
     }
diff --git a/panda/src/common.c b/panda/src/common.c
index d29be2e2b0d..b671dfb3dfc 100644
--- a/panda/src/common.c
+++ b/panda/src/common.c
@@ -146,11 +146,16 @@ target_ulong panda_current_pc(CPUState *cpu) {
     if (cpu == NULL) {
         return 0;
     }
-    CPUArchState *env = (CPUArchState *)cpu->env_ptr;
-    target_ulong pc, cs_base;
-    uint32_t flags;
-    cpu_get_tb_cpu_state(env, &pc, &cs_base, &flags);
-    return pc;
+    // give precise PC if enabled
+    if (panda_update_pc){
+        return cpu->panda_guest_pc;
+    }else{
+        CPUArchState *env = (CPUArchState *)cpu->env_ptr;
+        target_ulong pc, cs_base;
+        uint32_t flags;
+        cpu_get_tb_cpu_state(env, &pc, &cs_base, &flags);
+        return pc;
+    }
 }
 
 /**
diff --git a/softmmu_template.h b/softmmu_template.h
index c2ee6d3e61d..861ce9b3049 100644
--- a/softmmu_template.h
+++ b/softmmu_template.h
@@ -436,9 +436,9 @@ WORD_TYPE glue(helper_le_ld_name, _panda)(CPUArchState *env, target_ulong addr,
         retaddr = GETPC();
     }
 
-    panda_callbacks_mem_before_read(cpu, cpu->panda_guest_pc, addr, DATA_SIZE, (void *)haddr);
+    panda_callbacks_mem_before_read(cpu, panda_current_pc(cpu), addr, DATA_SIZE, (void *)haddr);
     WORD_TYPE ret = helper_le_ld_name(env, addr, oi, retaddr);
-    panda_callbacks_mem_after_read(cpu, cpu->panda_guest_pc, addr, DATA_SIZE, (uint64_t)ret, (void *)haddr);
+    panda_callbacks_mem_after_read(cpu, panda_current_pc(cpu), addr, DATA_SIZE, (uint64_t)ret, (void *)haddr);
     return ret;
 }
 
@@ -465,9 +465,9 @@ void glue(helper_le_st_name, _panda)(CPUArchState *env, target_ulong addr,
         retaddr = GETPC();
     }
 
-    panda_callbacks_mem_before_write(cpu, cpu->panda_guest_pc, addr, DATA_SIZE, (uint64_t)val, (void *)haddr);
+    panda_callbacks_mem_before_write(cpu, panda_current_pc(cpu), addr, DATA_SIZE, (uint64_t)val, (void *)haddr);
     helper_le_st_name(env, addr, val, oi, retaddr);
-    panda_callbacks_mem_after_write(cpu, cpu->panda_guest_pc, addr, DATA_SIZE, (uint64_t)val, (void *)haddr);
+    panda_callbacks_mem_after_write(cpu, panda_current_pc(cpu), addr, DATA_SIZE, (uint64_t)val, (void *)haddr);
 }
 
 #if DATA_SIZE > 1
@@ -493,9 +493,9 @@ WORD_TYPE glue(helper_be_ld_name, _panda)(CPUArchState *env, target_ulong addr,
         retaddr = GETPC();
     }
 
-    panda_callbacks_mem_before_read(cpu, cpu->panda_guest_pc, addr, DATA_SIZE, (void *)haddr);
+    panda_callbacks_mem_before_read(cpu, panda_current_pc(cpu), addr, DATA_SIZE, (void *)haddr);
     WORD_TYPE ret = helper_be_ld_name(env, addr, oi, retaddr);
-    panda_callbacks_mem_after_read(cpu, cpu->panda_guest_pc, addr, DATA_SIZE, (uint64_t)ret, (void *)haddr);
+    panda_callbacks_mem_after_read(cpu, panda_current_pc(cpu), addr, DATA_SIZE, (uint64_t)ret, (void *)haddr);
     return ret;
 }
 
@@ -522,9 +522,9 @@ void glue(helper_be_st_name, _panda)(CPUArchState *env, target_ulong addr,
         retaddr = GETPC();
     }
 
-    panda_callbacks_mem_before_write(cpu, cpu->panda_guest_pc, addr, DATA_SIZE, (uint64_t)val, (void *)haddr);
+    panda_callbacks_mem_before_write(cpu, panda_current_pc(cpu), addr, DATA_SIZE, (uint64_t)val, (void *)haddr);
     helper_be_st_name(env, addr, val, oi, retaddr);
-    panda_callbacks_mem_after_write(cpu, cpu->panda_guest_pc, addr, DATA_SIZE, (uint64_t)val, (void *)haddr);
+    panda_callbacks_mem_after_write(cpu, panda_current_pc(cpu), addr, DATA_SIZE, (uint64_t)val, (void *)haddr);
 }
 
 #endif /* DATA_SIZE > 1 */

From 4f504b1779c1cd054c68cfd30f5659224247929e Mon Sep 17 00:00:00 2001
From: Luke Craig <lacraig3@gmail.com>
Date: Wed, 16 Mar 2022 23:31:44 -0400
Subject: [PATCH 050/140] add get_id to panda (#1186)

---
 panda/python/core/pandare/panda.py | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/panda/python/core/pandare/panda.py b/panda/python/core/pandare/panda.py
index b2064c69844..9bcfe0a24e9 100755
--- a/panda/python/core/pandare/panda.py
+++ b/panda/python/core/pandare/panda.py
@@ -1276,6 +1276,18 @@ def current_asid(self, cpu):
             integer: value of current ASID
         '''
         return self.libpanda.panda_current_asid(cpu)
+    
+    def get_id(self, cpu):
+        '''
+        Get current hw_proc_id ID
+
+        Args:
+            cpu (CPUState): CPUState structure
+        
+        Returns:
+            integer: value of current hw_proc_id
+        '''
+        return self.plugins["hw_proc_id"].get_id(cpu)
 
     def disas2(self, code, size):
         '''

From ce291cc236a6d528b2b44fd220b6a3152309a5b1 Mon Sep 17 00:00:00 2001
From: Luke Craig <lacraig3@gmail.com>
Date: Wed, 23 Mar 2022 19:49:56 -0400
Subject: [PATCH 051/140] FIX callback enable flag not checked on some
 callbacks (#1191)

---
 panda/include/panda/callbacks/cb-helper-impl.h | 8 ++++++--
 panda/src/callbacks.c                          | 4 +++-
 2 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/panda/include/panda/callbacks/cb-helper-impl.h b/panda/include/panda/callbacks/cb-helper-impl.h
index a7f913e7268..2e2c40dd20f 100644
--- a/panda/include/panda/callbacks/cb-helper-impl.h
+++ b/panda/include/panda/callbacks/cb-helper-impl.h
@@ -19,7 +19,9 @@ void HELPER(panda_insn_exec)(target_ulong pc) {
     // PANDA instrumentation: before basic block
     panda_cb_list *plist;
     for(plist = panda_cbs[PANDA_CB_INSN_EXEC]; plist != NULL; plist = panda_cb_list_next(plist)) {
-        plist->entry.insn_exec(plist->context, first_cpu, pc);
+        if (plist->enabled) {
+            plist->entry.insn_exec(plist->context, first_cpu, pc);
+        }
     }
 }
 
@@ -27,7 +29,9 @@ void HELPER(panda_after_insn_exec)(target_ulong pc) {
     // PANDA instrumentation: after basic block
     panda_cb_list *plist;
     for(plist = panda_cbs[PANDA_CB_AFTER_INSN_EXEC]; plist != NULL; plist = panda_cb_list_next(plist)) {
-        plist->entry.after_insn_exec(plist->context, first_cpu, pc);
+        if (plist->enabled){
+            plist->entry.after_insn_exec(plist->context, first_cpu, pc);
+        }
     }
 }
 
diff --git a/panda/src/callbacks.c b/panda/src/callbacks.c
index e497e977bab..d2c98c19edb 100644
--- a/panda/src/callbacks.c
+++ b/panda/src/callbacks.c
@@ -1446,7 +1446,9 @@ void hmp_panda_plugin_cmd(Monitor *mon, const QDict *qdict) {
     panda_cb_list *plist;
     const char *cmd = qdict_get_try_str(qdict, "cmd");
     for(plist = panda_cbs[PANDA_CB_MONITOR]; plist != NULL; plist = panda_cb_list_next(plist)) {
-        plist->entry.monitor(plist->context, mon, cmd);
+        if (plist->enabled){
+            plist->entry.monitor(plist->context, mon, cmd);
+        }
     }
 }
 

From e3cd89469bd6b4c2f3a28463fb94a5fbe7c2b939 Mon Sep 17 00:00:00 2001
From: Luke Craig <lacraig3@gmail.com>
Date: Wed, 23 Mar 2022 19:50:48 -0400
Subject: [PATCH 052/140] Simplify PyPANDA callback handle (#1192)

---
 panda/python/core/pandare/panda.py | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/panda/python/core/pandare/panda.py b/panda/python/core/pandare/panda.py
index 9bcfe0a24e9..111903f3810 100755
--- a/panda/python/core/pandare/panda.py
+++ b/panda/python/core/pandare/panda.py
@@ -212,6 +212,7 @@ def __init__(self, arch="i386", mem="128M",
 
         # Callbacks
         self.register_cb_decorators()
+        self.plugin_register_count = 0
         self.registered_callbacks = {} # name -> {procname: "bash", enabled: False, callback: None}
 
         # Register asid_changed CB if and only if a callback requires procname
@@ -2681,7 +2682,8 @@ def register_callback(self, callback, function, name, enabled=True, procname=Non
         cb = self.callback_dictionary[callback]
 
         # Generate a unique handle for each callback type using the number of previously registered CBs of that type added to a constant
-        handle = self.ffi.cast('void *', 0x8888 + 100*len([x for x in self.registered_callbacks.values() if x['callback'] == cb]))
+        self.plugin_register_count += 1
+        handle = self.ffi.cast('void *', self.plugin_register_count)
 
         # XXX: We should have another layer of indirection here so we can catch
         #      exceptions raised during execution of the CB and abort analysis

From f50a0971c3f16243e9c2be3691d37d84ac0772a1 Mon Sep 17 00:00:00 2001
From: Andrew Fasano <fasano@mit.edu>
Date: Mon, 28 Mar 2022 11:39:33 -0400
Subject: [PATCH 053/140] Fix PyPlugin docs error and rename function in
 proc_trace graph.py accordingly

---
 panda/docs/pyplugins.md           | 2 +-
 panda/plugins/proc_trace/graph.py | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/panda/docs/pyplugins.md b/panda/docs/pyplugins.md
index 81245f7d8ce..9328279d6b0 100644
--- a/panda/docs/pyplugins.md
+++ b/panda/docs/pyplugins.md
@@ -37,7 +37,7 @@ class TestPlugin(PyPlugin):
             print("Running test plugin")
             panda.disable_callback('test_before_block')
 
-    def __del__(self):
+    def uninit(self):
         print("Uninitialized test plugin")
 ```
 
diff --git a/panda/plugins/proc_trace/graph.py b/panda/plugins/proc_trace/graph.py
index 2e7bd2a0d5a..062f9147e6e 100644
--- a/panda/plugins/proc_trace/graph.py
+++ b/panda/plugins/proc_trace/graph.py
@@ -60,7 +60,7 @@ def task_change(cpu):
             self.time_data.append((proc_key, self.n_insns))
             self.n_insns = 0
 
-    def __del__(self):
+    def uninit(self):
         col_size = self.total_insns / self.n_cols
         pids = set([x for x,y in self.time_data]) # really a list of (pid, tid) tuples
         merged = {} # pid: [(True, 100), False, 9999)

From 6d96e7f89fee9642c8f411175f813c1adf6901ae Mon Sep 17 00:00:00 2001
From: jamcleod <Jordan.McLeod@ll.mit.edu>
Date: Mon, 28 Mar 2022 12:03:18 -0400
Subject: [PATCH 054/140] Have qcows.py lazily import argv

---
 panda/python/core/pandare/qcows.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/panda/python/core/pandare/qcows.py b/panda/python/core/pandare/qcows.py
index 29598c4a3db..d68425b03ab 100644
--- a/panda/python/core/pandare/qcows.py
+++ b/panda/python/core/pandare/qcows.py
@@ -5,7 +5,6 @@
 
 import logging
 from os import path, remove, makedirs
-from sys import argv
 from subprocess import check_call
 from collections import namedtuple
 from shlex import split as shlex_split
@@ -310,6 +309,8 @@ def qcow_from_arg(idx=1):
         Returns:
             string: Path to qcow
         '''
+        from sys import argv
+
         if len(argv) > idx:
             return Qcows.get_qcow(argv[idx])
         else:

From 5fb39520452302ad02c1a4a375fd88c20f158ecc Mon Sep 17 00:00:00 2001
From: Andrew Fasano <fasano@mit.edu>
Date: Mon, 28 Mar 2022 16:52:46 -0400
Subject: [PATCH 055/140] Revert syscalls hooks to BTC to fix performance bug
 (#1173)

---
 .../syscalls2/generated-tpl/syscall_switch_enter.tpl        | 6 ++++--
 .../generated/syscall_switch_enter_freebsd_x64.cpp          | 6 ++++--
 .../syscalls2/generated/syscall_switch_enter_linux_arm.cpp  | 6 ++++--
 .../generated/syscall_switch_enter_linux_arm64.cpp          | 6 ++++--
 .../syscalls2/generated/syscall_switch_enter_linux_mips.cpp | 6 ++++--
 .../syscalls2/generated/syscall_switch_enter_linux_x64.cpp  | 6 ++++--
 .../syscalls2/generated/syscall_switch_enter_linux_x86.cpp  | 6 ++++--
 .../generated/syscall_switch_enter_windows_2000_x86.cpp     | 6 ++++--
 .../generated/syscall_switch_enter_windows_7_x86.cpp        | 6 ++++--
 .../generated/syscall_switch_enter_windows_xpsp2_x86.cpp    | 6 ++++--
 .../generated/syscall_switch_enter_windows_xpsp3_x86.cpp    | 6 ++++--
 11 files changed, 44 insertions(+), 22 deletions(-)

diff --git a/panda/plugins/syscalls2/generated-tpl/syscall_switch_enter.tpl b/panda/plugins/syscalls2/generated-tpl/syscall_switch_enter.tpl
index cebf71dd356..4bce7c0a39f 100644
--- a/panda/plugins/syscalls2/generated-tpl/syscall_switch_enter.tpl
+++ b/panda/plugins/syscalls2/generated-tpl/syscall_switch_enter.tpl
@@ -77,8 +77,10 @@ void syscall_enter_switch_{{os}}_{{arch}}(CPUState *cpu, target_ptr_t pc, int st
 		struct hook h;
 		h.addr = ctx.retaddr;
 		h.asid = ctx.asid;
-		h.cb.start_block_exec = hook_syscall_return;
-		h.type = PANDA_CB_START_BLOCK_EXEC;
+		//h.cb.start_block_exec = hook_syscall_return;
+		//h.type = PANDA_CB_START_BLOCK_EXEC;
+		h.cb.before_tcg_codegen = hook_syscall_return;
+		h.type = PANDA_CB_BEFORE_TCG_CODEGEN;
 		h.enabled = true;
 		h.km = MODE_ANY; //you'd expect this to be user only
 		hooks_add_hook(&h);
diff --git a/panda/plugins/syscalls2/generated/syscall_switch_enter_freebsd_x64.cpp b/panda/plugins/syscalls2/generated/syscall_switch_enter_freebsd_x64.cpp
index f396ed13afe..fa309edc6a3 100644
--- a/panda/plugins/syscalls2/generated/syscall_switch_enter_freebsd_x64.cpp
+++ b/panda/plugins/syscalls2/generated/syscall_switch_enter_freebsd_x64.cpp
@@ -6749,8 +6749,10 @@ void syscall_enter_switch_freebsd_x64(CPUState *cpu, target_ptr_t pc, int static
 		struct hook h;
 		h.addr = ctx.retaddr;
 		h.asid = ctx.asid;
-		h.cb.start_block_exec = hook_syscall_return;
-		h.type = PANDA_CB_START_BLOCK_EXEC;
+		//h.cb.start_block_exec = hook_syscall_return;
+		//h.type = PANDA_CB_START_BLOCK_EXEC;
+		h.cb.before_tcg_codegen = hook_syscall_return;
+		h.type = PANDA_CB_BEFORE_TCG_CODEGEN;
 		h.enabled = true;
 		h.km = MODE_ANY; //you'd expect this to be user only
 		hooks_add_hook(&h);
diff --git a/panda/plugins/syscalls2/generated/syscall_switch_enter_linux_arm.cpp b/panda/plugins/syscalls2/generated/syscall_switch_enter_linux_arm.cpp
index 117d4fa92bf..bd5c554b0d2 100644
--- a/panda/plugins/syscalls2/generated/syscall_switch_enter_linux_arm.cpp
+++ b/panda/plugins/syscalls2/generated/syscall_switch_enter_linux_arm.cpp
@@ -5377,8 +5377,10 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 		struct hook h;
 		h.addr = ctx.retaddr;
 		h.asid = ctx.asid;
-		h.cb.start_block_exec = hook_syscall_return;
-		h.type = PANDA_CB_START_BLOCK_EXEC;
+		//h.cb.start_block_exec = hook_syscall_return;
+		//h.type = PANDA_CB_START_BLOCK_EXEC;
+		h.cb.before_tcg_codegen = hook_syscall_return;
+		h.type = PANDA_CB_BEFORE_TCG_CODEGEN;
 		h.enabled = true;
 		h.km = MODE_ANY; //you'd expect this to be user only
 		hooks_add_hook(&h);
diff --git a/panda/plugins/syscalls2/generated/syscall_switch_enter_linux_arm64.cpp b/panda/plugins/syscalls2/generated/syscall_switch_enter_linux_arm64.cpp
index 416a191e366..561b5f1fe3b 100644
--- a/panda/plugins/syscalls2/generated/syscall_switch_enter_linux_arm64.cpp
+++ b/panda/plugins/syscalls2/generated/syscall_switch_enter_linux_arm64.cpp
@@ -4461,8 +4461,10 @@ void syscall_enter_switch_linux_arm64(CPUState *cpu, target_ptr_t pc, int static
 		struct hook h;
 		h.addr = ctx.retaddr;
 		h.asid = ctx.asid;
-		h.cb.start_block_exec = hook_syscall_return;
-		h.type = PANDA_CB_START_BLOCK_EXEC;
+		//h.cb.start_block_exec = hook_syscall_return;
+		//h.type = PANDA_CB_START_BLOCK_EXEC;
+		h.cb.before_tcg_codegen = hook_syscall_return;
+		h.type = PANDA_CB_BEFORE_TCG_CODEGEN;
 		h.enabled = true;
 		h.km = MODE_ANY; //you'd expect this to be user only
 		hooks_add_hook(&h);
diff --git a/panda/plugins/syscalls2/generated/syscall_switch_enter_linux_mips.cpp b/panda/plugins/syscalls2/generated/syscall_switch_enter_linux_mips.cpp
index 11ff95c2cc5..d3f5a0116b4 100644
--- a/panda/plugins/syscalls2/generated/syscall_switch_enter_linux_mips.cpp
+++ b/panda/plugins/syscalls2/generated/syscall_switch_enter_linux_mips.cpp
@@ -6079,8 +6079,10 @@ void syscall_enter_switch_linux_mips(CPUState *cpu, target_ptr_t pc, int static_
 		struct hook h;
 		h.addr = ctx.retaddr;
 		h.asid = ctx.asid;
-		h.cb.start_block_exec = hook_syscall_return;
-		h.type = PANDA_CB_START_BLOCK_EXEC;
+		//h.cb.start_block_exec = hook_syscall_return;
+		//h.type = PANDA_CB_START_BLOCK_EXEC;
+		h.cb.before_tcg_codegen = hook_syscall_return;
+		h.type = PANDA_CB_BEFORE_TCG_CODEGEN;
 		h.enabled = true;
 		h.km = MODE_ANY; //you'd expect this to be user only
 		hooks_add_hook(&h);
diff --git a/panda/plugins/syscalls2/generated/syscall_switch_enter_linux_x64.cpp b/panda/plugins/syscalls2/generated/syscall_switch_enter_linux_x64.cpp
index 6a3f4886092..5ede06d2a4e 100644
--- a/panda/plugins/syscalls2/generated/syscall_switch_enter_linux_x64.cpp
+++ b/panda/plugins/syscalls2/generated/syscall_switch_enter_linux_x64.cpp
@@ -4905,8 +4905,10 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 		struct hook h;
 		h.addr = ctx.retaddr;
 		h.asid = ctx.asid;
-		h.cb.start_block_exec = hook_syscall_return;
-		h.type = PANDA_CB_START_BLOCK_EXEC;
+		//h.cb.start_block_exec = hook_syscall_return;
+		//h.type = PANDA_CB_START_BLOCK_EXEC;
+		h.cb.before_tcg_codegen = hook_syscall_return;
+		h.type = PANDA_CB_BEFORE_TCG_CODEGEN;
 		h.enabled = true;
 		h.km = MODE_ANY; //you'd expect this to be user only
 		hooks_add_hook(&h);
diff --git a/panda/plugins/syscalls2/generated/syscall_switch_enter_linux_x86.cpp b/panda/plugins/syscalls2/generated/syscall_switch_enter_linux_x86.cpp
index cbc2d583209..8fb90af915b 100644
--- a/panda/plugins/syscalls2/generated/syscall_switch_enter_linux_x86.cpp
+++ b/panda/plugins/syscalls2/generated/syscall_switch_enter_linux_x86.cpp
@@ -5469,8 +5469,10 @@ void syscall_enter_switch_linux_x86(CPUState *cpu, target_ptr_t pc, int static_c
 		struct hook h;
 		h.addr = ctx.retaddr;
 		h.asid = ctx.asid;
-		h.cb.start_block_exec = hook_syscall_return;
-		h.type = PANDA_CB_START_BLOCK_EXEC;
+		//h.cb.start_block_exec = hook_syscall_return;
+		//h.type = PANDA_CB_START_BLOCK_EXEC;
+		h.cb.before_tcg_codegen = hook_syscall_return;
+		h.type = PANDA_CB_BEFORE_TCG_CODEGEN;
 		h.enabled = true;
 		h.km = MODE_ANY; //you'd expect this to be user only
 		hooks_add_hook(&h);
diff --git a/panda/plugins/syscalls2/generated/syscall_switch_enter_windows_2000_x86.cpp b/panda/plugins/syscalls2/generated/syscall_switch_enter_windows_2000_x86.cpp
index 7505cd2284c..d0e0ec7eca7 100644
--- a/panda/plugins/syscalls2/generated/syscall_switch_enter_windows_2000_x86.cpp
+++ b/panda/plugins/syscalls2/generated/syscall_switch_enter_windows_2000_x86.cpp
@@ -4431,8 +4431,10 @@ void syscall_enter_switch_windows_2000_x86(CPUState *cpu, target_ptr_t pc, int s
 		struct hook h;
 		h.addr = ctx.retaddr;
 		h.asid = ctx.asid;
-		h.cb.start_block_exec = hook_syscall_return;
-		h.type = PANDA_CB_START_BLOCK_EXEC;
+		//h.cb.start_block_exec = hook_syscall_return;
+		//h.type = PANDA_CB_START_BLOCK_EXEC;
+		h.cb.before_tcg_codegen = hook_syscall_return;
+		h.type = PANDA_CB_BEFORE_TCG_CODEGEN;
 		h.enabled = true;
 		h.km = MODE_ANY; //you'd expect this to be user only
 		hooks_add_hook(&h);
diff --git a/panda/plugins/syscalls2/generated/syscall_switch_enter_windows_7_x86.cpp b/panda/plugins/syscalls2/generated/syscall_switch_enter_windows_7_x86.cpp
index 792d3734eb2..7263a2130b3 100644
--- a/panda/plugins/syscalls2/generated/syscall_switch_enter_windows_7_x86.cpp
+++ b/panda/plugins/syscalls2/generated/syscall_switch_enter_windows_7_x86.cpp
@@ -7177,8 +7177,10 @@ void syscall_enter_switch_windows_7_x86(CPUState *cpu, target_ptr_t pc, int stat
 		struct hook h;
 		h.addr = ctx.retaddr;
 		h.asid = ctx.asid;
-		h.cb.start_block_exec = hook_syscall_return;
-		h.type = PANDA_CB_START_BLOCK_EXEC;
+		//h.cb.start_block_exec = hook_syscall_return;
+		//h.type = PANDA_CB_START_BLOCK_EXEC;
+		h.cb.before_tcg_codegen = hook_syscall_return;
+		h.type = PANDA_CB_BEFORE_TCG_CODEGEN;
 		h.enabled = true;
 		h.km = MODE_ANY; //you'd expect this to be user only
 		hooks_add_hook(&h);
diff --git a/panda/plugins/syscalls2/generated/syscall_switch_enter_windows_xpsp2_x86.cpp b/panda/plugins/syscalls2/generated/syscall_switch_enter_windows_xpsp2_x86.cpp
index 3f433d93d40..0d0c8121eab 100644
--- a/panda/plugins/syscalls2/generated/syscall_switch_enter_windows_xpsp2_x86.cpp
+++ b/panda/plugins/syscalls2/generated/syscall_switch_enter_windows_xpsp2_x86.cpp
@@ -5093,8 +5093,10 @@ void syscall_enter_switch_windows_xpsp2_x86(CPUState *cpu, target_ptr_t pc, int
 		struct hook h;
 		h.addr = ctx.retaddr;
 		h.asid = ctx.asid;
-		h.cb.start_block_exec = hook_syscall_return;
-		h.type = PANDA_CB_START_BLOCK_EXEC;
+		//h.cb.start_block_exec = hook_syscall_return;
+		//h.type = PANDA_CB_START_BLOCK_EXEC;
+		h.cb.before_tcg_codegen = hook_syscall_return;
+		h.type = PANDA_CB_BEFORE_TCG_CODEGEN;
 		h.enabled = true;
 		h.km = MODE_ANY; //you'd expect this to be user only
 		hooks_add_hook(&h);
diff --git a/panda/plugins/syscalls2/generated/syscall_switch_enter_windows_xpsp3_x86.cpp b/panda/plugins/syscalls2/generated/syscall_switch_enter_windows_xpsp3_x86.cpp
index 3186d357136..d3e09ddebaf 100644
--- a/panda/plugins/syscalls2/generated/syscall_switch_enter_windows_xpsp3_x86.cpp
+++ b/panda/plugins/syscalls2/generated/syscall_switch_enter_windows_xpsp3_x86.cpp
@@ -5093,8 +5093,10 @@ void syscall_enter_switch_windows_xpsp3_x86(CPUState *cpu, target_ptr_t pc, int
 		struct hook h;
 		h.addr = ctx.retaddr;
 		h.asid = ctx.asid;
-		h.cb.start_block_exec = hook_syscall_return;
-		h.type = PANDA_CB_START_BLOCK_EXEC;
+		//h.cb.start_block_exec = hook_syscall_return;
+		//h.type = PANDA_CB_START_BLOCK_EXEC;
+		h.cb.before_tcg_codegen = hook_syscall_return;
+		h.type = PANDA_CB_BEFORE_TCG_CODEGEN;
 		h.enabled = true;
 		h.km = MODE_ANY; //you'd expect this to be user only
 		hooks_add_hook(&h);

From 2d2358d714e8dd766fbc21a30d4a41a4c33fba04 Mon Sep 17 00:00:00 2001
From: Mark Mankins <31133733+MarkMankins@users.noreply.github.com>
Date: Wed, 6 Apr 2022 10:05:43 -0400
Subject: [PATCH 056/140] =?UTF-8?q?Fallback=20to=20using=20ASID=20change?=
 =?UTF-8?q?=20heuristic=20to=20detect=20task=20changes=20on=20win=E2=80=A6?=
 =?UTF-8?q?=20(#1184)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../plugins/wintrospection/wintrospection.cpp | 71 ++++++++++++++++---
 1 file changed, 62 insertions(+), 9 deletions(-)

diff --git a/panda/plugins/wintrospection/wintrospection.cpp b/panda/plugins/wintrospection/wintrospection.cpp
index 93e28e624d8..5503131ad8d 100644
--- a/panda/plugins/wintrospection/wintrospection.cpp
+++ b/panda/plugins/wintrospection/wintrospection.cpp
@@ -71,6 +71,7 @@ void on_get_modules(CPUState *cpu, GArray **out);
 void on_get_mappings(CPUState *cpu, OsiProc *p, GArray **out);
 
 void initialize_introspection(CPUState *cpu);
+void task_change(CPUState *cpu);
 
 std::unique_ptr<WindowsKernelManager> g_kernel_manager;
 std::unique_ptr<WindowsProcessManager> g_process_manager;
@@ -78,6 +79,15 @@ std::unique_ptr<WindowsProcessManager> g_process_manager;
 bool g_initialized_kernel;
 uint64_t swapcontext_address;
 
+// last process address seen
+static uint64_t last_seen_paddr = 0;
+
+// last thread id seen
+static uint64_t last_seen_tid = std::numeric_limits<uint64_t>::max();
+
+// true when using asid change heuristic to detect task changes
+static bool using_asid_change_heuristic = true;
+
 // globals for toggling callbacks
 void* self = NULL;
 panda_cb pcb_asid;
@@ -276,6 +286,33 @@ char *get_handle_name(CPUState *cpu, uint64_t handle) {
   return name;
 }
 
+// fill in thread id and process id into OsiThread structure
+// when using asid change heuristic, update g_process_manager if process id
+// changed since the last time fill_thread was called
+static inline void fill_thread(CPUState *cpu, OsiThread *t) {
+  auto kernel = g_kernel_manager->get_kernel_object();
+  uint64_t tid = kosi_get_current_tid(kernel);
+
+  // if the thread id changed, process may also have changed
+  if(using_asid_change_heuristic && (tid != last_seen_tid)) {
+    last_seen_tid = tid;
+    uint64_t paddr = kosi_get_current_process_address(kernel);
+    if(paddr != last_seen_paddr) {
+      last_seen_paddr = paddr;
+      g_process_manager.reset(new WindowsProcessManager());
+      g_process_manager->initialize(kernel, paddr);
+      notify_task_change(cpu);
+    }
+  }
+
+  auto proc = g_process_manager->get_process_object();
+
+  if(t) {
+    t->pid = proc->pid;
+    t->tid = tid;
+  }
+}
+
 /* ******************************************************************
  PPP Callbacks
 ****************************************************************** */
@@ -286,13 +323,7 @@ void on_get_current_thread(CPUState *cpu, OsiThread **out) {
   }
 
   OsiThread *t = (OsiThread *)g_malloc(sizeof(OsiThread));
-
-  auto proc = g_process_manager->get_process_object();
-  auto kernel = g_kernel_manager->get_kernel_object();
-
-  t->pid = proc->pid;
-  t->tid = kosi_get_current_tid(kernel);
-
+  fill_thread(cpu, t);
   *out = t;
 }
 
@@ -305,6 +336,10 @@ void on_get_process_pid(CPUState *cpu, const OsiProcHandle *h,
   if (h->taskd == (intptr_t)(NULL) || h->taskd == (target_ptr_t)-1) {
     *pid = (target_pid_t)-1;
   } else {
+    if(using_asid_change_heuristic) {
+        // process may have changed
+        fill_thread(cpu, NULL);
+    }
     *pid = g_process_manager->get_process_object()->pid;
   }
 }
@@ -316,6 +351,11 @@ void on_get_current_process_handle(CPUState *cpu, OsiProcHandle **out) {
 
   OsiProcHandle *p = (OsiProcHandle *)g_malloc(sizeof(OsiProcHandle));
 
+  if(using_asid_change_heuristic) {
+    // process may have changed
+    fill_thread(cpu, NULL);
+  }
+
   auto process = g_process_manager->get_process_object();
   p->taskd = process->eprocess_address;
   p->asid = process->vmem->get_asid();
@@ -371,6 +411,11 @@ void on_get_current_process(CPUState *cpu, OsiProc **out) {
 
   OsiProc *p = (OsiProc *)g_malloc(sizeof(OsiProc));
 
+  if(using_asid_change_heuristic) {
+    // process may have changed
+    fill_thread(cpu, NULL);
+  }
+
   auto proc = g_process_manager->get_process_object();
   if (proc->eprocess_address == 0) {
     *out = NULL;
@@ -519,8 +564,8 @@ void task_change(CPUState *cpu) {
   g_process_manager.reset(new WindowsProcessManager());
 
   auto kernel = g_kernel_manager->get_kernel_object();
-  g_process_manager->initialize(kernel,
-                                kosi_get_current_process_address(kernel));
+  last_seen_paddr = kosi_get_current_process_address(kernel);
+  g_process_manager->initialize(kernel, last_seen_paddr);
 
   notify_task_change(cpu);
 }
@@ -650,6 +695,12 @@ void initialize_introspection(CPUState *cpu) {
       std::unique_ptr<WindowsProcessManager>(new WindowsProcessManager());
   task_change(cpu);
 
+  // Hooking SwapContext on windows 2000 doesn't seem to be enough to detect
+  // all tasks changes, fallback to ASID change heuristic for now.
+  if (strncmp(panda_os_name, "windows-32-2000", 15) == 0) {
+    return;
+  }
+
   uint64_t swapcontext_offset = g_kernel_manager->get_swapcontext_offset();
 
   // we do not know exactly when a nt!SwapContext executes, and we must use the
@@ -658,6 +709,8 @@ void initialize_introspection(CPUState *cpu) {
     return;
   }
 
+  using_asid_change_heuristic = false;
+
   GArray *mods = get_modules(cpu);
   for (int i = 0; i < mods->len; i++) {
       OsiModule *mod = &g_array_index(mods, OsiModule, i);

From 1c573712a9952a20918ca844ba609cf23dca8ab2 Mon Sep 17 00:00:00 2001
From: Andrew Fasano <fasano@mit.edu>
Date: Wed, 4 May 2022 11:37:58 -0400
Subject: [PATCH 057/140] Fix #1164: Error in build script for new gcc

COMPILER_CONFIG was being overwritten when both gcc and g++ were too new and -Wno-error wasn't getting saved into extra cflags. Suggested by Lancern.
---
 build.sh | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/build.sh b/build.sh
index be8282a8372..5de959c508a 100755
--- a/build.sh
+++ b/build.sh
@@ -65,8 +65,9 @@ gcc --version | awk '/gcc/ && ($3+0)<7.1{print "Fatal error: GCC too old"; exit
 g++ --version | awk '/g\+\+/ && ($3+0)<7.1{print "Fatal error: G++ too old"; exit 1}' || exit 1
 
 # Untested GCC - it's probably going to have some warnings - Just disable Werror and hope it works
-gcc --version | awk '/gcc/   && ($3+0)>9.3{print "WARNING: Your GCC is too new: disabling -Werror and hoping this builds"; exit 1}' || COMPILER_CONFIG="--extra-cflags=-Wno-error"
-g++ --version | awk '/g\+\+/ && ($3+0)>9.3{print "WARNING: Your G++ is too new: disabling -Werror and hoping this builds"; exit 1}' ||  COMPILER_CONFIG="--extra-cxxflags=-Wno-error"
+COMPILER_CONFIG=""
+gcc --version | awk '/gcc/   && ($3+0)>9.3{print "WARNING: Your GCC is too new: disabling -Werror and hoping this builds"; exit 1}' || COMPILER_CONFIG+= "--extra-cflags=-Wno-error"
+g++ --version | awk '/g\+\+/ && ($3+0)>9.3{print "WARNING: Your G++ is too new: disabling -Werror and hoping this builds"; exit 1}' ||  COMPILER_CONFIG +=" --extra-cxxflags=-Wno-error"
 
 ### Check for protobuf v2.
 if ! pkg-config --exists protobuf; then

From 272272456171f03bad5ebeb72929bf5cf676346d Mon Sep 17 00:00:00 2001
From: Andrew Fasano <fasano@mit.edu>
Date: Wed, 4 May 2022 13:00:47 -0400
Subject: [PATCH 058/140] Bugfix: Enable Werror for GCC/G++ as expected

Previously the `-Wno-error` flag was never being set if both gcc and G++ were of supported versions.
---
 build.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/build.sh b/build.sh
index 5de959c508a..1aa1dddd636 100755
--- a/build.sh
+++ b/build.sh
@@ -66,8 +66,8 @@ g++ --version | awk '/g\+\+/ && ($3+0)<7.1{print "Fatal error: G++ too old"; exi
 
 # Untested GCC - it's probably going to have some warnings - Just disable Werror and hope it works
 COMPILER_CONFIG=""
-gcc --version | awk '/gcc/   && ($3+0)>9.3{print "WARNING: Your GCC is too new: disabling -Werror and hoping this builds"; exit 1}' || COMPILER_CONFIG+= "--extra-cflags=-Wno-error"
-g++ --version | awk '/g\+\+/ && ($3+0)>9.3{print "WARNING: Your G++ is too new: disabling -Werror and hoping this builds"; exit 1}' ||  COMPILER_CONFIG +=" --extra-cxxflags=-Wno-error"
+gcc --version | awk '/gcc/   && ($3+0)>9.3{print "WARNING: Your GCC is too new: disabling -Werror and hoping this builds"; exit 1}' || COMPILER_CONFIG+="--extra-cflags=-Wno-error"
+g++ --version | awk '/g\+\+/ && ($3+0)>9.3{print "WARNING: Your G++ is too new: disabling -Werror and hoping this builds"; exit 1}' ||  COMPILER_CONFIG+=" --extra-cxxflags=-Wno-error"
 
 ### Check for protobuf v2.
 if ! pkg-config --exists protobuf; then

From 9145a3db5b305127930dea071ae18004e2a69d44 Mon Sep 17 00:00:00 2001
From: Andrew Fasano <fasano@mit.edu>
Date: Tue, 26 Apr 2022 18:11:46 -0400
Subject: [PATCH 059/140] Cleanup proc_trace graph.py

---
 panda/dependencies/ubuntu:20.04_base.txt | 3 +++
 panda/plugins/proc_trace/graph.py        | 6 ++++--
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/panda/dependencies/ubuntu:20.04_base.txt b/panda/dependencies/ubuntu:20.04_base.txt
index b1fa4eb9cce..96fa204441d 100644
--- a/panda/dependencies/ubuntu:20.04_base.txt
+++ b/panda/dependencies/ubuntu:20.04_base.txt
@@ -25,6 +25,9 @@ python3-colorama
 python3-protobuf
 python3-pycparser
 
+# Not sure what this one is needed for
+liblzo2-2
+
 # apt-rdepends qemu-system-common
 acl
 libc6
diff --git a/panda/plugins/proc_trace/graph.py b/panda/plugins/proc_trace/graph.py
index 062f9147e6e..1b3ced39bbf 100644
--- a/panda/plugins/proc_trace/graph.py
+++ b/panda/plugins/proc_trace/graph.py
@@ -89,7 +89,9 @@ def uninit(self):
         for (pid, tid) in sorted(self.procinfo, key=lambda v: self.procinfo[v]['count'], reverse=True):
             details = self.procinfo[(pid, tid)]
             names = ", ".join([x.decode() for x in details['names']])
-            print(f"{details['count']: >10} {pid:<5} {tid:<5}{details['first']:<8} -> {details['last']:<8} {names}")
+
+            end = f"{details['last']:<8}" if details['last'] is not None else "N/A"
+            print(f"{details['count']: >10} {pid:<5} {tid:<5}{details['first']:<8} -> {end} {names}")
 
 
         # Render output: Stage 2: ascii art
@@ -106,7 +108,7 @@ def uninit(self):
                 counted = 0
                 on_count = 0
                 off_count = 0
-                import ipdb
+                #import ipdb
                 while (counted < col_size and len(queue)): #or pending is not None:
                     if pending is not None:
                         (on_bool, cnt) = pending

From f2c0951ea459e890d112a8cf874cb090e6747c63 Mon Sep 17 00:00:00 2001
From: Andrew Fasano <fasano@mit.edu>
Date: Tue, 26 Apr 2022 18:11:57 -0400
Subject: [PATCH 060/140] Fix typo

---
 panda/python/core/pandare/panda.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/panda/python/core/pandare/panda.py b/panda/python/core/pandare/panda.py
index 111903f3810..a042bb02efa 100755
--- a/panda/python/core/pandare/panda.py
+++ b/panda/python/core/pandare/panda.py
@@ -839,7 +839,7 @@ def _memory_read(self, env, addr, length, physical=False, fmt='bytearray'):
         elif fmt=='str':
             return self.ffi.string(buf, length)
         elif fmt=='ptrlist':
-            # This one is weird. Chunmk the memory into byte-sequences of (self.bits/8) bytes and flip endianness as approperiate
+            # This one is weird. Chunk the memory into byte-sequences of (self.bits/8) bytes and flip endianness as approperiate
             # return a list
             bytelen = int(self.bits/8)
             if (length % bytelen != 0):

From 1b8203e4b5eee217112822fbc6707f960dc7c624 Mon Sep 17 00:00:00 2001
From: Andrew Fasano <fasano@mit.edu>
Date: Mon, 18 Jul 2022 16:32:18 -0400
Subject: [PATCH 061/140] Add thread info to pypanda osi_syscall example

---
 panda/python/examples/osi_syscalls.py | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/panda/python/examples/osi_syscalls.py b/panda/python/examples/osi_syscalls.py
index 52b96a2deb1..60a7a345e05 100644
--- a/panda/python/examples/osi_syscalls.py
+++ b/panda/python/examples/osi_syscalls.py
@@ -16,11 +16,13 @@
 @panda.ppp("syscalls2", "on_sys_read_return")
 def on_sys_read_return(cpu, pc, fd, buf, count):
     proc = panda.plugins['osi'].get_current_process(cpu)
+    thread = panda.plugins['osi'].get_current_thread(cpu)
+    tid = thread.tid
     procname = panda.ffi.string(proc.name) if proc != panda.ffi.NULL else "error"
     fname_ptr = panda.plugins['osi_linux'].osi_linux_fd_to_filename(cpu, proc, fd)
     fname = panda.ffi.string(fname_ptr) if fname_ptr != panda.ffi.NULL else "error"
     rc = panda.plugins['syscalls2'].get_syscall_retval(cpu)
-    print(f"[PANDA] {procname} read {rc} bytes from {fname}")
+    print(f"[PANDA] {procname} (pid={proc.pid},tid={thread.tid}) read {rc} bytes from {fname}")
 
 @panda.ppp("syscalls2", "on_sys_execve_enter")
 def on_sys_execve_enter(cpu, pc, fname_ptr, argv_ptr, envp):

From c8aaecfe0714e405ff13a2b60d41de598397498b Mon Sep 17 00:00:00 2001
From: Alexander Kanavin <alex.kanavin@gmail.com>
Date: Wed, 16 Jan 2019 12:37:51 +0100
Subject: [PATCH 062/140] egl-helpers.h: do not depend on X11 Window type, use
 EGLNativeWindowType
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

It was assumed that mesa provides the necessary X11 includes,
but it is not always the case, as it can be configured without x11 support.

Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20190116113751.17177-1-alex.kanavin@gmail.com

[ kraxel: codestyle fix (long line) ]

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
---
 include/ui/egl-helpers.h | 2 +-
 ui/egl-helpers.c         | 4 ++--
 ui/gtk-egl.c             | 3 ++-
 3 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/include/ui/egl-helpers.h b/include/ui/egl-helpers.h
index 88a13e827b2..5e4c9c53645 100644
--- a/include/ui/egl-helpers.h
+++ b/include/ui/egl-helpers.h
@@ -19,7 +19,7 @@ int egl_get_fd_for_texture(uint32_t tex_id, EGLint *stride, EGLint *fourcc);
 
 #endif
 
-EGLSurface qemu_egl_init_surface_x11(EGLContext ectx, Window win);
+EGLSurface qemu_egl_init_surface_x11(EGLContext ectx, EGLNativeWindowType win);
 
 int qemu_egl_init_dpy(EGLNativeDisplayType dpy, bool gles, bool debug);
 EGLContext qemu_egl_init_ctx(void);
diff --git a/ui/egl-helpers.c b/ui/egl-helpers.c
index b7b6b2e3cc7..a9055e5cdbc 100644
--- a/ui/egl-helpers.c
+++ b/ui/egl-helpers.c
@@ -166,7 +166,7 @@ int egl_get_fd_for_texture(uint32_t tex_id, EGLint *stride, EGLint *fourcc)
 
 /* ---------------------------------------------------------------------- */
 
-EGLSurface qemu_egl_init_surface_x11(EGLContext ectx, Window win)
+EGLSurface qemu_egl_init_surface_x11(EGLContext ectx, EGLNativeWindowType win)
 {
     EGLSurface esurface;
     EGLBoolean b;
@@ -175,7 +175,7 @@ EGLSurface qemu_egl_init_surface_x11(EGLContext ectx, Window win)
             (unsigned long) win);
     esurface = eglCreateWindowSurface(qemu_egl_display,
                                       qemu_egl_config,
-                                      (EGLNativeWindowType)win, NULL);
+                                      win, NULL);
     if (esurface == EGL_NO_SURFACE) {
         error_report("egl: eglCreateWindowSurface failed");
         return NULL;
diff --git a/ui/gtk-egl.c b/ui/gtk-egl.c
index d53288f027b..ed318646510 100644
--- a/ui/gtk-egl.c
+++ b/ui/gtk-egl.c
@@ -64,7 +64,8 @@ void gd_egl_init(VirtualConsole *vc)
     }
 
     vc->gfx.ectx = qemu_egl_init_ctx();
-    vc->gfx.esurface = qemu_egl_init_surface_x11(vc->gfx.ectx, x11_window);
+    vc->gfx.esurface = qemu_egl_init_surface_x11
+        (vc->gfx.ectx, (EGLNativeWindowType)x11_window);
 
     assert(vc->gfx.esurface);
 }

From 73140d712d193572572b0951eec218e96355006f Mon Sep 17 00:00:00 2001
From: Andrew Fasano <fasano@mit.edu>
Date: Tue, 26 Apr 2022 19:03:42 -0400
Subject: [PATCH 063/140] Network plugin: do not build if wireshark plugin is
 too new

---
 panda/plugins/network/network.cpp | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/panda/plugins/network/network.cpp b/panda/plugins/network/network.cpp
index 50fbb152a18..16ad8a63353 100644
--- a/panda/plugins/network/network.cpp
+++ b/panda/plugins/network/network.cpp
@@ -34,7 +34,16 @@ extern uint64_t rr_get_guest_instr_count(void);
 panda_arg_list *args;
 wtap_dumper *plugin_log;
 
+#if (VERSION_MAJOR>=3 && VERSION_MINOR >= 6)
+#define TOONEW
+#endif
+
 bool init_plugin(void *self) {
+#ifdef TOONEW
+    printf("Wireshark too new. Please update the network plugin\n");
+    return false;
+#else
+
     panda_cb pcb;
     int err;
     int i;
@@ -53,6 +62,7 @@ bool init_plugin(void *self) {
     };
     #endif
 
+
     if (args != NULL) {
         for (i = 0; i < args->nargs; i++) {
             // Format is sample:file=<file>
@@ -110,6 +120,7 @@ bool init_plugin(void *self) {
     pcb.replay_handle_packet = handle_packet;
     panda_register_callback(self, PANDA_CB_REPLAY_HANDLE_PACKET, pcb);
     return true;
+#endif
 }
 
 void uninit_plugin(void *self) {
@@ -132,6 +143,7 @@ void uninit_plugin(void *self) {
     }
 }
 
+#ifndef TOONEW
 void handle_packet(CPUState *env, uint8_t *buf, size_t size, uint8_t direction,
                    uint64_t buf_addr_rec) {
     int err;
@@ -193,4 +205,5 @@ void handle_packet(CPUState *env, uint8_t *buf, size_t size, uint8_t direction,
     }
     return;
 }
+#endif
 

From 73b0f819c77f1fe668a02ffb73ee21cd75bca812 Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Thu, 17 Dec 2020 17:19:55 +0100
Subject: [PATCH 064/140] block/vpc: Make vpc_open() read the full dynamic
 header

The dynamic header's size is 1024 bytes.

vpc_open() reads only the 512 bytes of the dynamic header into buf[].
Works, because it doesn't actually access the second half.  However, a
colleague told me that GCC 11 warns:

    ../block/vpc.c:358:51: error: array subscript 'struct VHDDynDiskHeader[0]' is partly outside array bounds of 'uint8_t[512]' [-Werror=array-bounds]

Clean up to read the full header.

Rename buf[] to dyndisk_header_buf[] while there.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-Id: <20201217162003.1102738-2-armbru@redhat.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/vpc.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/block/vpc.c b/block/vpc.c
index 95fcbc5bf16..3214e2ba101 100644
--- a/block/vpc.c
+++ b/block/vpc.c
@@ -213,7 +213,7 @@ static int vpc_open(BlockDriverState *bs, QDict *options, int flags,
     QemuOpts *opts = NULL;
     Error *local_err = NULL;
     bool use_chs;
-    uint8_t buf[HEADER_SIZE];
+    uint8_t dyndisk_header_buf[1024];
     uint32_t checksum;
     uint64_t computed_size;
     uint64_t pagetable_size;
@@ -332,14 +332,14 @@ static int vpc_open(BlockDriverState *bs, QDict *options, int flags,
     }
 
     if (disk_type == VHD_DYNAMIC) {
-        ret = bdrv_pread(bs->file, be64_to_cpu(footer->data_offset), buf,
-                         HEADER_SIZE);
+        ret = bdrv_pread(bs->file, be64_to_cpu(footer->data_offset),
+                         dyndisk_header_buf, 1024);
         if (ret < 0) {
             error_setg(errp, "Error reading dynamic VHD header");
             goto fail;
         }
 
-        dyndisk_header = (VHDDynDiskHeader *) buf;
+        dyndisk_header = (VHDDynDiskHeader *)dyndisk_header_buf;
 
         if (strncmp(dyndisk_header->magic, "cxsparse", 8)) {
             error_setg(errp, "Invalid header magic");

From 9f7e31a8ab5948ed882e990d4e61fdaf940c037e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Herv=C3=A9=20Poussineau?= <hpoussin@reactos.org>
Date: Mon, 22 May 2017 23:12:00 +0200
Subject: [PATCH 065/140] vvfat: correctly create long names for non-ASCII
 filenames
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Assume that input filename is encoded as UTF-8, so correctly create UTF-16 encoding.

Signed-off-by: Hervé Poussineau <hpoussin@reactos.org>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/vvfat.c | 48 +++++++++++++++++++++++-------------------------
 1 file changed, 23 insertions(+), 25 deletions(-)

diff --git a/block/vvfat.c b/block/vvfat.c
index 7d08f65547a..525570591a6 100644
--- a/block/vvfat.c
+++ b/block/vvfat.c
@@ -413,28 +413,19 @@ static void init_mbr(BDRVVVFATState *s, int cyls, int heads, int secs)
 
 /* direntry functions */
 
-/* dest is assumed to hold 258 bytes, and pads with 0xffff up to next multiple of 26 */
-static inline int short2long_name(char* dest,const char* src)
+static direntry_t *create_long_filename(BDRVVVFATState *s, const char *filename)
 {
-    int i;
-    int len;
-    for(i=0;i<129 && src[i];i++) {
-        dest[2*i]=src[i];
-	dest[2*i+1]=0;
+    int number_of_entries, i;
+    glong length;
+    direntry_t *entry;
+
+    gunichar2 *longname = g_utf8_to_utf16(filename, -1, NULL, &length, NULL);
+    if (!longname) {
+        fprintf(stderr, "vvfat: invalid UTF-8 name: %s\n", filename);
+        return NULL;
     }
-    len=2*i;
-    dest[2*i]=dest[2*i+1]=0;
-    for(i=2*i+2;(i%26);i++)
-	dest[i]=0xff;
-    return len;
-}
 
-static inline direntry_t* create_long_filename(BDRVVVFATState* s,const char* filename)
-{
-    char buffer[258];
-    int length=short2long_name(buffer,filename),
-        number_of_entries=(length+25)/26,i;
-    direntry_t* entry;
+    number_of_entries = (length * 2 + 25) / 26;
 
     for(i=0;i<number_of_entries;i++) {
 	entry=array_get_next(&(s->directory));
@@ -444,13 +435,20 @@ static inline direntry_t* create_long_filename(BDRVVVFATState* s,const char* fil
 	entry->name[0]=(number_of_entries-i)|(i==0?0x40:0);
     }
     for(i=0;i<26*number_of_entries;i++) {
-	int offset=(i%26);
-	if(offset<10) offset=1+offset;
-	else if(offset<22) offset=14+offset-10;
-	else offset=28+offset-22;
-	entry=array_get(&(s->directory),s->directory.next-1-(i/26));
-	entry->name[offset]=buffer[i];
+        int offset=(i%26);
+        if(offset<10) offset=1+offset;
+        else if(offset<22) offset=14+offset-10;
+        else offset=28+offset-22;
+        entry=array_get(&(s->directory),s->directory.next-1-(i/26));
+        if (i >= 2 * length + 2) {
+            entry->name[offset] = 0xff;
+        } else if (i % 2 == 0) {
+            entry->name[offset] = longname[i / 2] & 0xff;
+        } else {
+            entry->name[offset] = longname[i / 2] >> 8;
+        }
     }
+    g_free(longname);
     return array_get(&(s->directory),s->directory.next-number_of_entries);
 }
 

From 07fa2d04bd434b887e44c257813aa84ce6b9a096 Mon Sep 17 00:00:00 2001
From: Andrew Fasano <fasano@mit.edu>
Date: Mon, 18 Jul 2022 16:34:40 -0400
Subject: [PATCH 066/140] Sheepdog: Fix out-of-bounds array access identified
 by GCC (just makes GCC happy, original code was okay)

---
 block/sheepdog.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/block/sheepdog.c b/block/sheepdog.c
index b6b96f7b457..3c7f96cecb0 100644
--- a/block/sheepdog.c
+++ b/block/sheepdog.c
@@ -1472,7 +1472,7 @@ static int reload_inode(BDRVSheepdogState *s, uint32_t snapid, const char *tag)
         return -EIO;
     }
 
-    inode = g_malloc(SD_INODE_HEADER_SIZE);
+    inode = g_malloc(SD_INODE_SIZE); // Was INODE_HEADER_SIZE but GCC (incorrectly?) thought there would be an OOB read
 
     ret = find_vdi_name(s, s->name, snapid, tag, &vid, false, &local_err);
     if (ret) {

From 9ab8c6f84541c8c011e430f1d2c22e0810a0d285 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
Date: Wed, 10 Mar 2021 19:31:17 +0100
Subject: [PATCH 067/140] net/eth: Use correct in6_address offset in
 _eth_get_rss_ex_dst_addr()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The in6_address comes after the ip6_ext_hdr_routing header,
not after the ip6_ext_hdr one. Fix the offset.

Cc: qemu-stable@nongnu.org
Reported-by: Stefano Garzarella <sgarzare@redhat.com>
Fixes: eb700029c78 ("net_pkt: Extend packet abstraction as required by e1000e functionality")
Reviewed-by: Miroslav Rezanina <mrezanin@redhat.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/eth.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/eth.c b/net/eth.c
index 5b9ba26a563..4c111871dae 100644
--- a/net/eth.c
+++ b/net/eth.c
@@ -420,7 +420,7 @@ _eth_get_rss_ex_dst_addr(const struct iovec *pkt, int pkt_frags,
         }
 
         bytes_read = iov_to_buf(pkt, pkt_frags,
-                                rthdr_offset + sizeof(*ext_hdr),
+                                rthdr_offset + sizeof(*rthdr),
                                 dst_addr, sizeof(*dst_addr));
 
         return bytes_read == sizeof(dst_addr);

From 27219db5b353e0150c9cab0c2db1bc116d35a9ce Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
Date: Wed, 10 Mar 2021 19:31:18 +0100
Subject: [PATCH 068/140] net/eth: Simplify _eth_get_rss_ex_dst_addr()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The length field is already contained in the ip6_ext_hdr structure.
Check it direcly in eth_parse_ipv6_hdr() before calling
_eth_get_rss_ex_dst_addr(), which gets a bit simplified.

Reviewed-by: Miroslav Rezanina <mrezanin@redhat.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/eth.c | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/net/eth.c b/net/eth.c
index 4c111871dae..f1e73cf009a 100644
--- a/net/eth.c
+++ b/net/eth.c
@@ -408,9 +408,7 @@ _eth_get_rss_ex_dst_addr(const struct iovec *pkt, int pkt_frags,
 {
     struct ip6_ext_hdr_routing *rthdr = (struct ip6_ext_hdr_routing *) ext_hdr;
 
-    if ((rthdr->rtype == 2) &&
-        (rthdr->len == sizeof(struct in6_address) / 8) &&
-        (rthdr->segleft == 1)) {
+    if ((rthdr->rtype == 2) && (rthdr->segleft == 1)) {
 
         size_t input_size = iov_size(pkt, pkt_frags);
         size_t bytes_read;
@@ -529,10 +527,12 @@ bool eth_parse_ipv6_hdr(const struct iovec *pkt, int pkt_frags,
         }
 
         if (curr_ext_hdr_type == IP6_ROUTING) {
-            info->rss_ex_dst_valid =
-                _eth_get_rss_ex_dst_addr(pkt, pkt_frags,
-                                         ip6hdr_off + info->full_hdr_len,
-                                         &ext_hdr, &info->rss_ex_dst);
+            if (ext_hdr.ip6r_len == sizeof(struct in6_address) / 8) {
+                info->rss_ex_dst_valid =
+                    _eth_get_rss_ex_dst_addr(pkt, pkt_frags,
+                                             ip6hdr_off + info->full_hdr_len,
+                                             &ext_hdr, &info->rss_ex_dst);
+            }
         } else if (curr_ext_hdr_type == IP6_DESTINATON) {
             info->rss_ex_src_valid =
                 _eth_get_rss_ex_src_addr(pkt, pkt_frags,

From 6b4353404f6bce6697b0825d4b37f249c9c29889 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
Date: Wed, 10 Mar 2021 19:31:19 +0100
Subject: [PATCH 069/140] net/eth: Better describe _eth_get_rss_ex_dst_addr's
 offset argument
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The 'offset' argument represents the offset to the ip6_ext_hdr
header, rename it as 'ext_hdr_offset'.

Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Reviewed-by: Miroslav Rezanina <mrezanin@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/eth.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/net/eth.c b/net/eth.c
index f1e73cf009a..b3d69918839 100644
--- a/net/eth.c
+++ b/net/eth.c
@@ -402,7 +402,7 @@ eth_is_ip6_extension_header_type(uint8_t hdr_type)
 
 static bool
 _eth_get_rss_ex_dst_addr(const struct iovec *pkt, int pkt_frags,
-                        size_t rthdr_offset,
+                        size_t ext_hdr_offset,
                         struct ip6_ext_hdr *ext_hdr,
                         struct in6_address *dst_addr)
 {
@@ -413,12 +413,12 @@ _eth_get_rss_ex_dst_addr(const struct iovec *pkt, int pkt_frags,
         size_t input_size = iov_size(pkt, pkt_frags);
         size_t bytes_read;
 
-        if (input_size < rthdr_offset + sizeof(*ext_hdr)) {
+        if (input_size < ext_hdr_offset + sizeof(*ext_hdr)) {
             return false;
         }
 
         bytes_read = iov_to_buf(pkt, pkt_frags,
-                                rthdr_offset + sizeof(*rthdr),
+                                ext_hdr_offset + sizeof(*rthdr),
                                 dst_addr, sizeof(*dst_addr));
 
         return bytes_read == sizeof(dst_addr);

From aba59c72e6cdf8bd8b34c170cda2f9fb55af3d28 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
Date: Wed, 10 Mar 2021 19:31:20 +0100
Subject: [PATCH 070/140] net/eth: Check size earlier in
 _eth_get_rss_ex_dst_addr()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Reviewed-by: Miroslav Rezanina <mrezanin@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/eth.c | 14 ++++++--------
 1 file changed, 6 insertions(+), 8 deletions(-)

diff --git a/net/eth.c b/net/eth.c
index b3d69918839..bd8cc24b915 100644
--- a/net/eth.c
+++ b/net/eth.c
@@ -407,16 +407,14 @@ _eth_get_rss_ex_dst_addr(const struct iovec *pkt, int pkt_frags,
                         struct in6_address *dst_addr)
 {
     struct ip6_ext_hdr_routing *rthdr = (struct ip6_ext_hdr_routing *) ext_hdr;
+    size_t input_size = iov_size(pkt, pkt_frags);
+    size_t bytes_read;
 
-    if ((rthdr->rtype == 2) && (rthdr->segleft == 1)) {
-
-        size_t input_size = iov_size(pkt, pkt_frags);
-        size_t bytes_read;
-
-        if (input_size < ext_hdr_offset + sizeof(*ext_hdr)) {
-            return false;
-        }
+    if (input_size < ext_hdr_offset + sizeof(*ext_hdr)) {
+        return false;
+    }
 
+    if ((rthdr->rtype == 2) && (rthdr->segleft == 1)) {
         bytes_read = iov_to_buf(pkt, pkt_frags,
                                 ext_hdr_offset + sizeof(*rthdr),
                                 dst_addr, sizeof(*dst_addr));

From 9f48c17219589b1ce43dbc9d5a7d511c33c11247 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
Date: Wed, 10 Mar 2021 19:31:21 +0100
Subject: [PATCH 071/140] net/eth: Check iovec has enough data earlier
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We want to check fields from ip6_ext_hdr_routing structure
and if correct read the full in6_address. Let's directly check
if our iovec contains enough data for everything, else return
early.

Suggested-by: Stefano Garzarella <sgarzare@redhat.com>
Reviewed-by: Miroslav Rezanina <mrezanin@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/eth.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/eth.c b/net/eth.c
index bd8cc24b915..7e17630d24d 100644
--- a/net/eth.c
+++ b/net/eth.c
@@ -410,7 +410,7 @@ _eth_get_rss_ex_dst_addr(const struct iovec *pkt, int pkt_frags,
     size_t input_size = iov_size(pkt, pkt_frags);
     size_t bytes_read;
 
-    if (input_size < ext_hdr_offset + sizeof(*ext_hdr)) {
+    if (input_size < ext_hdr_offset + sizeof(*rthdr) + sizeof(*dst_addr)) {
         return false;
     }
 

From 26c305c58043fac2e3829bdbd11e277fbd41b6be Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
Date: Wed, 10 Mar 2021 19:31:22 +0100
Subject: [PATCH 072/140] net/eth: Read ip6_ext_hdr_routing buffer before
 accessing it
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We can't know the caller read enough data in the memory pointed
by ext_hdr to cast it as a ip6_ext_hdr_routing.
Declare rt_hdr on the stack and fill it again from the iovec.

Since we already checked there is enough data in the iovec buffer,
simply add an assert() call to consume the bytes_read variable.

This fix a 2 bytes buffer overrun in eth_parse_ipv6_hdr() reported
by QEMU fuzzer:

  $ cat << EOF | ./qemu-system-i386 -M pc-q35-5.0 \
    -accel qtest -monitor none \
    -serial none -nographic -qtest stdio
  outl 0xcf8 0x80001010
  outl 0xcfc 0xe1020000
  outl 0xcf8 0x80001004
  outw 0xcfc 0x7
  write 0x25 0x1 0x86
  write 0x26 0x1 0xdd
  write 0x4f 0x1 0x2b
  write 0xe1020030 0x4 0x190002e1
  write 0xe102003a 0x2 0x0807
  write 0xe1020048 0x4 0x12077cdd
  write 0xe1020400 0x4 0xba077cdd
  write 0xe1020420 0x4 0x190002e1
  write 0xe1020428 0x4 0x3509d807
  write 0xe1020438 0x1 0xe2
  EOF
  =================================================================
  ==2859770==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffdef904902 at pc 0x561ceefa78de bp 0x7ffdef904820 sp 0x7ffdef904818
  READ of size 1 at 0x7ffdef904902 thread T0
      #0 0x561ceefa78dd in _eth_get_rss_ex_dst_addr net/eth.c:410:17
      #1 0x561ceefa41fb in eth_parse_ipv6_hdr net/eth.c:532:17
      #2 0x561cef7de639 in net_tx_pkt_parse_headers hw/net/net_tx_pkt.c:228:14
      #3 0x561cef7dbef4 in net_tx_pkt_parse hw/net/net_tx_pkt.c:273:9
      #4 0x561ceec29f22 in e1000e_process_tx_desc hw/net/e1000e_core.c:730:29
      #5 0x561ceec28eac in e1000e_start_xmit hw/net/e1000e_core.c:927:9
      #6 0x561ceec1baab in e1000e_set_tdt hw/net/e1000e_core.c:2444:9
      #7 0x561ceebf300e in e1000e_core_write hw/net/e1000e_core.c:3256:9
      #8 0x561cef3cd4cd in e1000e_mmio_write hw/net/e1000e.c:110:5

  Address 0x7ffdef904902 is located in stack of thread T0 at offset 34 in frame
      #0 0x561ceefa320f in eth_parse_ipv6_hdr net/eth.c:486

    This frame has 1 object(s):
      [32, 34) 'ext_hdr' (line 487) <== Memory access at offset 34 overflows this variable
  HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
        (longjmp and C++ exceptions *are* supported)
  SUMMARY: AddressSanitizer: stack-buffer-overflow net/eth.c:410:17 in _eth_get_rss_ex_dst_addr
  Shadow bytes around the buggy address:
    0x10003df188d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x10003df188e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x10003df188f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x10003df18900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x10003df18910: 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1
  =>0x10003df18920:[02]f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00
    0x10003df18930: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x10003df18940: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x10003df18950: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x10003df18960: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x10003df18970: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  Shadow byte legend (one shadow byte represents 8 application bytes):
    Addressable:           00
    Partially addressable: 01 02 03 04 05 06 07
    Stack left redzone:      f1
    Stack right redzone:     f3
  ==2859770==ABORTING

Add the corresponding qtest case with the fuzzer reproducer.

FWIW GCC 11 similarly reported:

  net/eth.c: In function 'eth_parse_ipv6_hdr':
  net/eth.c:410:15: error: array subscript 'struct ip6_ext_hdr_routing[0]' is partly outside array bounds of 'struct ip6_ext_hdr[1]' [-Werror=array-bounds]
    410 |     if ((rthdr->rtype == 2) && (rthdr->segleft == 1)) {
        |          ~~~~~^~~~~~~
  net/eth.c:485:24: note: while referencing 'ext_hdr'
    485 |     struct ip6_ext_hdr ext_hdr;
        |                        ^~~~~~~
  net/eth.c:410:38: error: array subscript 'struct ip6_ext_hdr_routing[0]' is partly outside array bounds of 'struct ip6_ext_hdr[1]' [-Werror=array-bounds]
    410 |     if ((rthdr->rtype == 2) && (rthdr->segleft == 1)) {
        |                                 ~~~~~^~~~~~~~~
  net/eth.c:485:24: note: while referencing 'ext_hdr'
    485 |     struct ip6_ext_hdr ext_hdr;
        |                        ^~~~~~~

Cc: qemu-stable@nongnu.org
Buglink: https://bugs.launchpad.net/qemu/+bug/1879531
Reported-by: Alexander Bulekov <alxndr@bu.edu>
Reported-by: Miroslav Rezanina <mrezanin@redhat.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Reviewed-by: Miroslav Rezanina <mrezanin@redhat.com>
Fixes: eb700029c78 ("net_pkt: Extend packet abstraction as required by e1000e functionality")
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 MAINTAINERS              |  1 +
 net/eth.c                | 13 ++++++----
 tests/fuzz-e1000e-test.c | 53 ++++++++++++++++++++++++++++++++++++++++
 3 files changed, 62 insertions(+), 5 deletions(-)
 create mode 100644 tests/fuzz-e1000e-test.c

diff --git a/MAINTAINERS b/MAINTAINERS
index 377078711a0..532cbeb328c 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1123,6 +1123,7 @@ e1000e
 M: Dmitry Fleytman <dmitry@daynix.com>
 S: Maintained
 F: hw/net/e1000e*
+F: tests/qtest/fuzz-e1000e-test.c
 
 Generic Loader
 M: Alistair Francis <alistair.francis@xilinx.com>
diff --git a/net/eth.c b/net/eth.c
index 7e17630d24d..2b816a93ffd 100644
--- a/net/eth.c
+++ b/net/eth.c
@@ -406,17 +406,20 @@ _eth_get_rss_ex_dst_addr(const struct iovec *pkt, int pkt_frags,
                         struct ip6_ext_hdr *ext_hdr,
                         struct in6_address *dst_addr)
 {
-    struct ip6_ext_hdr_routing *rthdr = (struct ip6_ext_hdr_routing *) ext_hdr;
+    struct ip6_ext_hdr_routing rt_hdr;
     size_t input_size = iov_size(pkt, pkt_frags);
     size_t bytes_read;
 
-    if (input_size < ext_hdr_offset + sizeof(*rthdr) + sizeof(*dst_addr)) {
+    if (input_size < ext_hdr_offset + sizeof(rt_hdr) + sizeof(*dst_addr)) {
         return false;
     }
 
-    if ((rthdr->rtype == 2) && (rthdr->segleft == 1)) {
-        bytes_read = iov_to_buf(pkt, pkt_frags,
-                                ext_hdr_offset + sizeof(*rthdr),
+    bytes_read = iov_to_buf(pkt, pkt_frags, ext_hdr_offset,
+                            &rt_hdr, sizeof(rt_hdr));
+    assert(bytes_read == sizeof(rt_hdr));
+
+    if ((rt_hdr.rtype == 2) && (rt_hdr.segleft == 1)) {
+        bytes_read = iov_to_buf(pkt, pkt_frags, ext_hdr_offset + sizeof(rt_hdr),
                                 dst_addr, sizeof(*dst_addr));
 
         return bytes_read == sizeof(dst_addr);
diff --git a/tests/fuzz-e1000e-test.c b/tests/fuzz-e1000e-test.c
new file mode 100644
index 00000000000..66229e60964
--- /dev/null
+++ b/tests/fuzz-e1000e-test.c
@@ -0,0 +1,53 @@
+/*
+ * QTest testcase for e1000e device generated by fuzzer
+ *
+ * Copyright (c) 2021 Red Hat, Inc.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+
+#include "libqos/libqtest.h"
+
+/*
+ * https://bugs.launchpad.net/qemu/+bug/1879531
+ */
+static void test_lp1879531_eth_get_rss_ex_dst_addr(void)
+{
+    QTestState *s;
+
+    s = qtest_init("-nographic -monitor none -serial none -M pc-q35-5.0");
+
+    qtest_outl(s, 0xcf8, 0x80001010);
+    qtest_outl(s, 0xcfc, 0xe1020000);
+    qtest_outl(s, 0xcf8, 0x80001004);
+    qtest_outw(s, 0xcfc, 0x7);
+    qtest_writeb(s, 0x25, 0x86);
+    qtest_writeb(s, 0x26, 0xdd);
+    qtest_writeb(s, 0x4f, 0x2b);
+
+    qtest_writel(s, 0xe1020030, 0x190002e1);
+    qtest_writew(s, 0xe102003a, 0x0807);
+    qtest_writel(s, 0xe1020048, 0x12077cdd);
+    qtest_writel(s, 0xe1020400, 0xba077cdd);
+    qtest_writel(s, 0xe1020420, 0x190002e1);
+    qtest_writel(s, 0xe1020428, 0x3509d807);
+    qtest_writeb(s, 0xe1020438, 0xe2);
+    qtest_writeb(s, 0x4f, 0x2b);
+    qtest_quit(s);
+}
+
+int main(int argc, char **argv)
+{
+    const char *arch = qtest_get_arch();
+
+    g_test_init(&argc, &argv, NULL);
+
+    if (strcmp(arch, "i386") == 0 || strcmp(arch, "x86_64") == 0) {
+        qtest_add_func("fuzz/test_lp1879531_eth_get_rss_ex_dst_addr",
+                       test_lp1879531_eth_get_rss_ex_dst_addr);
+    }
+
+    return g_test_run();
+}

From e76ccbdd6cb3a784b344fba8944b8c9618e580f2 Mon Sep 17 00:00:00 2001
From: Andrew Fasano <fasano@mit.edu>
Date: Mon, 18 Jul 2022 16:58:29 -0400
Subject: [PATCH 073/140] dynamic_symbols: Fix range-loop-construction error
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fixes the following gcc 11 error:

panda/panda/plugins/dynamic_symbols/dynamic_symbols.cpp: In function ‘symbol resolve_symbol(CPUState*, target_ulong, char*, char*)’:
panda/panda/plugins/dynamic_symbols/dynamic_symbols.cpp:197:21: error: loop variable ‘section’ creates a copy from type ‘const std::pair<const std::__cxx11::basic_string<char>, std::unordered_map<std::__cxx11::basic_string<char>, symbol>*>’ [-Werror=range-loop-construct]
  197 |     for (const auto section : symbols[asid]){
      |                     ^~~~~~~
---
 panda/plugins/dynamic_symbols/dynamic_symbols.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/panda/plugins/dynamic_symbols/dynamic_symbols.cpp b/panda/plugins/dynamic_symbols/dynamic_symbols.cpp
index 65508b8fc14..52259b6399c 100644
--- a/panda/plugins/dynamic_symbols/dynamic_symbols.cpp
+++ b/panda/plugins/dynamic_symbols/dynamic_symbols.cpp
@@ -194,7 +194,7 @@ void new_assignment_check_symbols(CPUState* cpu, unordered_map<string, struct sy
 struct symbol resolve_symbol(CPUState* cpu, target_ulong asid, char* section_name, char* symbol){
     update_symbols_in_space(cpu);
 
-    for (const auto section : symbols[asid]){
+    for (const auto &section : symbols[asid]){
         string n = section.first;
         auto section_vec = section.second;
         size_t found;

From 12d38f0ec484a71d51ac4e5f6f72d18596ee8c99 Mon Sep 17 00:00:00 2001
From: Andrew Fasano <fasano@mit.edu>
Date: Mon, 18 Jul 2022 16:59:55 -0400
Subject: [PATCH 074/140] Enable -Werror for GCC up to 11.2

---
 build.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/build.sh b/build.sh
index 1aa1dddd636..866c784caee 100755
--- a/build.sh
+++ b/build.sh
@@ -66,8 +66,8 @@ g++ --version | awk '/g\+\+/ && ($3+0)<7.1{print "Fatal error: G++ too old"; exi
 
 # Untested GCC - it's probably going to have some warnings - Just disable Werror and hope it works
 COMPILER_CONFIG=""
-gcc --version | awk '/gcc/   && ($3+0)>9.3{print "WARNING: Your GCC is too new: disabling -Werror and hoping this builds"; exit 1}' || COMPILER_CONFIG+="--extra-cflags=-Wno-error"
-g++ --version | awk '/g\+\+/ && ($3+0)>9.3{print "WARNING: Your G++ is too new: disabling -Werror and hoping this builds"; exit 1}' ||  COMPILER_CONFIG+=" --extra-cxxflags=-Wno-error"
+gcc --version | awk '/gcc/   && ($3+0)>11.2{print "WARNING: Your GCC is too new: disabling -Werror and hoping this builds"; exit 1}' || COMPILER_CONFIG+="--extra-cflags=-Wno-error"
+g++ --version | awk '/g\+\+/ && ($3+0)>11.2{print "WARNING: Your G++ is too new: disabling -Werror and hoping this builds"; exit 1}' ||  COMPILER_CONFIG+=" --extra-cxxflags=-Wno-error"
 
 ### Check for protobuf v2.
 if ! pkg-config --exists protobuf; then

From 27875366103bde1354a76c1f2596da988b08fc6a Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Fri, 16 Apr 2021 14:55:43 +0100
Subject: [PATCH 075/140] include/disas/dis-asm.h: Handle being included
 outside 'extern "C"'

[This commit from upstream was modified fairly significantly as we use
bfd.h while upstream is using dis-asm.h -- Andrew]

Make dis-asm.h handle being included outside an 'extern "C"' block;
this allows us to remove the 'extern "C"' blocks that our two C++
files that include it are using.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 disas/arm-a64.cc     | 2 --
 include/disas/bfd.h  | 8 ++++++++
 include/qemu/osdep.h | 8 ++++++++
 3 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/disas/arm-a64.cc b/disas/arm-a64.cc
index 9280950ce38..8a7cb0bc6d7 100644
--- a/disas/arm-a64.cc
+++ b/disas/arm-a64.cc
@@ -17,10 +17,8 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-extern "C" {
 #include "qemu/osdep.h"
 #include "disas/bfd.h"
-}
 
 #include "vixl/a64/disasm-a64.h"
 
diff --git a/include/disas/bfd.h b/include/disas/bfd.h
index 0f4ecdeb88a..cb6aa2696c9 100644
--- a/include/disas/bfd.h
+++ b/include/disas/bfd.h
@@ -11,6 +11,10 @@
 
 #include "qemu/fprintf-fn.h"
 
+#ifdef __cplusplus
+extern "C" {
+#endif
+
 typedef void *PTR;
 typedef uint64_t bfd_vma;
 typedef int64_t bfd_signed_vma;
@@ -507,4 +511,8 @@ bfd_vma bfd_getl16 (const bfd_byte *addr);
 bfd_vma bfd_getb16 (const bfd_byte *addr);
 typedef bool bfd_boolean;
 
+#ifdef __cplusplus
+}
+#endif
+
 #endif /* DISAS_BFD_H */
diff --git a/include/qemu/osdep.h b/include/qemu/osdep.h
index c97ad5a7fda..f5aae5ef585 100644
--- a/include/qemu/osdep.h
+++ b/include/qemu/osdep.h
@@ -49,6 +49,10 @@
 #define __STDC_FORMAT_MACROS
 #endif
 
+#ifdef __cplusplus
+extern "C" {
+#endif
+
 /* The following block of code temporarily renames the daemon() function so the
  * compiler does not see the warning associated with it in stdlib.h on OSX
  */
@@ -475,5 +479,9 @@ pid_t qemu_fork(Error **errp);
 void panda_set_library_mode(bool);
 bool panda_get_library_mode(void);
 
+#ifdef __cplusplus
+}
+#endif
+
 #endif
 

From 560c4da5b452d11151196545d52faa7a7dcd2d2f Mon Sep 17 00:00:00 2001
From: Andrew Fasano <fasano@mit.edu>
Date: Mon, 18 Jul 2022 17:36:12 -0400
Subject: [PATCH 076/140] Callstack_instr: fix arguments to cs_version in
 capstone version check

---
 panda/plugins/callstack_instr/callstack_instr.cpp | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/panda/plugins/callstack_instr/callstack_instr.cpp b/panda/plugins/callstack_instr/callstack_instr.cpp
index 93fcac6cedb..e84a51c7ec8 100644
--- a/panda/plugins/callstack_instr/callstack_instr.cpp
+++ b/panda/plugins/callstack_instr/callstack_instr.cpp
@@ -525,8 +525,8 @@ bool init_plugin(void *self) {
     if (cs_open(CS_ARCH_ARM, CS_MODE_ARM, &cs_handle_32) != CS_ERR_OK)
         return false;
 
-    // Run-time check
-    if (cs_version < CS_MAKE_VERSION(4, 0)) {
+    // Run-time check: is current version below 4.0?
+    if (cs_version(NULL, NULL) < CS_MAKE_VERSION(4, 0)) {
       printf("\n[ERROR] Capstone versions prior to 4.0.1 are unusable with ARM so callstack instr will fail! Please upgrade your libcapstone install and rebuild to use this plugin\n\n");
       return false;
     }

From 2ed6e237269a4270e8d4300f21a2137bc4069ecd Mon Sep 17 00:00:00 2001
From: Andrew Fasano <fasano@mit.edu>
Date: Mon, 18 Jul 2022 17:42:01 -0400
Subject: [PATCH 077/140] Remove extern C from osdep header
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fixes errors about "template with C linkage":

In file included from /usr/include/glib-2.0/glib/glib-typeof.h:39,
                 from /usr/include/glib-2.0/glib/gatomic.h:28,
                 from /usr/include/glib-2.0/glib/gthread.h:32,
                 from /usr/include/glib-2.0/glib/gasyncqueue.h:32,
                 from /usr/include/glib-2.0/glib.h:32,
                 from /home/andrew/git/panda/include/glib-compat.h:22,
                 from /home/andrew/git/panda/include/qemu/osdep.h:117,
                 from /home/andrew/git/panda/disas/arm-a64.cc:20:
/usr/include/c++/11/type_traits:44:3: error: template with C linkage
   44 |   template<typename... _Elements>
      |   ^~~~~~~~
In file included from /home/andrew/git/panda/disas/arm-a64.cc:20:
/home/andrew/git/panda/include/qemu/osdep.h:53:1: note: ‘extern "C"’ linkage started here
   53 | extern "C" {
      | ^~~~~~~~~~
In file included from /usr/include/glib-2.0/glib/glib-typeof.h:39,
                 from /usr/include/glib-2.0/glib/gatomic.h:28,
                 from /usr/include/glib-2.0/glib/gthread.h:32,
                 from /usr/include/glib-2.0/glib/gasyncqueue.h:32,
                 from /usr/include/glib-2.0/glib.h:32,
                 from /home/andrew/git/panda/include/glib-compat.h:22,
                 from /home/andrew/git/panda/include/qemu/osdep.h:117,
                 from /home/andrew/git/panda/disas/arm-a64.cc:20:
/usr/include/c++/11/type_traits:47:3: error: template with C linkage
   47 |   template<typename _Tp>
      |   ^~~~~~~~
---
 include/qemu/osdep.h | 7 -------
 1 file changed, 7 deletions(-)

diff --git a/include/qemu/osdep.h b/include/qemu/osdep.h
index f5aae5ef585..525b6d87865 100644
--- a/include/qemu/osdep.h
+++ b/include/qemu/osdep.h
@@ -49,10 +49,6 @@
 #define __STDC_FORMAT_MACROS
 #endif
 
-#ifdef __cplusplus
-extern "C" {
-#endif
-
 /* The following block of code temporarily renames the daemon() function so the
  * compiler does not see the warning associated with it in stdlib.h on OSX
  */
@@ -479,9 +475,6 @@ pid_t qemu_fork(Error **errp);
 void panda_set_library_mode(bool);
 bool panda_get_library_mode(void);
 
-#ifdef __cplusplus
-}
-#endif
 
 #endif
 

From 96a23ef4a151f6eea14ba2ee56ca5a19674fff43 Mon Sep 17 00:00:00 2001
From: Andrew Fasano <fasano@mit.edu>
Date: Tue, 26 Apr 2022 19:06:13 -0400
Subject: [PATCH 078/140] Disable xen in configure to avoid build errors on
 Ubuntu 22.04

---
 configure | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/configure b/configure
index 64b0b0476e3..a2e85de2d36 100755
--- a/configure
+++ b/configure
@@ -304,7 +304,7 @@ vde=""
 vnc_sasl=""
 vnc_jpeg=""
 vnc_png=""
-xen=""
+xen="no" # Disabled for PANDA
 xen_ctrl_version=""
 xen_pv_domain_build="no"
 xen_pci_passthrough=""

From a23dfc78ec343f29d27e264723e99cae5ad44688 Mon Sep 17 00:00:00 2001
From: Andrew Fasano <fasano@mit.edu>
Date: Mon, 18 Jul 2022 15:06:37 -0400
Subject: [PATCH 079/140] Add dependencies list for for Ubuntu 22.04.

* Leave CI and dockerfile at 20.04 due to a docker bug where Docker <= 20.10.7 can't run 22.04 containers.
* Add notes and a yaml file for local CI testing.
---
 .github/workflows/README.md               | 29 +++-----
 .github/workflows/local_tests.yml         | 18 +++++
 .github/workflows/parallel_tests.yml      |  2 +-
 Dockerfile                                |  2 +
 panda/dependencies/ubuntu:22.04_base.txt  | 81 ++++++++++++++++++++
 panda/dependencies/ubuntu:22.04_build.txt | 90 +++++++++++++++++++++++
 6 files changed, 204 insertions(+), 18 deletions(-)
 create mode 100644 .github/workflows/local_tests.yml
 create mode 100644 panda/dependencies/ubuntu:22.04_base.txt
 create mode 100644 panda/dependencies/ubuntu:22.04_build.txt

diff --git a/.github/workflows/README.md b/.github/workflows/README.md
index 182402ab41f..ae9062f8fe2 100644
--- a/.github/workflows/README.md
+++ b/.github/workflows/README.md
@@ -1,25 +1,20 @@
 # GitHub Actions Tests
 
-**Important Note:** GitHub Actions does *not* recommend self-hosted runners for public repos b/c a PR could trigger arbitrary code execution on the hosted server. However, our tests run in a temporary container that is removed after the test completes, so this mitigates *much* of the risk.
-
-
-## Ideal Design:
-On PR/push:
-    If dockerfile unmodified and code (*.c, *.cpp, *.h, Makefile) changed: pull container from dockerhub, copy in source, rebuild with label `$UID` -> Kick off PR test suite
-    If dockerfile modified: rebuild container from scratch with label `$UID` -> Kick off PR test suite
-    If nothing modified: -> No tests
-
-Test suite: Given `$UID` for a docker container with code built
-    For each arch: qemu checks
-    For each arch: taint unit tests
-
-On push to `master`:
-    Rebuild container, push to dockerhub
-
-
 ## Current Design:
 On PR/push:
   Rebuild container from source. Once container is built, run all test suites in parallel
 
 On push to `master`
   Rebuild container (again), push to dockerhub
+
+
+## Testing locally
+
+We recommend using [act](https://github.com/nektos/act) to locally run CI tests.
+This is much easier than repeatedly pushing to a branch/PR if you have a CI failure.
+
+Running with the `-b` flag seems to be required, but then your directory will be owned by `root`:
+
+``
+act -b -j local_build_container; sudo chown -R $USER:$USER . .git
+```
diff --git a/.github/workflows/local_tests.yml b/.github/workflows/local_tests.yml
new file mode 100644
index 00000000000..6f01b98de03
--- /dev/null
+++ b/.github/workflows/local_tests.yml
@@ -0,0 +1,18 @@
+# Run directly with act - standard repo-name guards are disabled and runs without self-hosted.
+# See .github/workflows/README.md for more details
+#
+# Note that this action never runs automatically
+
+name: Local
+
+jobs:
+  local_build_container:
+    runs-on: ubuntu:22.04
+    steps:
+    - uses: actions/checkout@v2 # Clones to $GITHUB_WORKSPACE. NOTE: this requires git > 2.18 (not on ubuntu 18.04 by default) to get .git directory
+
+    - name: Build docker container from project root
+      run: echo $GITHUB_WORKSPACE; cd $GITHUB_WORKSPACE && DOCKER_BUILDKIT=1 docker build --progress=plain --target developer -t panda_local_${{ github.sha }} .
+
+    - name: Minimal test of built container # Just test to see if one of our binaries is built
+      run: docker run --rm "panda_local_${{ github.sha }}" /bin/bash -c 'exit $(/panda/build/arm-softmmu/panda-system-arm -help | grep -q "usage. panda-system-arm")'
diff --git a/.github/workflows/parallel_tests.yml b/.github/workflows/parallel_tests.yml
index 7555671ab63..b4dc7c88644 100644
--- a/.github/workflows/parallel_tests.yml
+++ b/.github/workflows/parallel_tests.yml
@@ -17,7 +17,7 @@ on:
 jobs:
 
   test_installer: # test install_ubuntu.sh
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-20.04 # Note 22.04 would work, but it requires docker > 20.10.7 which is not on our CI box (yet)
     steps:
     - uses: actions/checkout@v2 # Clones to $GITHUB_WORKSPACE. NOTE: this requires git > 2.18 (not on ubuntu 18.04 by default) to get .git directory
     - name: Lint PyPANDA with flake8
diff --git a/Dockerfile b/Dockerfile
index b18ed1cdccb..02aba77027e 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,6 @@
 ARG BASE_IMAGE="ubuntu:20.04"
+# Note PANDA supports ubuntu:22.04, but docker versions <= 20.10.7 can't run 22.04 containers
+
 ARG TARGET_LIST="x86_64-softmmu,i386-softmmu,arm-softmmu,ppc-softmmu,mips-softmmu,mipsel-softmmu,aarch64-softmmu"
 
 ### BASE IMAGE
diff --git a/panda/dependencies/ubuntu:22.04_base.txt b/panda/dependencies/ubuntu:22.04_base.txt
new file mode 100644
index 00000000000..ecbf8a33f9e
--- /dev/null
+++ b/panda/dependencies/ubuntu:22.04_base.txt
@@ -0,0 +1,81 @@
+# Panda dependencies
+# Note that libcapstone >= v4.1 is also required, but that's not available in apt
+git
+libdwarf1
+libjsoncpp-dev
+libllvm11
+libprotobuf-c-dev
+libvte-2.91-0
+libwireshark-dev
+libwiretap-dev
+libxen-dev
+libz3-dev
+python3
+python3-pip
+python3-protobuf
+wget
+
+# pyperipheral (only needed for armel)
+libpython3-dev
+
+# pypanda dependencies
+genisoimage
+libffi-dev
+python3-colorama
+python3-protobuf
+python3-pycparser
+
+# Not sure what this one is needed for
+liblzo2-2
+
+# apt-rdepends qemu-system-common
+acl
+libc6
+libcap-ng0
+libcap2
+libgbm1
+libglib2.0-0
+libgnutls30
+libnettle8
+libpixman-1-0
+libvirglrenderer1
+
+# apt-rdepends qemu-block-extra
+libcurl3-gnutls
+libglib2.0-0
+libiscsi7
+librados2
+librbd1
+libssh-4
+
+# apt-rdepends qemu-system-arm, seems most of the system-[arch]es have same dependencies
+libaio1
+libasound2
+libbrlapi-dev
+libc6
+libcacard0
+libepoxy0
+libfdt1
+libgbm1
+libgcc-s1
+libglib2.0-0
+libgnutls30
+libibverbs1
+libjpeg8
+libncursesw6
+libnuma1
+libpixman-1-0
+libpmem1
+libpng16-16
+librdmacm1
+libsasl2-2
+libseccomp2
+libslirp0
+libspice-server1
+libstdc++6
+libtinfo6
+libusb-1.0-0
+libusbredirparser1
+libvirglrenderer1
+zlib1g
+
diff --git a/panda/dependencies/ubuntu:22.04_build.txt b/panda/dependencies/ubuntu:22.04_build.txt
new file mode 100644
index 00000000000..57a682f20da
--- /dev/null
+++ b/panda/dependencies/ubuntu:22.04_build.txt
@@ -0,0 +1,90 @@
+libc++-dev
+libelf-dev
+libtool-bin
+libwireshark-dev
+libwiretap-dev
+lsb-core
+zip
+
+# panda build deps
+# Note libcapstone-dev is required, but we need v4 + which isn't in apt
+build-essential
+chrpath
+clang-11
+gcc
+libdwarf-dev
+libprotoc-dev
+llvm-11-dev
+protobuf-c-compiler
+protobuf-compiler
+python3-dev
+libpixman-1-dev
+zip
+
+# pypanda dependencies
+python3-setuptools
+python3-wheel
+
+# pypanda test dependencies
+gcc-multilib
+libc6-dev-i386
+nasm
+
+# Qemu build deps
+debhelper
+device-tree-compiler
+gnutls-dev
+libaio-dev
+libasound2-dev
+libattr1-dev
+libbrlapi-dev
+libcacard-dev
+libcap-dev
+libcap-ng-dev
+libcurl4-gnutls-dev
+libdrm-dev
+libepoxy-dev
+libfdt-dev
+libgbm-dev
+libibumad-dev
+libibverbs-dev
+libiscsi-dev
+libjpeg-dev
+libncursesw5-dev
+libnuma-dev
+libpmem-dev
+libpng-dev
+libpulse-dev
+librbd-dev
+librdmacm-dev
+libsasl2-dev
+libseccomp-dev
+libslirp-dev
+libspice-protocol-dev
+libspice-server-dev
+libssh-dev
+libudev-dev
+libusb-1.0-0-dev
+libusbredirparser-dev
+libvirglrenderer-dev
+nettle-dev
+python3
+python3-sphinx
+texinfo
+uuid-dev
+xfslibs-dev
+zlib1g-dev
+libc6.1-dev-alpha-cross
+
+# qemu build deps that conflict with gcc-multilib
+#gcc-alpha-linux-gnu
+#gcc-powerpc64-linux-gnu
+#gcc-s390x-linux-gnu
+
+# rust install deps
+curl
+
+# libosi install deps
+cmake
+ninja-build
+rapidjson-dev

From d46451825ae32267cf0f97e21766b0b97d479f7d Mon Sep 17 00:00:00 2001
From: Jacques Becker <jacques.becker20@gmail.com>
Date: Wed, 20 Jul 2022 14:21:32 -0400
Subject: [PATCH 080/140] fixed arm osi bug - removed use of
 per_cpu_offset_0_addr in computation of current task_struct pointer (#1205)

---
 panda/plugins/osi_linux/default_profile.cpp | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/panda/plugins/osi_linux/default_profile.cpp b/panda/plugins/osi_linux/default_profile.cpp
index 48b082dc603..f7fd8bab867 100644
--- a/panda/plugins/osi_linux/default_profile.cpp
+++ b/panda/plugins/osi_linux/default_profile.cpp
@@ -44,6 +44,14 @@ target_ptr_t default_get_current_task_struct(CPUState *cpu)
         target_ptr_t task_thread_info = kernel_sp & ~(0x2000 -1);
 
         current_task_addr=task_thread_info+0xC;
+
+        //because some kernel versions use both per_cpu variables AND access the task_struct 
+        //via the thread_info struct, the default call to struct_get with the per_cpu_offset_0_addr can be incorrect
+        err = struct_get(cpu, &ts, current_task_addr, 0);
+        assert(err == struct_get_ret_t::SUCCESS && "failed to get current task struct");
+        fixupendian(ts);
+        return ts;
+
     }
 #elif defined(TARGET_MIPS)
     // __current_thread_info is stored in KERNEL r28

From f95cc5e09642cc7c98b529d1cc5126a148e762c0 Mon Sep 17 00:00:00 2001
From: mariusmue <m.muench@vu.nl>
Date: Wed, 27 Jul 2022 12:45:46 +0200
Subject: [PATCH 081/140] Explicitly enable taint for python unicorn examples

---
 panda/python/examples/unicorn/taint_sym_x86_64.py | 3 +++
 panda/python/examples/unicorn/taint_x86_64.py     | 3 +++
 2 files changed, 6 insertions(+)

diff --git a/panda/python/examples/unicorn/taint_sym_x86_64.py b/panda/python/examples/unicorn/taint_sym_x86_64.py
index 53dcec5f91e..d75274f57bb 100644
--- a/panda/python/examples/unicorn/taint_sym_x86_64.py
+++ b/panda/python/examples/unicorn/taint_sym_x86_64.py
@@ -63,6 +63,9 @@ def setup(cpu):
     # Set starting pc
     panda.arch.set_pc(cpu, ADDRESS)
 
+    # Enable tainting
+    panda.taint_enable()
+
     # Taint buffer using PHYSICAL addresses
     for idx in range(len(buf)):
         panda.taint_label_ram(buf_src+idx, idx)
diff --git a/panda/python/examples/unicorn/taint_x86_64.py b/panda/python/examples/unicorn/taint_x86_64.py
index 3d4bb8be5b1..15b903bab6d 100644
--- a/panda/python/examples/unicorn/taint_x86_64.py
+++ b/panda/python/examples/unicorn/taint_x86_64.py
@@ -60,6 +60,9 @@ def setup(cpu):
     # Set starting pc
     panda.arch.set_pc(cpu, ADDRESS)
 
+    # Enable tainting
+    panda.taint_enable()
+
     # Taint buffer using PHYSICAL addresses
     for idx in range(len(buf)):
         panda.taint_label_ram(buf_src+idx, idx)

From fb4382be6e5624d5f410683142c3b448b7e1b5bb Mon Sep 17 00:00:00 2001
From: Andrew Fasano <fasano@mit.edu>
Date: Thu, 30 Dec 2021 12:27:32 -0500
Subject: [PATCH 082/140] Add panda_break_exec which will jump out of execution
 from SBE CBs

This logic mirrors the existing panda_flush_tb code, only it's checked
at the end of SBE callbacks.

This allows for a user to change program counter in an SBE callback and
immediately redirect control flow without running the original block.
Similarly, the block can be modified and dropped from the tcg cache and
it will then be retranslated before being executed. This may make
before_block_invalidate_opt redundant.

Also updates forcedexecution plugin to use panda_flush_tb instead of
the internal panda_do_flush_tb
---
 panda/include/panda/plugin.h            |  4 ++++
 panda/plugins/forcedexec/forcedexec.cpp |  6 +++---
 panda/python/core/pandare/panda.py      |  7 +++++++
 panda/src/callbacks.c                   | 15 +++++++++++++++
 panda/src/cb-support.c                  | 21 +++++++++++++++++++--
 5 files changed, 48 insertions(+), 5 deletions(-)

diff --git a/panda/include/panda/plugin.h b/panda/include/panda/plugin.h
index 0940f99b319..e2330623330 100644
--- a/panda/include/panda/plugin.h
+++ b/panda/include/panda/plugin.h
@@ -92,9 +92,13 @@ extern PandaOsFamily panda_os_familyno; // numeric identifier for family
 
 
 
+/* Internal callback functions that plugins shouldn't use. These unset the flag when called so must be handled */
+bool panda_break_exec(void);
 bool panda_flush_tb(void);
 
+/* Regular functions plugins should use */
 void panda_do_flush_tb(void);
+void panda_do_break_exec(void);
 void panda_enable_precise_pc(void);
 void panda_disable_precise_pc(void);
 void panda_enable_memcb(void);
diff --git a/panda/plugins/forcedexec/forcedexec.cpp b/panda/plugins/forcedexec/forcedexec.cpp
index 9a377573ab7..715473e2dad 100644
--- a/panda/plugins/forcedexec/forcedexec.cpp
+++ b/panda/plugins/forcedexec/forcedexec.cpp
@@ -71,14 +71,14 @@ void tcg_parse(CPUState *env, TranslationBlock *tb) {
 void enable_forcedexec() {
     assert(self != NULL);
     panda_enable_callback(self, PANDA_CB_BEFORE_TCG_CODEGEN, tcg_cb);
-    panda_flush_tb();
+    panda_do_flush_tb();
 }
 
 void disable_forcedexec() {
     assert(self != NULL);
     panda_disable_callback(self, PANDA_CB_BEFORE_TCG_CODEGEN, tcg_cb);
-    panda_flush_tb(); // Really we only need to flush blocks we flipped-
-                      // we could track that and then optimize this.
+    panda_do_flush_tb(); // Really we only need to flush blocks we flipped-
+                         // we could track that and then optimize this.
 }
 
 
diff --git a/panda/python/core/pandare/panda.py b/panda/python/core/pandare/panda.py
index a042bb02efa..46dab1e2cfd 100755
--- a/panda/python/core/pandare/panda.py
+++ b/panda/python/core/pandare/panda.py
@@ -1182,6 +1182,13 @@ def flush_tb(self):
         '''
         return self.libpanda.panda_do_flush_tb()
 
+    def break_exec(self):
+        '''
+        If called from a start block exec callback, will cause the emulation to bail *before* executing
+        the rest of the current block.
+        '''
+        return self.libpanda.panda_do_break_exec()
+
     def enable_precise_pc(self):
         '''
         By default, QEMU does not update the program counter after every instruction.
diff --git a/panda/src/callbacks.c b/panda/src/callbacks.c
index d2c98c19edb..e58d3e73424 100644
--- a/panda/src/callbacks.c
+++ b/panda/src/callbacks.c
@@ -64,6 +64,7 @@ int nb_panda_plugins_loaded = 0;
 char *panda_plugins_loaded[MAX_PANDA_PLUGINS];
 
 bool panda_please_flush_tb = false;
+bool panda_please_break_exec = false;
 bool panda_update_pc = false;
 bool panda_use_memcb = false;
 bool panda_tb_chaining = true;
@@ -782,6 +783,20 @@ panda_cb_list *panda_cb_list_next(panda_cb_list *plist)
     return NULL;
 }
 
+void panda_do_break_exec(void) {
+  panda_please_break_exec = true;
+}
+
+bool panda_break_exec(void) {
+    if (panda_please_break_exec) {
+        panda_please_break_exec = false;
+        return true;
+    } else {
+        return false;
+    }
+
+}
+
 bool panda_flush_tb(void)
 {
     if (panda_please_flush_tb) {
diff --git a/panda/src/cb-support.c b/panda/src/cb-support.c
index 158a61ebb7f..ecf4c1d718f 100644
--- a/panda/src/cb-support.c
+++ b/panda/src/cb-support.c
@@ -75,12 +75,29 @@ MAKE_CALLBACK(bool, INSN_TRANSLATE, insn_translate,
 MAKE_CALLBACK(bool, AFTER_INSN_TRANSLATE, after_insn_translate,
                     CPUState*, env, target_ptr_t, pc)
 
-MAKE_CALLBACK(void, START_BLOCK_EXEC, start_block_exec,
-                    CPUState*, env, TranslationBlock*, tb)
+//MAKE_CALLBACK(void, START_BLOCK_EXEC, start_block_exec,
+//                    CPUState*, env, TranslationBlock*, tb)
 
 MAKE_CALLBACK(void, END_BLOCK_EXEC, end_block_exec,
                     CPUState*, env, TranslationBlock*, tb)
 
+// Non-macroized version for SBE - if panda_please_retranslate is set, we'll break
+void PCB(start_block_exec)(CPUState *cpu, TranslationBlock *tb) {
+    panda_cb_list *plist;
+    for (plist = panda_cbs[PANDA_CB_START_BLOCK_EXEC]; plist != NULL; plist = panda_cb_list_next(plist)) {
+        if (plist->enabled)
+            plist->entry.start_block_exec(plist->context, cpu, tb);
+    }
+
+    if (panda_break_exec()) {
+        cpu_loop_exit_noexc(cpu); // noreturn - lonjmps back to translation logic. Allows you to change pc in an SBE and go
+                                  // there immediately. It's like before_block_exec_invalidate_opt, but fast
+    }
+}
+void panda_cb_trampoline_start_block_exec(void* context, CPUState *cpu, TranslationBlock *tb) {\
+    (*(panda_cb*)context).start_block_exec(cpu, tb);
+}
+
 // these aren't used
 MAKE_CALLBACK(void, HD_READ, hd_read, CPUState*, env);
 MAKE_CALLBACK(void, HD_WRITE, hd_write, CPUState*, env);

From 493676487f7c2d237c7e55e7d3ecb3b49bdcd2b0 Mon Sep 17 00:00:00 2001
From: Andrew Fasano <fasano@mit.edu>
Date: Wed, 3 Aug 2022 22:10:44 -0400
Subject: [PATCH 083/140] Some minor PyPANDA enhancements  (#1172)

* PyPlugins: support kwargs

* PyPANDA: add get_os_family function to return the current OS family name

* Pandare.arch: consistently return errno as negative, even for x86 freebsd

* pypanda expect: support sending bytes

* SCGen: If multiple numbers exist for the same syscall, just return highest
---
 panda/python/core/pandare/arch.py            | 15 ++++++++++
 panda/python/core/pandare/panda.py           | 15 +++++++++-
 panda/python/core/pandare/panda_expect.py    |  4 +--
 panda/python/core/pandare/pypluginmanager.py |  2 +-
 panda/scripts/scgen.py                       | 30 +++++++++++++++++---
 5 files changed, 58 insertions(+), 8 deletions(-)

diff --git a/panda/python/core/pandare/arch.py b/panda/python/core/pandare/arch.py
index bb695b9857a..6b48ed43420 100644
--- a/panda/python/core/pandare/arch.py
+++ b/panda/python/core/pandare/arch.py
@@ -663,6 +663,21 @@ def get_pc(self, cpu):
         '''
         return cpu.env_ptr.eip
 
+    def get_retval(self, cpu, convention='default'):
+        '''
+        Overloaded to support FreeBSD syscall ABI
+        In that ABI, if eflags carry bit is set, an error has occured. To standardize
+        pandare.arch returns across architectures/ABIs, we indicate a failure by returnning
+        -ERRNO.
+        '''
+
+        error_flip = False
+        if convention == 'syscall' and self.panda.get_os_family() == 'OS_FREEBSD' and \
+                self.panda.libpanda.cpu_cc_compute_all(cpu.env_ptr, 1) & 1 == 1:
+            error_flip = True
+
+        return super().get_retval(cpu, convention) * (-1 if error_flip else 1)
+
     def set_pc(self, cpu, val):
         '''
         Overloaded function to set the x86_64 program counter
diff --git a/panda/python/core/pandare/panda.py b/panda/python/core/pandare/panda.py
index 46dab1e2cfd..5143799194b 100755
--- a/panda/python/core/pandare/panda.py
+++ b/panda/python/core/pandare/panda.py
@@ -1650,6 +1650,17 @@ def set_os_name(self, os_name):
         os_name_new = self.ffi.new("char[]", bytes(os_name, "utf-8"))
         self.libpanda.panda_set_os_name(os_name_new)
 
+    def get_os_family(self):
+        '''
+        Get the current OS family name. Valid values are the entries in `OSFamilyEnum`
+
+        Returns:
+            string: one of OS_UNKNOWN, OS_WINDOWS, OS_LINUX, OS_FREEBSD
+        '''
+
+        family_num = self.libpanda.panda_os_familyno
+        family_name = self.ffi.string(self.ffi.cast("PandaOsFamily", family_num))
+        return family_name
 
     def get_mappings(self, cpu):
         '''
@@ -2323,7 +2334,9 @@ def run_serial_cmd_async(self, cmd, delay=1):
     @blocking
     def type_serial_cmd(self, cmd):
         #Can send message into socket without guest running (no self.running.wait())
-        self.serial_console.send(cmd.encode("utf8")) # send, not sendline
+        if isinstance(cmd, str):
+            cmd = cmd.encode('utf8')
+        self.serial_console.send(cmd) # send, not sendline
 
     def finish_serial_cmd(self):
         result = self.serial_console.send_eol()
diff --git a/panda/python/core/pandare/panda_expect.py b/panda/python/core/pandare/panda_expect.py
index 7c54ae8dc8e..5513589e07d 100644
--- a/panda/python/core/pandare/panda_expect.py
+++ b/panda/python/core/pandare/panda_expect.py
@@ -440,8 +440,8 @@ def send(self, msg):
             self.consumed_first = True
 
         # Newlines will call problems
-        assert len(msg.decode().split("\n")) <= 2, "Multiline cmds unsupported"
-        self.last_msg = msg.decode().replace("\n", "")
+        assert len(msg.decode(errors='ignore').split("\n")) <= 2, "Multiline cmds unsupported"
+        self.last_msg = msg.decode(errors='ignore').replace("\n", "")
         os.write(self.fd, msg)
         if self.logfile:
             self.logfile.write(msg)
diff --git a/panda/python/core/pandare/pypluginmanager.py b/panda/python/core/pandare/pypluginmanager.py
index b425ce600bf..0ee184ff27a 100644
--- a/panda/python/core/pandare/pypluginmanager.py
+++ b/panda/python/core/pandare/pypluginmanager.py
@@ -29,7 +29,7 @@ def __getattr__(self, name):
         method = self.data.get(name, None)
         if method is None:
             raise AttributeError(f"No method {name}: available options are {self}")
-        return lambda *args: method(*args)
+        return lambda *args, **kwargs: method(*args, **kwargs)
 
 class _PppPlugins(_DotGetter):
     def __getattr__(self, name):
diff --git a/panda/scripts/scgen.py b/panda/scripts/scgen.py
index bf94289cf76..6cefc1cbb28 100644
--- a/panda/scripts/scgen.py
+++ b/panda/scripts/scgen.py
@@ -34,6 +34,7 @@ def gen_syscalls(os_arch):
     if not path.isfile(target):
         raise ValueError(f"Unsupported os_arch: {os_arch} - could not find {target}")
 
+    seen = {} # name -> [entry details]
     with open(target) as f:
         for line in f.readlines():
             if not len(line):
@@ -47,17 +48,38 @@ def gen_syscalls(os_arch):
             sys_name = line.split(" ")[2].split("(")[0]
 
             sys_name = sys_name.replace("sys_", "")
-            if sys_name.startswith("do_"):
-                sys_name.replace("do_", "")
+            if sys_name.startswith("do_"): # Unify names
+                sys_name = sys_name.replace("do_", "")
+
+            if sys_name.startswith("*"): # Parser put type into name
+                sys_name = sys_name.replace("*", "")
+
+            if sys_name not in seen:
+                seen[sys_name] = []
+            seen[sys_name].append(line)
+
             syscalls[sys_name] = sys_no
             num_sc[sys_no] = sys_name
 
-    #return syscalls
+    # Duplicates only show up in FreeBSD. It seems like we want to generally take the maximum value we see
+    # though this will cause some issues for older OSes. Is there a way to get the OS version -> syscall name details
+    # and then incorporate those?
+
+    # Print a warning, then drop all but the highest number
+    for name, dups in seen.items():
+        if len(dups) > 1:
+            print(f"WARNING dupliate entries for {name}:\n\t" + '\t'.join([x for x in dups]))
+
+            nums = [x for x,s_name in num_sc.items() if s_name == name]
+            non_max = [x for x in nums if x != max(nums)]
+            for x in non_max:
+                del num_sc[x]
+
     return num_sc
 
 if __name__ == '__main__':
     results = {}
-    for arch in ['linux_arm', 'linux_mips', 'linux_x64', 'linux_x86']:
+    for arch in ['linux_arm', 'linux_mips', 'linux_x64', 'linux_x86', 'freebsd_x64']:
         results[arch] = gen_syscalls(arch)
     with open("syscalls.json", 'w') as f:
         json.dump(results, f)

From d57295eb10e2b7668cb13d6559e1a8eb1a693a2f Mon Sep 17 00:00:00 2001
From: Ben-Dumas <bendumas95@gmail.com>
Date: Wed, 24 Aug 2022 12:23:46 -0400
Subject: [PATCH 084/140] fixes to profile documentation

---
 panda/plugins/osi/README.md        | 5 ++++-
 panda/python/core/pandare/panda.py | 5 ++++-
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/panda/plugins/osi/README.md b/panda/plugins/osi/README.md
index 70f4ded6f51..58aa4f1542c 100644
--- a/panda/plugins/osi/README.md
+++ b/panda/plugins/osi/README.md
@@ -21,10 +21,13 @@ The key is that you can swap out the bottom layer to support a new operating sys
 ```C
   const char * valid_os_re[] = {
       "windows[-_]32[-_]xpsp[23]",
-      "windows[-_]32[-_]7",
       "windows[-_]32[-_]2000",
+      "windows[-_]32[-_]7sp[01]",
+      "windows[-_]64[-_]7sp[01]",
       "linux[-_]32[-_].+",
       "linux[-_]64[-_].+",
+      "freebsd[-_]32[-_].+",
+      "freebsd[-_]64[-_].+",
       NULL
   };
 ```
diff --git a/panda/python/core/pandare/panda.py b/panda/python/core/pandare/panda.py
index 5143799194b..5aee8028ef6 100755
--- a/panda/python/core/pandare/panda.py
+++ b/panda/python/core/pandare/panda.py
@@ -1635,10 +1635,13 @@ def set_os_name(self, os_name):
         Set OS target. Equivalent to "-os" flag on the command line. Matches the form of:
 
             "windows[-_]32[-_]xpsp[23]",
-            "windows[-_]32[-_]7",
             "windows[-_]32[-_]2000",
+            "windows[-_]32[-_]7sp[01]",
+            "windows[-_]64[-_]7sp[01]",
             "linux[-_]32[-_].+",
             "linux[-_]64[-_].+",
+            "freebsd[-_]32[-_].+",
+            "freebsd[-_]64[-_].+",
 
             Args:
                 os_name (str): Name that matches the format for the os flag.

From 8b94f197a024a43522db1b2be61dd40e429c4a55 Mon Sep 17 00:00:00 2001
From: Luke Craig <lacraig3@gmail.com>
Date: Thu, 1 Sep 2022 17:26:37 -0400
Subject: [PATCH 085/140] callbacks: normalize plugin name path (#1189)

* callbacks: normalize plugin name path

* resolving code review issues

* add back static fn def

* const not static

* add cast

* change const char* to char*
---
 panda/src/callbacks.c | 32 +++++++++++++++++++++++---------
 1 file changed, 23 insertions(+), 9 deletions(-)

diff --git a/panda/src/callbacks.c b/panda/src/callbacks.c
index e58d3e73424..3186bd7d96b 100644
--- a/panda/src/callbacks.c
+++ b/panda/src/callbacks.c
@@ -100,18 +100,31 @@ bool panda_add_arg(const char *plugin_name, const char *plugin_arg) {
 // Forward declaration
 static void panda_args_set_help_wanted(const char *);
 
+/*
+* This function takes ownership of path.
+*/
+static char* attempt_normalize_path(char* path){
+    char* new_path = g_malloc(PATH_MAX); 
+    if (realpath(path, new_path) == NULL) {
+        strncpy(new_path, path, PATH_MAX);
+    }
+    g_free((char*)path);
+    return new_path;
+}
+
 bool panda_load_external_plugin(const char *filename, const char *plugin_name, void *plugin_uuid, void *init_fn_ptr) {
     // don't load the same plugin twice
+    char* rfilename = attempt_normalize_path(strdup(filename));
     uint32_t i;
     for (i=0; i<nb_panda_plugins_loaded; i++) {
-        if (0 == (strcmp(filename, panda_plugins_loaded[i]))) {
+        if (0 == (strcmp(rfilename, panda_plugins_loaded[i]))) {
             fprintf(stderr, PANDA_MSG_FMT "%s already loaded\n", PANDA_CORE_NAME, filename);
             return true;
         }
     }
     // NB: this is really a list of plugins for which we have started loading
     // and not yet called init_plugin fn.  needed to avoid infinite loop with panda_require
-    panda_plugins_loaded[nb_panda_plugins_loaded] = strdup(filename);
+    panda_plugins_loaded[nb_panda_plugins_loaded] = strdup(rfilename);
     nb_panda_plugins_loaded ++;
     void *plugin = plugin_uuid;//going to be a handle of some sort -> dlopen(filename, RTLD_NOW);
     bool (*init_fn)(void *) = init_fn_ptr; //normally dlsym init_fun
@@ -124,7 +137,7 @@ bool panda_load_external_plugin(const char *filename, const char *plugin_name, v
     if (plugin_name) {
         strncpy(panda_plugins[nb_panda_plugins].name, plugin_name, 256);
     } else {
-        char *pn = g_path_get_basename((char *) filename);
+        char *pn = g_path_get_basename(rfilename);
         *g_strrstr(pn, HOST_DSOSUF) = '\0';
         strncpy(panda_plugins[nb_panda_plugins].name, pn, 256);
         g_free(pn);
@@ -265,8 +278,8 @@ char* resolve_file_from_plugin_directory(const char* file_name_fmt, const char*
     // First try relative to PANDA_PLUGIN_DIR
 #ifdef PLUGIN_DIR
     if (g_getenv("PANDA_DIR") != NULL) {
-        plugin_path = g_strdup_printf(
-            "%s/%s/%s" , g_getenv("PANDA_DIR"), PLUGIN_DIR, name_formatted);
+        plugin_path = attempt_normalize_path(g_strdup_printf(
+            "%s/%s/%s" , g_getenv("PANDA_DIR"), PLUGIN_DIR, name_formatted));
         if (TRUE == g_file_test(plugin_path, G_FILE_TEST_EXISTS)) {
             return plugin_path;
         }
@@ -280,8 +293,9 @@ char* resolve_file_from_plugin_directory(const char* file_name_fmt, const char*
 
     // Second, try relative to PANDA binary as it would be in the build or install directory
     char *dir = g_path_get_dirname(qemu_file);
-    plugin_path = g_strdup_printf("%s/panda/plugins/%s", dir,
-                                  name_formatted);
+    plugin_path = attempt_normalize_path(g_strdup_printf(
+                                "%s/panda/plugins/%s", dir,
+                                  name_formatted));
 
     g_free(dir);
     if (TRUE == g_file_test(plugin_path, G_FILE_TEST_EXISTS)) {
@@ -290,9 +304,9 @@ char* resolve_file_from_plugin_directory(const char* file_name_fmt, const char*
     g_free(plugin_path);
 
     // Finally, try relative to the installation path.
-    plugin_path =
+    plugin_path = attempt_normalize_path(
         g_strdup_printf("%s/%s/%s", CONFIG_PANDA_PLUGINDIR,
-                        TARGET_NAME, name_formatted);
+                        TARGET_NAME, name_formatted));
     if (TRUE == g_file_test(plugin_path, G_FILE_TEST_EXISTS)) {
         return plugin_path;
     }

From b11092a5d3780b035524ad7761fdbcf214b9d11d Mon Sep 17 00:00:00 2001
From: Luke Craig <lacraig3@gmail.com>
Date: Tue, 6 Sep 2022 18:20:27 -0400
Subject: [PATCH 086/140] proc_start_linux enhancements (#1190)

* fix psl to support BE targets and change to SBE

* rethink later

* some cleanup

* remove print statements
---
 .../proc_start_linux/proc_start_linux.cpp     | 326 +++++++++++-------
 panda/python/examples/proc_start.py           |   6 +-
 2 files changed, 197 insertions(+), 135 deletions(-)

diff --git a/panda/plugins/proc_start_linux/proc_start_linux.cpp b/panda/plugins/proc_start_linux/proc_start_linux.cpp
index 461d796ee6d..48016cf1ab0 100644
--- a/panda/plugins/proc_start_linux/proc_start_linux.cpp
+++ b/panda/plugins/proc_start_linux/proc_start_linux.cpp
@@ -33,6 +33,25 @@ PPP_PROT_REG_CB(on_rec_auxv);
 PPP_CB_BOILERPLATE(on_rec_auxv);
 }
 
+// uncomment to look under the hood
+//#define DEBUG
+
+#ifdef DEBUG
+#define log(...) printf(__VA_ARGS__)
+#else
+#define log(...)
+#endif
+
+
+#if defined(TARGET_WORDS_BIGENDIAN)
+#if TARGET_LONG_SIZE == 4
+#define fixupendian(x)         {x=bswap32((target_ptr_t)x);}
+#else
+#define fixupendian(x)         {x=bswap64((uint64_t)x);}
+#endif
+#else
+#define fixupendian(x) {}
+#endif
 
 
 #if TARGET_LONG_BITS == 32
@@ -42,7 +61,7 @@ PPP_CB_BOILERPLATE(on_rec_auxv);
 #endif
 
 void *self_ptr;
-panda_cb pcb_btc_execve;
+panda_cb pcb_sbe_execve;
 
 string read_str(CPUState* cpu, target_ulong ptr){
     string buf = "";
@@ -61,148 +80,188 @@ string read_str(CPUState* cpu, target_ulong ptr){
     return buf;
 }
 
-void btc_execve(CPUState *env, TranslationBlock *tb){
-    if (unlikely(!panda_in_kernel(env))){
-        target_ulong sp = panda_current_sp(env);
-        target_ulong argc;
-        if (panda_virtual_memory_read(env, sp, (uint8_t*) &argc, sizeof(argc))== MEMTX_OK){
-            
-            // the idea of this code is to fill this as best as we can
-            struct auxv_values vals;
-            memset(&vals, 0, sizeof(struct auxv_values));
-
-            // we read argc, but just to check the stack is readable.
-            // don't use it. just iterate and check for nulls.
-            int ptrlistpos = 1;
-            target_ulong ptr;
-            
-            // read the arguments from the argv
-            vals.argv_ptr_ptr = sp+(ptrlistpos*sizeof(target_ulong));
-            int argc_num = 0;
-            while (true){
-                if (panda_virtual_memory_read(env, sp+(ptrlistpos*sizeof(target_ulong)), (uint8_t*) &ptr, sizeof(ptr)) != MEMTX_OK){
-                    printf("failed reading args\n");
-                    panda_disable_callback(self_ptr, PANDA_CB_BEFORE_TCG_CODEGEN, pcb_btc_execve);
-                    return;
-                }
-                ptrlistpos++;
-                if (ptr == 0){
-                    break;
-                }else if (argc_num < MAX_NUM_ARGS){
-                    string arg = read_str(env, ptr);
-                    if (arg.length() > 0){
-                        strncpy(vals.argv[argc_num], arg.c_str(), MAX_PATH_LEN);
-                        vals.arg_ptr[argc_num] = ptr;
-                        argc_num++;
-                    }
-                }
-            }
-            vals.argc = argc_num;
-
-            // read the environment variable
-            vals.env_ptr_ptr = sp+(ptrlistpos*sizeof(target_ulong));
-            int envc_num = 0;
-            while (true){
-                if (panda_virtual_memory_read(env, sp+(ptrlistpos*sizeof(target_ulong)), (uint8_t*) &ptr, sizeof(ptr)) != MEMTX_OK){
-                    printf("failed reading envp\n");
-                    panda_disable_callback(self_ptr, PANDA_CB_BEFORE_TCG_CODEGEN, pcb_btc_execve);
-                    return;
-                }
-                ptrlistpos++;
-                if (ptr == 0){
-                    break;
-                }else if (envc_num < MAX_NUM_ENV){
-                    string arg = read_str(env, ptr);
-                    if (arg.length() > 0){
-                        strncpy(vals.envp[envc_num], arg.c_str(), MAX_PATH_LEN);
-                        vals.env_ptr[envc_num] = ptr;
-                        envc_num++;
-                    }
-                }
-            }
-            vals.envc = envc_num;
-            target_ulong entrynum, entryval;
-
-            while (true){
-                if (panda_virtual_memory_read(env, sp+(ptrlistpos*sizeof(target_ulong)), (uint8_t*) &entrynum, sizeof(entrynum)) != MEMTX_OK || panda_virtual_memory_read(env, sp+((ptrlistpos+1)*sizeof(target_ulong)), (uint8_t*) &entryval, sizeof(entryval))){
-                    panda_disable_callback(self_ptr, PANDA_CB_BEFORE_TCG_CODEGEN, pcb_btc_execve);
-                    return;
-                }
-                ptrlistpos+=2;
-                if (entrynum == AT_NULL){
-                    break;
-                }else if (entrynum == AT_ENTRY){
-                    vals.entry = entryval;
-                }else if (entrynum == AT_PHDR){
-                    vals.phdr = entryval;
-                    // every elf I've seen says that the PHDR
-                    // is immediately following the EHDR.
-                    // we can do a bunch to check this or we can just
-                    // take the value.
-                    vals.program_header = entryval - sizeof(ELF(Ehdr));
-                }else if (entrynum == AT_EXECFN){
-                    vals.execfn_ptr = entryval;
-                    string execfn = read_str(env, entryval);
-                    execfn.copy(vals.execfn, MAX_PATH_LEN -1, 0);
-                }else if (entrynum == AT_SYSINFO_EHDR){
-                    vals.ehdr = entryval;
-                }else if (entrynum == AT_HWCAP){
-                    vals.hwcap = entryval;
-                }else if (entrynum == AT_HWCAP2){
-                    vals.hwcap2 = entryval;
-                }else if (entrynum == AT_PAGESZ){
-                    vals.pagesz = entryval;
-                }else if (entrynum == AT_CLKTCK){
-                    vals.clktck = entryval;
-                }else if (entrynum == AT_PHENT){
-                    vals.phent = entryval;
-                }else if (entrynum == AT_PHNUM){
-                    vals.phnum = entryval;
-                }else if (entrynum == AT_BASE){
-                    vals.base = entryval;
-                }else if (entrynum == AT_FLAGS){
-                    vals.flags = entryval;
-                }else if (entrynum == AT_UID){
-                    vals.uid = entryval;
-                }else if (entrynum == AT_EUID){
-                    vals.euid = entryval;
-                }else if (entrynum == AT_GID){
-                    vals.gid = entryval;
-                }else if (entrynum == AT_EGID){
-                    vals.egid = entryval;
-                }else if (entrynum == AT_SECURE){
-                    vals.secure = entryval;
-                }else if (entrynum == AT_RANDOM){
-                    vals.random = entryval;
-                }else if (entrynum == AT_PLATFORM){
-                    vals.platform = entryval;
-                }
+#define FAIL_READ_ARGV -1
+#define FAIL_READ_ENVP -2
+#define FAIL_READ_AUXV -3
+
+
+/**
+ * 
+ * The stack layout in the first block of a linux process looks like this:
+ * 
+ * |‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾|
+ * |             Auxiliary vector           |
+ * |________________________________________|
+ * |                                        |
+ * |                  environ               |
+ * |________________________________________|
+ * |‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾|
+ * |                   argv                 |
+ * |________________________________________|
+ * |‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾|
+ * |                   Stack                |
+ * |________________________________________|
+ * 
+ * The Stack grows down.
+ * 
+ */ 
+
+int read_aux_vals(CPUState *cpu, struct auxv_values *vals){
+    target_ulong sp = panda_current_sp(cpu);
+    
+    // keep track of where on the stack we are
+    int ptrlistpos = 1;
+    target_ulong ptr;
+
+    /**
+     * Read the argv values to the program.
+     */
+    vals->argv_ptr_ptr = sp + (ptrlistpos * sizeof(target_ulong));
+    int argc_num = 0;
+    while (true){
+        if (panda_virtual_memory_read(cpu, sp + (ptrlistpos * sizeof(target_ulong)), (uint8_t *)&ptr, sizeof(ptr)) != MEMTX_OK){
+            return FAIL_READ_ARGV;
+        }
+        ptrlistpos++;
+        if (ptr == 0){
+            break;
+        } else if (argc_num < MAX_NUM_ARGS){
+            string arg = read_str(cpu, ptr);
+            if (arg.length() > 0)
+            {
+                strncpy(vals->argv[argc_num], arg.c_str(), MAX_PATH_LEN);
+                vals->arg_ptr[argc_num] = ptr;
+                argc_num++;
             }
-            if (vals.entry && vals.phdr){
-                PPP_RUN_CB(on_rec_auxv, env, tb, &vals);
-            }else {
-                return;
+        }
+    }
+    vals->argc = argc_num;
+
+    /**
+     * Read the environ values from the stack
+     */ 
+    vals->env_ptr_ptr = sp + (ptrlistpos * sizeof(target_ulong));
+    int envc_num = 0;
+    while (true){
+        if (panda_virtual_memory_read(cpu, sp + (ptrlistpos * sizeof(target_ulong)), (uint8_t *)&ptr, sizeof(ptr)) != MEMTX_OK){
+            return FAIL_READ_ENVP;
+        }
+        ptrlistpos++;
+        if (ptr == 0){
+            break;
+        } else if (envc_num < MAX_NUM_ENV){
+            string arg = read_str(cpu, ptr);
+            if (arg.length() > 0){
+                strncpy(vals->envp[envc_num], arg.c_str(), MAX_PATH_LEN);
+                vals->env_ptr[envc_num] = ptr;
+                envc_num++;
             }
-        }else{
-            // If we can't read from the stack this is an indication that
-            // we aren't quite in a usable userspace just yet.
-            return;
         }
-        panda_disable_callback(self_ptr, PANDA_CB_BEFORE_TCG_CODEGEN, pcb_btc_execve);
     }
+    vals->envc = envc_num;
+
+    /**
+     * Read the auxiliary vector
+     */ 
+    target_ulong entrynum, entryval;
+    while (true){
+        if (panda_virtual_memory_read(cpu, sp + (ptrlistpos * sizeof(target_ulong)), (uint8_t *)&entrynum, sizeof(entrynum)) != MEMTX_OK || panda_virtual_memory_read(cpu, sp + ((ptrlistpos + 1) * sizeof(target_ulong)), (uint8_t *)&entryval, sizeof(entryval))){
+            return FAIL_READ_AUXV;
+        }
+        ptrlistpos += 2;
+        fixupendian(entrynum);
+        fixupendian(entryval);
+        if (entrynum == AT_NULL){
+            break;
+        }else if (entrynum == AT_ENTRY){
+            vals->entry = entryval;
+        }else if (entrynum == AT_PHDR){
+            vals->phdr = entryval;
+            // every elf I've seen says that the PHDR
+            // is immediately following the EHDR.
+            // we can do a bunch to check this or we can just
+            // take the value.
+            vals->program_header = entryval - sizeof(ELF(Ehdr));
+        }else if (entrynum == AT_EXECFN){
+            vals->execfn_ptr = entryval;
+            string execfn = read_str(cpu, entryval);
+            execfn.copy(vals->execfn, MAX_PATH_LEN - 1, 0);
+        }else if (entrynum == AT_SYSINFO_EHDR){
+            vals->ehdr = entryval;
+        }else if (entrynum == AT_HWCAP){
+            vals->hwcap = entryval;
+        }else if (entrynum == AT_HWCAP2){
+            vals->hwcap2 = entryval;
+        }else if (entrynum == AT_PAGESZ){
+            vals->pagesz = entryval;
+        }else if (entrynum == AT_CLKTCK){
+            vals->clktck = entryval;
+        }else if (entrynum == AT_PHENT){
+            vals->phent = entryval;
+        }else if (entrynum == AT_PHNUM){
+            vals->phnum = entryval;
+        }else if (entrynum == AT_BASE){
+            vals->base = entryval;
+        }else if (entrynum == AT_FLAGS){
+            vals->flags = entryval;
+        }else if (entrynum == AT_UID){
+            vals->uid = entryval;
+        }else if (entrynum == AT_EUID){
+            vals->euid = entryval;
+        }else if (entrynum == AT_GID){
+            vals->gid = entryval;
+        }else if (entrynum == AT_EGID){
+            vals->egid = entryval;
+        }else if (entrynum == AT_SECURE){
+            vals->secure = entryval;
+        }else if (entrynum == AT_RANDOM){
+            vals->random = entryval;
+        }else if (entrynum == AT_PLATFORM){
+            vals->platform = entryval;
+        }
+    }
+    return 0;
 }
 
-void run_btc_cb(){
-    panda_do_flush_tb();
-    panda_enable_callback(self_ptr, PANDA_CB_BEFORE_TCG_CODEGEN, pcb_btc_execve);
+bool has_been_in_kernel = false;
+
+void sbe(CPUState *cpu, TranslationBlock *tb){
+    bool in_kernel = panda_in_kernel_code_linux(cpu);
+    if (unlikely(!panda_in_kernel_code_linux(cpu) && has_been_in_kernel)){
+        // check that we can read the stack
+        target_ulong sp = panda_current_sp(cpu);
+        target_ulong argc;
+        if (panda_virtual_memory_read(cpu, sp, (uint8_t *)&argc, sizeof(argc)) == MEMTX_OK){
+            struct auxv_values *vals = (struct auxv_values*)malloc(sizeof(struct auxv_values));
+            memset(vals, 0, sizeof(struct auxv_values));
+            int status = read_aux_vals(cpu, vals);
+            if (!status && vals->entry && vals->phdr){
+                PPP_RUN_CB(on_rec_auxv, cpu, tb, vals);
+            }else if (status == FAIL_READ_ARGV){
+                log("failed to read argv\n");
+            }else if (status == FAIL_READ_ENVP){
+                log("failed to read envp\n");
+            }else if (status == FAIL_READ_AUXV){
+                log("failed to read auxv\n");
+            }
+            panda_disable_callback(self_ptr, PANDA_CB_START_BLOCK_EXEC, pcb_sbe_execve);
+            free(vals);
+            has_been_in_kernel = false;
+        }else{
+            // this would be the case where fault_hooks would work well.
+            // printf("got here and could not read stack\n");
+        }
+    } else if (in_kernel){
+        has_been_in_kernel = true;
+    }
 }
 
 void execve_cb(CPUState *cpu, target_ptr_t pc, target_ptr_t filename, target_ptr_t argv, target_ptr_t envp) {
-    run_btc_cb();
+    panda_enable_callback(self_ptr, PANDA_CB_START_BLOCK_EXEC, pcb_sbe_execve);
 }
 
 void execveat_cb (CPUState* cpu, target_ptr_t pc, int dfd, target_ptr_t filename, target_ptr_t argv, target_ptr_t envp, int flags) {
-    run_btc_cb();
+    panda_enable_callback(self_ptr, PANDA_CB_START_BLOCK_EXEC, pcb_sbe_execve);
 }
 
 bool init_plugin(void *self) {
@@ -215,8 +274,9 @@ bool init_plugin(void *self) {
         fprintf(stderr, "[ERROR] proc_start_linux: PPC architecture not supported by syscalls2!\n");
         return false;
     #else
-        pcb_btc_execve.before_tcg_codegen = btc_execve;
-        panda_register_callback(self, PANDA_CB_BEFORE_TCG_CODEGEN, pcb_btc_execve);
+        pcb_sbe_execve.start_block_exec = sbe;
+        panda_register_callback(self, PANDA_CB_START_BLOCK_EXEC, pcb_sbe_execve);
+        panda_disable_callback(self, PANDA_CB_START_BLOCK_EXEC, pcb_sbe_execve);
 
         // why? so we don't get 1000 messages telling us syscalls2 is already loaded
         void* syscalls2 = panda_get_plugin_by_name("syscalls2");
diff --git a/panda/python/examples/proc_start.py b/panda/python/examples/proc_start.py
index 413f5f378ad..2c0bcb1d124 100644
--- a/panda/python/examples/proc_start.py
+++ b/panda/python/examples/proc_start.py
@@ -10,14 +10,16 @@
 from rich import print
 from sys import argv
 
-arch = argv[1] if len(argv) > 1 else "arm"
+arch = argv[1] if len(argv) > 1 else "mips"
 panda = Panda(generic=arch)
 
 @panda.queue_blocking
 def do_stuff():
     panda.revert_sync("root")
     for command in ["ls -la", "whoami", "sleep 1", "uname -r"]:
-        print(panda.run_serial_cmd("LD_SHOW_AUXV=1 "+command))
+        print("Output start:")
+        print(panda.run_serial_cmd("LD_SHOW_AUXV=1 "+command,no_timeout=True))
+        print("Output end")
     panda.end_analysis()
 
 @panda.ppp("proc_start_linux","on_rec_auxv")

From 76b21631a1cddc10b8c18fff592ddeed1420f6e9 Mon Sep 17 00:00:00 2001
From: Andrew Fasano <fasano@mit.edu>
Date: Fri, 9 Sep 2022 10:26:26 -0400
Subject: [PATCH 087/140] Fix stringop-truncation in panda callbacks
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

  CC      x86_64-softmmu/panda/src/callbacks.o
In file included from /usr/include/string.h:535,
                 from /home/andrew/git/panda/panda/src/callbacks.c:15:
In function ‘strncpy’,
    inlined from ‘attempt_normalize_path’ at /home/andrew/git/panda/panda/src/callbacks.c:109:9:
/usr/include/x86_64-linux-gnu/bits/string_fortified.h:95:10: error: ‘__builtin_strncpy’ specified bound 4096 equals destination size [-Werror=stringop-truncation]
   95 |   return __builtin___strncpy_chk (__dest, __src, __len,
      |          ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   96 |                                   __glibc_objsize (__dest));
      |                                   ~~~~~~~~~~~~~~~~~~~~~~~~~
---
 panda/src/callbacks.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/panda/src/callbacks.c b/panda/src/callbacks.c
index 3186bd7d96b..ff657a38e0a 100644
--- a/panda/src/callbacks.c
+++ b/panda/src/callbacks.c
@@ -106,7 +106,7 @@ static void panda_args_set_help_wanted(const char *);
 static char* attempt_normalize_path(char* path){
     char* new_path = g_malloc(PATH_MAX); 
     if (realpath(path, new_path) == NULL) {
-        strncpy(new_path, path, PATH_MAX);
+        strncpy(new_path, path, PATH_MAX-1);
     }
     g_free((char*)path);
     return new_path;

From acdfe5c057335370197081b6b1102c1a11be86bd Mon Sep 17 00:00:00 2001
From: Andrew Fasano <fasano@mit.edu>
Date: Fri, 9 Sep 2022 10:28:46 -0400
Subject: [PATCH 088/140] pandare.qcows include -os argument with generated
 command

---
 panda/python/core/pandare/qcows.py | 1 +
 1 file changed, 1 insertion(+)

diff --git a/panda/python/core/pandare/qcows.py b/panda/python/core/pandare/qcows.py
index d68425b03ab..7b0e11fd2ca 100644
--- a/panda/python/core/pandare/qcows.py
+++ b/panda/python/core/pandare/qcows.py
@@ -326,6 +326,7 @@ def cli(target):
         panda_args = [build_dir + f"/{arch}-softmmu/panda-system-{arch}"]
         biospath = path.realpath(path.join(build_dir, "pc-bios"))
         panda_args.extend(["-L", biospath])
+        panda_args.extend(["-os", q.os])
 
         if arch == 'mips64':
             panda_args.extend(["-drive", f"file={qcow},if=virtio"])

From ce682db709af95bba768d6c0a7b78f6a4f39a27f Mon Sep 17 00:00:00 2001
From: Andrew Fasano <fasano@mit.edu>
Date: Tue, 13 Sep 2022 14:56:14 -0400
Subject: [PATCH 089/140] PyPANDA: Support finding panda binaries independently
 from libpanda, use this in pandare.qcows

---
 panda/python/core/pandare/panda.py | 40 +++++++++++++++++++-----------
 panda/python/core/pandare/qcows.py |  7 +++++-
 2 files changed, 31 insertions(+), 16 deletions(-)

diff --git a/panda/python/core/pandare/panda.py b/panda/python/core/pandare/panda.py
index 5aee8028ef6..de6bef71929 100755
--- a/panda/python/core/pandare/panda.py
+++ b/panda/python/core/pandare/panda.py
@@ -298,8 +298,6 @@ def _initialize_panda(self):
 
         self._initialized_panda = True
 
-        
-
     def __main_loop_wait_cb(self):
         '''
         __main_loop_wait_cb is called at the start of the main cpu loop in qemu.
@@ -318,30 +316,42 @@ def __main_loop_wait_cb(self):
             self.end_analysis()
 
     @staticmethod
-    def _find_build_dir(arch_name):
+    def _find_build_dir(arch_name, find_executable=False):
         '''
-        Find build directory containing ARCH-softmmu/libpanda-ARCH.so and ARCH-softmmu/panda/plugins/
-        1) check relative to file (in the case of installed packages)
+        Find build directory containing:
+			A: (if not find_executable) ARCH-softmmu/libpanda-ARCH.so and ARCH-softmmu/panda/plugins/
+			B: (if find_executable) the panda-system-ARCH binary
+        1) Check relative to file (in the case of installed packages)
         2) Check in../ ../../../build/
-        3) raise RuntimeError
+        2) Search path if user is looking for an executable instead of a library
+        3) Raise RuntimeError if we find nothing
+
+        Set find_executable if you want to search for the directory with the
+        panda-system-[arch] binary instead of the libpanda-[arch].so library.
         '''
-        archs = ['i386', 'x86_64', 'arm', 'ppc']
+        arches = ['i386', 'x86_64', 'arm', 'aarch64', 'ppc', 'mips', 'mipsel', 'mips64']
+        if arch_name not in arches:
+            raise ValueError(f"Unsupported architecture name: {arch_name}, allowed values are: {arches}")
         python_package = pjoin(*[dirname(__file__), "data"])
         local_build = realpath(pjoin(dirname(__file__), "../../../../build"))
-        path_end = "{0}-softmmu/libpanda-{0}.so".format(arch_name)
+        arch_dir = f"{arch_name}-softmmu"
+        file_name = f"panda-system-{arch_name}" if find_executable else \
+                    f"libpanda-{arch_name}.so"
+        pot_paths = [pjoin(python_package, arch_dir), pjoin(local_build, arch_dir)]
+
+        if find_executable and 'PATH' in environ:
+            # If we're looking for the panda executable, also search the user's path
+            pot_paths.extend(environ.get('PATH').split(":"))
 
-        pot_paths = [python_package, local_build]
         for potential_path in pot_paths:
-            if isfile(pjoin(potential_path, path_end)):
+            if isfile(pjoin(potential_path, file_name)):
                 #print("Loading libpanda from {}".format(potential_path))
                 return potential_path
 
         searched_paths = "\n".join(["\t"+p for p in  pot_paths])
-        raise RuntimeError(("Couldn't find libpanda-{}.so.\n"
-                            "Did you built PANDA for this architecture?\n"
-                            "Searched paths:\n{}"
-                           ).format(arch_name, searched_paths))
-
+        raise RuntimeError((f"Couldn't find {file_name}\n"
+                            f"Did you built PANDA for this architecture?\n"
+                            f"Searched for {arch_dir}/{file_name} in:\n{searched_paths}"))
 
     def queue_main_loop_wait_fn(self, fn, args=[]):
         '''
diff --git a/panda/python/core/pandare/qcows.py b/panda/python/core/pandare/qcows.py
index 7b0e11fd2ca..a58d3c23811 100644
--- a/panda/python/core/pandare/qcows.py
+++ b/panda/python/core/pandare/qcows.py
@@ -319,10 +319,11 @@ def qcow_from_arg(idx=1):
     @staticmethod
     def cli(target):
         from .panda import Panda
+        from os import environ
         q = Qcows.get_qcow_info(target)
         qcow = Qcows.get_qcow(target)
         arch = q.arch
-        build_dir = Panda._find_build_dir(arch)
+        build_dir = Panda._find_build_dir(arch, find_executable=True)
         panda_args = [build_dir + f"/{arch}-softmmu/panda-system-{arch}"]
         biospath = path.realpath(path.join(build_dir, "pc-bios"))
         panda_args.extend(["-L", biospath])
@@ -349,6 +350,10 @@ def cli(target):
 
         if "-display none" in ret:
             ret = ret.replace("-display none", "-nographic")
+
+        # Repalce /home/username with ~ when we can
+        if 'HOME' in environ:
+            ret = ret.replace(environ['HOME'], '~')
         return ret
 
 if __name__ == "__main__":

From f9c636bc6b6f99fd22573c3322760bb1e06f11ca Mon Sep 17 00:00:00 2001
From: Andrew Fasano <fasano@mit.edu>
Date: Tue, 13 Sep 2022 21:15:26 -0400
Subject: [PATCH 090/140] Refactor pandare.qcows into an internal and public
 interface to fix warnings about circular imports. Add file hashes and checks
 on download

---
 panda/python/core/pandare/panda.py          |   2 +-
 panda/python/core/pandare/qcows.py          | 353 +++--------------
 panda/python/core/pandare/qcows_internal.py | 401 ++++++++++++++++++++
 3 files changed, 449 insertions(+), 307 deletions(-)
 create mode 100644 panda/python/core/pandare/qcows_internal.py

diff --git a/panda/python/core/pandare/panda.py b/panda/python/core/pandare/panda.py
index de6bef71929..3bddd8fe60f 100755
--- a/panda/python/core/pandare/panda.py
+++ b/panda/python/core/pandare/panda.py
@@ -36,7 +36,7 @@
 from .taint import TaintQuery
 from .panda_expect import Expect
 from .asyncthread import AsyncThread
-from .qcows import Qcows
+from .qcows_internal import Qcows
 from .qemu_logging import QEMU_Log_Manager
 from .arch import ArmArch, Aarch64Arch, MipsArch, Mips64Arch, X86Arch, X86_64Arch
 
diff --git a/panda/python/core/pandare/qcows.py b/panda/python/core/pandare/qcows.py
index a58d3c23811..77639c2e54b 100644
--- a/panda/python/core/pandare/qcows.py
+++ b/panda/python/core/pandare/qcows.py
@@ -1,6 +1,8 @@
 #!/usr/bin/env python3
 '''
-Module for fetching generic PANDA images and managing their metadata.
+Module to simplify PANDA command line usage. Use python3 -m pandare.qcows to 
+fetch files necessary to run various generic VMs and generate command lines to start them.
+Also supports deleting previously-fetched files
 '''
 
 import logging
@@ -8,318 +10,43 @@
 from subprocess import check_call
 from collections import namedtuple
 from shlex import split as shlex_split
+from sys import exit
+
+from .panda import Panda
+from os import environ
+from .qcows_internal import Qcows, SUPPORTED_IMAGES
 
 logger = logging.getLogger(__name__)
 logger.setLevel(logging.DEBUG)
 
 VM_DIR = path.join(path.expanduser("~"), ".panda")
-
-class Image(namedtuple('Image', ['arch', 'os', 'prompt', 'cdrom', 'snapshot', 'url', 'extra_files', 'qcow', 'default_mem', 'extra_args'])):
-    '''
-    The Image class stores information about a supported PANDA image
-
-    Args:
-        arch (str): Arch for the given architecture.
-        os (str): an os string we can pass to panda with -os
-        prompt (regex): a regex to detect a bash prompt after loading the snapshot and sending commands
-        cdrom (str): name to use for cd-drive when inserting an ISO via monitor
-        qcow (str): optional name to save qcow as
-        url (str): url to download the qcow (e.g. https:// website.com/yourqcow.qcow2)
-        default_mem (str): memory to use for the root snapshot (e.g. 1G)
-        extra_files (list): other files (assumed to be in same directory on server) that we also need
-        extra_args (list): Extra arguments to pass to PANDA (e.g. ['-display', 'none'])
-    '''
-
-Image.__new__.__defaults__ = (None,) * len(Image._fields)
-
-SUPPORTED_IMAGES = {
-    # Debian: support for 4 arches on Wheezy
-    'i386_wheezy': Image(
-            arch = 'i386',
-            os="linux-32-debian:3.2.0-4-686-pae",
-            prompt=rb"root@debian-i386:.*# ",
-            qcow="wheezy_panda2.qcow2", # Backwards compatability
-            cdrom="ide1-cd0",
-            snapshot="root",
-            default_mem='128M',
-            url="https://panda-re.mit.edu/qcows/linux/debian/7.3/x86/debian_7.3_x86.qcow",
-            extra_args="-display none"),
-
-    'x86_64_wheezy': Image(
-            arch='x86_64',
-            os="linux-64-debian:3.2.0-4-amd64",
-            prompt=rb"root@debian-amd64:.*# ",
-            qcow="wheezy_x64.qcow2",# Backwards compatability 
-            cdrom="ide1-cd0",
-            snapshot="root",
-            default_mem='128M',
-            url="https://panda-re.mit.edu/qcows/linux/debian/7.3/x86_64/debian_7.3_x86_64.qcow",
-            extra_args="-display none"),
-
-    'ppc_wheezy': Image(
-            arch='ppc',
-            os="linux-64-debian:3.2.0-4-ppc-pae",
-            prompt=rb"root@debian-powerpc:.*# ",
-            qcow="ppc_wheezy.qcow2",# Backwards compatability 
-            cdrom="ide1-cd0",
-            default_mem='128M',
-            snapshot="root",
-            url="https://panda-re.mit.edu/qcows/linux/debian/7.3/ppc/debian_7.3_ppc.qcow",
-            extra_args="-display none"),
-
-    'arm_wheezy': Image(
-            arch='arm',
-            os="linux-32-debian:3.2.0-4-versatile-arm",
-            prompt=rb"root@debian-armel:.*# ",
-            qcow="arm_wheezy.qcow",# Backwards compatability 
-            cdrom="scsi0-cd2",
-            default_mem='128M',
-            snapshot="root",
-            url="https://panda-re.mit.edu/qcows/linux/debian/7.3/arm/debian_7.3_arm.qcow",
-            extra_files=['vmlinuz-3.2.0-4-versatile', 'initrd.img-3.2.0-4-versatile'],
-            extra_args='-display none -M versatilepb -append "root=/dev/sda1" -kernel {DOT_DIR}/vmlinuz-3.2.0-4-versatile -initrd {DOT_DIR}/initrd.img-3.2.0-4-versatile'.format(DOT_DIR=VM_DIR)),
-
-    'aarch64_focal': Image(
-            arch='aarch64',
-            os="linux-64-ubuntu:5.4.0-58-generic-arm64",
-            prompt=rb"root@ubuntu-panda:.*# ",
-            #cdrom="scsi0-cd2", # No idea what this should be
-            default_mem='1G',
-            snapshot="root",
-            url="https://panda-re.mit.edu/qcows/linux/ubuntu/2004/aarch64/ubuntu20_04-aarch64.qcow",
-            extra_files=['ubuntu20_04-aarch64-flash0.qcow'],
-            extra_args='-nographic -machine virt -cpu cortex-a57 -drive file={DOT_DIR}/ubuntu20_04-aarch64-flash0.qcow,if=pflash,readonly=on'.format(DOT_DIR=VM_DIR)),
-
-    'mips64': Image(
-            arch='mips64',
-            os="linux-64-debian:4.14.0-3-5kc-malta", # XXX: NO OSI
-            prompt=rb"root@debian-buster-mips:.*# ",
-            cdrom="ide1-cd0", # not sure
-            snapshot="root",
-            url="https://panda-re.mit.edu/qcows/linux/debian/10/mips64/debian-buster-mips.qcow2",
-            default_mem='2g',
-            extra_files=['vmlinux-4.14.0-3-5kc-malta.mips.buster', 'initrd.img-4.14.0-3-5kc-malta.mips.buster'],
-            extra_args='-M malta -cpu MIPS64R2-generic -append "root=/dev/vda console=ttyS0 mem=2048m net.ifnames=0 nokaslr" -netdev user,id=user.0 -device virtio-net,netdev=user.0 -device usb-kbd -device usb-tablet -kernel {DOT_DIR}/vmlinux-4.14.0-3-5kc-malta.mips.buster -initrd {DOT_DIR}/initrd.img-4.14.0-3-5kc-malta.mips.buster -nographic'.format(DOT_DIR=VM_DIR)),
-
-    'mips_wheezy': Image(
-            arch='mips',
-            os="linux-32-debian:3.2.0-4-4kc-malta",
-            prompt=rb"root@debian-mips:.*# ",
-            cdrom="ide1-cd0",
-            snapshot="root",
-            url="https://panda-re.mit.edu/qcows/linux/debian/7.3/mips/debian_7.3_mips.qcow",
-            default_mem='1g',
-            extra_files=['vmlinux-3.2.0-4-4kc-malta'],
-            extra_args='-M malta -kernel {DOT_DIR}/vmlinux-3.2.0-4-4kc-malta -append "root=/dev/sda1" -nographic'.format(DOT_DIR=VM_DIR)),
-
-    'mipsel_wheezy':  Image(
-            arch='mipsel',
-            os = "linux-32-debian:3.2.0-4-4kc-malta",
-            prompt=rb"root@debian-mipsel:.*# ",
-            cdrom="ide1-cd0",
-            snapshot="root",
-            default_mem='1g',
-            url="https://panda-re.mit.edu/qcows/linux/debian/7.3/mipsel/debian_7.3_mipsel.qcow",
-            extra_files=['vmlinux-3.2.0-4-4kc-malta.mipsel',],
-            extra_args='-M malta -kernel {DOT_DIR}/vmlinux-3.2.0-4-4kc-malta.mipsel -append "root=/dev/sda1" -nographic'.format(DOT_DIR=VM_DIR)),
-
-    'mips_buildroot5':  Image(
-            arch='mips',
-            os = "linux-32-buildroot:5.10.7-4kc-malta",
-            prompt=rb"# ",
-            cdrom="ide1-cd0",
-            snapshot="root",
-            default_mem='1g',
-            url="https://panda-re.mit.edu/qcows/linux/buildroot/5.10/mips/mips32_buildroot.qcow",
-            extra_files=['mips32_vmlinux-5.10.7-4kc-malta',],
-            extra_args='-M malta -kernel {DOT_DIR}/mips32_vmlinux-5.10.7-4kc-malta -net nic,model=pcnet -net user -append "root=/dev/hda" -nographic'.format(DOT_DIR=VM_DIR)),
-
-
-    'mipsel_buildroot5':  Image(
-            arch='mipsel',
-            os = "linux-32-buildroot:5.10.7-4kc-malta-el",
-            prompt=rb"# ",
-            cdrom="ide1-cd0",
-            snapshot="root",
-            default_mem='1g',
-            url="https://panda-re.mit.edu/qcows/linux/buildroot/5.10/mipsel/mipsel32_buildroot.qcow",
-            extra_files=['mipsel32_vmlinux-5.10.7-4kc-malta-el',],
-            extra_args='-M malta -kernel {DOT_DIR}/mipsel32_vmlinux-5.10.7-4kc-malta-el -net nic,model=pcnet -net user -append "root=/dev/hda" -nographic'.format(DOT_DIR=VM_DIR)),
-
-
-    # Ubuntu: x86/x86_64 support for 16.04, x86_64 support for 18.04
-    'i386_ubuntu_1604': Image(
-            arch = 'i386',
-            os="linux-32-ubuntu:4.4.200-170-generic", # Version.c is 200 but name is 4.4.0. Not sure why
-            prompt=rb"root@instance-1:.*#",
-            cdrom="ide1-cd0",
-            snapshot="root",
-            default_mem='1024',
-            url="https://panda-re.mit.edu/qcows/linux/ubuntu/1604/x86/ubuntu_1604_x86.qcow",
-            extra_args="-display none"),
-
-    #'x86_64_ubuntu_1604': Image( # XXX: This one is broken
-    #        arch='x86_64',
-    #        os="linux-64-ubuntu:4.4.0-180-pae",
-    #        prompt=rb"root@instance-1:.*#",
-    #        cdrom="ide1-cd0",
-    #        snapshot="root",
-    #        default_mem='1024',
-    #        url="https://panda-re.mit.edu/qcows/linux/ubuntu/1604/x86_64/ubuntu_1604_x86_64.qcow",
-    #        extra_files=['xenial-server-cloudimg-amd64-disk1.img',],
-    #        extra_args="-display none"),
-
-    'x86_64_ubuntu_1804': Image(
-            arch='x86_64',
-            os="linux-64-ubuntu:4.15.0-72-generic-noaslr-nokaslr",
-            prompt=rb"root@ubuntu:.*#",
-            cdrom="ide1-cd0",
-            snapshot="root",
-            default_mem='1024',
-            url="https://panda-re.mit.edu/qcows/linux/ubuntu/1804/x86_64/bionic-server-cloudimg-amd64-noaslr-nokaslr.qcow2",
-            extra_args="-display none"),
-}
-"""
-Dictionary of `Image` objects by name.
-Generic values (underlying OS version may change) include:
-    x86_64
-    i386
-    ppc
-    arm
-    aarch64
-    mips
-    mipsel
-    mips64
-
-You may also specify an exact arch/OS combination from the following exist:
-    x86_64_ubuntu_1804
-    i386_ubuntu_1604
-    ppc_wheezy
-    arm_wheezy
-    aarch64 _focal
-    mips_wheezy
-    mips_buildroot5
-    mipsel_wheezy
-    mipsel_buildroot5
-    mips64
-""" # TODO: autogenerate values here
-
-# Default values
-SUPPORTED_IMAGES['x86_64']  = SUPPORTED_IMAGES['x86_64_ubuntu_1804']
-SUPPORTED_IMAGES['i386']    = SUPPORTED_IMAGES['i386_ubuntu_1604']
-SUPPORTED_IMAGES['ppc']     = SUPPORTED_IMAGES['ppc_wheezy']
-SUPPORTED_IMAGES['arm']     = SUPPORTED_IMAGES['arm_wheezy']
-SUPPORTED_IMAGES['aarch64'] = SUPPORTED_IMAGES['aarch64_focal']
-SUPPORTED_IMAGES['mips']    = SUPPORTED_IMAGES['mips_wheezy']
-SUPPORTED_IMAGES['mipsel']  = SUPPORTED_IMAGES['mipsel_wheezy']
-SUPPORTED_IMAGES['mips64']    = SUPPORTED_IMAGES['mips64']
-
-class Qcows():
-    '''
-    Helper library for managing qcows on your filesystem.
-    Given an architecture, it can download a qcow from `panda.mit.edu` to `~/.panda/` and then use that.
-    Alternatively, if a path to a qcow is provided, it can just use that.
-    A qcow loaded by architecture can then be queried to get the name of the root snapshot or prompt.
-    '''
-
-    @staticmethod
-    def get_qcow_info(name=None):
-        '''
-        Get information about supported image as specified by name.
-
-        Args:
-            name (str): String idenfifying a qcow supported
-                
-        Returns:
-            Image: Instance of the Image class for a qcow
-        '''
-        if name is None:
-            logger.warning("No qcow name provided. Defaulting to i386")
-            name = "i386"
-
-        if path.isfile(name):
-            raise RuntimeError("TODO: can't automatically determine system info from custom qcows. Use one of: {}".format(", ".join(SUPPORTED_IMAGES.keys())))
-
-        name = name.lower() # Case insensitive. Assumes supported_arches keys are lowercase
-        if name not in SUPPORTED_IMAGES.keys():
-            raise RuntimeError("Architecture {} is not in list of supported names: {}".format(name, ", ".join(SUPPORTED_IMAGES.keys())))
-
-        r = SUPPORTED_IMAGES[name]
-        # Move properties in .arch to being in the main object
-        return r
-
+class Qcows_cli():
     @staticmethod
-    def get_qcow(name=None):
-        '''
-        Given a generic name of a qcow in `pandare.qcows.SUPPORTED_IMAGES` or a path to a qcow, return the path. Defaults to i386
-
-        Args:
-            name (str): generic name or path to qcow
-                
-        Returns:
-            string: Path to qcow
-        '''
-        if name is None:
-            logger.warning("No qcow name provided. Defaulting to i386")
-            name = "i386"
-
-        if path.isfile(name):
-            logger.debug("Provided qcow name appears to be a path, returning it directly: %s", name)
-            return name
+    def remove_image(target):
+        try:
+            qcow = Qcows.get_qcow(target, download=False)
+        except ValueError:
+            # No QCOW, we're good!
+            return
+
+        try:
+            image_data = SUPPORTED_IMAGES[target]
+        except ValueError:
+            # Not a valid image? I guess we're good
+            return
 
-        name = name.lower() # Case insensitive. Assumes supported_images keys are lowercase
-        if name not in SUPPORTED_IMAGES.keys():
-            raise RuntimeError("Architecture {} is not in list of supported names: {}".format(name, ", ".join(SUPPORTED_IMAGES.keys())))
-
-        image_data = SUPPORTED_IMAGES[name]
         qc = image_data.qcow
         if not qc: # Default, get name from url
             qc = image_data.url.split("/")[-1]
-        qcow_path = path.join(VM_DIR,qc)
-        makedirs(VM_DIR, exist_ok=True)
-
-        if not path.isfile(qcow_path):
-            print("\nQcow {} doesn't exist. Downloading from https://panda-re.mit.edu. Thanks MIT!\n".format(qc))
-            try:
-                check_call(["wget", "--quiet", image_data.url, "-O", qcow_path])
-                for extra_file in image_data.extra_files or []:
-                    extra_file_path = path.join(VM_DIR, extra_file)
-                    url = image_data.url[:image_data.url.rfind("/")] + "/" + extra_file # Truncate url to last /, then add extra_file
-                    check_call(["wget", "--quiet", url, "-O", extra_file_path])
-            except Exception as e:
-                logger.info("Download failed, deleting partial file(s): %s", qcow_path)
-                remove(qcow_path)
-                for extra_file in image_data.extra_files or []:
-                    try:
-                        remove(path.join(VM_DIR, extra_file))
-                    except: # Extra files might not exist
-                        pass
-                raise e # Reraise
-            logger.debug("Downloaded %s to %s", qc, qcow_path)
-        return qcow_path
-
-    @staticmethod
-    def qcow_from_arg(idx=1):
-        '''
-        Given an index into argv, call get_qcow with that arg if it exists, else with None
-
-        Args:
-            idx (int): an index into argv
-                
-        Returns:
-            string: Path to qcow
-        '''
-        from sys import argv
-
-        if len(argv) > idx:
-            return Qcows.get_qcow(argv[idx])
-        else:
-            return Qcows.get_qcow()
+        qcow_path = path.join(VM_DIR, qc)
+        remove(qcow_path)
 
+        for extra_file in image_data.extra_files or []:
+            extra_file_path = path.join(VM_DIR, extra_file)
+            if os.path.isfile(extra_file_path):
+                remove(extra_file_path)
     @staticmethod
     def cli(target):
-        from .panda import Panda
-        from os import environ
         q = Qcows.get_qcow_info(target)
         qcow = Qcows.get_qcow(target)
         arch = q.arch
@@ -358,13 +85,27 @@ def cli(target):
 
 if __name__ == "__main__":
     from sys import argv, stdout
-    valid_names = ", ".join(SUPPORTED_IMAGES.keys())
+    valid_names = "\n * ".join(SUPPORTED_IMAGES.keys())
+
+    delete_mode = False
+    if len(argv) == 3 and argv[1] == 'delete':
+        delete_mode = True
+        argv.pop(1)
 
     if len(argv) != 2 or argv[1] not in SUPPORTED_IMAGES:
-        raise ValueError(f"USAGE: {argv[0]}: target_arch where name is one of " + valid_names)
+        print("\n" + f"USAGE: {argv[0]} [target_images]\n" +
+                     f"   or: {argv[0]} delete [target_image]\n\n" +
+                      "The required files for the specified images will be downloaded and the PANDA command line to emulate that guest will be printed.\n" +
+                      "If the \"delete\" argument is passed, any files related to the image will be deleted and no command line will be printed"
+                     f"Where target_images is one of:\n * {valid_names}\n")
+        exit(1)
+
+    if delete_mode:
+        Qcows_cli.remove_image(argv[1])
 
-    cmd = Qcows.cli(argv[1])
-    if stdout.isatty():
-        print(f"\nRun panda for {argv[1]} with:\n{cmd}")
     else:
-        print(cmd)
+        cmd = Qcows_cli.cli(argv[1])
+        if stdout.isatty():
+            print(f"Run the generic {argv[1]} PANDA guest interactively with the following command:\n{cmd}")
+        else:
+            print(cmd)
diff --git a/panda/python/core/pandare/qcows_internal.py b/panda/python/core/pandare/qcows_internal.py
new file mode 100644
index 00000000000..21b2c0c5328
--- /dev/null
+++ b/panda/python/core/pandare/qcows_internal.py
@@ -0,0 +1,401 @@
+#!/usr/bin/env python3
+'''
+Module for fetching generic PANDA images and managing their metadata.
+'''
+
+import logging
+from os import path, remove, makedirs
+from subprocess import check_call
+from collections import namedtuple
+from shlex import split as shlex_split
+from sys import exit
+
+logger = logging.getLogger(__name__)
+logger.setLevel(logging.DEBUG)
+
+VM_DIR = path.join(path.expanduser("~"), ".panda")
+
+class Image(namedtuple('Image', ['arch', 'os', 'prompt', 'cdrom', 'snapshot', 'url', 'extra_files', 'qcow', 'default_mem', 'extra_args', 'hashes'])):
+    '''
+    The Image class stores information about a supported PANDA image
+
+    Args:
+        arch (str): Arch for the given architecture.
+        os (str): an os string we can pass to panda with -os
+        prompt (regex): a regex to detect a bash prompt after loading the snapshot and sending commands
+        cdrom (str): name to use for cd-drive when inserting an ISO via monitor
+        qcow (str): optional name to save qcow as
+        url (str): url to download the qcow (e.g. https:// website.com/yourqcow.qcow2)
+        default_mem (str): memory to use for the root snapshot (e.g. 1G)
+        extra_files (list): other files (assumed to be in same directory on server) that we also need
+        extra_args (list): Extra arguments to pass to PANDA (e.g. ['-display', 'none'])
+        hashes (dict, optional): Mapping between qcow filenames and SHA1hashes they should match upon download
+    '''
+
+Image.__new__.__defaults__ = (None,) * len(Image._fields)
+
+SUPPORTED_IMAGES = {
+    # Debian: support for 4 arches on Wheezy
+    'i386_wheezy': Image(
+            arch = 'i386',
+            os="linux-32-debian:3.2.0-4-686-pae",
+            prompt=rb"root@debian-i386:.*# ",
+            qcow="wheezy_panda2.qcow2", # Backwards compatability
+            cdrom="ide1-cd0",
+            snapshot="root",
+            default_mem='128M',
+            url="https://panda-re.mit.edu/qcows/linux/debian/7.3/x86/debian_7.3_x86.qcow",
+            extra_args="-display none"),
+
+    'x86_64_wheezy': Image(
+            arch='x86_64',
+            os="linux-64-debian:3.2.0-4-amd64",
+            prompt=rb"root@debian-amd64:.*# ",
+            qcow="wheezy_x64.qcow2",# Backwards compatability 
+            cdrom="ide1-cd0",
+            snapshot="root",
+            default_mem='128M',
+            url="https://panda-re.mit.edu/qcows/linux/debian/7.3/x86_64/debian_7.3_x86_64.qcow",
+            extra_args="-display none"),
+
+    'ppc_wheezy': Image(
+            arch='ppc',
+            os="linux-64-debian:3.2.0-4-ppc-pae",
+            prompt=rb"root@debian-powerpc:.*# ",
+            qcow="ppc_wheezy.qcow2",# Backwards compatability 
+            cdrom="ide1-cd0",
+            default_mem='128M',
+            snapshot="root",
+            url="https://panda-re.mit.edu/qcows/linux/debian/7.3/ppc/debian_7.3_ppc.qcow",
+            extra_args="-display none"),
+
+    'arm_wheezy': Image(
+            arch='arm',
+            os="linux-32-debian:3.2.0-4-versatile-arm",
+            prompt=rb"root@debian-armel:.*# ",
+            qcow="arm_wheezy.qcow",# Backwards compatability 
+            cdrom="scsi0-cd2",
+            default_mem='128M',
+            snapshot="root",
+            url="https://panda-re.mit.edu/qcows/linux/debian/7.3/arm/debian_7.3_arm.qcow",
+            extra_files=['vmlinuz-3.2.0-4-versatile', 'initrd.img-3.2.0-4-versatile'],
+            extra_args='-display none -M versatilepb -append "root=/dev/sda1" -kernel {DOT_DIR}/vmlinuz-3.2.0-4-versatile -initrd {DOT_DIR}/initrd.img-3.2.0-4-versatile'.format(DOT_DIR=VM_DIR)),
+
+    'aarch64_focal': Image(
+            arch='aarch64',
+            os="linux-64-ubuntu:5.4.0-58-generic-arm64",
+            prompt=rb"root@ubuntu-panda:.*# ",
+            #cdrom="scsi0-cd2", # No idea what this should be
+            default_mem='1G',
+            snapshot="root",
+            url="https://panda-re.mit.edu/qcows/linux/ubuntu/2004/aarch64/ubuntu20_04-aarch64.qcow",
+            extra_files=['ubuntu20_04-aarch64-flash0.qcow'],
+            extra_args='-nographic -machine virt -cpu cortex-a57 -drive file={DOT_DIR}/ubuntu20_04-aarch64-flash0.qcow,if=pflash,readonly=on'.format(DOT_DIR=VM_DIR)),
+
+    'mips64': Image(
+            arch='mips64',
+            os="linux-64-debian:4.14.0-3-5kc-malta", # XXX: NO OSI
+            prompt=rb"root@debian-buster-mips:.*# ",
+            cdrom="ide1-cd0", # not sure
+            snapshot="root",
+            url="https://panda-re.mit.edu/qcows/linux/debian/10/mips64/debian-buster-mips.qcow2",
+            default_mem='2g',
+            extra_files=['vmlinux-4.14.0-3-5kc-malta.mips.buster', 'initrd.img-4.14.0-3-5kc-malta.mips.buster'],
+            extra_args='-M malta -cpu MIPS64R2-generic -append "root=/dev/vda console=ttyS0 mem=2048m net.ifnames=0 nokaslr" -netdev user,id=user.0 -device virtio-net,netdev=user.0 -device usb-kbd -device usb-tablet -kernel {DOT_DIR}/vmlinux-4.14.0-3-5kc-malta.mips.buster -initrd {DOT_DIR}/initrd.img-4.14.0-3-5kc-malta.mips.buster -nographic'.format(DOT_DIR=VM_DIR)),
+
+    'mips_wheezy': Image(
+            arch='mips',
+            os="linux-32-debian:3.2.0-4-4kc-malta",
+            prompt=rb"root@debian-mips:.*# ",
+            cdrom="ide1-cd0",
+            snapshot="root",
+            url="https://panda-re.mit.edu/qcows/linux/debian/7.3/mips/debian_7.3_mips.qcow",
+            default_mem='1g',
+            extra_files=['vmlinux-3.2.0-4-4kc-malta'],
+            extra_args='-M malta -kernel {DOT_DIR}/vmlinux-3.2.0-4-4kc-malta -append "root=/dev/sda1" -nographic'.format(DOT_DIR=VM_DIR)),
+
+    'mipsel_wheezy':  Image(
+            arch='mipsel',
+            os = "linux-32-debian:3.2.0-4-4kc-malta",
+            prompt=rb"root@debian-mipsel:.*# ",
+            cdrom="ide1-cd0",
+            snapshot="root",
+            default_mem='1g',
+            url="https://panda-re.mit.edu/qcows/linux/debian/7.3/mipsel/debian_7.3_mipsel.qcow",
+            extra_files=['vmlinux-3.2.0-4-4kc-malta.mipsel',],
+            extra_args='-M malta -kernel {DOT_DIR}/vmlinux-3.2.0-4-4kc-malta.mipsel -append "root=/dev/sda1" -nographic'.format(DOT_DIR=VM_DIR)),
+
+    'mips_buildroot5':  Image(
+            arch='mips',
+            os = "linux-32-buildroot:5.10.7-4kc-malta",
+            prompt=rb"# ",
+            cdrom="ide1-cd0",
+            snapshot="root",
+            default_mem='1g',
+            url="https://panda-re.mit.edu/qcows/linux/buildroot/5.10/mips/mips32_buildroot.qcow",
+            extra_files=['mips32_vmlinux-5.10.7-4kc-malta',],
+            extra_args='-M malta -kernel {DOT_DIR}/mips32_vmlinux-5.10.7-4kc-malta -net nic,model=pcnet -net user -append "root=/dev/hda" -nographic'.format(DOT_DIR=VM_DIR)),
+
+
+    'mipsel_buildroot5':  Image(
+            arch='mipsel',
+            os = "linux-32-buildroot:5.10.7-4kc-malta-el",
+            prompt=rb"# ",
+            cdrom="ide1-cd0",
+            snapshot="root",
+            default_mem='1g',
+            url="https://panda-re.mit.edu/qcows/linux/buildroot/5.10/mipsel/mipsel32_buildroot.qcow",
+            extra_files=['mipsel32_vmlinux-5.10.7-4kc-malta-el',],
+            extra_args='-M malta -kernel {DOT_DIR}/mipsel32_vmlinux-5.10.7-4kc-malta-el -net nic,model=pcnet -net user -append "root=/dev/hda" -nographic'.format(DOT_DIR=VM_DIR)),
+
+
+    # Ubuntu: x86/x86_64 support for 16.04, x86_64 support for 18.04
+    'i386_ubuntu_1604': Image(
+            arch = 'i386',
+            os="linux-32-ubuntu:4.4.200-170-generic", # Version.c is 200 but name is 4.4.0. Not sure why
+            prompt=rb"root@instance-1:.*#",
+            cdrom="ide1-cd0",
+            snapshot="root",
+            default_mem='1024',
+            url="https://panda-re.mit.edu/qcows/linux/ubuntu/1604/x86/ubuntu_1604_x86.qcow",
+            extra_args="-display none"),
+
+    #'x86_64_ubuntu_1604': Image( # XXX: This one is broken
+    #        arch='x86_64',
+    #        os="linux-64-ubuntu:4.4.0-180-pae",
+    #        prompt=rb"root@instance-1:.*#",
+    #        cdrom="ide1-cd0",
+    #        snapshot="root",
+    #        default_mem='1024',
+    #        url="https://panda-re.mit.edu/qcows/linux/ubuntu/1604/x86_64/ubuntu_1604_x86_64.qcow",
+    #        extra_files=['xenial-server-cloudimg-amd64-disk1.img',],
+    #        extra_args="-display none"),
+
+    'x86_64_ubuntu_1804': Image(
+            arch='x86_64',
+            os="linux-64-ubuntu:4.15.0-72-generic-noaslr-nokaslr",
+            prompt=rb"root@ubuntu:.*#",
+            cdrom="ide1-cd0",
+            snapshot="root",
+            default_mem='1024',
+            url="https://panda-re.mit.edu/qcows/linux/ubuntu/1804/x86_64/bionic-server-cloudimg-amd64-noaslr-nokaslr.qcow2",
+            extra_args="-display none",
+            hashes={"bionic-server-cloudimg-amd64-noaslr-nokaslr.qcow2": "556305921c8250537bbbfbb57cb56f9ef07f4d63"}),
+}
+"""
+Dictionary of `Image` objects by name.
+Generic values (underlying OS version may change) include:
+    x86_64
+    i386
+    ppc
+    arm
+    aarch64
+    mips
+    mipsel
+    mips64
+
+You may also specify an exact arch/OS combination from the following exist:
+    x86_64_ubuntu_1804
+    i386_ubuntu_1604
+    ppc_wheezy
+    arm_wheezy
+    aarch64 _focal
+    mips_wheezy
+    mips_buildroot5
+    mipsel_wheezy
+    mipsel_buildroot5
+    mips64
+""" # TODO: autogenerate values here
+
+# Default values
+SUPPORTED_IMAGES['x86_64']  = SUPPORTED_IMAGES['x86_64_ubuntu_1804']
+SUPPORTED_IMAGES['i386']    = SUPPORTED_IMAGES['i386_ubuntu_1604']
+SUPPORTED_IMAGES['ppc']     = SUPPORTED_IMAGES['ppc_wheezy']
+SUPPORTED_IMAGES['arm']     = SUPPORTED_IMAGES['arm_wheezy']
+SUPPORTED_IMAGES['aarch64'] = SUPPORTED_IMAGES['aarch64_focal']
+SUPPORTED_IMAGES['mips']    = SUPPORTED_IMAGES['mips_wheezy']
+SUPPORTED_IMAGES['mipsel']  = SUPPORTED_IMAGES['mipsel_wheezy']
+SUPPORTED_IMAGES['mips64']    = SUPPORTED_IMAGES['mips64']
+
+class Qcows():
+    '''
+    Helper library for managing qcows on your filesystem.
+    Given an architecture, it can download a qcow from `panda.mit.edu` to `~/.panda/` and then use that.
+    Alternatively, if a path to a qcow is provided, it can just use that.
+    A qcow loaded by architecture can then be queried to get the name of the root snapshot or prompt.
+    '''
+
+    @staticmethod
+    def get_qcow_info(name=None):
+        '''
+        Get information about supported image as specified by name.
+
+        Args:
+            name (str): String idenfifying a qcow supported
+                
+        Returns:
+            Image: Instance of the Image class for a qcow
+        '''
+        if name is None:
+            logger.warning("No qcow name provided. Defaulting to i386")
+            name = "i386"
+
+        if path.isfile(name):
+            raise RuntimeError("TODO: can't automatically determine system info from custom qcows. Use one of: {}".format(", ".join(SUPPORTED_IMAGES.keys())))
+
+        name = name.lower() # Case insensitive. Assumes supported_arches keys are lowercase
+        if name not in SUPPORTED_IMAGES.keys():
+            raise RuntimeError("Architecture {} is not in list of supported names: {}".format(name, ", ".join(SUPPORTED_IMAGES.keys())))
+
+        r = SUPPORTED_IMAGES[name]
+        # Move properties in .arch to being in the main object
+        return r
+
+    @staticmethod
+    def get_qcow(name=None, download=True):
+        '''
+        Given a generic name of a qcow in `pandare.qcows.SUPPORTED_IMAGES` or a path to a qcow, return the path. Defaults to i386
+
+        Args:
+            name (str): generic name or path to qcow
+            download (bool, default True): should the qcow be downloaded if necessary
+                
+        Returns:
+            string: Path to qcow
+
+        Raises:
+            ValueError: if download is set to False and the qcow is not present
+            RuntimeError: if the architecture is unsupported or the necessary files could not be downloaded
+        '''
+        if name is None:
+            logger.warning("No qcow name provided. Defaulting to i386")
+            name = "i386"
+
+        if path.isfile(name):
+            logger.debug("Provided qcow name appears to be a path, returning it directly: %s", name)
+            return name
+
+        name = name.lower() # Case insensitive. Assumes supported_images keys are lowercase
+        if name not in SUPPORTED_IMAGES.keys():
+            raise RuntimeError("Architecture {} is not in list of supported names: {}".format(name, ", ".join(SUPPORTED_IMAGES.keys())))
+
+        image_data = SUPPORTED_IMAGES[name]
+        qc = image_data.qcow
+        if not qc: # Default, get name from url
+            qc = image_data.url.split("/")[-1]
+        qcow_path = path.join(VM_DIR,qc)
+        makedirs(VM_DIR, exist_ok=True)
+
+        # We need to downlaod if the QCOW or any extra files are missing
+        # If the files are present on disk, assume they're okay
+        needs_download = not path.isfile(qcow_path)
+
+        if not needs_download:
+            for extra_file in image_data.extra_files or []:
+                extra_file_path = path.join(VM_DIR, extra_file)
+                if not os.path.isfile(extra_file_path):
+                    needs_download = True
+                    break
+
+        if needs_download and download:
+            Qcows.download_qcow(image_data, qcow_path)
+        elif needs_download:
+            raise ValueError("Qcow is not on disk and download option is disabled")
+
+        return qcow_path
+
+    @staticmethod
+    def download_qcow(image_data, output_path, _is_retry=False):
+        '''
+        Download the qcow described in the Image object in image_data
+        Store to the output output_path.
+        If the Image includes SHA1 hashes, validate the file was downloaded correctly, otherwise retry once
+        '''
+
+        def get_file(url, output_path, sha1hash=None, do_retry=True):
+            print(f"Downloading required file: {url}\n")
+            try:
+                check_call(["wget", "--quiet", url, "-O", output_path])
+                if sha1hash is not None:
+                    import hashlib
+                    sha1 = hashlib.sha1()
+
+                    with open(output_path, 'rb') as f:
+                        while True:
+                            data = f.read(65536) #64kb chunks
+                            if not data:
+                                break
+                            sha1.update(data)
+                    computed_hash = sha1.hexdigest()
+                    if computed_hash != sha1hash:
+                        logger.warning(f"{url} has {computed_hash} vs expected {sha1hash}")
+            except Exception as e:
+                logger.info("Download failed, deleting partial file: %s", output_path)
+                remove(output_path)
+
+                if do_retry:
+                    get_file(url, output_path, sha1hash, do_retry=False)
+                else:
+                    # Not retrying again, fatal - leave any partial files though
+                    raise RuntimeError(f"Unable to download expeted file from {url} even after retrying")
+            logger.debug("Downloaded %s to %s", url, output_path)
+
+        # Check if we have a hash for the base qcow. Then download and vlidate with that hash
+        qcow_base = image_data.url.split("/")[-1] if '/' in image_data.url else image_data.url
+        base_hash = None
+        print(image_data)
+        if hasattr(image_data, "hashes") and qcow_base in image_data.hashes:
+            base_hash = image_data.hashes[qcow_base]
+        get_file(image_data.url, output_path, base_hash)
+
+        # Download all extra files out of the same directory
+        url_base = image_data.url[:image_data.url.rfind("/")] + "/"  # Truncate url to last /
+        for extra_file in image_data.extra_files or []:
+            extra_file_path = path.join(VM_DIR, extra_file)
+            extra_hash = None
+            if hasattr(image_data, "hashes") and extra_file in image_data['hashes']:
+                extra_hash = image_data.hashes[extra_file]
+            get_file(extra_file_path, url_base + extra_file, extra_hash)
+
+    @staticmethod
+    def qcow_from_arg(idx=1):
+        '''
+        Given an index into argv, call get_qcow with that arg if it exists, else with None
+
+        Args:
+            idx (int): an index into argv
+                
+        Returns:
+            string: Path to qcow
+        '''
+        from sys import argv
+
+        if len(argv) > idx:
+            return Qcows.get_qcow(argv[idx])
+        else:
+            return Qcows.get_qcow()
+
+    @staticmethod
+    def remove_image(target):
+        try:
+            qcow = Qcows.get_qcow(target, download=False)
+        except ValueError:
+            # No QCOW, we're good!
+            return
+
+        try:
+            image_data = SUPPORTED_IMAGES[target]
+        except ValueError:
+            # Not a valid image? I guess we're good
+            return
+
+        qc = image_data.qcow
+        if not qc: # Default, get name from url
+            qc = image_data.url.split("/")[-1]
+        qcow_path = path.join(VM_DIR, qc)
+        remove(qcow_path)
+
+        for extra_file in image_data.extra_files or []:
+            extra_file_path = path.join(VM_DIR, extra_file)
+            if os.path.isfile(extra_file_path):
+                remove(extra_file_path)

From 6379e956bbeaf0f8f07a1a62e0e0b712871f148f Mon Sep 17 00:00:00 2001
From: Andrew Fasano <fasano@mit.edu>
Date: Tue, 13 Sep 2022 21:49:39 -0400
Subject: [PATCH 091/140] pandare.qcows: add hash-checks and hashes for some
 qcows. Move _find_build_dir to utils and allow wildcard architecture

---
 panda/python/core/pandare/panda.py          | 42 +---------------
 panda/python/core/pandare/qcows.py          | 40 ++++++++++-----
 panda/python/core/pandare/qcows_internal.py | 22 +++++----
 panda/python/core/pandare/utils.py          | 55 +++++++++++++++++++++
 4 files changed, 98 insertions(+), 61 deletions(-)

diff --git a/panda/python/core/pandare/panda.py b/panda/python/core/pandare/panda.py
index 3bddd8fe60f..77902cbad0a 100755
--- a/panda/python/core/pandare/panda.py
+++ b/panda/python/core/pandare/panda.py
@@ -32,7 +32,7 @@
 from time import sleep
 from cffi import FFI
 
-from .utils import progress, warn, make_iso, debug, blocking, GArrayIterator, plugin_list
+from .utils import progress, warn, make_iso, debug, blocking, GArrayIterator, plugin_list, find_build_dir
 from .taint import TaintQuery
 from .panda_expect import Expect
 from .asyncthread import AsyncThread
@@ -146,7 +146,7 @@ def __init__(self, arch="i386", mem="128M",
             raise ValueError(f"Unsupported architecture {self.arch_name}")
         self.bits, self.endianness, self.register_size = self.arch._determine_bits()
 
-        self.build_dir  = self._find_build_dir(self.arch_name)
+        self.build_dir  = find_build_dir(self.arch_name)
         environ["PANDA_DIR"] = self.build_dir
 
         if libpanda_path:
@@ -315,44 +315,6 @@ def __main_loop_wait_cb(self):
         except KeyboardInterrupt:
             self.end_analysis()
 
-    @staticmethod
-    def _find_build_dir(arch_name, find_executable=False):
-        '''
-        Find build directory containing:
-			A: (if not find_executable) ARCH-softmmu/libpanda-ARCH.so and ARCH-softmmu/panda/plugins/
-			B: (if find_executable) the panda-system-ARCH binary
-        1) Check relative to file (in the case of installed packages)
-        2) Check in../ ../../../build/
-        2) Search path if user is looking for an executable instead of a library
-        3) Raise RuntimeError if we find nothing
-
-        Set find_executable if you want to search for the directory with the
-        panda-system-[arch] binary instead of the libpanda-[arch].so library.
-        '''
-        arches = ['i386', 'x86_64', 'arm', 'aarch64', 'ppc', 'mips', 'mipsel', 'mips64']
-        if arch_name not in arches:
-            raise ValueError(f"Unsupported architecture name: {arch_name}, allowed values are: {arches}")
-        python_package = pjoin(*[dirname(__file__), "data"])
-        local_build = realpath(pjoin(dirname(__file__), "../../../../build"))
-        arch_dir = f"{arch_name}-softmmu"
-        file_name = f"panda-system-{arch_name}" if find_executable else \
-                    f"libpanda-{arch_name}.so"
-        pot_paths = [pjoin(python_package, arch_dir), pjoin(local_build, arch_dir)]
-
-        if find_executable and 'PATH' in environ:
-            # If we're looking for the panda executable, also search the user's path
-            pot_paths.extend(environ.get('PATH').split(":"))
-
-        for potential_path in pot_paths:
-            if isfile(pjoin(potential_path, file_name)):
-                #print("Loading libpanda from {}".format(potential_path))
-                return potential_path
-
-        searched_paths = "\n".join(["\t"+p for p in  pot_paths])
-        raise RuntimeError((f"Couldn't find {file_name}\n"
-                            f"Did you built PANDA for this architecture?\n"
-                            f"Searched for {arch_dir}/{file_name} in:\n{searched_paths}"))
-
     def queue_main_loop_wait_fn(self, fn, args=[]):
         '''
         Queue a function to run at the next main loop
diff --git a/panda/python/core/pandare/qcows.py b/panda/python/core/pandare/qcows.py
index 77639c2e54b..adf16027713 100644
--- a/panda/python/core/pandare/qcows.py
+++ b/panda/python/core/pandare/qcows.py
@@ -2,25 +2,39 @@
 '''
 Module to simplify PANDA command line usage. Use python3 -m pandare.qcows to 
 fetch files necessary to run various generic VMs and generate command lines to start them.
-Also supports deleting previously-fetched files
+Also supports deleting previously-fetched files.
+
+Most of the interesting logic fot his is contained in qcows_internal.py
 '''
 
-import logging
-from os import path, remove, makedirs
-from subprocess import check_call
-from collections import namedtuple
+from os import path, remove
 from shlex import split as shlex_split
-from sys import exit
+from sys import exit, stderr
 
+from .utils import find_build_dir
 from .panda import Panda
 from os import environ
 from .qcows_internal import Qcows, SUPPORTED_IMAGES
 
-logger = logging.getLogger(__name__)
-logger.setLevel(logging.DEBUG)
-
 VM_DIR = path.join(path.expanduser("~"), ".panda")
 class Qcows_cli():
+    @staticmethod
+    def _find_build_dir(arch):
+        try:
+            build_dir = find_build_dir(arch, find_executable=True)
+        except RuntimeError as e:
+            # Couldn't find this arch - can we find any?
+            try:
+                build_dir = find_build_dir(None, find_executable=True)
+                print(f"WARNING: You do not appear to have panda-system-{arch}, please build it then try again\n",
+                      file=None if stdout.isatty() else stderr)
+
+            except RuntimeError as e2:
+                print(f"ERROR: Cannot find any version of PANDA on your system, please build and then try again\n",
+                      file=None if stdout.isatty() else stderr)
+                raise e
+        return build_dir
+
     @staticmethod
     def remove_image(target):
         try:
@@ -43,14 +57,18 @@ def remove_image(target):
 
         for extra_file in image_data.extra_files or []:
             extra_file_path = path.join(VM_DIR, extra_file)
-            if os.path.isfile(extra_file_path):
+            if path.isfile(extra_file_path):
                 remove(extra_file_path)
     @staticmethod
     def cli(target):
         q = Qcows.get_qcow_info(target)
         qcow = Qcows.get_qcow(target)
         arch = q.arch
-        build_dir = Panda._find_build_dir(arch, find_executable=True)
+        # User needs to have the specified arch in order to run the command.
+        # But if they just want to download/delete files and we find another arch
+        # we can fetch/delete the files print a warning about how the generatd command won't work.
+
+        build_dir = Qcows_cli._find_build_dir(arch)
         panda_args = [build_dir + f"/{arch}-softmmu/panda-system-{arch}"]
         biospath = path.realpath(path.join(build_dir, "pc-bios"))
         panda_args.extend(["-L", biospath])
diff --git a/panda/python/core/pandare/qcows_internal.py b/panda/python/core/pandare/qcows_internal.py
index 21b2c0c5328..87be32f0a74 100644
--- a/panda/python/core/pandare/qcows_internal.py
+++ b/panda/python/core/pandare/qcows_internal.py
@@ -123,7 +123,9 @@ class Image(namedtuple('Image', ['arch', 'os', 'prompt', 'cdrom', 'snapshot', 'u
             default_mem='1g',
             url="https://panda-re.mit.edu/qcows/linux/debian/7.3/mipsel/debian_7.3_mipsel.qcow",
             extra_files=['vmlinux-3.2.0-4-4kc-malta.mipsel',],
-            extra_args='-M malta -kernel {DOT_DIR}/vmlinux-3.2.0-4-4kc-malta.mipsel -append "root=/dev/sda1" -nographic'.format(DOT_DIR=VM_DIR)),
+            extra_args='-M malta -kernel {DOT_DIR}/vmlinux-3.2.0-4-4kc-malta.mipsel -append "root=/dev/sda1" -nographic'.format(DOT_DIR=VM_DIR),
+            hashes={'vmlinux-3.2.0-4-4kc-malta': '592e384a4edc16dade52a6cd5c785c637bcbc9ad',
+                    'debian_7.3_mipsel.qcow': 'eeb5de0128a95c5f0d76c4f2161afd1bb320d85b'}),
 
     'mips_buildroot5':  Image(
             arch='mips',
@@ -293,7 +295,7 @@ def get_qcow(name=None, download=True):
         if not needs_download:
             for extra_file in image_data.extra_files or []:
                 extra_file_path = path.join(VM_DIR, extra_file)
-                if not os.path.isfile(extra_file_path):
+                if not path.isfile(extra_file_path):
                     needs_download = True
                     break
 
@@ -313,7 +315,7 @@ def download_qcow(image_data, output_path, _is_retry=False):
         '''
 
         def get_file(url, output_path, sha1hash=None, do_retry=True):
-            print(f"Downloading required file: {url}\n")
+            print(f"Downloading required file: {url}")
             try:
                 check_call(["wget", "--quiet", url, "-O", output_path])
                 if sha1hash is not None:
@@ -328,7 +330,7 @@ def get_file(url, output_path, sha1hash=None, do_retry=True):
                             sha1.update(data)
                     computed_hash = sha1.hexdigest()
                     if computed_hash != sha1hash:
-                        logger.warning(f"{url} has {computed_hash} vs expected {sha1hash}")
+                        raise ValueError(f"{url} has hash {computed_hash} vs expected hash {sha1hash}")
             except Exception as e:
                 logger.info("Download failed, deleting partial file: %s", output_path)
                 remove(output_path)
@@ -337,14 +339,14 @@ def get_file(url, output_path, sha1hash=None, do_retry=True):
                     get_file(url, output_path, sha1hash, do_retry=False)
                 else:
                     # Not retrying again, fatal - leave any partial files though
-                    raise RuntimeError(f"Unable to download expeted file from {url} even after retrying")
+                    raise RuntimeError(f"Unable to download expeted file from {url} even after retrying: {e}") from None
             logger.debug("Downloaded %s to %s", url, output_path)
 
         # Check if we have a hash for the base qcow. Then download and vlidate with that hash
         qcow_base = image_data.url.split("/")[-1] if '/' in image_data.url else image_data.url
         base_hash = None
-        print(image_data)
-        if hasattr(image_data, "hashes") and qcow_base in image_data.hashes:
+
+        if image_data.hashes is not None and qcow_base in image_data.hashes:
             base_hash = image_data.hashes[qcow_base]
         get_file(image_data.url, output_path, base_hash)
 
@@ -353,9 +355,9 @@ def get_file(url, output_path, sha1hash=None, do_retry=True):
         for extra_file in image_data.extra_files or []:
             extra_file_path = path.join(VM_DIR, extra_file)
             extra_hash = None
-            if hasattr(image_data, "hashes") and extra_file in image_data['hashes']:
+            if image_data.hashes is not None and extra_file in image_data.hashes:
                 extra_hash = image_data.hashes[extra_file]
-            get_file(extra_file_path, url_base + extra_file, extra_hash)
+            get_file(url_base + extra_file, extra_file_path, extra_hash)
 
     @staticmethod
     def qcow_from_arg(idx=1):
@@ -397,5 +399,5 @@ def remove_image(target):
 
         for extra_file in image_data.extra_files or []:
             extra_file_path = path.join(VM_DIR, extra_file)
-            if os.path.isfile(extra_file_path):
+            if path.isfile(extra_file_path):
                 remove(extra_file_path)
diff --git a/panda/python/core/pandare/utils.py b/panda/python/core/pandare/utils.py
index 8ca3bf87eae..75327f97d95 100644
--- a/panda/python/core/pandare/utils.py
+++ b/panda/python/core/pandare/utils.py
@@ -9,6 +9,9 @@
 from subprocess import check_call, STDOUT
 from sys import platform, stdout
 from threading import current_thread, main_thread
+#for _find_build_path
+from os import dup, getenv, environ, path
+from os.path import realpath, isfile, dirname, join as pjoin
 
 # Set to enable pypanda debugging
 debug = False
@@ -142,3 +145,55 @@ def __getitem__(self,plugin_name):
         if plugin_name not in self:
             self._panda.load_plugin(plugin_name)
         return super().__getitem__(plugin_name)
+
+def _find_build_dir(arch_name=None, find_executable=False):
+    python_package = pjoin(*[dirname(__file__), "data"])
+    local_build = realpath(pjoin(dirname(__file__), "../../../../build"))
+    arch_dir = f"{arch_name}-softmmu"
+    file_name = f"panda-system-{arch_name}" if find_executable else \
+                f"libpanda-{arch_name}.so"
+    pot_paths = [pjoin(python_package, arch_dir), pjoin(local_build, arch_dir)]
+
+    if find_executable and 'PATH' in environ:
+        # If we're looking for the panda executable, also search the user's path
+        pot_paths.extend(environ.get('PATH').split(":"))
+
+    for potential_path in pot_paths:
+        if isfile(pjoin(potential_path, file_name)):
+            #print("Loading libpanda from {}".format(potential_path))
+            return potential_path
+
+    searched_paths = "\n".join(["\t"+p for p in  pot_paths])
+    raise RuntimeError((f"Couldn't find {file_name}\n"
+                        f"Did you built PANDA for this architecture?\n"
+                        f"Searched for {arch_dir}/{file_name} in:\n{searched_paths}"))
+
+
+def find_build_dir(arch_name=None, find_executable=False):
+    '''
+    Find build directory containing:
+        A: (if not find_executable) ARCH-softmmu/libpanda-ARCH.so and ARCH-softmmu/panda/plugins/
+        B: (if find_executable) the panda-system-ARCH binary
+    1) Check relative to file (in the case of installed packages)
+    2) Check in../ ../../../build/
+    2) Search path if user is looking for an executable instead of a library
+    3) Raise RuntimeError if we find nothing
+
+    Set find_executable if you want to search for the directory with the
+    panda-system-[arch] binary instead of the libpanda-[arch].so library.
+    '''
+    arches = ['i386', 'x86_64', 'arm', 'aarch64', 'ppc', 'mips', 'mipsel', 'mips64']
+
+    if arch_name is None:
+        e = None
+        for arch in arches:
+            try:
+                return _find_build_dir(arch, find_executable)
+            except RuntimeError as _e:
+                e = _e
+        if e:
+            raise e
+
+    elif arch_name not in arches:
+        raise ValueError(f"Unsupported architecture name: {arch_name}, allowed values are: {arches}")
+    return _find_build_dir(arch_name, find_executable)

From 24355e98b6cf29d59e4485c550dc3a14e36a5973 Mon Sep 17 00:00:00 2001
From: Andrew Fasano <fasano@mit.edu>
Date: Tue, 13 Sep 2022 22:05:35 -0400
Subject: [PATCH 092/140] Pandare.qcows cleanup: handle interrupted downloads,
 show download progress for TTYs and generally handle TTYs better

---
 panda/python/core/pandare/qcows.py          | 15 ++--
 panda/python/core/pandare/qcows_internal.py | 92 +++++++++++++--------
 2 files changed, 66 insertions(+), 41 deletions(-)

diff --git a/panda/python/core/pandare/qcows.py b/panda/python/core/pandare/qcows.py
index adf16027713..a66a807b220 100644
--- a/panda/python/core/pandare/qcows.py
+++ b/panda/python/core/pandare/qcows.py
@@ -38,7 +38,7 @@ def _find_build_dir(arch):
     @staticmethod
     def remove_image(target):
         try:
-            qcow = Qcows.get_qcow(target, download=False)
+            qcow = Qcows.get_qcow(target, download=False, _is_tty=stdout.isatty())
         except ValueError:
             # No QCOW, we're good!
             return
@@ -53,23 +53,26 @@ def remove_image(target):
         if not qc: # Default, get name from url
             qc = image_data.url.split("/")[-1]
         qcow_path = path.join(VM_DIR, qc)
-        remove(qcow_path)
+        if path.isfile(qcow_path):
+            print(f"Deleting {qcow_path}")
+            remove(qcow_path)
 
         for extra_file in image_data.extra_files or []:
             extra_file_path = path.join(VM_DIR, extra_file)
             if path.isfile(extra_file_path):
+                print(f"Deleting {extra_file_path}")
                 remove(extra_file_path)
     @staticmethod
     def cli(target):
         q = Qcows.get_qcow_info(target)
-        qcow = Qcows.get_qcow(target)
+        qcow = Qcows.get_qcow(target, _is_tty=stdout.isatty())
         arch = q.arch
         # User needs to have the specified arch in order to run the command.
         # But if they just want to download/delete files and we find another arch
         # we can fetch/delete the files print a warning about how the generatd command won't work.
 
         build_dir = Qcows_cli._find_build_dir(arch)
-        panda_args = [build_dir + f"/{arch}-softmmu/panda-system-{arch}"]
+        panda_args = [build_dir + f"/panda-system-{arch}"]
         biospath = path.realpath(path.join(build_dir, "pc-bios"))
         panda_args.extend(["-L", biospath])
         panda_args.extend(["-os", q.os])
@@ -96,8 +99,8 @@ def cli(target):
         if "-display none" in ret:
             ret = ret.replace("-display none", "-nographic")
 
-        # Repalce /home/username with ~ when we can
-        if 'HOME' in environ:
+        # Repalce /home/username with ~ when we can (TTYs)
+        if stdout.isatty() and 'HOME' in environ:
             ret = ret.replace(environ['HOME'], '~')
         return ret
 
diff --git a/panda/python/core/pandare/qcows_internal.py b/panda/python/core/pandare/qcows_internal.py
index 87be32f0a74..595a2512215 100644
--- a/panda/python/core/pandare/qcows_internal.py
+++ b/panda/python/core/pandare/qcows_internal.py
@@ -4,11 +4,13 @@
 '''
 
 import logging
+import hashlib
 from os import path, remove, makedirs
-from subprocess import check_call
+from subprocess import Popen, PIPE, CalledProcessError
 from collections import namedtuple
 from shlex import split as shlex_split
-from sys import exit
+from sys import exit, stderr
+from shutil import move
 
 logger = logging.getLogger(__name__)
 logger.setLevel(logging.DEBUG)
@@ -254,7 +256,7 @@ def get_qcow_info(name=None):
         return r
 
     @staticmethod
-    def get_qcow(name=None, download=True):
+    def get_qcow(name=None, download=True, _is_tty=True):
         '''
         Given a generic name of a qcow in `pandare.qcows.SUPPORTED_IMAGES` or a path to a qcow, return the path. Defaults to i386
 
@@ -300,55 +302,75 @@ def get_qcow(name=None, download=True):
                     break
 
         if needs_download and download:
-            Qcows.download_qcow(image_data, qcow_path)
+            Qcows.download_qcow(image_data, qcow_path, _is_tty=_is_tty)
         elif needs_download:
             raise ValueError("Qcow is not on disk and download option is disabled")
 
         return qcow_path
 
     @staticmethod
-    def download_qcow(image_data, output_path, _is_retry=False):
+    def get_file(url, output_path, sha1hash=None, do_retry=True, _is_tty=True):
+        if _is_tty:
+            print(f"Downloading required file: {url}")
+            cmd = ["wget", '--show-progress', '--quiet', url, "-O", output_path+".tmp"]
+        else:
+            print(f"Please wait for download of required file: {url}", file=stderr)
+            cmd = ["wget", "--quiet", url, "-O", output_path+".tmp"]
+
+        try:
+            with Popen(cmd, stdout=PIPE, bufsize=1, universal_newlines=True) as p:
+                for line in p.stdout:
+                    print(line, end='')
+
+            if p.returncode != 0:
+                raise CalledProcessError(p.returncode, p.args)
+
+            # Check hash if we have one
+            if sha1hash is not None:
+                if _is_tty:
+                    print(f"Validating file hash")
+                sha1 = hashlib.sha1()
+
+                with open(output_path+".tmp", 'rb') as f:
+                    while True:
+                        data = f.read(65536) #64kb chunks
+                        if not data:
+                            break
+                        sha1.update(data)
+                computed_hash = sha1.hexdigest()
+                if computed_hash != sha1hash:
+                    raise ValueError(f"{url} has hash {computed_hash} vs expected hash {sha1hash}")
+                # Hash matches, move .tmp file to actual path
+                move(output_path+".tmp", output_path)
+
+        except Exception as e:
+            logger.info("Download failed, deleting partial file: %s", output_path)
+            remove(output_path+".tmp")
+
+            if do_retry:
+                if _is_tty and do_retry:
+                    print("Hash mismatch - retrying")
+                Qcows.get_file(url, output_path, sha1hash, do_retry=False, _is_tty=_is_tty)
+            else:
+                # Not retrying again, fatal - leave any partial files though
+                raise RuntimeError(f"Unable to download expeted file from {url} even after retrying: {e}") from None
+        logger.debug("Downloaded %s to %s", url, output_path)
+
+    @staticmethod
+    def download_qcow(image_data, output_path, _is_retry=False, _is_tty=True):
         '''
         Download the qcow described in the Image object in image_data
         Store to the output output_path.
         If the Image includes SHA1 hashes, validate the file was downloaded correctly, otherwise retry once
         '''
 
-        def get_file(url, output_path, sha1hash=None, do_retry=True):
-            print(f"Downloading required file: {url}")
-            try:
-                check_call(["wget", "--quiet", url, "-O", output_path])
-                if sha1hash is not None:
-                    import hashlib
-                    sha1 = hashlib.sha1()
-
-                    with open(output_path, 'rb') as f:
-                        while True:
-                            data = f.read(65536) #64kb chunks
-                            if not data:
-                                break
-                            sha1.update(data)
-                    computed_hash = sha1.hexdigest()
-                    if computed_hash != sha1hash:
-                        raise ValueError(f"{url} has hash {computed_hash} vs expected hash {sha1hash}")
-            except Exception as e:
-                logger.info("Download failed, deleting partial file: %s", output_path)
-                remove(output_path)
-
-                if do_retry:
-                    get_file(url, output_path, sha1hash, do_retry=False)
-                else:
-                    # Not retrying again, fatal - leave any partial files though
-                    raise RuntimeError(f"Unable to download expeted file from {url} even after retrying: {e}") from None
-            logger.debug("Downloaded %s to %s", url, output_path)
-
         # Check if we have a hash for the base qcow. Then download and vlidate with that hash
         qcow_base = image_data.url.split("/")[-1] if '/' in image_data.url else image_data.url
         base_hash = None
 
         if image_data.hashes is not None and qcow_base in image_data.hashes:
             base_hash = image_data.hashes[qcow_base]
-        get_file(image_data.url, output_path, base_hash)
+        Qcows.get_file(image_data.url, output_path, base_hash, _is_tty=_is_tty)
 
         # Download all extra files out of the same directory
         url_base = image_data.url[:image_data.url.rfind("/")] + "/"  # Truncate url to last /
@@ -357,7 +379,7 @@ def get_file(url, output_path, sha1hash=None, do_retry=True):
             extra_hash = None
             if image_data.hashes is not None and extra_file in image_data.hashes:
                 extra_hash = image_data.hashes[extra_file]
-            get_file(url_base + extra_file, extra_file_path, extra_hash)
+            Qcows.get_file(url_base + extra_file, extra_file_path, extra_hash, _is_tty=_is_tty)
 
     @staticmethod
     def qcow_from_arg(idx=1):

From d1bb8e55e634b38e60fd86a2503b5e8fe3410edb Mon Sep 17 00:00:00 2001
From: Andrew Fasano <fasano@mit.edu>
Date: Tue, 13 Sep 2022 22:35:34 -0400
Subject: [PATCH 093/140] pandare.qcows support alternate URLs for qcow
 downloads

---
 panda/python/core/pandare/qcows_internal.py | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/panda/python/core/pandare/qcows_internal.py b/panda/python/core/pandare/qcows_internal.py
index 595a2512215..d68003482a7 100644
--- a/panda/python/core/pandare/qcows_internal.py
+++ b/panda/python/core/pandare/qcows_internal.py
@@ -4,6 +4,7 @@
 '''
 
 import logging
+import random
 import hashlib
 from os import path, remove, makedirs
 from subprocess import Popen, PIPE, CalledProcessError
@@ -17,7 +18,7 @@
 
 VM_DIR = path.join(path.expanduser("~"), ".panda")
 
-class Image(namedtuple('Image', ['arch', 'os', 'prompt', 'cdrom', 'snapshot', 'url', 'extra_files', 'qcow', 'default_mem', 'extra_args', 'hashes'])):
+class Image(namedtuple('Image', ['arch', 'os', 'prompt', 'cdrom', 'snapshot', 'url', 'alternate_urls', 'extra_files', 'qcow', 'default_mem', 'extra_args', 'hashes'])):
     '''
     The Image class stores information about a supported PANDA image
 
@@ -183,6 +184,7 @@ class Image(namedtuple('Image', ['arch', 'os', 'prompt', 'cdrom', 'snapshot', 'u
             snapshot="root",
             default_mem='1024',
             url="https://panda-re.mit.edu/qcows/linux/ubuntu/1804/x86_64/bionic-server-cloudimg-amd64-noaslr-nokaslr.qcow2",
+            alternate_urls=["https://www.dropbox.com/s/4avqfxqemd29i5j/bionic-server-cloudimg-amd64-noaslr-nokaslr.qcow2?dl=1"],
             extra_args="-display none",
             hashes={"bionic-server-cloudimg-amd64-noaslr-nokaslr.qcow2": "556305921c8250537bbbfbb57cb56f9ef07f4d63"}),
 }
@@ -309,7 +311,10 @@ def get_qcow(name=None, download=True, _is_tty=True):
         return qcow_path
 
     @staticmethod
-    def get_file(url, output_path, sha1hash=None, do_retry=True, _is_tty=True):
+    def get_file(urls, output_path, sha1hash=None, do_retry=True, _is_tty=True):
+        assert len(urls) > 0
+        url = random.choice([x for x in urls if x is not None])
+
         if _is_tty:
             print(f"Downloading required file: {url}")
             cmd = ["wget", '--show-progress', '--quiet', url, "-O", output_path+".tmp"]
@@ -350,7 +355,7 @@ def get_file(url, output_path, sha1hash=None, do_retry=True, _is_tty=True):
             if do_retry:
                 if _is_tty and do_retry:
                     print("Hash mismatch - retrying")
-                Qcows.get_file(url, output_path, sha1hash, do_retry=False, _is_tty=_is_tty)
+                Qcows.get_file([url], output_path, sha1hash, do_retry=False, _is_tty=_is_tty)
             else:
                 # Not retrying again, fatal - leave any partial files though
                 raise RuntimeError(f"Unable to download expeted file from {url} even after retrying: {e}") from None
@@ -370,7 +375,8 @@ def download_qcow(image_data, output_path, _is_retry=False, _is_tty=True):
 
         if image_data.hashes is not None and qcow_base in image_data.hashes:
             base_hash = image_data.hashes[qcow_base]
-        Qcows.get_file(image_data.url, output_path, base_hash, _is_tty=_is_tty)
+
+        Qcows.get_file([image_data.url] + (image_data.alternate_urls if image_data.alternate_urls is not None else []), output_path, base_hash, _is_tty=_is_tty)
 
         # Download all extra files out of the same directory
         url_base = image_data.url[:image_data.url.rfind("/")] + "/"  # Truncate url to last /
@@ -379,7 +385,7 @@ def download_qcow(image_data, output_path, _is_retry=False, _is_tty=True):
             extra_hash = None
             if image_data.hashes is not None and extra_file in image_data.hashes:
                 extra_hash = image_data.hashes[extra_file]
-            Qcows.get_file(url_base + extra_file, extra_file_path, extra_hash, _is_tty=_is_tty)
+            Qcows.get_file([url_base + extra_file], extra_file_path, extra_hash, _is_tty=_is_tty) # TODO: support alternate URL here too? Won't work for some hosting options
 
     @staticmethod
     def qcow_from_arg(idx=1):

From f5434463b752ff79b542a4fb4d7e786dd3e8de52 Mon Sep 17 00:00:00 2001
From: Andrew Fasano <fasano@mit.edu>
Date: Wed, 14 Sep 2022 08:47:47 -0400
Subject: [PATCH 094/140] Bugfix: find_build_dir should return build dir, not
 softmmu dir

---
 panda/python/core/pandare/qcows.py |  2 +-
 panda/python/core/pandare/utils.py | 30 ++++++++++++++++++------------
 2 files changed, 19 insertions(+), 13 deletions(-)

diff --git a/panda/python/core/pandare/qcows.py b/panda/python/core/pandare/qcows.py
index a66a807b220..20e080e114a 100644
--- a/panda/python/core/pandare/qcows.py
+++ b/panda/python/core/pandare/qcows.py
@@ -72,7 +72,7 @@ def cli(target):
         # we can fetch/delete the files print a warning about how the generatd command won't work.
 
         build_dir = Qcows_cli._find_build_dir(arch)
-        panda_args = [build_dir + f"/panda-system-{arch}"]
+        panda_args = [path.join(build_dir, f"{arch}-softmmu/panda-system-{arch}")]
         biospath = path.realpath(path.join(build_dir, "pc-bios"))
         panda_args.extend(["-L", biospath])
         panda_args.extend(["-os", q.os])
diff --git a/panda/python/core/pandare/utils.py b/panda/python/core/pandare/utils.py
index 75327f97d95..39631b59991 100644
--- a/panda/python/core/pandare/utils.py
+++ b/panda/python/core/pandare/utils.py
@@ -146,7 +146,10 @@ def __getitem__(self,plugin_name):
             self._panda.load_plugin(plugin_name)
         return super().__getitem__(plugin_name)
 
-def _find_build_dir(arch_name=None, find_executable=False):
+def _find_build_dir(arch_name, find_executable=False):
+    '''
+    Internal function to return the build directory for the specified architecture
+    '''
     python_package = pjoin(*[dirname(__file__), "data"])
     local_build = realpath(pjoin(dirname(__file__), "../../../../build"))
     arch_dir = f"{arch_name}-softmmu"
@@ -160,7 +163,8 @@ def _find_build_dir(arch_name=None, find_executable=False):
 
     for potential_path in pot_paths:
         if isfile(pjoin(potential_path, file_name)):
-            #print("Loading libpanda from {}".format(potential_path))
+            # potential_path may contain [arch]-softmmu, if so remove it
+            potential_path = potential_path.replace(arch_dir, "")
             return potential_path
 
     searched_paths = "\n".join(["\t"+p for p in  pot_paths])
@@ -171,16 +175,18 @@ def _find_build_dir(arch_name=None, find_executable=False):
 
 def find_build_dir(arch_name=None, find_executable=False):
     '''
-    Find build directory containing:
-        A: (if not find_executable) ARCH-softmmu/libpanda-ARCH.so and ARCH-softmmu/panda/plugins/
-        B: (if find_executable) the panda-system-ARCH binary
-    1) Check relative to file (in the case of installed packages)
-    2) Check in../ ../../../build/
-    2) Search path if user is looking for an executable instead of a library
-    3) Raise RuntimeError if we find nothing
-
-    Set find_executable if you want to search for the directory with the
-    panda-system-[arch] binary instead of the libpanda-[arch].so library.
+    Find build directory (i.e., ~git/panda/build) containing the binaries we care about. If
+    find_executable is False, we're looking for [arch]-softmmu/libpanda-[arch].so. If
+    find_executable is True, we're looking for [arch]-softmmu/panda-system-[arhc]
+
+    We do this by searching paths in the following order:
+        1) Check relative to file (in the case of installed packages)
+        2) Check in../ ../../../build/
+        2) Search path if user is looking for an executable instead of a library
+        3) Raise RuntimeError if we find nothing
+
+    If arch_name is none, we'll search for any supported architecture and return the first
+    one we find.
     '''
     arches = ['i386', 'x86_64', 'arm', 'aarch64', 'ppc', 'mips', 'mipsel', 'mips64']
 

From 29cd8efcc7bab4ad0c2916a086d25554e2decc25 Mon Sep 17 00:00:00 2001
From: Andrew Fasano <fasano@mit.edu>
Date: Wed, 14 Sep 2022 12:12:43 -0400
Subject: [PATCH 095/140] pandare/qcows bugfix for path resolution

---
 panda/python/core/pandare/qcows.py |  4 ++--
 panda/python/core/pandare/utils.py | 12 ++++++++----
 2 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/panda/python/core/pandare/qcows.py b/panda/python/core/pandare/qcows.py
index 20e080e114a..b482b215ae5 100644
--- a/panda/python/core/pandare/qcows.py
+++ b/panda/python/core/pandare/qcows.py
@@ -71,8 +71,8 @@ def cli(target):
         # But if they just want to download/delete files and we find another arch
         # we can fetch/delete the files print a warning about how the generatd command won't work.
 
-        build_dir = Qcows_cli._find_build_dir(arch)
-        panda_args = [path.join(build_dir, f"{arch}-softmmu/panda-system-{arch}")]
+        build_dir = Qcows_cli._find_build_dir(arch) # will set find_executable
+        panda_args = [path.join(build_dir, f"panda-system-{arch}")]
         biospath = path.realpath(path.join(build_dir, "pc-bios"))
         panda_args.extend(["-L", biospath])
         panda_args.extend(["-os", q.os])
diff --git a/panda/python/core/pandare/utils.py b/panda/python/core/pandare/utils.py
index 39631b59991..508e7a8d9ea 100644
--- a/panda/python/core/pandare/utils.py
+++ b/panda/python/core/pandare/utils.py
@@ -163,8 +163,11 @@ def _find_build_dir(arch_name, find_executable=False):
 
     for potential_path in pot_paths:
         if isfile(pjoin(potential_path, file_name)):
-            # potential_path may contain [arch]-softmmu, if so remove it
-            potential_path = potential_path.replace(arch_dir, "")
+            if not find_executable:
+                # potential_path may contain [arch]-softmmu/ which
+                # we shouldn't return unless we're looking for an executable's
+                # build dir
+                potential_path = potential_path.replace(arch_dir, "")
             return potential_path
 
     searched_paths = "\n".join(["\t"+p for p in  pot_paths])
@@ -175,9 +178,10 @@ def _find_build_dir(arch_name, find_executable=False):
 
 def find_build_dir(arch_name=None, find_executable=False):
     '''
-    Find build directory (i.e., ~git/panda/build) containing the binaries we care about. If
+    Find directory containing the binaries we care about (i.e., ~git/panda/build). If
     find_executable is False, we're looking for [arch]-softmmu/libpanda-[arch].so. If
-    find_executable is True, we're looking for [arch]-softmmu/panda-system-[arhc]
+    find_executable is True, we're looking for [arch]-softmmu/panda-system-[arch] and we'll return
+    the parent dir of the executable (i.e., ~/git/panda/build/x86_64-softmmu/)
 
     We do this by searching paths in the following order:
         1) Check relative to file (in the case of installed packages)

From 346c2be274dfbe5f5a417ac36feb2fbc6c796dc9 Mon Sep 17 00:00:00 2001
From: Andrew Fasano <fasano@mit.edu>
Date: Wed, 14 Sep 2022 15:30:02 -0400
Subject: [PATCH 096/140] Syscalls_loger: print inline errors to stdout to
 improve usability with pipes

---
 panda/plugins/syscalls_logger/syscalls_logger.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/panda/plugins/syscalls_logger/syscalls_logger.cpp b/panda/plugins/syscalls_logger/syscalls_logger.cpp
index fbe90a2f4f7..babc4eeec27 100644
--- a/panda/plugins/syscalls_logger/syscalls_logger.cpp
+++ b/panda/plugins/syscalls_logger/syscalls_logger.cpp
@@ -729,7 +729,7 @@ void log_argument(CPUState* cpu, const syscall_info_t *call, int i, Panda__Named
                     sa->ptr = (uint64_t)ptr_val;
                     sa->has_ptr = true;
                 }else{
-                    std::cerr << "(struct pointer error)";
+                    std::cout << "(struct pointer error)";
                 }
             }
 

From 60d9f21a927367186ffa6112699c22da24d1be10 Mon Sep 17 00:00:00 2001
From: Andrew Fasano <fasano@mit.edu>
Date: Wed, 14 Sep 2022 15:33:28 -0400
Subject: [PATCH 097/140] syscalls_logger: long on start of sleep so we can
 report long sleeps

---
 panda/plugins/syscalls_logger/syscalls_logger.cpp | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/panda/plugins/syscalls_logger/syscalls_logger.cpp b/panda/plugins/syscalls_logger/syscalls_logger.cpp
index babc4eeec27..5166caf592b 100644
--- a/panda/plugins/syscalls_logger/syscalls_logger.cpp
+++ b/panda/plugins/syscalls_logger/syscalls_logger.cpp
@@ -1168,8 +1168,10 @@ void sys_enter(CPUState *cpu, target_ulong pc, const syscall_info_t *call, const
     // NOTE: if these syscalls fail, we'll initially record them (on enter) with a retval of 0
     // but we'll then also record them again (on return) with the actual retval.
     // In the non failure case, they never return and are only captured once.
+    // nanosleep/clock_nanosleep are special exceptions: we'll just print those twice, otherwise we often miss it on return
     if(strcmp(call->name, "sys_exit") == 0 || strcmp(call->name, "sys_exit_group") == 0 ||
-        strcmp(call->name, "sys_execve") == 0 || strcmp(call->name, "sys_execveat") == 0) {
+       strcmp(call->name, "sys_execve") == 0 || strcmp(call->name, "sys_execveat") == 0 ||
+       strcmp(call->name, "sys_nanosleep") == 0 || strcmp(call->name, "sys_clock_nanosleep") == 0) {
     handle_syscall(cpu, pc, call, rp, false);
   }
 }

From a31db0e33b1eecc16897c98c4c809554171b26ac Mon Sep 17 00:00:00 2001
From: Andrew Fasano <fasano@mit.edu>
Date: Thu, 15 Sep 2022 15:16:05 -0400
Subject: [PATCH 098/140] Fix race condition when started with -replay and
 -loadvm

Previously we would non-deterministically load the replay starting
state or the snapshot first and and replays would diverge if the
snapshot was loaded second.

Now we print a warning when we get both of these arguments and ignore
the argument passed to loadvm.
---
 vl.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/vl.c b/vl.c
index cec8235a2c5..4052b5b8b4d 100644
--- a/vl.c
+++ b/vl.c
@@ -5035,7 +5035,9 @@ int main_aux(int argc, char **argv, char **envp, PandaMainMode pmm)
     if (replay_mode != REPLAY_MODE_NONE) {
         replay_vmstate_init();
     } else if (loadvm) {
-        if (load_vmstate(loadvm) < 0) {
+        if (replay_name) {
+          fprintf(stderr, "Ignoring request to loadvm since we're in replay mode\n");
+        } else if (load_vmstate(loadvm) < 0) {
             autostart = 0;
         }
     }

From 1217e9493e60cbe0173d8c38c57f71e6085148de Mon Sep 17 00:00:00 2001
From: Zak Estrada <zestrada@users.noreply.github.com>
Date: Thu, 15 Sep 2022 21:00:20 -0400
Subject: [PATCH 099/140] panda_*_memory_write now raises an exception in
 PyPANDA (#1211)

---
 panda/python/core/pandare/arch.py    |   3 +-
 panda/python/core/pandare/panda.py   |  20 +++--
 panda/python/tests/enabled_tests.txt |   1 +
 panda/python/tests/memory_tests.py   | 111 +++++++++++++++++++++++++++
 4 files changed, 127 insertions(+), 8 deletions(-)
 create mode 100755 panda/python/tests/memory_tests.py

diff --git a/panda/python/core/pandare/arch.py b/panda/python/core/pandare/arch.py
index 6b48ed43420..3533aa81c60 100644
--- a/panda/python/core/pandare/arch.py
+++ b/panda/python/core/pandare/arch.py
@@ -199,8 +199,7 @@ def _write_stack(self, cpu, argloc, val):
         stack_idx = int(argloc.split("stack_")[1])
         stack_base = self.get_reg(cpu, self.reg_sp)
         offset = reg_sz * (stack_idx+1)
-        if self.panda.virtual_memory_write(cpu, stack_base + offset, val):
-            raise ValueError
+        self.panda.virtual_memory_write(cpu, stack_base + offset, val)
 
     def _read_stack(self, cpu, argloc):
         '''
diff --git a/panda/python/core/pandare/panda.py b/panda/python/core/pandare/panda.py
index 77902cbad0a..e035e575844 100755
--- a/panda/python/core/pandare/panda.py
+++ b/panda/python/core/pandare/panda.py
@@ -835,9 +835,12 @@ def physical_memory_write(self, addr, buf):
             buf (bytestring):  byte string to write into memory
 
         Returns:
-            bool: error
+            None
+
+        Raises:
+            ValueError if the call to panda.physical_memory_write fails (e.g., if you pass a pointer to an invalid memory region)
         '''
-        return self._memory_write(None, addr, buf, physical=True)
+        self._memory_write(None, addr, buf, physical=True)
 
     def virtual_memory_write(self, cpu, addr, buf):
         '''
@@ -849,10 +852,12 @@ def virtual_memory_write(self, cpu, addr, buf):
             buf (bytestr): byte string to write into memory
 
         Returns:
-            bool: error
+            None
 
+        Raises:
+            ValueError if the call to panda.virtual_memory_write fails (e.g., if you pass a pointer to an unmapped page)
         '''
-        return self._memory_write(cpu, addr, buf, physical=False)
+        self._memory_write(cpu, addr, buf, physical=False)
 
     def _memory_write(self, cpu, addr, buf, physical=False):
         '''
@@ -867,9 +872,12 @@ def _memory_write(self, cpu, addr, buf, physical=False):
             self.enable_memcb()
 
         if physical:
-            return self.libpanda.panda_physical_memory_write_external(addr, buf_a, length_a)
+            err = self.libpanda.panda_physical_memory_write_external(addr, buf_a, length_a)
         else:
-            return self.libpanda.panda_virtual_memory_write_external(cpu, addr, buf_a, length_a)
+            err = self.libpanda.panda_virtual_memory_write_external(cpu, addr, buf_a, length_a)
+
+        if err < 0:
+            raise ValueError(f"Memory write failed with err={err}") # TODO: make a PANDA Exn class
 
     def callstack_callers(self, lim, cpu): # XXX move into new directory, 'callstack' ?
         '''
diff --git a/panda/python/tests/enabled_tests.txt b/panda/python/tests/enabled_tests.txt
index a2ffcf176b4..2aea3394332 100644
--- a/panda/python/tests/enabled_tests.txt
+++ b/panda/python/tests/enabled_tests.txt
@@ -1,5 +1,6 @@
 file_fake.py
 file_hook.py
+memory_tests.py
 monitor_cmds.py
 multi_proc_cbs.py
 sleep_in_cb.py
diff --git a/panda/python/tests/memory_tests.py b/panda/python/tests/memory_tests.py
new file mode 100755
index 00000000000..c372282b2a4
--- /dev/null
+++ b/panda/python/tests/memory_tests.py
@@ -0,0 +1,111 @@
+#!/usr/bin/env python3
+
+#REMOVE FOR COMMIT vv
+import sys
+sys.path.insert(1, '/out/panda/panda/panda/python/core')
+#REMOVE FOR COMMIT ^^
+
+from pandare import Panda
+from sys import argv
+
+#Tests for memory_read/memory_write functions
+#There are many implicit uses of those functions in this code as well
+
+arch = argv[1] if len(argv) > 1 else "i386"
+panda = Panda(generic=arch)
+
+virt_mem_write=False
+virt_mem_read=False
+virt_mem_write_bad=False
+virt_mem_read_bad=False
+phys_mem_write=False
+phys_mem_read=False
+
+@panda.ppp("syscalls2", "on_sys_write_enter")
+def on_sys_write(cpu, pc, fd, buf, count):
+    global virt_mem_write
+    global virt_mem_read
+    global virt_mem_write_bad
+    global virt_mem_read_bad
+    global phys_mem_write
+    global phys_mem_read
+
+    proc = panda.plugins['osi'].get_current_process(cpu)
+    if b'ls' not in panda.ffi.string(proc.name):
+        return
+
+    try:
+        b = panda.virtual_memory_read(cpu, buf, count)
+        s = b.decode('utf8')
+    except ValueError:
+        print("Failed to read virtual memory at 0x{buf:x}")
+        return
+
+    if "root" in s:
+        #Assumes image has a /root and not a /woot
+        virt_mem_read = True
+        s = s.replace("root", "woot")
+        try:
+            panda.virtual_memory_write(cpu, buf, s.encode())
+            b = panda.virtual_memory_read(cpu, buf, count)
+            if "woot" in b.decode('utf8'):
+                virt_mem_write = True
+
+        except ValueError:
+            print("Failed to write virtual memory at 0x{buf:x}")
+            return
+
+        phys_addr = panda.virt_to_phys(cpu, buf)
+         
+        try:
+            b = panda.physical_memory_read(phys_addr, count)
+            s = b.decode('utf8')
+        except ValueError:
+            print("Failed to read physical memory at 0x{phys_addr:x}")
+            return
+
+        #The value we wrote should be present
+        if "woot" in s:
+            phys_mem_read = True
+            s = s.replace("woot", "root")
+            try:
+                panda.physical_memory_write(phys_addr, s.encode())
+                b = panda.physical_memory_read(phys_addr, count)
+                if "woot" not in b.decode('utf8'):
+                    phys_mem_write = True
+
+            except ValueError:
+                print("Failed to write physical memory at 0x{phys_addr:x}")
+                return
+
+        #Now try bad accesses and look for appropriate exceptions
+        *_, last_mapping = panda.get_mappings(cpu) 
+        bad_virt_addr = last_mapping.base + last_mapping.size + 4096
+
+        try:
+            b = panda.virtual_memory_read(cpu, bad_virt_addr, 1)
+        except ValueError:
+            virt_mem_read_bad = True
+
+        try:
+            panda.virtual_memory_write(cpu, bad_virt_addr, b'\x00')
+        except ValueError:
+            virt_mem_write_bad = True
+
+        panda.disable_ppp("on_sys_write")
+
+
+@panda.queue_blocking
+def driver():
+    print(panda.revert_sync("root"))
+    panda.run_serial_cmd("ls /")
+    panda.end_analysis()
+
+panda.run()
+
+assert(virt_mem_read), "Virtual memory read failed"
+assert(virt_mem_write), "Virtual memory write failed"
+assert(phys_mem_read), "Physical memory read failed"
+assert(phys_mem_write), "Physical memory write failed"
+assert(virt_mem_read_bad), "Bad virtual memory read failed to raise exception"
+assert(virt_mem_write_bad), "Bad virtual memory write failed to raise exception"

From 044ce717a1c146a4f00a8f96b81a252436c6c6a4 Mon Sep 17 00:00:00 2001
From: Luke Craig <lacraig3@gmail.com>
Date: Sun, 18 Sep 2022 22:41:03 -0400
Subject: [PATCH 100/140] fix docker CFFI + qcows no-hash move (#1216)

---
 Dockerfile                                  | 3 ++-
 panda/python/core/pandare/qcows_internal.py | 4 ++++
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/Dockerfile b/Dockerfile
index 02aba77027e..34a6e4ed5d7 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -9,7 +9,7 @@ ARG BASE_IMAGE
 
 # Copy dependencies lists into container. Note this
 #  will rarely change so caching should still work well
-COPY ./panda/dependencies/${BASE_IMAGE}*.txt /tmp/
+COPY ./panda/dependencies/${BASE_IMAGE}*.txt /tmp/ 
 
 # Base image just needs runtime dependencies
 RUN [ -e /tmp/${BASE_IMAGE}_base.txt ] && \
@@ -80,6 +80,7 @@ RUN  make -C /panda/build install
 # Install pypanda
 RUN cd /panda/panda/python/core && \
     python3 setup.py install
+RUN python3 -m pip install --ignore-install pycparser && python3 -m pip install --force-reinstall --no-binary :all: cffi
 
 ### Copy files for panda+pypanda from installer  - Stage 5
 FROM base as panda
diff --git a/panda/python/core/pandare/qcows_internal.py b/panda/python/core/pandare/qcows_internal.py
index d68003482a7..b319be9d046 100644
--- a/panda/python/core/pandare/qcows_internal.py
+++ b/panda/python/core/pandare/qcows_internal.py
@@ -347,6 +347,10 @@ def get_file(urls, output_path, sha1hash=None, do_retry=True, _is_tty=True):
                     raise ValueError(f"{url} has hash {computed_hash} vs expected hash {sha1hash}")
                 # Hash matches, move .tmp file to actual path
                 move(output_path+".tmp", output_path)
+            else:
+                # No hash, move .tmp file to actual path
+                move(output_path+".tmp", output_path)
+                
 
         except Exception as e:
             logger.info("Download failed, deleting partial file: %s", output_path)

From 2c146cf47b69e3591399ffb19d5b3fcb4d99280b Mon Sep 17 00:00:00 2001
From: Luke Craig <lacraig3@gmail.com>
Date: Sun, 18 Sep 2022 23:19:04 -0400
Subject: [PATCH 101/140] Fix leftover space (#1217)

* fix some stuff

* remove space

From 3b393968b8e81786008fa35adf03beaca9354b2e Mon Sep 17 00:00:00 2001
From: christopher-nguyen-re <chris.nguyen2578@gmail.com>
Date: Mon, 19 Sep 2022 17:40:39 -0400
Subject: [PATCH 102/140] Fix typos in qcows.py

---
 panda/python/core/pandare/qcows.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/panda/python/core/pandare/qcows.py b/panda/python/core/pandare/qcows.py
index b482b215ae5..ac3fac6cabc 100644
--- a/panda/python/core/pandare/qcows.py
+++ b/panda/python/core/pandare/qcows.py
@@ -4,7 +4,7 @@
 fetch files necessary to run various generic VMs and generate command lines to start them.
 Also supports deleting previously-fetched files.
 
-Most of the interesting logic fot his is contained in qcows_internal.py
+Most of the interesting logic for this is contained in qcows_internal.py.
 '''
 
 from os import path, remove
@@ -99,7 +99,7 @@ def cli(target):
         if "-display none" in ret:
             ret = ret.replace("-display none", "-nographic")
 
-        # Repalce /home/username with ~ when we can (TTYs)
+        # Replace /home/username with ~ when we can (TTYs)
         if stdout.isatty() and 'HOME' in environ:
             ret = ret.replace(environ['HOME'], '~')
         return ret

From f5ec376a7bac63acaa956ee5aa0b47be1a00b485 Mon Sep 17 00:00:00 2001
From: christopher-nguyen-re <chris.nguyen2578@gmail.com>
Date: Mon, 19 Sep 2022 17:54:08 -0400
Subject: [PATCH 103/140] Minor changes to documentation

---
 panda/python/core/pandare/arch.py                  | 14 +++++++-------
 panda/python/core/pandare/asyncthread.py           |  4 ++--
 panda/python/core/pandare/panda.py                 |  2 +-
 .../python/core/pandare/volatility_cli_classes.py  |  2 +-
 4 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/panda/python/core/pandare/arch.py b/panda/python/core/pandare/arch.py
index 3533aa81c60..19245910ef0 100644
--- a/panda/python/core/pandare/arch.py
+++ b/panda/python/core/pandare/arch.py
@@ -1,7 +1,7 @@
 '''
 This module contains architecture-specific code.
 
-When the `pandare.panda` class is initialized it will automatically
+When the `pandare.panda` class is initialized, it will automatically
 initialize a PandaArch class for the specified architecture in the variable
 `panda.arch`.
 
@@ -349,7 +349,7 @@ def get_return_value(self, cpu):
 
     def get_return_address(self, cpu):
         '''
-        looks up where ret will go
+        Looks up where ret will go
         '''
         return self.get_reg(cpu, "LR")
 
@@ -384,7 +384,7 @@ def __init__(self, panda):
     def get_pc(self, cpu):
         '''
         Overloaded function to get aarch64 program counter.
-        Note the PC is not stored in a general purpose reg
+        Note the PC is not stored in a general purpose register.
         '''
         return cpu.env_ptr.pc
 
@@ -419,7 +419,7 @@ def get_return_value(self, cpu):
 
     def get_return_address(self, cpu):
         '''
-        looks up where ret will go
+        Looks up where ret will go
         '''
         return self.get_reg(cpu, "LR")
 
@@ -528,10 +528,10 @@ def set_retval(self, cpu, val, convention='default', failure=False):
         '''
         Overloaded function so when convention is syscall, user can control
         the A3 register (which indicates syscall success/failure) in addition
-        to syscall return value.
+        to the syscall return value.
 
-        When convention == 'syscall', failure = False means A3 will bet set to 0,
-        otherwise it will be set to 1
+        When convention == 'syscall', failure = False means A3 will bet set to 0.
+        Otherwise, it will be set to 1
 
         '''
         if convention == 'syscall':
diff --git a/panda/python/core/pandare/asyncthread.py b/panda/python/core/pandare/asyncthread.py
index dcf6fc84158..ed947505c4f 100644
--- a/panda/python/core/pandare/asyncthread.py
+++ b/panda/python/core/pandare/asyncthread.py
@@ -1,6 +1,6 @@
 """
-Internal module to run a thread in parallel to QEMU's main cpu loop.
-Enables queuing up python functions from main thread and vice versa
+This is an internal module to run a thread in parallel to QEMU's main cpu loop.
+It enables queuing up python functions from main thread and vice versa.
 """
 
 import threading
diff --git a/panda/python/core/pandare/panda.py b/panda/python/core/pandare/panda.py
index e035e575844..d8c2395cdf9 100755
--- a/panda/python/core/pandare/panda.py
+++ b/panda/python/core/pandare/panda.py
@@ -1,5 +1,5 @@
 """
-This module simply contains the Panda class
+This module simply contains the Panda class.
 """
 
 from sys import version_info, exit
diff --git a/panda/python/core/pandare/volatility_cli_classes.py b/panda/python/core/pandare/volatility_cli_classes.py
index f86926603d5..79312282653 100644
--- a/panda/python/core/pandare/volatility_cli_classes.py
+++ b/panda/python/core/pandare/volatility_cli_classes.py
@@ -1,5 +1,5 @@
 """
-Second method of interacting with volatility via their CLI options. Less preferred. Highly experimental.
+Second method of interacting with volatility via their CLI options. This is less preferred and highly experimental.
 """
 
 

From d70b58b203d5d7ac70a15304280780d399affdb0 Mon Sep 17 00:00:00 2001
From: Andrew Fasano <fasano@mit.edu>
Date: Wed, 28 Sep 2022 15:54:30 -0400
Subject: [PATCH 104/140] pypanda: Bugfix, ensure pc-bios/keymaps directory is
 installed

---
 panda/python/core/setup.py | 1 +
 1 file changed, 1 insertion(+)

diff --git a/panda/python/core/setup.py b/panda/python/core/setup.py
index 602d05d4de9..a4cecede530 100644
--- a/panda/python/core/setup.py
+++ b/panda/python/core/setup.py
@@ -165,6 +165,7 @@ def run(self):
           'data/*-softmmu/panda/plugins/**/*',# All plugin files
           'data/pypanda/include/*.h',         # Includes files
           'data/pc-bios/*',                   # BIOSes
+          'data/pc-bios/**/*',                # Keymaps
           ]},
       install_requires=[ 'cffi>=1.14.3', 'colorama', 'protobuf=='+pc_version],
       python_requires='>=3.6',

From 098b77e7239e2abf90704c684daa0491f3c1b868 Mon Sep 17 00:00:00 2001
From: Luke Craig <lacraig3@gmail.com>
Date: Wed, 5 Oct 2022 14:28:19 -0400
Subject: [PATCH 105/140] MIPS Hypercalls (#1223)

* adding to helpers; fixing def;

* add less privileged instruction
---
 panda/include/panda/callbacks/cb-helper-defs.h | 2 +-
 panda/include/panda/callbacks/cb-helper-impl.h | 2 +-
 target/mips/translate.c                        | 2 ++
 3 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/panda/include/panda/callbacks/cb-helper-defs.h b/panda/include/panda/callbacks/cb-helper-defs.h
index dbc2b89a97d..948e5f8f16c 100644
--- a/panda/include/panda/callbacks/cb-helper-defs.h
+++ b/panda/include/panda/callbacks/cb-helper-defs.h
@@ -14,6 +14,6 @@ PANDAENDCOMMENT */
 DEF_HELPER_1(panda_insn_exec, void, tl)
 DEF_HELPER_1(panda_after_insn_exec, void, tl)
 
-#if defined(TARGET_ARM)
+#if defined(TARGET_ARM) || defined(TARGET_MIPS)
 DEF_HELPER_1(panda_guest_hypercall, void, env)
 #endif
diff --git a/panda/include/panda/callbacks/cb-helper-impl.h b/panda/include/panda/callbacks/cb-helper-impl.h
index 2e2c40dd20f..28587d01eac 100644
--- a/panda/include/panda/callbacks/cb-helper-impl.h
+++ b/panda/include/panda/callbacks/cb-helper-impl.h
@@ -35,7 +35,7 @@ void HELPER(panda_after_insn_exec)(target_ulong pc) {
     }
 }
 
-#if defined(TARGET_ARM)
+#if defined(TARGET_ARM) || defined(TARGET_MIPS)
 void HELPER(panda_guest_hypercall)(CPUArchState *cpu_env) {
     panda_callbacks_guest_hypercall(ENV_GET_CPU(cpu_env));
 }
diff --git a/target/mips/translate.c b/target/mips/translate.c
index 0110049a1f5..c2b4a93ae82 100644
--- a/target/mips/translate.c
+++ b/target/mips/translate.c
@@ -2846,6 +2846,7 @@ static void gen_cond_move(DisasContext *ctx, uint32_t opc,
 
     if (rd == 0) {
         /* If no destination, treat it as a NOP. */
+        gen_helper_panda_guest_hypercall(cpu_env);
         return;
     }
 
@@ -8050,6 +8051,7 @@ static void gen_cp0 (CPUMIPSState *env, DisasContext *ctx, uint32_t opc, int rt,
     case OPC_MFC0:
         if (rt == 0) {
             /* Treat as NOP. */
+            gen_helper_panda_guest_hypercall(cpu_env);
             return;
         }
         gen_mfc0(ctx, cpu_gpr[rt], rd, ctx->opcode & 0x7);

From 6d057aac1498bba43a84aa3d94e3999f69b30425 Mon Sep 17 00:00:00 2001
From: Zak Estrada <zachary.estrada@ll.mit.edu>
Date: Tue, 4 Oct 2022 18:37:57 -0400
Subject: [PATCH 106/140] Added linux_kernel calling convention to PyPANDA

---
 panda/python/core/pandare/arch.py | 23 +++++++++++++++++------
 1 file changed, 17 insertions(+), 6 deletions(-)

diff --git a/panda/python/core/pandare/arch.py b/panda/python/core/pandare/arch.py
index 19245910ef0..f38c0c3d9c7 100644
--- a/panda/python/core/pandare/arch.py
+++ b/panda/python/core/pandare/arch.py
@@ -324,9 +324,11 @@ def __init__(self, panda):
                                  "syscall": ["R7", "R0", "R1", "R2", "R3", "R4", "R5"], # EABI
                                  }
         self.call_conventions['default'] = self.call_conventions['arm32']
+        self.call_conventions['linux_kernel'] = self.call_conventions['arm32']
 
         self.reg_retval = {"default":    "R0",
-                           "syscall":    "R0"}
+                           "syscall":    "R0",
+                           "linux_kernel":    "R0"}
         self.reg_pc = regnames.index("IP")
 
     def _get_reg_val(self, cpu, reg):
@@ -377,9 +379,11 @@ def __init__(self, panda):
         self.call_conventions = {"arm64":         ["X0", "X1", "X2", "X3", "X4", "X5", "X6", "X7"],
                                  "syscall": ["XR", "X0", "X1", "X2", "X3", "X4", "X5", "X6", "X7"]}
         self.call_conventions['default'] = self.call_conventions['arm64']
+        self.call_conventions['linux_kernel'] = self.call_conventions['arm64']
 
         self.reg_retval = {"default":    "X0",
-                           "syscall":    "X0"}
+                           "syscall":    "X0",
+                           "linux_kernel":    "X0"}
 
     def get_pc(self, cpu):
         '''
@@ -458,9 +462,11 @@ def __init__(self, panda):
         self.call_conventions = {"mips":          ["A0", "A1", "A2", "A3"],
                 "syscall": ["V0", "A0", "A1", "A2", "A3", "stack_3", "stack_4", "stack_5", "stack_6"]} # XXX: Note it's not 0-indexed for stack args, I guess the syscall pushes stuff too
         self.call_conventions['default'] = self.call_conventions['mips']
+        self.call_conventions['linux_kernel'] = self.call_conventions['mips']
 
         self.reg_retval =  {"default":    "V0",
-                            "syscall":    'V0'}
+                            "syscall":    'V0',
+                            "linux_kernel":    'V0'}
 
 
         # note names must be stored uppercase for get/set reg to work case-insensitively
@@ -564,6 +570,7 @@ def __init__(self, panda):
         self.call_conventions = {"mips":          ["A0", "A1", "A2", "A3"], # XXX Unsure?
                                  "syscall": ["V0", "A0", "A1", "A2", "A3", "A4", "A5"]}
         self.call_conventions['default'] = self.call_conventions['mips']
+        self.call_conventions['linux_kernel'] = self.call_conventions['mips']
 
         self.reg_retval =  {"default":    "V0",
                             "syscall":    'V0'}
@@ -585,10 +592,12 @@ def __init__(self, panda):
         # Note we don't set self.call_conventions because stack-based arg get/set is
         # not yet supported
         self.reg_retval = {"default":    "EAX",
-                           "syscall":    "EAX"}
+                           "syscall":    "EAX",
+                           "linux_kernel":    "EAX"}
         
         self.call_conventions = {"cdecl": ["stack_{x}" for x in range(20)], # 20: arbitrary but big
-                                 "syscall": ["EAX", "EBX", "ECX", "EDX", "ESI", "EDI", "EBP"]}
+                                 "syscall": ["EAX", "EBX", "ECX", "EDX", "ESI", "EDI", "EBP"],
+                                 "linux_kernel": ["EAX", "EDX", "ECX", "stack_3", "stack_4", "stack_5", "stack_6"]}
         self.call_conventions['default'] = self.call_conventions['cdecl']
 
         self.reg_sp = regnames.index('ESP')
@@ -648,10 +657,12 @@ def __init__(self, panda):
                                  'syscall': ['RAX', 'RDI', 'RSI', 'RDX', 'R10', 'R8', 'R9']}
 
         self.call_conventions['default'] = self.call_conventions['sysv']
+        self.call_conventions['linux_kernel'] = self.call_conventions['sysv']
 
         self.reg_sp = regnames.index('RSP')
         self.reg_retval = {'sysv': 'RAX',
-                           'syscall': 'RAX'}
+                           'syscall': 'RAX',
+                           'linux_kernel': 'RAX'}
         self.reg_retval['default'] = self.reg_retval['sysv']
 
         self.registers = {regnames[idx]: idx for idx in range(len(regnames)) }

From 2cafe77c1f6fdef7b34d1e66039a966ecb892e13 Mon Sep 17 00:00:00 2001
From: Zak Estrada <zestrada@users.noreply.github.com>
Date: Fri, 14 Oct 2022 13:50:16 -0400
Subject: [PATCH 107/140] Add hook_symbol_resolution to PyPANDA (#1210)

---
 panda/python/core/pandare/panda.py | 62 ++++++++++++++++++++++++++++++
 panda/python/tests/dyn_hooks.py    | 20 +++++++++-
 2 files changed, 81 insertions(+), 1 deletion(-)

diff --git a/panda/python/core/pandare/panda.py b/panda/python/core/pandare/panda.py
index d8c2395cdf9..53602fc61f3 100755
--- a/panda/python/core/pandare/panda.py
+++ b/panda/python/core/pandare/panda.py
@@ -225,6 +225,7 @@ def __init__(self, arch="i386", mem="128M",
         self.hook_list = []
         self.hook_list2 = {}
         self.mem_hooks = {}
+        self.sr_hooks = []
 
         # Asid stuff
         self.current_asid_name = None
@@ -2979,6 +2980,67 @@ def wrapper(*args, **kw):
             return wrapper
         return decorator
 
+    def hook_symbol_resolution(self, libraryname, symbol, name=None):
+        '''
+        Decorate a function to setup a hook: when a guest process resolves a symbol
+        the function will be called with args (CPUState, struct hook_symbol_resolve, struct symbol, OsiModule)
+
+        Args:
+            libraryname (string): Name of library containing symbol to be hooked. May be None to match any.
+            symbol (string, int): Name of symbol or offset into library to hook
+            name (string): name of hook, defaults to function name
+
+        Returns:
+            None: Decorated function is called when guest resolves the specified symbol in the specified library.
+        '''
+        #Mostly based on hook_symbol below
+        def decorator(fun):
+            sh = self.ffi.new("struct hook_symbol_resolve*")
+            sh.hook_offset = False
+            if symbol is not None:
+                if isinstance(symbol, int):
+                    sh.offset = symbol
+                    sh.hook_offset = True
+                    symbolname_ffi = self.ffi.new("char[]",bytes("\x00\x00\x00\x00","utf-8"))
+                else:
+                    symbolname_ffi = self.ffi.new("char[]",bytes(symbol,"utf-8"))
+            else:
+                symbolname_ffi = self.ffi.new("char[]",bytes("\x00\x00\x00\x00","utf-8"))
+            self.ffi.memmove(sh.name,symbolname_ffi,len(symbolname_ffi))
+
+            if libraryname is not None:
+                libname_ffi = self.ffi.new("char[]",bytes(libraryname,"utf-8"))
+            else:
+                libname_ffi = self.ffi.new("char[]",bytes("\x00\x00\x00\x00","utf-8"))
+            self.ffi.memmove(sh.section,libname_ffi,len(libname_ffi))
+
+            #sh.id #not used here
+            sh.enabled = True
+            def _run_and_catch(*args, **kwargs): # Run function but if it raises an exception, stop panda and raise it
+                if not hasattr(self, "exit_exception"):
+                    try:
+                        r = fun(*args, **kwargs)
+                        return r
+                    except Exception as e:
+                        # exceptions wont work in our thread. Therefore we print it here and then throw it after the
+                        # machine exits.
+                        if self.catch_exceptions:
+                            self.exit_exception = e
+                            self.end_analysis()
+                        else:
+                            raise e
+                        return None
+
+            sr_hook_cb_type = self.ffi.callback("void (CPUState *cpu, struct hook_symbol_resolve *sh, struct symbol s, OsiModule* m)")
+            sr_hook_cb_ptr = sr_hook_cb_type(_run_and_catch)
+            sh.cb = sr_hook_cb_ptr
+            hook_ptr = self.plugins['dynamic_symbols'].hook_symbol_resolution(sh)
+            self.sr_hooks.append((sh, sr_hook_cb_ptr, hook_ptr))
+
+            def wrapper(*args, **kw):
+                _run_and_catch(args,kw)
+            return wrapper
+        return decorator
 
     def hook_symbol(self, libraryname, symbol, kernel=False, name=None, cb_type="start_block_exec"):
         '''
diff --git a/panda/python/tests/dyn_hooks.py b/panda/python/tests/dyn_hooks.py
index 427cd3f9e14..78932668aa5 100644
--- a/panda/python/tests/dyn_hooks.py
+++ b/panda/python/tests/dyn_hooks.py
@@ -9,7 +9,7 @@
 else:
     program_name = "curl"
 
-command_str = f"{program_name} --no-check-certificate  http://www.ll.mit.edu/sites/default/files/styles/ifde_wysiwyg__floated/public/other/image/2018-04/New_Full_Logo-BLACK-2500-lissajou-only-square.png -O o.png"
+command_str = f"{program_name} http://www.ll.mit.edu/sites/default/files/styles/ifde_wysiwyg__floated/public/other/image/2018-04/New_Full_Logo-BLACK-2500-lissajou-only-square.png -O o.png"
 
 @panda.queue_blocking
 def driver():
@@ -18,9 +18,25 @@ def driver():
     print(panda.run_serial_cmd("ldd $(which grep)"))
     panda.end_analysis()
 
+malloc_resolved = False
+calloc_resolved = False
 malloc_ran = False
 calloc_ran = False
 
+@panda.hook_symbol_resolution(None, "calloc")
+def calloc_resolve(cpu, sh, s, m):
+    print(f"Calloc resolved to 0x{s.address:x}")
+    global calloc_resolved
+    calloc_resolved = True
+    sh.enabled = False # got result. no reason to continue
+
+@panda.hook_symbol_resolution(None, "malloc")
+def malloc_resolve(cpu, sh, s, m):
+    print(f"Malloc resolved to 0x{s.address:x}")
+    global malloc_resolved
+    malloc_resolved = True
+    sh.enabled = False # got result. no reason to continue
+
 @panda.hook_symbol(None, "calloc")
 def calloc(cpu, tb, h):
     print(f"Calloc hook running at 0x{tb.pc:x}")
@@ -37,5 +53,7 @@ def malloc(cpu, tb, h):
 
 panda.run()
 
+assert(malloc_resolved), "Malloc symbol resolution hook failed to trigger"
+assert(calloc_resolved), "Calloc symbol resolution hook failed to trigger"
 assert(malloc_ran), "Malloc hook failed to trigger"
 assert(calloc_ran), "Calloc hook failed to trigger"

From e3bb29b95055de3c7f5e9da60e97f0dbcc57e0d5 Mon Sep 17 00:00:00 2001
From: Luke Craig <lacraig3@gmail.com>
Date: Fri, 14 Oct 2022 13:42:21 -0400
Subject: [PATCH 108/140] provide means to expose rr_control.name to plugins
 (e.g. scissors)

---
 panda/include/panda/plugin.h | 1 +
 panda/src/callbacks.c        | 9 +++++++++
 vl.c                         | 4 ----
 vl.h                         | 2 --
 4 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/panda/include/panda/plugin.h b/panda/include/panda/plugin.h
index e2330623330..e3b79f895a9 100644
--- a/panda/include/panda/plugin.h
+++ b/panda/include/panda/plugin.h
@@ -113,6 +113,7 @@ uintptr_t panda_get_current_llvm_module(void);
 void panda_enable_tb_chaining(void);
 void panda_disable_tb_chaining(void);
 void panda_memsavep(FILE *f);
+char* panda_get_rr_name(void);
 
 // Struct for holding a parsed key/value pair from
 // a -panda-arg plugin:key=value style argument.
diff --git a/panda/src/callbacks.c b/panda/src/callbacks.c
index ff657a38e0a..58bdaa8f84c 100644
--- a/panda/src/callbacks.c
+++ b/panda/src/callbacks.c
@@ -996,6 +996,15 @@ int panda_replay_end(void) {
     return RRCTRL_OK;
 }
 
+/**
+ * @brief Return the name of the current PANDA record/replay
+ * 
+ * @return char* 
+ */
+char* panda_get_rr_name(void){
+    return rr_control.name;
+}
+
 // Parse out arguments and return them to caller
 static panda_arg_list *panda_get_args_internal(const char *plugin_name, bool check_only) {
     panda_arg_list *ret = NULL;
diff --git a/vl.c b/vl.c
index 4052b5b8b4d..35d68850ef3 100644
--- a/vl.c
+++ b/vl.c
@@ -3093,10 +3093,6 @@ void main_panda_run(void) {
     panda_in_main_loop = 0;
 }
 
-void set_replay_name(char *name) {
-    replay_name = name;
-}
-
 int main_aux(int argc, char **argv, char **envp, PandaMainMode pmm)
  {
     if (pmm == PANDA_RUN)    goto PANDA_MAIN_RUN;
diff --git a/vl.h b/vl.h
index 487b3d8ccce..df71b7f3ab0 100644
--- a/vl.h
+++ b/vl.h
@@ -17,6 +17,4 @@ void main_loop(void);
 
 int main_aux(int argc, char **argv, char **envp, PandaMainMode pmm);
 
-void set_replay_name(char *name);
-
 #endif

From 25251b42d9edf54c7772a6a61480510f625a05d5 Mon Sep 17 00:00:00 2001
From: Andrew Fasano <fasano@mit.edu>
Date: Tue, 11 Oct 2022 22:56:18 -0400
Subject: [PATCH 109/140] Minor updates to PyPluginManager's load_all func

Update documentation.
Return a list of classes loaded.
Don't try to load the base PyPlugin class.
---
 panda/python/core/pandare/pypluginmanager.py | 20 ++++++++++++++++----
 1 file changed, 16 insertions(+), 4 deletions(-)

diff --git a/panda/python/core/pandare/pypluginmanager.py b/panda/python/core/pandare/pypluginmanager.py
index 0ee184ff27a..e10f549a63a 100644
--- a/panda/python/core/pandare/pypluginmanager.py
+++ b/panda/python/core/pandare/pypluginmanager.py
@@ -173,7 +173,7 @@ def load(self, pluginclasses, args=None, template_dir=None):
 
         for pluginclass in pluginclasses:
             if not isinstance(pluginclass, type) or not issubclass(pluginclass, PyPlugin):
-                raise ValueError(f"pluginclass must be an uninstantiated subclass of PyPlugin")
+                raise ValueError(f"{pluginclass} must be an uninstantiated subclass of PyPlugin")
 
             # If PyPlugin is in scope it should not be treated as a plugin
             if pluginclass is PyPlugin:
@@ -207,8 +207,17 @@ def load(self, pluginclasses, args=None, template_dir=None):
 
     def load_all(self, plugin_file, args=None, template_dir=None):
         '''
-        Given a path to a python file, load every PyPlugin defind in that file by identifying
-        all classes that subclass PyPlugin and passing them to self.load()
+        Given a path to a python file, load every PyPlugin defined in that file
+        by identifying all classes that subclass PyPlugin and passing them to
+        self.load()
+
+        Args:
+            plugin_file (str): A path specifying a Python file from which PyPlugin classes should be loaded
+            args (dict): Optional. A dictionary of arguments to pass to the PyPlugin
+            template_dir (string): Optional. A directory for template files, passed through to `self.load`.
+
+        Returns:
+            String list of PyPlugin class names loaded from the plugin_file
         '''
         import inspect, importlib
         spec = importlib.util.spec_from_file_location("plugin_file", plugin_file)
@@ -219,11 +228,14 @@ def load_all(self, plugin_file, args=None, template_dir=None):
         module = importlib.util.module_from_spec(spec)
         spec.loader.exec_module(module)
 
+        names = []
         for name, cls in inspect.getmembers(module, lambda x: inspect.isclass(x)):
-            if not issubclass(cls, PyPlugin):
+            if not issubclass(cls, PyPlugin) or cls == PyPlugin:
                 continue
             cls.__name__ = name
             self.load(cls, args, template_dir)
+            names.append(name)
+        return names
 
     def unload(self, pluginclass, do_del=True):
         if isinstance(pluginclass, str):

From b31862ac0ed4713ad05ef77f2b164a3f6faa0853 Mon Sep 17 00:00:00 2001
From: Andrew Fasano <fasano@mit.edu>
Date: Tue, 11 Oct 2022 23:23:26 -0400
Subject: [PATCH 110/140] pandare/pyplugins Fix doccumentation error

---
 panda/docs/pyplugins.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/panda/docs/pyplugins.md b/panda/docs/pyplugins.md
index 9328279d6b0..306f415135e 100644
--- a/panda/docs/pyplugins.md
+++ b/panda/docs/pyplugins.md
@@ -100,7 +100,7 @@ class Consumer(PyPlugin):
     '''
     def __init__(self, panda):
         self.ppp.Server.ppp_reg_cb('some_f', self.my_f)
-        print(f"Calling Server's do_add(1): ", self.call_ppp('Server', 'do_add', 1))
+        print(f"Calling Server's do_add(1): ", self.ppp.Server.do_add(1))
 
     def my_f(self, arg):
         print("Consumer my_f runs with arg:", hex(arg))

From 187559d647545bfab92f1c92f7301bc971604668 Mon Sep 17 00:00:00 2001
From: Andrew Fasano <fasano@mit.edu>
Date: Tue, 11 Oct 2022 23:24:14 -0400
Subject: [PATCH 111/140] pandare/pyplugins: register exported PPP functions
 before init runs

This allows a PyPlugin to export a function and load another PyPlugin
that uses this exported function in its init method. Previously, the
2nd loaded plugin couldn't see the exported function.
---
 panda/python/core/pandare/pypluginmanager.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/panda/python/core/pandare/pypluginmanager.py b/panda/python/core/pandare/pypluginmanager.py
index e10f549a63a..8ac4a415af0 100644
--- a/panda/python/core/pandare/pypluginmanager.py
+++ b/panda/python/core/pandare/pypluginmanager.py
@@ -183,8 +183,8 @@ def load(self, pluginclasses, args=None, template_dir=None):
 
             self.plugins[name] = pluginclass.__new__(pluginclass)
             self.plugins[name].__preinit__(self, args)
-            self.plugins[name].__init__(self.panda)
             self.get_ppp_funcs(self.plugins[name])
+            self.plugins[name].__init__(self.panda)
 
             # Setup webserver if necessary
             if self.flask and hasattr(self.plugins[name], 'webserver_init') and \

From 83e141ab609f642fe00503686b7d77361dd91ff7 Mon Sep 17 00:00:00 2001
From: Andrew Fasano <fasano@mit.edu>
Date: Fri, 14 Oct 2022 16:46:36 -0400
Subject: [PATCH 112/140] Support multiple serial devices for arm virt machine

Based off code by LastRitter available at https://unix.stackexchange.com/a/549798
---
 hw/arm/virt-acpi-build.c | 27 +++++++++++++++++++++------
 hw/arm/virt.c            | 26 ++++++++++++++++++++------
 include/hw/arm/virt.h    |  5 ++++-
 include/sysemu/sysemu.h  |  2 +-
 4 files changed, 46 insertions(+), 14 deletions(-)

diff --git a/hw/arm/virt-acpi-build.c b/hw/arm/virt-acpi-build.c
index 0835e59bb2e..23f645e31e6 100644
--- a/hw/arm/virt-acpi-build.c
+++ b/hw/arm/virt-acpi-build.c
@@ -448,11 +448,11 @@ build_iort(GArray *table_data, BIOSLinker *linker)
 }
 
 static void
-build_spcr(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)
+build_spcr(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms, int uart)
 {
     AcpiSerialPortConsoleRedirection *spcr;
-    const MemMapEntry *uart_memmap = &vms->memmap[VIRT_UART];
-    int irq = vms->irqmap[VIRT_UART] + ARM_SPI_BASE;
+    const MemMapEntry *uart_memmap = &vms->memmap[uart];
+    int irq = vms->irqmap[uart] + ARM_SPI_BASE;
 
     spcr = acpi_data_push(table_data, sizeof(*spcr));
 
@@ -711,8 +711,14 @@ build_dsdt(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)
      */
     scope = aml_scope("\\_SB");
     acpi_dsdt_add_cpus(scope, vms->smp_cpus);
-    acpi_dsdt_add_uart(scope, &memmap[VIRT_UART],
-                       (irqmap[VIRT_UART] + ARM_SPI_BASE));
+    acpi_dsdt_add_uart(scope, &memmap[VIRT_UART0],
+                       (irqmap[VIRT_UART0] + ARM_SPI_BASE));
+    acpi_dsdt_add_uart(scope, &memmap[VIRT_UART1],
+                       (irqmap[VIRT_UART1] + ARM_SPI_BASE));
+    acpi_dsdt_add_uart(scope, &memmap[VIRT_UART2],
+                       (irqmap[VIRT_UART2] + ARM_SPI_BASE));
+    acpi_dsdt_add_uart(scope, &memmap[VIRT_UART3],
+                       (irqmap[VIRT_UART3] + ARM_SPI_BASE));
     acpi_dsdt_add_flash(scope, &memmap[VIRT_FLASH]);
     acpi_dsdt_add_fw_cfg(scope, &memmap[VIRT_FW_CFG]);
     acpi_dsdt_add_virtio(scope, &memmap[VIRT_MMIO],
@@ -776,7 +782,16 @@ void virt_acpi_build(VirtMachineState *vms, AcpiBuildTables *tables)
     build_mcfg(tables_blob, tables->linker, vms);
 
     acpi_add_table(table_offsets, tables_blob);
-    build_spcr(tables_blob, tables->linker, vms);
+    build_spcr(tables_blob, tables->linker, vms, VIRT_UART0);
+
+    acpi_add_table(table_offsets, tables_blob);
+    build_spcr(tables_blob, tables->linker, vms, VIRT_UART1);
+
+    acpi_add_table(table_offsets, tables_blob);
+    build_spcr(tables_blob, tables->linker, vms, VIRT_UART2);
+
+    acpi_add_table(table_offsets, tables_blob);
+    build_spcr(tables_blob, tables->linker, vms, VIRT_UART3);
 
     if (nb_numa_nodes > 0) {
         acpi_add_table(table_offsets, tables_blob);
diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index 5f62a0321e5..c34f4fcd9a7 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -134,11 +134,14 @@ static const MemMapEntry a15memmap[] = {
     [VIRT_GIC_ITS] =            { 0x08080000, 0x00020000 },
     /* This redistributor space allows up to 2*64kB*123 CPUs */
     [VIRT_GIC_REDIST] =         { 0x080A0000, 0x00F60000 },
-    [VIRT_UART] =               { 0x09000000, 0x00001000 },
+    [VIRT_UART0] =              { 0x09000000, 0x00001000 },
     [VIRT_RTC] =                { 0x09010000, 0x00001000 },
     [VIRT_FW_CFG] =             { 0x09020000, 0x00000018 },
     [VIRT_GPIO] =               { 0x09030000, 0x00001000 },
     [VIRT_SECURE_UART] =        { 0x09040000, 0x00001000 },
+    [VIRT_UART1] =              { 0x09080000, 0x00001000 },
+    [VIRT_UART2] =              { 0x09090000, 0x00001000 },
+    [VIRT_UART3] =              { 0x090a0000, 0x00001000 },
     [VIRT_MMIO] =               { 0x0a000000, 0x00000200 },
     /* ...repeating for a total of NUM_VIRTIO_TRANSPORTS, each of that size */
     [VIRT_PLATFORM_BUS] =       { 0x0c000000, 0x02000000 },
@@ -152,11 +155,14 @@ static const MemMapEntry a15memmap[] = {
 };
 
 static const int a15irqmap[] = {
-    [VIRT_UART] = 1,
+    [VIRT_UART0] = 1,
     [VIRT_RTC] = 2,
     [VIRT_PCIE] = 3, /* ... to 6 */
     [VIRT_GPIO] = 7,
     [VIRT_SECURE_UART] = 8,
+    [VIRT_UART1] = 9,
+    [VIRT_UART2] = 10,
+    [VIRT_UART3] = 11,
     [VIRT_MMIO] = 16, /* ...to 16 + NUM_VIRTIO_TRANSPORTS - 1 */
     [VIRT_GIC_V2M] = 48, /* ...to 48 + NUM_GICV2M_SPIS - 1 */
     [VIRT_PLATFORM_BUS] = 112, /* ...to 112 + PLATFORM_BUS_NUM_IRQS -1 */
@@ -618,8 +624,13 @@ static void create_uart(const VirtMachineState *vms, qemu_irq *pic, int uart,
     hwaddr base = vms->memmap[uart].base;
     hwaddr size = vms->memmap[uart].size;
     int irq = vms->irqmap[uart];
+
+   if(chr == NULL)
+       return;
+
     const char compat[] = "arm,pl011\0arm,primecell";
     const char clocknames[] = "uartclk\0apb_pclk";
+
     DeviceState *dev = qdev_create(NULL, "pl011");
     SysBusDevice *s = SYS_BUS_DEVICE(dev);
 
@@ -644,9 +655,9 @@ static void create_uart(const VirtMachineState *vms, qemu_irq *pic, int uart,
     qemu_fdt_setprop(vms->fdt, nodename, "clock-names",
                          clocknames, sizeof(clocknames));
 
-    if (uart == VIRT_UART) {
+    if (uart == VIRT_UART0) {
         qemu_fdt_setprop_string(vms->fdt, "/chosen", "stdout-path", nodename);
-    } else {
+    } else if ((uart != VIRT_UART1) && (uart != VIRT_UART2) && (uart != VIRT_UART3))  {
         /* Mark as not usable by the normal world */
         qemu_fdt_setprop_string(vms->fdt, nodename, "status", "disabled");
         qemu_fdt_setprop_string(vms->fdt, nodename, "secure-status", "okay");
@@ -1393,11 +1404,14 @@ static void machvirt_init(MachineState *machine)
 
     fdt_add_pmu_nodes(vms);
 
-    create_uart(vms, pic, VIRT_UART, sysmem, serial_hds[0]);
+    create_uart(vms, pic, VIRT_UART0, sysmem, serial_hds[0]);
+    create_uart(vms, pic, VIRT_UART1, sysmem, serial_hds[1]);
+    create_uart(vms, pic, VIRT_UART2, sysmem, serial_hds[2]);
+    create_uart(vms, pic, VIRT_UART3, sysmem, serial_hds[3]);
 
     if (vms->secure) {
         create_secure_ram(vms, secure_sysmem);
-        create_uart(vms, pic, VIRT_SECURE_UART, secure_sysmem, serial_hds[1]);
+        create_uart(vms, pic, VIRT_SECURE_UART, secure_sysmem, serial_hds[4]);
     }
 
     create_rtc(vms, pic);
diff --git a/include/hw/arm/virt.h b/include/hw/arm/virt.h
index 33b0ff3892a..533f1e80e26 100644
--- a/include/hw/arm/virt.h
+++ b/include/hw/arm/virt.h
@@ -59,7 +59,10 @@ enum {
     VIRT_GIC_V2M,
     VIRT_GIC_ITS,
     VIRT_GIC_REDIST,
-    VIRT_UART,
+    VIRT_UART0,
+    VIRT_UART1,
+    VIRT_UART2,
+    VIRT_UART3,
     VIRT_MMIO,
     VIRT_RTC,
     VIRT_FW_CFG,
diff --git a/include/sysemu/sysemu.h b/include/sysemu/sysemu.h
index 4606072b3bd..d5ee2c19d68 100644
--- a/include/sysemu/sysemu.h
+++ b/include/sysemu/sysemu.h
@@ -193,7 +193,7 @@ void hmp_pcie_aer_inject_error(Monitor *mon, const QDict *qdict);
 
 /* serial ports */
 
-#define MAX_SERIAL_PORTS 4
+#define MAX_SERIAL_PORTS 5
 
 extern Chardev *serial_hds[MAX_SERIAL_PORTS];
 

From 5477dd8d71620b0c532e6996939b1e926368006d Mon Sep 17 00:00:00 2001
From: Dominik Maier <dmnk@google.com>
Date: Mon, 17 Oct 2022 16:49:13 +0200
Subject: [PATCH 113/140] Fix compiler error for NULL va_list

---
 monitor.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/monitor.c b/monitor.c
index c79e74f1106..9be7dfcb135 100644
--- a/monitor.c
+++ b/monitor.c
@@ -3974,6 +3974,13 @@ void error_vprintf_unless_qmp(const char *fmt, va_list ap)
     }
 }
 
+static void error_printf_internal(const char *fmt, ...) {
+    va_list ap;
+    va_start(ap, fmt);
+    error_vprintf(fmt, ap);
+    va_end(ap);
+}
+
 static void __attribute__((constructor)) monitor_lock_init(void)
 {
     qemu_mutex_init(&monitor_lock);
@@ -4029,7 +4036,7 @@ char* panda_monitor_run(char * cmdline)
     int i=0;
     while (panda_chr->buf == NULL) {
       if (i++ > 10000) {
-        error_vprintf("PANDA monitor got no result after 10,000 iterations\n", NULL);
+        error_printf_internal("PANDA monitor got no result after 10,000 iterations\n");
         break;
       }
     }

From 23c2a0cee8497a85e729f8baf6b3162a9e25e8c8 Mon Sep 17 00:00:00 2001
From: Luke Craig <lacraig3@gmail.com>
Date: Thu, 20 Oct 2022 23:28:06 -0400
Subject: [PATCH 114/140] add arm helpers

---
 panda/python/core/create_panda_datatypes.py     | 3 ++-
 panda/python/core/pandare/include/arm_helpers.h | 1 +
 2 files changed, 3 insertions(+), 1 deletion(-)
 create mode 100644 panda/python/core/pandare/include/arm_helpers.h

diff --git a/panda/python/core/create_panda_datatypes.py b/panda/python/core/create_panda_datatypes.py
index 0285a655eeb..1a23272b022 100755
--- a/panda/python/core/create_panda_datatypes.py
+++ b/panda/python/core/create_panda_datatypes.py
@@ -247,10 +247,11 @@ def expand_ppp_def(line):
     elif arch == "arm":
         define_clean_header(ffi, include_dir + "/panda_datatypes_ARM_32.h")
         define_clean_header(ffi, include_dir + "/syscalls_ext_typedefs_arm.h")
-
+        define_clean_header(ffi, include_dir + "/arm_helpers.h")
     elif arch == "aarch64": # Could also do arch and bits==64
         define_clean_header(ffi, include_dir + "/panda_datatypes_ARM_64.h")
         define_clean_header(ffi, include_dir + "/syscalls_ext_typedefs_arm64.h")
+        define_clean_header(ffi, include_dir + "/arm_helpers.h")
     elif arch == "ppc" and int(bits) == 32:
         define_clean_header(ffi, include_dir + "/panda_datatypes_PPC_32.h")
         print('WARNING: no syscalls support for PPC 32')
diff --git a/panda/python/core/pandare/include/arm_helpers.h b/panda/python/core/pandare/include/arm_helpers.h
new file mode 100644
index 00000000000..ab7cb67e216
--- /dev/null
+++ b/panda/python/core/pandare/include/arm_helpers.h
@@ -0,0 +1 @@
+uint32_t cpsr_read(CPUARMState *env);
\ No newline at end of file

From 418d79d61032cb0ef47c7574103ff1fb4e75485e Mon Sep 17 00:00:00 2001
From: Luke Craig <lacraig3@gmail.com>
Date: Sat, 22 Oct 2022 23:00:56 -0400
Subject: [PATCH 115/140] Fix memsavep opt (#1234)

* fix memsavep no size option

* fix readme for memsavep
---
 panda/plugins/memsavep/README.md  |  2 ++
 panda/plugins/memsavep/memsavep.c | 13 ++++++++++++-
 2 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/panda/plugins/memsavep/README.md b/panda/plugins/memsavep/README.md
index 7622ada782c..f3fdcd96203 100644
--- a/panda/plugins/memsavep/README.md
+++ b/panda/plugins/memsavep/README.md
@@ -16,6 +16,8 @@ Arguments
 * `percent`: double, defaults to 200 (do not dump at percent). The percentage of the replay at which we should dump memory.
 * `instrcount`: uint64, defaults to 0 (do not dump at instrcount). The instruction count of the replay at which we should dump memory.
 * `file`: string, defaults to "memsavep.raw". The filename to dump RAM out to.
+* `regfile`: string (optional). The filename of the register file to create.
+* `size`: uint64 (optional). The number of bytes of physical memory to save.
 
 Dependencies
 ------------
diff --git a/panda/plugins/memsavep/memsavep.c b/panda/plugins/memsavep/memsavep.c
index 1999d385394..ea158da17bc 100644
--- a/panda/plugins/memsavep/memsavep.c
+++ b/panda/plugins/memsavep/memsavep.c
@@ -29,6 +29,7 @@ static uint64_t instr_count = 0;
 static const char *filename = NULL;
 static const char* register_filename = NULL;
 static uint64_t pmem_len = 0;
+extern MachineState* current_machine;
 
 bool init_plugin(void *);
 void uninit_plugin(void *);
@@ -60,6 +61,12 @@ static void actually_dump_physical_memory(FILE* out, size_t len)
 
 void dump_memory(void){
     FILE* out = fopen(filename, "wb");
+
+    if (pmem_len == 0){
+        // dump all memory if not specified as arg
+        pmem_len = ram_size;
+    }
+
     actually_dump_physical_memory(out, pmem_len);
     fclose(out);
     if (register_filename)
@@ -104,7 +111,11 @@ bool init_plugin(void *self) {
     instr_count = panda_parse_uint64_opt(args, "instrcount", 0, "dump memory after a given instruction count is reached");
     filename = panda_parse_string_opt(args, "file", "memsavep.raw", "filename of the memory dump to create");
     register_filename = panda_parse_string_opt(args, "regfile", NULL, "filename of the register file to create");
-    pmem_len = panda_parse_uint64_opt(args, "size", ram_size, "number of bytes of physical memory");
+    
+    // do not use ram_size. It's not set until after init_plugin
+    pmem_len = panda_parse_uint64_opt(args, "size", 0, "number of bytes of physical memory");
+
+
 
     if(!instr_count && percent > 100.0){
         printf("memsavep: You should specify either one of percent or instrcount");

From aee5f52bb20e402a30d69a26a6ca8cdfc6866e47 Mon Sep 17 00:00:00 2001
From: Luke Craig <lacraig3@gmail.com>
Date: Mon, 24 Oct 2022 15:02:05 -0400
Subject: [PATCH 116/140] guest plugins (#1145)

* first real linjector commit

* formatting changes

* working fully now

* Fix linjector compilation issues

* Cleanup linjector some

* remove some prints

* initial gpm

* early commits for guest_daemon

* fix publish message type

* add get_channel_from_nam to api

* added guest_plugin_manager initial implementation

* Add hyperfuse

* Write length before payload in hyperfuse

* no. my hardcoded paths

* core changes

* first attempt at pure syscall injection

* some stuff

* forward progress

* Linjector updates:
* Fix linjector forking
* Cleanup linjector and add python example
* Rework linjector to use panda-rs for injection
* Remove outdated test code from linjector
* Add logging to linjector (behind 'LINJECTOR_LOG')
* Add 'proc_name' option to linjector
* Fix Rust linjector to not run off of a malformed forked/CoW buffer

* Hyperfuse updates:
- Add logging to hyperfuse, remove excess logging from guest_plugin_manager
- Add pre-fetching for hyperfuse dir listing

* Begin porting linjector to arm/i386

* Fix hardcoded linjector dependency

* Guest shell updates:
- Add latest guest shell additions
- Add guest_shell script

* remove osi_linux removal

* Add initial guest agent plugin build system

* Improve guest plugin build system

* Add guest plugin name-to-path lookup

* Remove debug prints from hyperfuse

* Add out-of-tree guest plugin building

* Remove hardcoded paths from guest_shell and hyperfuse

* Have guest_plugin_manager load linjector; Guest plugin cleanup

* Cleanup guest_shell PANDA plugin

* Move guest_shell over to message_recv macro

* Another guest_shell cleanup pass

* Move Rust example to crates.io panda-channels

* Add guest_plugin_example to demonstrate host<->guest communication

* Add symlink support to hyperfuse

* Allow reading partial messages via hyperchannels

* Update hyperfuse TODO for clarity

* Add guest plugin guide/docs

* Add API documentation to guest_plugin_manager

* Add documentation to linjector

* Add guest agent/linjector injection PPP callbacks

* Get mmap working under linjector on i386

* Add guest agent frida support

* Add ability to manually specify which process to inject the guest agent into

* Specify arm cross compiler linker

* Add i386 support to linjector

* Set arm guest plugins to build as armv5te

* Add anonymous guest agent channel API

* Add TCP passthrough plugin

* Update TCP passthrough to use panda-rs 0.34

* Rename print_tcp_servers to tcp_passthrough

* Add TCP passthrough python API prototype

* Clean up TCP passthrough python API example

* Move tcp_servers to public PANDA repo

* Add TCP passthrough API to pypanda

* Add documentation to pypanda TCP passthrough API

* Switch TCP passthrough default binding address

* Fix MIPS builds of linjector/guest_plugin_manager

* Fix build errors caused by unsupported guest agent architectures

* Add install script for musl toolchains

* Fix regression in linjector

* Fix panda-channels version for tcp guest plugin

* Add libfuse-dev to PANDA dependencies

* Move guest_daemon in-tree

* Remove unneeded nightly feature from guest_daemon

* Clean up guest_daemon warnings

* Fix linjector arm support

* Fix libc version for mips64

* Disable guest plugin building if toolchains not installed

* Fix assumption that x86_64 musl Rust target is installed

* Fix x86_64 musl Rust target typo

* Update linjector's panda-rs version

* Separate linjector from guest plugin manager

* Fix guest_plugin docs link

* Add libfuse-dev to 22.04 build requirements

* Remove outdated commented code from guest_plugin_manager

* Add check for guest plugins to setup.py

Co-authored-by: jamcleod <Jordan.McLeod@ll.mit.edu>
---
 panda/Makefile.panda.target                   |   91 +-
 panda/dependencies/ubuntu:18.04_build.txt     |    3 +
 panda/dependencies/ubuntu:20.04_build.txt     |    3 +
 panda/dependencies/ubuntu:22.04_build.txt     |    3 +
 panda/docs/guest_plugins.md                   |  306 ++
 panda/guest_plugins/config.panda              |    3 +
 panda/guest_plugins/guest_daemon/Cargo.lock   |  257 ++
 panda/guest_plugins/guest_daemon/Cargo.toml   |   11 +
 panda/guest_plugins/guest_daemon/Makefile     |   20 +
 .../guest_plugins/guest_daemon/src/loader.rs  |   44 +
 panda/guest_plugins/guest_daemon/src/main.rs  |   65 +
 panda/guest_plugins/panda.mak                 |   53 +
 panda/guest_plugins/rust_example/Cargo.lock   |  130 +
 panda/guest_plugins/rust_example/Cargo.toml   |    7 +
 panda/guest_plugins/rust_example/Makefile     |   20 +
 panda/guest_plugins/rust_example/src/main.rs  |   23 +
 panda/guest_plugins/tcp_servers/Cargo.lock    |  217 ++
 panda/guest_plugins/tcp_servers/Cargo.toml    |   12 +
 panda/guest_plugins/tcp_servers/Makefile      |   20 +
 .../tcp_servers/src/allow_cancel.rs           |  110 +
 panda/guest_plugins/tcp_servers/src/main.rs   |   99 +
 panda/include/panda/plugin.h                  |    2 +
 panda/plugins/config.panda                    |    7 +
 panda/plugins/frida/Cargo.lock                |  608 +++
 panda/plugins/frida/Cargo.toml                |   26 +
 panda/plugins/frida/Makefile                  |   18 +
 panda/plugins/frida/README.md                 |    6 +
 panda/plugins/frida/src/lib.rs                |   33 +
 panda/plugins/guest_plugin_example/Cargo.lock |  489 +++
 panda/plugins/guest_plugin_example/Cargo.toml |   24 +
 panda/plugins/guest_plugin_example/Makefile   |   18 +
 panda/plugins/guest_plugin_example/README.md  |    6 +
 panda/plugins/guest_plugin_example/src/lib.rs |   18 +
 panda/plugins/guest_plugin_example/try_it.py  |   13 +
 panda/plugins/guest_plugin_manager/Cargo.lock |  511 +++
 panda/plugins/guest_plugin_manager/Cargo.toml |   28 +
 panda/plugins/guest_plugin_manager/Makefile   |   18 +
 panda/plugins/guest_plugin_manager/README.md  |   94 +
 .../guest_plugin_manager_ppp.h                |   11 +
 .../plugins/guest_plugin_manager/rustfmt.toml |    1 +
 .../src/guest_plugin_manager.rs               |  148 +
 .../guest_plugin_manager/src/hyp_regs.rs      |   54 +
 .../guest_plugin_manager/src/interface/api.rs |   80 +
 .../src/interface/channels.rs                 |  103 +
 .../src/interface/daemon_manager.rs           |   54 +
 .../guest_plugin_manager/src/interface/hci.rs |  105 +
 .../guest_plugin_manager/src/interface/mod.rs |    5 +
 .../src/interface/plugin_manager.rs           |   61 +
 panda/plugins/guest_shell/Cargo.lock          |  489 +++
 panda/plugins/guest_shell/Cargo.toml          |   24 +
 panda/plugins/guest_shell/Makefile            |   18 +
 panda/plugins/guest_shell/README.md           |   95 +
 panda/plugins/guest_shell/guest_shell_pty.sh  |    1 +
 .../guest_shell/rusty_shell/Cargo.toml        |    4 +
 .../guest_shell/rusty_shell/src/hypercall.rs  |  113 +
 .../guest_shell/rusty_shell/src/main.rs       |   52 +
 panda/plugins/guest_shell/src/lib.rs          |   42 +
 panda/plugins/hyperfuse/Cargo.lock            |  749 ++++
 panda/plugins/hyperfuse/Cargo.toml            |   33 +
 panda/plugins/hyperfuse/Makefile              |   18 +
 panda/plugins/hyperfuse/README.md             |   95 +
 panda/plugins/hyperfuse/src/lib.rs            |  308 ++
 panda/plugins/hyperfuse/src/types.rs          |  104 +
 panda/plugins/linjector/.gitignore            |    3 +
 panda/plugins/linjector/Cargo.lock            |  705 ++++
 panda/plugins/linjector/Cargo.toml            |   28 +
 panda/plugins/linjector/Makefile              |   18 +
 panda/plugins/linjector/README.md             |   15 +
 panda/plugins/linjector/linjector_ppp.h       |   11 +
 panda/plugins/linjector/rustfmt.toml          |    1 +
 panda/plugins/linjector/src/args.rs           |   55 +
 .../linjector/src/injectables/Makefile        |   31 +
 .../src/injectables/include/hypercall.h       |   66 +
 .../injectables/include/hypercall_constants.h |   15 +
 .../src/injectables/include/syscall_x86.h     |  103 +
 .../linjector/src/injectables/injector.c      |   54 +
 .../linjector/src/injectables/tiny_mmap.c     |   11 +
 panda/plugins/linjector/src/lib.rs            |  274 ++
 panda/plugins/linjector/src/regs.rs           |   16 +
 panda/plugins/linjector/src/syscalls.rs       |  107 +
 .../plugins/linjector/src/syscalls/aarch64.rs |   17 +
 panda/plugins/linjector/src/syscalls/arm.rs   |   17 +
 panda/plugins/linjector/src/syscalls/i386.rs  |   19 +
 panda/plugins/linjector/src/syscalls/mips.rs  |   17 +
 .../plugins/linjector/src/syscalls/mips64.rs  |   17 +
 .../plugins/linjector/src/syscalls/x86_64.rs  |   17 +
 panda/plugins/rust_skeleton/Cargo.lock        |   27 +-
 panda/plugins/rust_skeleton/Cargo.toml        |    2 +-
 panda/plugins/rust_skeleton/src/lib.rs        |   14 +-
 panda/plugins/snake_hook/Cargo.lock           |    8 +-
 .../syscall_switch_enter_linux_arm.cpp        |   10 +-
 .../syscall_switch_enter_linux_x64.cpp        |    2 +-
 .../syscall_switch_return_linux_arm.cpp       |    3 +-
 panda/plugins/tcp_passthrough/Cargo.lock      |  728 ++++
 panda/plugins/tcp_passthrough/Cargo.toml      |   31 +
 panda/plugins/tcp_passthrough/Makefile        |   18 +
 panda/plugins/tcp_passthrough/README.md       |    5 +
 panda/plugins/tcp_passthrough/cbindgen.toml   |    7 +
 .../tcp_passthrough/generate_header.sh        |    3 +
 panda/plugins/tcp_passthrough/src/display.rs  |   70 +
 .../tcp_passthrough/src/forward_socket.rs     |   72 +
 panda/plugins/tcp_passthrough/src/lib.rs      |  138 +
 panda/plugins/tcp_passthrough/src/send_ext.rs |   12 +
 .../tcp_passthrough/src/socket_list.rs        |   51 +
 panda/plugins/tcp_passthrough/src/tcp.csv     | 3266 +++++++++++++++++
 .../plugins/tcp_passthrough/tcp_passthrough.h |   36 +
 .../tcp_shared_types/Cargo.lock               |   65 +
 .../tcp_shared_types/Cargo.toml               |    7 +
 .../tcp_shared_types/src/lib.rs               |   29 +
 panda/plugins/tcp_passthrough/try_it.py       |   34 +
 panda/python/core/create_panda_datatypes.py   |    7 +-
 panda/python/core/pandare/panda.py            |    4 +
 panda/python/core/pandare/tcp_passthrough.py  |   88 +
 panda/python/core/setup.py                    |    9 +
 panda/python/examples/guest_shell.py          |   26 +
 panda/python/examples/hyperfuse.py            |   22 +
 panda/python/examples/linject.py              |   31 +
 panda/python/examples/tcp_passthrough.py      |   51 +
 panda/scripts/musl_toolchains.sh              |  337 ++
 panda/src/callbacks.c                         |   24 +
 120 files changed, 13009 insertions(+), 28 deletions(-)
 create mode 100644 panda/docs/guest_plugins.md
 create mode 100644 panda/guest_plugins/config.panda
 create mode 100644 panda/guest_plugins/guest_daemon/Cargo.lock
 create mode 100644 panda/guest_plugins/guest_daemon/Cargo.toml
 create mode 100644 panda/guest_plugins/guest_daemon/Makefile
 create mode 100644 panda/guest_plugins/guest_daemon/src/loader.rs
 create mode 100644 panda/guest_plugins/guest_daemon/src/main.rs
 create mode 100644 panda/guest_plugins/panda.mak
 create mode 100644 panda/guest_plugins/rust_example/Cargo.lock
 create mode 100644 panda/guest_plugins/rust_example/Cargo.toml
 create mode 100644 panda/guest_plugins/rust_example/Makefile
 create mode 100644 panda/guest_plugins/rust_example/src/main.rs
 create mode 100644 panda/guest_plugins/tcp_servers/Cargo.lock
 create mode 100644 panda/guest_plugins/tcp_servers/Cargo.toml
 create mode 100644 panda/guest_plugins/tcp_servers/Makefile
 create mode 100644 panda/guest_plugins/tcp_servers/src/allow_cancel.rs
 create mode 100644 panda/guest_plugins/tcp_servers/src/main.rs
 create mode 100644 panda/plugins/frida/Cargo.lock
 create mode 100644 panda/plugins/frida/Cargo.toml
 create mode 100644 panda/plugins/frida/Makefile
 create mode 100644 panda/plugins/frida/README.md
 create mode 100644 panda/plugins/frida/src/lib.rs
 create mode 100644 panda/plugins/guest_plugin_example/Cargo.lock
 create mode 100644 panda/plugins/guest_plugin_example/Cargo.toml
 create mode 100644 panda/plugins/guest_plugin_example/Makefile
 create mode 100644 panda/plugins/guest_plugin_example/README.md
 create mode 100644 panda/plugins/guest_plugin_example/src/lib.rs
 create mode 100644 panda/plugins/guest_plugin_example/try_it.py
 create mode 100644 panda/plugins/guest_plugin_manager/Cargo.lock
 create mode 100644 panda/plugins/guest_plugin_manager/Cargo.toml
 create mode 100644 panda/plugins/guest_plugin_manager/Makefile
 create mode 100644 panda/plugins/guest_plugin_manager/README.md
 create mode 100644 panda/plugins/guest_plugin_manager/guest_plugin_manager_ppp.h
 create mode 100644 panda/plugins/guest_plugin_manager/rustfmt.toml
 create mode 100644 panda/plugins/guest_plugin_manager/src/guest_plugin_manager.rs
 create mode 100644 panda/plugins/guest_plugin_manager/src/hyp_regs.rs
 create mode 100644 panda/plugins/guest_plugin_manager/src/interface/api.rs
 create mode 100644 panda/plugins/guest_plugin_manager/src/interface/channels.rs
 create mode 100644 panda/plugins/guest_plugin_manager/src/interface/daemon_manager.rs
 create mode 100644 panda/plugins/guest_plugin_manager/src/interface/hci.rs
 create mode 100644 panda/plugins/guest_plugin_manager/src/interface/mod.rs
 create mode 100644 panda/plugins/guest_plugin_manager/src/interface/plugin_manager.rs
 create mode 100644 panda/plugins/guest_shell/Cargo.lock
 create mode 100644 panda/plugins/guest_shell/Cargo.toml
 create mode 100644 panda/plugins/guest_shell/Makefile
 create mode 100644 panda/plugins/guest_shell/README.md
 create mode 100755 panda/plugins/guest_shell/guest_shell_pty.sh
 create mode 100644 panda/plugins/guest_shell/rusty_shell/Cargo.toml
 create mode 100644 panda/plugins/guest_shell/rusty_shell/src/hypercall.rs
 create mode 100644 panda/plugins/guest_shell/rusty_shell/src/main.rs
 create mode 100644 panda/plugins/guest_shell/src/lib.rs
 create mode 100644 panda/plugins/hyperfuse/Cargo.lock
 create mode 100644 panda/plugins/hyperfuse/Cargo.toml
 create mode 100644 panda/plugins/hyperfuse/Makefile
 create mode 100644 panda/plugins/hyperfuse/README.md
 create mode 100644 panda/plugins/hyperfuse/src/lib.rs
 create mode 100644 panda/plugins/hyperfuse/src/types.rs
 create mode 100644 panda/plugins/linjector/.gitignore
 create mode 100644 panda/plugins/linjector/Cargo.lock
 create mode 100644 panda/plugins/linjector/Cargo.toml
 create mode 100644 panda/plugins/linjector/Makefile
 create mode 100644 panda/plugins/linjector/README.md
 create mode 100644 panda/plugins/linjector/linjector_ppp.h
 create mode 100644 panda/plugins/linjector/rustfmt.toml
 create mode 100644 panda/plugins/linjector/src/args.rs
 create mode 100644 panda/plugins/linjector/src/injectables/Makefile
 create mode 100644 panda/plugins/linjector/src/injectables/include/hypercall.h
 create mode 100644 panda/plugins/linjector/src/injectables/include/hypercall_constants.h
 create mode 100644 panda/plugins/linjector/src/injectables/include/syscall_x86.h
 create mode 100644 panda/plugins/linjector/src/injectables/injector.c
 create mode 100644 panda/plugins/linjector/src/injectables/tiny_mmap.c
 create mode 100644 panda/plugins/linjector/src/lib.rs
 create mode 100644 panda/plugins/linjector/src/regs.rs
 create mode 100644 panda/plugins/linjector/src/syscalls.rs
 create mode 100644 panda/plugins/linjector/src/syscalls/aarch64.rs
 create mode 100644 panda/plugins/linjector/src/syscalls/arm.rs
 create mode 100644 panda/plugins/linjector/src/syscalls/i386.rs
 create mode 100644 panda/plugins/linjector/src/syscalls/mips.rs
 create mode 100644 panda/plugins/linjector/src/syscalls/mips64.rs
 create mode 100644 panda/plugins/linjector/src/syscalls/x86_64.rs
 create mode 100644 panda/plugins/tcp_passthrough/Cargo.lock
 create mode 100644 panda/plugins/tcp_passthrough/Cargo.toml
 create mode 100644 panda/plugins/tcp_passthrough/Makefile
 create mode 100644 panda/plugins/tcp_passthrough/README.md
 create mode 100644 panda/plugins/tcp_passthrough/cbindgen.toml
 create mode 100755 panda/plugins/tcp_passthrough/generate_header.sh
 create mode 100644 panda/plugins/tcp_passthrough/src/display.rs
 create mode 100644 panda/plugins/tcp_passthrough/src/forward_socket.rs
 create mode 100644 panda/plugins/tcp_passthrough/src/lib.rs
 create mode 100644 panda/plugins/tcp_passthrough/src/send_ext.rs
 create mode 100644 panda/plugins/tcp_passthrough/src/socket_list.rs
 create mode 100644 panda/plugins/tcp_passthrough/src/tcp.csv
 create mode 100644 panda/plugins/tcp_passthrough/tcp_passthrough.h
 create mode 100644 panda/plugins/tcp_passthrough/tcp_shared_types/Cargo.lock
 create mode 100644 panda/plugins/tcp_passthrough/tcp_shared_types/Cargo.toml
 create mode 100644 panda/plugins/tcp_passthrough/tcp_shared_types/src/lib.rs
 create mode 100644 panda/plugins/tcp_passthrough/try_it.py
 create mode 100644 panda/python/core/pandare/tcp_passthrough.py
 create mode 100644 panda/python/examples/guest_shell.py
 create mode 100644 panda/python/examples/hyperfuse.py
 create mode 100644 panda/python/examples/linject.py
 create mode 100644 panda/python/examples/tcp_passthrough.py
 create mode 100755 panda/scripts/musl_toolchains.sh

diff --git a/panda/Makefile.panda.target b/panda/Makefile.panda.target
index 34a71ce5a8e..f036bc068c7 100644
--- a/panda/Makefile.panda.target
+++ b/panda/Makefile.panda.target
@@ -56,7 +56,7 @@ extra-plugin-%: plog.pb-c.h plog.pb.h $(PANDA_API_EXT)
 		PLUGIN_SRC_ROOT="$(EXTRA_PLUGINS_PATH)/panda/plugins" \
 		V="$(V)" PLUGIN_NAME="$*" all,)
 
-all: $(PLUGIN_SUBDIR_RULES) $(EXTRA_PLUGIN_SUBDIR_RULES)
+all: $(PLUGIN_SUBDIR_RULES) $(EXTRA_PLUGIN_SUBDIR_RULES) build_guest_plugins
 
 PROTO_FILES=$(wildcard $(addsuffix /*.proto,$(ALL_PLUGIN_SUBDIRS)))
 
@@ -147,6 +147,95 @@ clean-panda:
 		rm -f panda/panda_*.so;\
 	fi
 
+#########################################################
+# Guest Plugins
+
+# determine list of guest plugins
+# remove spaces from lines. skip lines starting with a #. concatenate the rest into 
+# a space-delimited list
+PANDA_GUEST_PLUGINS=$(shell tr -d "[:blank:]" < $(SRC_PATH)/panda/guest_plugins/config.panda | grep -v "^\#" | xargs)
+GUEST_PLUGIN_SUBDIR_RULES=$(patsubst %,guest-plugin-%, $(PANDA_GUEST_PLUGINS))
+GUEST_PLUGIN_SUBDIR_MAKEFLAGS=$(if $(V),,--no-print-directory) BUILD_DIR=$(BUILD_DIR)
+
+ALL_GUEST_PLUGIN_RULES=$(GUEST_PLUGIN_SUBDIR_RULES)
+
+ifdef EXTRA_GUEST_PLUGINS_PATH
+	EXTRA_GUEST_PLUGINS=$(shell tr -d "[:blank:]" < $(EXTRA_GUEST_PLUGINS_PATH)/config.panda | grep -v "^\#" | xargs)
+	EXTRA_GUEST_PLUGIN_SUBDIR_RULES=$(patsubst %,extra-guest-plugin-%, $(EXTRA_GUEST_PLUGINS))
+	ALL_GUEST_PLUGIN_RULES+=$(EXTRA_GUEST_PLUGIN_SUBDIR_RULES)
+endif
+
+ifeq ($(TARGET_NAME),i386)
+	GUEST_CC=i486-linux-musl-gcc
+	GUEST_RUST_TARGET=i686-unknown-linux-musl
+else ifeq ($(TARGET_NAME),x86_64)
+	GUEST_RUST_TARGET=x86_64-unknown-linux-musl
+else ifeq ($(TARGET_NAME),mips)
+	GUEST_CC=mips-linux-musl-gcc
+	GUEST_RUST_TARGET=mips-unknown-linux-musl
+else ifeq ($(TARGET_NAME),mipsel)
+	GUEST_CC=mipsel-linux-musl-gcc
+	GUEST_RUST_TARGET=mipsel-unknown-linux-musl
+else ifeq ($(TARGET_NAME),mips64)
+	GUEST_CC=mips64-linux-musl-gcc
+	GUEST_RUST_TARGET=mips64-unknown-linux-muslabi64
+else ifeq ($(TARGET_NAME),arm)
+	GUEST_CC=arm-linux-musleabi-gcc
+	GUEST_RUST_TARGET=armv5te-unknown-linux-musleabi
+else ifeq ($(TARGET_NAME),aarch64)
+	GUEST_CC=aarch64-linux-musl-gcc
+	GUEST_RUST_TARGET=aarch64-unknown-linux-musl
+endif
+
+HAS_GUEST_TOOLCHAIN="no"
+ifeq ($(TARGET_NAME),x86_64)
+    ifeq (, $(shell rustup target list --installed | grep $(GUEST_RUST_TARGET)))
+    	GUEST_PLUGIN_DISABLE_REASON="rust target ${GUEST_RUST_TARGET} not installed"
+    	HAS_GUEST_TOOLCHAIN="no"
+    else
+    	HAS_GUEST_TOOLCHAIN="yes"
+    endif
+else ifeq ($(TARGET_NAME),ppc)
+	HAS_GUEST_TOOLCHAIN="no"
+	GUEST_PLUGIN_DISABLE_REASON="unsupported on ppc"
+else ifneq (, $(shell which $(GUEST_CC)))
+    ifeq (, $(shell rustup target list --installed | grep $(GUEST_RUST_TARGET)))
+    	GUEST_PLUGIN_DISABLE_REASON="rust target ${GUEST_RUST_TARGET} not installed"
+    	HAS_GUEST_TOOLCHAIN="no"
+    else
+    	HAS_GUEST_TOOLCHAIN="yes"
+    endif
+else
+	GUEST_PLUGIN_DISABLE_REASON="musl toolchain not in PATH"
+endif
+
+ifeq ($(HAS_GUEST_TOOLCHAIN),"yes")
+build_guest_plugins: $(ALL_GUEST_PLUGIN_RULES)
+	@echo "GUEST_PLUGINS: ${PANDA_GUEST_PLUGINS} ${EXTRA_GUEST_PLUGINS}"
+else
+build_guest_plugins:
+	@echo "GUEST_PLUGINS: disabled on arch ${TARGET_NAME}, ${GUEST_PLUGIN_DISABLE_REASON}"
+endif
+
+
+guest-plugin-%:
+	$(call quiet-command,mkdir -p ../panda/guest_plugins/$*,)
+	$(call quiet-command,mkdir -p panda/guest_plugins/$*,)
+	$(call quiet-command,$(MAKE) $(GUEST_PLUGIN_SUBDIR_MAKEFLAGS) \
+		-f "$(SRC_PATH)/panda/guest_plugins/panda.mak" \
+		-f "$(SRC_PATH)/panda/guest_plugins/$*/Makefile" \
+		PLUGIN_SRC_ROOT="$(SRC_PATH)/panda/guest_plugins" \
+		V="$(V)" PLUGIN_NAME="$*" all,)
+
+extra-guest-plugin-%:
+	$(call quiet-command,mkdir -p ../panda/guest_plugins/$*,)
+	$(call quiet-command,mkdir -p panda/guest_plugins/$*,)
+	$(call quiet-command,$(MAKE) $(GUEST_PLUGIN_SUBDIR_MAKEFLAGS) \
+		-f "$(SRC_PATH)/panda/guest_plugins/panda.mak" \
+		-f "$(EXTRA_GUEST_PLUGINS_PATH)/$*/Makefile" \
+		PLUGIN_SRC_ROOT="$(EXTRA_GUEST_PLUGINS_PATH)" \
+		V="$(V)" PLUGIN_NAME="$*" all,)
+
 ifdef CONFIG_LLVM
 #########################################################
 # LLVM library
diff --git a/panda/dependencies/ubuntu:18.04_build.txt b/panda/dependencies/ubuntu:18.04_build.txt
index b0695e00e85..f6b7aedbc90 100644
--- a/panda/dependencies/ubuntu:18.04_build.txt
+++ b/panda/dependencies/ubuntu:18.04_build.txt
@@ -25,6 +25,9 @@ protobuf-compiler
 python3-dev
 zip
 
+# hyperfuse build deps
+libfuse-dev
+
 # pypanda dependencies
 python3-setuptools
 python3-wheel
diff --git a/panda/dependencies/ubuntu:20.04_build.txt b/panda/dependencies/ubuntu:20.04_build.txt
index 57a682f20da..453514816a1 100644
--- a/panda/dependencies/ubuntu:20.04_build.txt
+++ b/panda/dependencies/ubuntu:20.04_build.txt
@@ -21,6 +21,9 @@ python3-dev
 libpixman-1-dev
 zip
 
+# hyperfuse build deps
+libfuse-dev
+
 # pypanda dependencies
 python3-setuptools
 python3-wheel
diff --git a/panda/dependencies/ubuntu:22.04_build.txt b/panda/dependencies/ubuntu:22.04_build.txt
index 57a682f20da..453514816a1 100644
--- a/panda/dependencies/ubuntu:22.04_build.txt
+++ b/panda/dependencies/ubuntu:22.04_build.txt
@@ -21,6 +21,9 @@ python3-dev
 libpixman-1-dev
 zip
 
+# hyperfuse build deps
+libfuse-dev
+
 # pypanda dependencies
 python3-setuptools
 python3-wheel
diff --git a/panda/docs/guest_plugins.md b/panda/docs/guest_plugins.md
new file mode 100644
index 00000000000..74cd40bfa32
--- /dev/null
+++ b/panda/docs/guest_plugins.md
@@ -0,0 +1,306 @@
+# PANDA Guest Plugins
+
+### Overview
+
+PANDA guest plugins are a feature of PANDA that allows you to run non-cooperative guest agents. This means without any control of the guest, you can run programs that can communicate with code running on the host system. This gives the ability to gain a semantic understanding of the guest through stable interfaces, with the drawback of not being usable in replays.
+
+Some quick links to resources regarding guest plugins:
+
+* [`rust_example`](/panda/guest_plugins/rust_example) - An example guest plugin written in Rust
+* [`guest_plugin_example`](/panda/plugins/guest_plugin_example) - The PANDA (host) plugin that loads and interacts with the guest plugin example
+* [`guest_plugin_manager` Rust Documentation](https://docs.rs/panda-re/latest/panda/plugins/guest_plugin_manager/index.html)
+* [`guest_plugin_manager`](/panda/plugins/guest_plugin_manager) - Source for the guest plugin manager (the PANDA host plugin which handles loading/unloading guest plugins)
+
+### Structure of Typical Usage
+
+PANDA guest plugins are a bit more involved than normal PANDA plugins, due to needing to facilitate communication across the hypervisor:
+
+* Host-side plugin 
+    * A standard PANDA plugin (a shared object built from `panda/plugins`). 
+    * Responsible for loading the code into the guest using the `guest_plugin_manager` plugin
+    * Handles communication with the guest plugin 
+        * Sending - queuing up messages for the guest 
+        * Recieving - Provides a callback for messages sent by the guest
+* Guest-side plugin 
+    * A standard statically-linked executable cross-compiled for the guest (built from `panda/guest_plugins`)
+    * Additional guest plugins will be built from `$EXTRA_GUEST_PLUGINS_PATH`
+        * Requires a `$EXTRA_GUEST_PLUGINS_PATH/config.panda` file containing newline-separated plugin names. Each plugin is built from `$EXTRA_GUEST_PLUGINS_PATH/$plugin_name/`.
+    * Communicates to the host using hypervisor calls via the [`panda-channels`](https://github.com/panda-re/panda-channels) library.
+
+### Getting Started
+
+For starters let's try developing an out-of-tree guest plugin. This process won't be any different than in-tree, so if down the road you wish to upstream your plugin it'll only require a bit of copy/pasting.
+
+#### Creating a New Plugin
+
+First up, create a folder to use as your "out-of-tree" plugins folder and set `EXTRA_GUEST_PLUGINS_PATH` accordingly:
+
+```bash
+mkdir guest_plugins
+export EXTRA_GUEST_PLUGINS_PATH=`realpath guest_plugins`
+```
+
+Now let's create a guest plugin using the example plugin as a template:
+
+1. Copy `panda/guest_plugins/guest_plugins/rust_example` to `$EXTRA_GUEST_PLUGINS_PATH/your_plugin_name`
+2. Edit the `Cargo.toml` to change the name to match your folder name:
+
+```toml
+[package]
+name = "your_plugin_name"
+```
+
+3. Create a `config.panda` file in your out-of-tree `guest_plugins` folder. The only thing this needs to contain is your plugin's name:
+
+```
+your_plugin_name
+```
+
+Later, if you make more plugins you can add each one on a new line:
+
+```
+your_plugin_name
+your_other_plugin
+```
+
+#### Adding Some Guest Logic
+
+For our example, we'll make a guest plugin which informs the host of how many files/directories are in `/etc`.
+
+First up some imports we'll need:
+
+```rust
+use panda_channels::Channel;
+use std::io::Write;
+use std::fs;
+
+fn main() {
+}
+```
+
+We'll need `Channel` and `Write` for communicating with the host, and we'll need `fs` for actually interacting with the filesystem.
+
+Then in our `main` function we'll read `/etc` using [`read_dir`](https://doc.rust-lang.org/std/fs/fn.read_dir.html) and use [`Iterator::count`](https://doc.rust-lang.org/std/iter/trait.Iterator.html#method.count):
+
+```rust
+let file_count = fs::read_dir("/etc").unwrap().count();
+```
+
+Now let's create a channel to send this information to the host:
+
+```rust
+let mut channel = Channel::main("your_plugin_name").unwrap();
+```
+
+We pass the name of our plugin to `Channel::main` to get the main channel for our plugin. This channel is automatically allocated by the `guest_plugin_manager` when we load our plugin and for most usecases it's all we'll need.
+
+We've marked it as mutable so we can write to it. `Channel` implements Rust's [`Write`](https://doc.rust-lang.org/std/io/trait.Write.html) trait, so all we need to do is serialize our file count to bytes and use [`write_all`](https://doc.rust-lang.org/std/io/trait.Write.html#method.write_all) to send the bytes to the host:
+
+```rust
+channel.write_all(&(file_count as u32).to_le_bytes()).unwrap();
+```
+
+We convert `file_count` from `usize` (arch-width integer) to a 32-bit integer to serialize to a fixed number of bytes (that way our host code doesn't need to care about whether our guest is 32 or 64 bit) and then use `to_le_bytes` to convert to little endian bytes for us to write.
+
+Putting that all together we get our complete guest plugin:
+
+```rust
+use panda_channels::Channel;
+use std::io::Write;
+use std::fs;
+
+fn main() {
+    let file_count = fs::read_dir("/etc").unwrap().count();
+    let mut channel = Channel::main("your_plugin_name").unwrap();
+    channel.write_all(&(file_count as u32).to_le_bytes()).unwrap();
+}
+```
+
+If we want to check if it built properly, we can run:
+
+```
+cargo check
+```
+
+This will print out any errors that need to be resolved, if there's no issues we'll get:
+
+```
+   Finished dev [unoptimized + debuginfo] target(s) in 0.11s
+```
+
+This doesn't actually build or link our executable, so it saves a lot of time over doing a full PANDA build any time we want to check for compiler errors. Some other options are [`clippy`](https://github.com/rust-lang/rust-clippy) (A full Rust linter to help write idiomatic Rust) and [`bacon`](https://github.com/Canop/bacon) (Watches your project for changes and keeps a live-updating set of errors/warnings). Also helpful while developing is [`rust-analyzer`](https://rust-analyzer.github.io/), a Language Server implementation for VS Code, Emacs, Vim, etc.
+
+#### Writing a Host Plugin
+
+In order for our guest plugin to do anything, we'll need a host PANDA plugin in order to facilitate loading/message passing.
+
+First up, let's create a new Rust plugin. Similarly to with our guest plugin, we can use an example plugin as a template and just find/replace the names.
+
+I'd recommend using `panda/plugins/guest_plugin_example` as a base. Change the name in `Cargo.toml` to match the folder name, add the folder name to `panda/plugins/config.panda`, and you should be good to go.
+
+If you use another plugin as your base, make sure you have a somewhat recent version of `panda-re`, as you'll need at least `0.26` for this:
+
+```toml
+[dependencies]
+panda-re = { version = "0.26", default-features = false }
+```
+
+| Tip |
+|:----|
+| Install [`cargo-edit`](https://github.com/killercup/cargo-edit) and you can add the latest version of a dependency with `cargo add dep-name` |
+
+Now onto actually writing the host plugin. First off we'll want to pull the guest plugin management utilities we'll need into scope:
+
+```rust
+use panda::plugins::guest_plugin_manager::{load_guest_plugin, channel_recv};
+use panda::prelude::*;
+```
+
+We'll need a callback function for handling incoming messages from the guest. The `panda-re` package provides an (`#[channel_recv]`) attribute for this to do most of the work for us, so for the most part we just need to define a function which takes a `u32` (an ID representing the channel we're recieving messages from) and either bytes (`&[u8]`) or a string (`&str`). In this case, since we're dealing with binary data, let's go with a byte slice:
+
+```rust
+#[channel_recv]
+fn message_recv(_: u32, data: &[u8]) {
+}
+```
+
+And inside of that, let's just include a bit of code for converting back to an integer and printing it out to our terminal:
+
+```rust
+// convert &[u8] to [u8; 4]
+let count_bytes: [u8; 4] = data[..4].try_into().unwrap();
+
+// convert [u8; 4] to u32
+let file_count = u32::from_le_bytes(count_bytes);
+
+// print the file count to the terminal
+println!("Guest `/etc` file count: {}", file_count);
+```
+
+Next up, let's define our `init` function. Since all we need to do when our plugin is load the guest plugin:
+
+```rust
+#[panda::init]
+fn init(_: &mut PluginHandle) {
+    let mut channel = load_guest_plugin("your_guest_plugin_name", message_recv);
+
+    // if we needed to write to the channel at all we could do so here using
+    // std::io::Write, just like the guest plugin.
+}
+```
+
+Now we have everything we need for a fully-functional host plugin:
+
+```rust
+use panda::plugins::guest_plugin_manager::{load_guest_plugin, channel_recv};
+use panda::prelude::*;
+
+#[channel_recv]
+fn message_recv(_: u32, data: &[u8]) {
+    // convert &[u8] to [u8; 4]
+    let count_bytes: [u8; 4] = data[..4].try_into().unwrap();
+
+    // convert [u8; 4] to u32
+    let file_count = u32::from_le_bytes(count_bytes);
+
+    // print the file count to the terminal
+    println!("Guest `/etc` file count: {}", file_count);
+}
+
+#[panda::init]
+fn init(_: &mut PluginHandle) {
+    load_guest_plugin("your_guest_plugin_name", message_recv);
+}
+```
+
+If your plugin uses Rust 2018 edition then you'll also need to import `std::convert::TryInto`. If you forget this, no worries though, as rustc will remind you and tell you how to fix it:
+
+```
+help: the following trait is implemented but not in scope; perhaps add a `use` for it:
+    |
+1   | use std::convert::TryInto;
+    |
+```
+
+#### Building
+
+To build, we go through the standard PANDA build process:
+
+1. Create a `build` folder in the root of your clone of PANDA if you haven't already
+2. From within the build folder run `../build.sh`. In our case, we are only going to be testing on x86_64 while developing, so we can save ourselves some build time by only building a single architecture: `../build.sh x86_64-softmmu`
+
+#### Testing Our Guest Plugin
+
+The easiest way to test our plugin will be with a pypanda script. An example script can be found in [`panda/plugins/guest_plugin_example/try_it.py`](/panda/plugins/guest_plugin_example/try_it.py).
+
+```python
+from pandare import Panda
+
+panda = Panda(generic="x86_64")
+panda.load_plugin("guest_plugin_example")
+
+@panda.queue_blocking
+def run_cmd():
+    panda.revert_sync("root")
+    panda.run_serial_cmd("cat", no_timeout=True)
+    panda.run_serial_cmd("cat", no_timeout=True)
+
+    panda.end_analysis()
+
+panda.run()
+```
+
+Just replace `"guest_plugin_example"` with the name of your host PANDA plugin, then run the script. You should see roughly the following output:
+
+```
+$ python3 try_it.py
+
+[...]
+Guest `/etc` file count: 170
+```
+
+If you're getting this message, congrats! You've made your first PANDA guest plugin. If you're having trouble, a list of potential problems and solutions has been included below.
+
+### Troubleshooting
+
+If you issue is not listed here, ask for help in the PANDA/MIT Rehosting Slack, and we'll try to add it here.
+
+##### "No guest plugin path was provided but plugin could not be found"
+
+```
+thread '<unnamed>' panicked at 'No guest plugin path was provided but plugin "your_guest_plugin_name" could not be found, ensure "your_guest_plugin_name" has been built.', src/interface/api.rs:23:21
+note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
+fatal runtime error: failed to initiate panic, error 5
+Aborted (core dumped)
+```
+
+Fix steps:
+
+1. Ensure your guest plugin is listed in guest_plugins/config.panda
+2. Make sure you properly updated the guest plugin name in $host_plugin/src/lib.rs
+3. Double check for typos
+
+#### "Fatal error: could not find path for plugin"
+
+```
+PANDA[core]:Fatal error: could not find path for plugin your_plugin_name
+python3: {...}/panda/src/callbacks.c:166: _panda_load_plugin: Assertion `file name != NULL' failed.
+Aborted (core dumped)`
+```
+
+Fix steps:
+
+1. Ensure your host plugin is listed in panda/plugins/config.panda
+2. Ensure you didn't miss any build errors happening when building your host plugin
+
+
+#### "Failed to find channel number"
+
+```
+failed to find channel number
+```
+
+Fix steps:
+
+1. Ensure the name you include in $guest_plugin/src/main.rs is correct when you call `Channel::main`
+2. Ensure the name of the guest plugin itself is correct and contains no typos
diff --git a/panda/guest_plugins/config.panda b/panda/guest_plugins/config.panda
new file mode 100644
index 00000000000..af2bf46fe04
--- /dev/null
+++ b/panda/guest_plugins/config.panda
@@ -0,0 +1,3 @@
+#rust_example
+tcp_servers
+guest_daemon
diff --git a/panda/guest_plugins/guest_daemon/Cargo.lock b/panda/guest_plugins/guest_daemon/Cargo.lock
new file mode 100644
index 00000000000..eadba358711
--- /dev/null
+++ b/panda/guest_plugins/guest_daemon/Cargo.lock
@@ -0,0 +1,257 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 3
+
+[[package]]
+name = "bitflags"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
+
+[[package]]
+name = "cc"
+version = "1.0.73"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2fff2a6927b3bb87f9595d67196a70493f627687a71d87a0d692242c33f58c11"
+
+[[package]]
+name = "cfg-if"
+version = "0.1.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4785bdd1c96b2a846b2bd7cc02e86b6b3dbf14e7e53446c4f54c92a361040822"
+
+[[package]]
+name = "cfg-if"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
+
+[[package]]
+name = "daemonize-me"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "583332de51377006c0faf944fedde7edbfb857d6f79034925eab804cc97470ec"
+dependencies = [
+ "libc",
+ "nix",
+ "snafu",
+]
+
+[[package]]
+name = "doc-comment"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fea41bba32d969b513997752735605054bc0dfa92b4c56bf1189f2e174be7a10"
+
+[[package]]
+name = "guest_daemon"
+version = "0.1.0"
+dependencies = [
+ "daemonize-me",
+ "libc",
+ "libloading",
+ "memfd",
+ "panda-channels",
+]
+
+[[package]]
+name = "instant"
+version = "0.1.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bee0328b1209d157ef001c94dd85b4f8f64139adb0eac2659f4b08382b2f474d"
+dependencies = [
+ "cfg-if 1.0.0",
+]
+
+[[package]]
+name = "lazy_static"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
+
+[[package]]
+name = "libc"
+version = "0.2.131"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "04c3b4822ccebfa39c02fc03d1534441b22ead323fa0f48bb7ddd8e6ba076a40"
+
+[[package]]
+name = "libloading"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6f84d96438c15fcd6c3f244c8fce01d1e2b9c6b5623e9c711dc9286d8fc92d6a"
+dependencies = [
+ "cfg-if 1.0.0",
+ "winapi",
+]
+
+[[package]]
+name = "lock_api"
+version = "0.4.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "712a4d093c9976e24e7dbca41db895dabcbac38eb5f4045393d17a95bdfb1109"
+dependencies = [
+ "scopeguard",
+]
+
+[[package]]
+name = "memfd"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f6627dc657574b49d6ad27105ed671822be56e0d2547d413bfbf3e8d8fa92e7a"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "nix"
+version = "0.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "50e4785f2c3b7589a0d0c1dd60285e1188adac4006e8abd6dd578e1567027363"
+dependencies = [
+ "bitflags",
+ "cc",
+ "cfg-if 0.1.10",
+ "libc",
+ "void",
+]
+
+[[package]]
+name = "panda-channels"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "529d17650397380d80c95c6027ffcb48eaf4095a0c513eb7e827f0c3c0e52e9c"
+dependencies = [
+ "lazy_static",
+ "parking_lot",
+]
+
+[[package]]
+name = "parking_lot"
+version = "0.11.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d17b78036a60663b797adeaee46f5c9dfebb86948d1255007a1d6be0271ff99"
+dependencies = [
+ "instant",
+ "lock_api",
+ "parking_lot_core",
+]
+
+[[package]]
+name = "parking_lot_core"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d76e8e1493bcac0d2766c42737f34458f1c8c50c0d23bcb24ea953affb273216"
+dependencies = [
+ "cfg-if 1.0.0",
+ "instant",
+ "libc",
+ "redox_syscall",
+ "smallvec",
+ "winapi",
+]
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.43"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0a2ca2c61bc9f3d74d2886294ab7b9853abd9c1ad903a3ac7815c58989bb7bab"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbe448f377a7d6961e30f5955f9b8d106c3f5e449d493ee1b125c1d43c2b5179"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "redox_syscall"
+version = "0.2.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8383f39639269cde97d255a32bdb68c047337295414940c68bdd30c2e13203ff"
+dependencies = [
+ "bitflags",
+]
+
+[[package]]
+name = "scopeguard"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d29ab0c6d3fc0ee92fe66e2d99f700eab17a8d57d1c1d3b748380fb20baa78cd"
+
+[[package]]
+name = "smallvec"
+version = "1.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fe0f37c9e8f3c5a4a66ad655a93c74daac4ad00c441533bf5c6e7990bb42604e"
+
+[[package]]
+name = "snafu"
+version = "0.6.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eab12d3c261b2308b0d80c26fffb58d17eba81a4be97890101f416b478c79ca7"
+dependencies = [
+ "doc-comment",
+ "snafu-derive",
+]
+
+[[package]]
+name = "snafu-derive"
+version = "0.6.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1508efa03c362e23817f96cde18abed596a25219a8b2c66e8db33c03543d315b"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "syn"
+version = "1.0.99"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "58dbef6ec655055e20b86b15a8cc6d439cca19b667537ac6a1369572d151ab13"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c4f5b37a154999a8f3f98cc23a628d850e154479cd94decf3414696e12e31aaf"
+
+[[package]]
+name = "void"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6a02e4885ed3bc0f2de90ea6dd45ebcbb66dacffe03547fadbb0eeae2770887d"
+
+[[package]]
+name = "winapi"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
+dependencies = [
+ "winapi-i686-pc-windows-gnu",
+ "winapi-x86_64-pc-windows-gnu",
+]
+
+[[package]]
+name = "winapi-i686-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
+
+[[package]]
+name = "winapi-x86_64-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
diff --git a/panda/guest_plugins/guest_daemon/Cargo.toml b/panda/guest_plugins/guest_daemon/Cargo.toml
new file mode 100644
index 00000000000..d262ac88a6a
--- /dev/null
+++ b/panda/guest_plugins/guest_daemon/Cargo.toml
@@ -0,0 +1,11 @@
+[package]
+name = "guest_daemon"
+version = "0.1.0"
+edition = "2018"
+
+[dependencies]
+panda-channels = "0.3"
+memfd = "0.4.0"
+libloading = "0.7"
+daemonize-me = "1"
+libc = "0.2"
diff --git a/panda/guest_plugins/guest_daemon/Makefile b/panda/guest_plugins/guest_daemon/Makefile
new file mode 100644
index 00000000000..1458392b517
--- /dev/null
+++ b/panda/guest_plugins/guest_daemon/Makefile
@@ -0,0 +1,20 @@
+# Remember to:
+# * Add your plugin name to config.panda
+# * Keep your plugin name the same as the folder name and Cargo.toml package name
+
+# Output build artifacts to the build directory
+PLUGIN_ARTIFACTS_DIR = $(PLUGIN_TARGET_DIR)/$(PLUGIN_NAME)/target
+
+# recompile if any of the src/*.rs files changed, or Cargo.toml
+RUST_SOURCE = $(wildcard $(PLUGIN_DIR)/src/*.rs)
+PLUGIN_DEPS=$(RUST_SOURCE) $(PLUGIN_DIR)/Cargo.toml
+
+$(PLUGIN_OUT_PATH): BUILD_RESULT="$(PLUGIN_ARTIFACTS_DIR)/$(TARGET_TRIPLE)/release/$(PLUGIN_NAME)"
+$(PLUGIN_OUT_PATH): $(PLUGIN_DEPS)
+	@echo "  CARGO   $(PLUGIN_NAME) (${TARGET_TRIPLE})"
+	@CARGO_TERM_PROGRESS_WHEN=never cargo build --release \
+		--target=$(TARGET_TRIPLE) \
+		--manifest-path=$(PLUGIN_DIR)/Cargo.toml \
+		--target-dir=$(PLUGIN_ARTIFACTS_DIR)
+	@mkdir -p $(PLUGIN_BIN_DIR)
+	@cp -p $(BUILD_RESULT) $@
diff --git a/panda/guest_plugins/guest_daemon/src/loader.rs b/panda/guest_plugins/guest_daemon/src/loader.rs
new file mode 100644
index 00000000000..5b38c926dfd
--- /dev/null
+++ b/panda/guest_plugins/guest_daemon/src/loader.rs
@@ -0,0 +1,44 @@
+use memfd::MemfdOptions;
+use std::{
+    fs,
+    io::Write,
+    os::unix::{fs::OpenOptionsExt, prelude::AsRawFd},
+    process::Command,
+};
+
+pub(crate) fn load_plugin(payload: Vec<u8>) {
+    let (path, mut file) = if let Ok(plugin_file) = MemfdOptions::new().create("pluginfd") {
+        let fd = plugin_file.as_raw_fd();
+
+        (format!("/proc/self/fd/{}", fd), plugin_file.into_file())
+    } else {
+        match fs::OpenOptions::new()
+            .create(true)
+            .write(true)
+            .mode(0o777)
+            .custom_flags(libc::O_CLOEXEC)
+            .open("/tmp/plugin_file")
+        {
+            Ok(file) => (String::from("/tmp/plugin_file"), file),
+            Err(err) => {
+                eprintln!("Failed to write to /tmp");
+                panic!("{:?}", err);
+            }
+        }
+    };
+
+    file.write_all(&payload).unwrap();
+    let _ = file.flush();
+    let _ = file.sync_all();
+
+    let mut file = Some(file);
+
+    if path.starts_with("/tmp") {
+        drop(file.take());
+    }
+
+    eprintln!("Running guest plugin...");
+    Command::new(path)
+        .spawn()
+        .expect("Failed to run guest plugin");
+}
diff --git a/panda/guest_plugins/guest_daemon/src/main.rs b/panda/guest_plugins/guest_daemon/src/main.rs
new file mode 100644
index 00000000000..c527819d346
--- /dev/null
+++ b/panda/guest_plugins/guest_daemon/src/main.rs
@@ -0,0 +1,65 @@
+use panda_channels::{get_main_raw_channel, hypercall, RawChannel};
+use std::{io::Write, thread, time::Duration};
+
+mod loader;
+
+enum PacketKind {
+    LoadPlugin = 0,
+}
+
+struct Packet {
+    kind: PacketKind,
+    payload: Vec<u8>,
+}
+
+fn read_packet(reader: &mut RawChannel) -> Option<Packet> {
+    let mut temp_buf = vec![0u8; 4096 as _];
+    temp_buf.fill(1);
+
+    let mut payload = vec![];
+    loop {
+        match reader.read_packet(&mut temp_buf) {
+            0 => break,
+            _ => {
+                payload.write_all(&temp_buf).unwrap();
+            }
+        }
+    }
+
+    if payload.is_empty() {
+        return None;
+    }
+
+    Some(Packet {
+        kind: PacketKind::LoadPlugin,
+        payload,
+    })
+}
+
+fn main() {
+    eprintln!("at main.rs in guest_daemon");
+
+    eprintln!("Daemonizing...");
+    daemonize_me::Daemon::new()
+        .start()
+        .expect("Failed to daemonize");
+    eprintln!("Finished daemonizing");
+
+    while !hypercall::start() {
+        thread::yield_now();
+    }
+
+    let mut channel = get_main_raw_channel("guest_daemon").unwrap();
+
+    loop {
+        match read_packet(&mut channel) {
+            Some(Packet {
+                kind: PacketKind::LoadPlugin,
+                payload,
+            }) => loader::load_plugin(payload),
+            None => {
+                thread::sleep(Duration::from_millis(10));
+            }
+        }
+    }
+}
diff --git a/panda/guest_plugins/panda.mak b/panda/guest_plugins/panda.mak
new file mode 100644
index 00000000000..c84fb4c1014
--- /dev/null
+++ b/panda/guest_plugins/panda.mak
@@ -0,0 +1,53 @@
+include config-target.mak
+
+ifndef PLUGIN_SRC_ROOT
+$(error PLUGIN_SRC_ROOT is not set)
+endif
+ifndef PLUGIN_NAME
+$(error PLUGIN_NAME is not set)
+endif
+
+PLUGIN_DIR = $(realpath $(join $(PLUGIN_SRC_ROOT), /$(PLUGIN_NAME)/))
+PLUGIN_TARGET_DIR=panda/guest_plugins
+PLUGIN_BIN_DIR=$(PLUGIN_TARGET_DIR)/bin
+PLUGIN_OUT_PATH=$(PLUGIN_BIN_DIR)/$(PLUGIN_NAME)
+
+export CARGO_TARGET_ARMV5TE_UNKNOWN_LINUX_MUSLEABI_LINKER ?= arm-linux-musleabi-cc
+export CARGO_TARGET_ARMV5TE_UNKNOWN_LINUX_MUSLEABI_RUSTFLAGS = -C target-cpu=arm926ej-s
+
+export CARGO_TARGET_MIPS_UNKNOWN_LINUX_MUSL_LINKER ?= mips-linux-musl-cc
+#export CARGO_TARGET_MIPS_UNKNOWN_LINUX_MUSL_RUSTFLAGS = "-C linker=mips-linux-musl-cc"
+
+export CARGO_TARGET_MIPSEL_UNKNOWN_LINUX_MUSL_LINKER ?= mipsel-linux-musl-cc
+
+export CARGO_TARGET_AARCH64_UNKNOWN_LINUX_MUSL_LINKER ?= aarch64-linux-musl-cc
+
+export CARGO_TARGET_MIPS64_UNKNOWN_LINUX_MUSLABI64_LINKER ?= mips64-linux-musl-cc
+
+BUILD_TARGET=$(addprefix build-,$(TARGET_NAME))
+
+all: $(BUILD_TARGET)
+
+build-x86_64: TARGET_TRIPLE=x86_64-unknown-linux-musl
+build-x86_64: $(PLUGIN_OUT_PATH)
+
+build-i386: TARGET_TRIPLE=i686-unknown-linux-musl
+build-i386: $(PLUGIN_OUT_PATH)
+
+build-arm: TARGET_TRIPLE=armv5te-unknown-linux-musleabi
+build-arm: $(PLUGIN_OUT_PATH)
+
+build-aarch64: TARGET_TRIPLE=aarch64-unknown-linux-musl
+build-aarch64: $(PLUGIN_OUT_PATH)
+
+build-mips: TARGET_TRIPLE=mips-unknown-linux-musl
+build-mips: $(PLUGIN_OUT_PATH)
+
+build-mipsel: TARGET_TRIPLE=mipsel-unknown-linux-musl
+build-mipsel: $(PLUGIN_OUT_PATH)
+
+build-mips64: TARGET_TRIPLE=mips64-unknown-linux-muslabi64
+build-mips64: $(PLUGIN_OUT_PATH)
+
+# Do not build for PowerPC
+build-ppc: ;
diff --git a/panda/guest_plugins/rust_example/Cargo.lock b/panda/guest_plugins/rust_example/Cargo.lock
new file mode 100644
index 00000000000..568faf6b7d8
--- /dev/null
+++ b/panda/guest_plugins/rust_example/Cargo.lock
@@ -0,0 +1,130 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 3
+
+[[package]]
+name = "bitflags"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
+
+[[package]]
+name = "cfg-if"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
+
+[[package]]
+name = "instant"
+version = "0.1.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7a5bbe824c507c5da5956355e86a746d82e0e1464f65d862cc5e71da70e94b2c"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "lazy_static"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
+
+[[package]]
+name = "libc"
+version = "0.2.109"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f98a04dce437184842841303488f70d0188c5f51437d2a834dc097eafa909a01"
+
+[[package]]
+name = "lock_api"
+version = "0.4.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "712a4d093c9976e24e7dbca41db895dabcbac38eb5f4045393d17a95bdfb1109"
+dependencies = [
+ "scopeguard",
+]
+
+[[package]]
+name = "panda-channels"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a94b07d8bcc852032a8deb91be9d2bbd59421d776a9edb42fc74b40816e7d940"
+dependencies = [
+ "lazy_static",
+ "parking_lot",
+]
+
+[[package]]
+name = "parking_lot"
+version = "0.11.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d17b78036a60663b797adeaee46f5c9dfebb86948d1255007a1d6be0271ff99"
+dependencies = [
+ "instant",
+ "lock_api",
+ "parking_lot_core",
+]
+
+[[package]]
+name = "parking_lot_core"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d76e8e1493bcac0d2766c42737f34458f1c8c50c0d23bcb24ea953affb273216"
+dependencies = [
+ "cfg-if",
+ "instant",
+ "libc",
+ "redox_syscall",
+ "smallvec",
+ "winapi",
+]
+
+[[package]]
+name = "redox_syscall"
+version = "0.2.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8383f39639269cde97d255a32bdb68c047337295414940c68bdd30c2e13203ff"
+dependencies = [
+ "bitflags",
+]
+
+[[package]]
+name = "rust_example"
+version = "0.1.0"
+dependencies = [
+ "panda-channels",
+]
+
+[[package]]
+name = "scopeguard"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d29ab0c6d3fc0ee92fe66e2d99f700eab17a8d57d1c1d3b748380fb20baa78cd"
+
+[[package]]
+name = "smallvec"
+version = "1.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ecab6c735a6bb4139c0caafd0cc3635748bbb3acf4550e8138122099251f309"
+
+[[package]]
+name = "winapi"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
+dependencies = [
+ "winapi-i686-pc-windows-gnu",
+ "winapi-x86_64-pc-windows-gnu",
+]
+
+[[package]]
+name = "winapi-i686-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
+
+[[package]]
+name = "winapi-x86_64-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
diff --git a/panda/guest_plugins/rust_example/Cargo.toml b/panda/guest_plugins/rust_example/Cargo.toml
new file mode 100644
index 00000000000..193c1885fe7
--- /dev/null
+++ b/panda/guest_plugins/rust_example/Cargo.toml
@@ -0,0 +1,7 @@
+[package]
+name = "rust_example"
+version = "0.1.0"
+edition = "2021"
+
+[dependencies]
+panda-channels = "0.3"
diff --git a/panda/guest_plugins/rust_example/Makefile b/panda/guest_plugins/rust_example/Makefile
new file mode 100644
index 00000000000..1458392b517
--- /dev/null
+++ b/panda/guest_plugins/rust_example/Makefile
@@ -0,0 +1,20 @@
+# Remember to:
+# * Add your plugin name to config.panda
+# * Keep your plugin name the same as the folder name and Cargo.toml package name
+
+# Output build artifacts to the build directory
+PLUGIN_ARTIFACTS_DIR = $(PLUGIN_TARGET_DIR)/$(PLUGIN_NAME)/target
+
+# recompile if any of the src/*.rs files changed, or Cargo.toml
+RUST_SOURCE = $(wildcard $(PLUGIN_DIR)/src/*.rs)
+PLUGIN_DEPS=$(RUST_SOURCE) $(PLUGIN_DIR)/Cargo.toml
+
+$(PLUGIN_OUT_PATH): BUILD_RESULT="$(PLUGIN_ARTIFACTS_DIR)/$(TARGET_TRIPLE)/release/$(PLUGIN_NAME)"
+$(PLUGIN_OUT_PATH): $(PLUGIN_DEPS)
+	@echo "  CARGO   $(PLUGIN_NAME) (${TARGET_TRIPLE})"
+	@CARGO_TERM_PROGRESS_WHEN=never cargo build --release \
+		--target=$(TARGET_TRIPLE) \
+		--manifest-path=$(PLUGIN_DIR)/Cargo.toml \
+		--target-dir=$(PLUGIN_ARTIFACTS_DIR)
+	@mkdir -p $(PLUGIN_BIN_DIR)
+	@cp -p $(BUILD_RESULT) $@
diff --git a/panda/guest_plugins/rust_example/src/main.rs b/panda/guest_plugins/rust_example/src/main.rs
new file mode 100644
index 00000000000..e77424c9ff7
--- /dev/null
+++ b/panda/guest_plugins/rust_example/src/main.rs
@@ -0,0 +1,23 @@
+use panda_channels::Channel;
+use std::io::{Read, Write};
+
+fn main() {
+    // This print won't be visible outside of the serial log
+    println!("Hello, world!");
+
+    // Get the main channel for our plugin by name
+    let mut channel = Channel::main("rust_example").unwrap();
+
+    // Write some text to the channel using the standard std::io::Write interface
+    channel.write_all(b"Hello rust_example channel").unwrap();
+
+    // Or use formatting utilties to do so
+    writeln!(&mut channel, "today's lucky number is: {}", 3).unwrap();
+
+    // The channel can also be read from
+    let mut buf = [0; 4];
+    channel.read_exact(&mut buf).unwrap();
+
+    let num = u32::from_le_bytes(buf);
+    writeln!(&mut channel, "the number you sent the guest was: {}", num).unwrap();
+}
diff --git a/panda/guest_plugins/tcp_servers/Cargo.lock b/panda/guest_plugins/tcp_servers/Cargo.lock
new file mode 100644
index 00000000000..cc542916090
--- /dev/null
+++ b/panda/guest_plugins/tcp_servers/Cargo.lock
@@ -0,0 +1,217 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 3
+
+[[package]]
+name = "autocfg"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d468802bab17cbc0cc575e9b053f41e72aa36bfa6b7f55e3529ffa43161b97fa"
+
+[[package]]
+name = "bincode"
+version = "1.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b1f45e9417d87227c7a56d22e471c6206462cba514c7590c09aff4cf6d1ddcad"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "bitflags"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
+
+[[package]]
+name = "cfg-if"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
+
+[[package]]
+name = "instant"
+version = "0.1.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7a5bbe824c507c5da5956355e86a746d82e0e1464f65d862cc5e71da70e94b2c"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "lazy_static"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
+
+[[package]]
+name = "libc"
+version = "0.2.126"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "349d5a591cd28b49e1d1037471617a32ddcda5731b99419008085f72d5a53836"
+
+[[package]]
+name = "lock_api"
+version = "0.4.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "327fa5b6a6940e4699ec49a9beae1ea4845c6bab9314e4f84ac68742139d8c53"
+dependencies = [
+ "autocfg",
+ "scopeguard",
+]
+
+[[package]]
+name = "panda-channels"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "529d17650397380d80c95c6027ffcb48eaf4095a0c513eb7e827f0c3c0e52e9c"
+dependencies = [
+ "lazy_static",
+ "parking_lot",
+]
+
+[[package]]
+name = "parking_lot"
+version = "0.11.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d17b78036a60663b797adeaee46f5c9dfebb86948d1255007a1d6be0271ff99"
+dependencies = [
+ "instant",
+ "lock_api",
+ "parking_lot_core",
+]
+
+[[package]]
+name = "parking_lot_core"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d76e8e1493bcac0d2766c42737f34458f1c8c50c0d23bcb24ea953affb273216"
+dependencies = [
+ "cfg-if",
+ "instant",
+ "libc",
+ "redox_syscall",
+ "smallvec",
+ "winapi",
+]
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.39"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c54b25569025b7fc9651de43004ae593a75ad88543b17178aa5e1b9c4f15f56f"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "proc-net-tcp"
+version = "1.0.0"
+source = "git+https://github.com/panda-re/proc-net-tcp#87de3e9ce7adeda56d75c13dc0b510136ee675b2"
+
+[[package]]
+name = "quote"
+version = "1.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a1feb54ed693b93a84e14094943b84b7c4eae204c512b7ccb95ab0c66d278ad1"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "redox_syscall"
+version = "0.2.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "62f25bc4c7e55e0b0b7a1d43fb893f4fa1361d0abe38b9ce4f323c2adfe6ef42"
+dependencies = [
+ "bitflags",
+]
+
+[[package]]
+name = "scopeguard"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d29ab0c6d3fc0ee92fe66e2d99f700eab17a8d57d1c1d3b748380fb20baa78cd"
+
+[[package]]
+name = "serde"
+version = "1.0.137"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "61ea8d54c77f8315140a05f4c7237403bf38b72704d031543aa1d16abbf517d1"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.137"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1f26faba0c3959972377d3b2d306ee9f71faee9714294e41bb777f83f88578be"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "smallvec"
+version = "1.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2dd574626839106c320a323308629dcb1acfc96e32a8cba364ddc61ac23ee83"
+
+[[package]]
+name = "syn"
+version = "1.0.96"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0748dd251e24453cb8717f0354206b91557e4ec8703673a4b30208f2abaf1ebf"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "tcp_servers"
+version = "0.1.0"
+dependencies = [
+ "bincode",
+ "panda-channels",
+ "proc-net-tcp",
+ "serde",
+ "tcp_shared_types",
+]
+
+[[package]]
+name = "tcp_shared_types"
+version = "0.1.0"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5bd2fe26506023ed7b5e1e315add59d6f584c621d037f9368fea9cfb988f368c"
+
+[[package]]
+name = "winapi"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
+dependencies = [
+ "winapi-i686-pc-windows-gnu",
+ "winapi-x86_64-pc-windows-gnu",
+]
+
+[[package]]
+name = "winapi-i686-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
+
+[[package]]
+name = "winapi-x86_64-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
diff --git a/panda/guest_plugins/tcp_servers/Cargo.toml b/panda/guest_plugins/tcp_servers/Cargo.toml
new file mode 100644
index 00000000000..6ec634079ae
--- /dev/null
+++ b/panda/guest_plugins/tcp_servers/Cargo.toml
@@ -0,0 +1,12 @@
+[package]
+name = "tcp_servers"
+version = "0.1.0"
+edition = "2021"
+
+[dependencies]
+panda-channels = "0.3"
+bincode = "1"
+serde = { version = "1", features = ["derive"] }
+
+proc-net-tcp = { git = "https://github.com/panda-re/proc-net-tcp" }
+tcp_shared_types = { path = "../../plugins/tcp_passthrough/tcp_shared_types" }
diff --git a/panda/guest_plugins/tcp_servers/Makefile b/panda/guest_plugins/tcp_servers/Makefile
new file mode 100644
index 00000000000..1458392b517
--- /dev/null
+++ b/panda/guest_plugins/tcp_servers/Makefile
@@ -0,0 +1,20 @@
+# Remember to:
+# * Add your plugin name to config.panda
+# * Keep your plugin name the same as the folder name and Cargo.toml package name
+
+# Output build artifacts to the build directory
+PLUGIN_ARTIFACTS_DIR = $(PLUGIN_TARGET_DIR)/$(PLUGIN_NAME)/target
+
+# recompile if any of the src/*.rs files changed, or Cargo.toml
+RUST_SOURCE = $(wildcard $(PLUGIN_DIR)/src/*.rs)
+PLUGIN_DEPS=$(RUST_SOURCE) $(PLUGIN_DIR)/Cargo.toml
+
+$(PLUGIN_OUT_PATH): BUILD_RESULT="$(PLUGIN_ARTIFACTS_DIR)/$(TARGET_TRIPLE)/release/$(PLUGIN_NAME)"
+$(PLUGIN_OUT_PATH): $(PLUGIN_DEPS)
+	@echo "  CARGO   $(PLUGIN_NAME) (${TARGET_TRIPLE})"
+	@CARGO_TERM_PROGRESS_WHEN=never cargo build --release \
+		--target=$(TARGET_TRIPLE) \
+		--manifest-path=$(PLUGIN_DIR)/Cargo.toml \
+		--target-dir=$(PLUGIN_ARTIFACTS_DIR)
+	@mkdir -p $(PLUGIN_BIN_DIR)
+	@cp -p $(BUILD_RESULT) $@
diff --git a/panda/guest_plugins/tcp_servers/src/allow_cancel.rs b/panda/guest_plugins/tcp_servers/src/allow_cancel.rs
new file mode 100644
index 00000000000..83da71f9661
--- /dev/null
+++ b/panda/guest_plugins/tcp_servers/src/allow_cancel.rs
@@ -0,0 +1,110 @@
+use std::io::{self, Read, Seek, SeekFrom, Write};
+use std::sync::{
+    atomic::{AtomicBool, Ordering},
+    Arc,
+};
+
+pub struct AllowCancel<T>(T, Arc<AtomicBool>);
+
+#[derive(Clone)]
+pub struct CancelSignal(Arc<AtomicBool>);
+
+impl CancelSignal {
+    pub fn cancel(&self) {
+        self.0.store(true, Ordering::SeqCst)
+    }
+}
+
+impl Clone for AllowCancel<panda_channels::Channel> {
+    fn clone(&self) -> Self {
+        Self(self.0.clone(), Arc::clone(&self.1))
+    }
+}
+
+impl<T> AllowCancel<T> {
+    pub fn new(io: T) -> Self {
+        Self(io, Arc::new(AtomicBool::new(false)))
+    }
+
+    pub fn cancel_signal(&self) -> CancelSignal {
+        CancelSignal(Arc::clone(&self.1))
+    }
+
+    pub fn with_signal(self, cancel_signal: CancelSignal) -> Self {
+        Self(self.0, cancel_signal.0)
+    }
+}
+
+macro_rules! dbg {
+    ($expr:expr) => {
+        //panda_channels::Channel::main(&format!(
+        //    "[{}:{}] {} = {:?}",
+        //    file!(),
+        //    line!(),
+        //    stringify!($expr),
+        //    $expr,
+        //))
+    };
+}
+
+impl<T: Write> Write for AllowCancel<T> {
+    fn write(&mut self, buf: &[u8]) -> std::io::Result<usize> {
+        if !self.1.load(Ordering::SeqCst) {
+            dbg!(buf.len());
+
+            self.0.write(buf)
+        } else {
+            Err(io::Error::new(
+                io::ErrorKind::ConnectionAborted,
+                "Connection ended",
+            ))
+        }
+    }
+
+    fn flush(&mut self) -> io::Result<()> {
+        if !self.1.load(Ordering::SeqCst) {
+            dbg!("flushing");
+
+            self.0.flush()
+        } else {
+            Err(io::Error::new(
+                io::ErrorKind::ConnectionAborted,
+                "Connection ended",
+            ))
+        }
+    }
+}
+
+impl<T: Read> Read for AllowCancel<T> {
+    fn read(&mut self, buf: &mut [u8]) -> io::Result<usize> {
+        if !self.1.load(Ordering::SeqCst) {
+            //dbg!(buf.len());
+
+            self.0.read(buf).map(|len| {
+                if len != 0 {
+                    dbg!(len);
+                }
+
+                len
+            })
+        } else {
+            Err(io::Error::new(
+                io::ErrorKind::ConnectionAborted,
+                "Connection ended",
+            ))
+        }
+    }
+}
+
+impl<T: Seek> Seek for AllowCancel<T> {
+    fn seek(&mut self, pos: SeekFrom) -> io::Result<u64> {
+        if !self.1.load(Ordering::SeqCst) {
+            self.0.seek(pos)
+        } else {
+            Err(io::Error::new(
+                io::ErrorKind::ConnectionAborted,
+                "Connection ended",
+            ))
+        }
+    }
+}
diff --git a/panda/guest_plugins/tcp_servers/src/main.rs b/panda/guest_plugins/tcp_servers/src/main.rs
new file mode 100644
index 00000000000..4b2c4927410
--- /dev/null
+++ b/panda/guest_plugins/tcp_servers/src/main.rs
@@ -0,0 +1,99 @@
+use panda_channels::{Channel, RawChannel};
+use proc_net_tcp::socket_info;
+
+use std::collections::HashMap;
+use std::mem::transmute;
+use std::net::{Ipv4Addr, TcpStream};
+
+use tcp_shared_types::{Request, SocketInfo};
+
+mod allow_cancel;
+use allow_cancel::{AllowCancel, CancelSignal};
+
+fn recv_request(mut channel: &mut Channel) -> Request {
+    loop {
+        if let Ok(request) = bincode::deserialize_from(&mut channel) {
+            break request;
+        }
+
+        std::thread::sleep(std::time::Duration::from_millis(10));
+    }
+}
+
+fn build_socket_list_packet() -> Vec<u8> {
+    let sockets = socket_info()
+        .into_iter()
+        .filter_map(|socket| {
+            socket.ok().map(|socket| SocketInfo {
+                ip: *socket.local_address.ip(),
+                port: socket.local_address.port(),
+                pid: socket.owning_pid,
+                server: socket.is_listening(),
+            })
+        })
+        .collect::<Vec<_>>();
+
+    bincode::serialize(&sockets).unwrap()
+}
+
+fn forward_connection(ip: Ipv4Addr, port: u16, channel_id: u32) -> CancelSignal {
+    let raw = unsafe { transmute(channel_id) };
+
+    let mut write_channel = AllowCancel::new(Channel::from_raw(raw));
+    let mut read_channel = write_channel.clone();
+
+    let cancel_signal = write_channel.cancel_signal();
+
+    let write_socket = TcpStream::connect((ip, port)).unwrap();
+    let read_socket = write_socket.try_clone().unwrap();
+
+    let mut read_socket = AllowCancel::new(read_socket).with_signal(cancel_signal.clone());
+    let mut write_socket = AllowCancel::new(write_socket).with_signal(cancel_signal.clone());
+
+    std::thread::spawn(move || {
+        let _ = std::io::copy(&mut read_channel, &mut write_socket);
+    });
+
+    std::thread::spawn(move || {
+        let _ = std::io::copy(&mut read_socket, &mut write_channel);
+    });
+
+    cancel_signal
+}
+
+fn main() {
+    let mut channel = Channel::main("tcp_servers").unwrap();
+    let mut active_sockets = HashMap::new();
+
+    loop {
+        let request = recv_request(&mut channel);
+
+        // debug??
+        //let _ = Channel::main(&format!("Request: {:?}", request));
+        //panda_channels::debug_output(&);
+        match request {
+            Request::GetSocketList { channel_id } => {
+                eprintln!("Getting socket list...");
+                let socket_list_channel: RawChannel = unsafe { transmute(channel_id) };
+
+                socket_list_channel.write_packet(&build_socket_list_packet());
+            }
+
+            Request::ForwardConnection {
+                ip,
+                port,
+                channel_id,
+            } => {
+                let cancel_signal = forward_connection(ip, port, channel_id);
+
+                active_sockets.insert(channel_id, cancel_signal);
+            }
+
+            Request::CloseSocket { channel_id } => {
+                if let Some(socket) = active_sockets.remove(&channel_id) {
+                    socket.cancel();
+                }
+            }
+        }
+    }
+}
diff --git a/panda/include/panda/plugin.h b/panda/include/panda/plugin.h
index e3b79f895a9..39edeecc3b1 100644
--- a/panda/include/panda/plugin.h
+++ b/panda/include/panda/plugin.h
@@ -159,6 +159,8 @@ char** str_split(char *a_str, const char a_delim);
 extern gchar *panda_argv[MAX_PANDA_PLUGIN_ARGS];
 extern int panda_argc;
 
+
+char *panda_guest_plugin_path(const char *name);
 char* resolve_file_from_plugin_directory(const char* file_name_fmt, const char* name);
 char *panda_plugin_path(const char *name);
 char* panda_shared_library_path(const char* name);
diff --git a/panda/plugins/config.panda b/panda/plugins/config.panda
index 60b8166f4af..92f7580ca38 100644
--- a/panda/plugins/config.panda
+++ b/panda/plugins/config.panda
@@ -12,12 +12,18 @@ dynamic_symbols
 edge_coverage
 filereadmon
 forcedexec
+frida
 gdb
+guest_plugin_example
+guest_plugin_manager
+guest_shell
 hooks
 hooks2
+hyperfuse
 hw_proc_id
 libfi
 lighthouse_coverage
+linjector
 loaded
 loaded_libs
 mem_hooks
@@ -32,6 +38,7 @@ osi_test
 pri
 pri_dwarf
 pri_simple
+tcp_passthrough
 proc_start_linux
 proc_trace
 recctrl
diff --git a/panda/plugins/frida/Cargo.lock b/panda/plugins/frida/Cargo.lock
new file mode 100644
index 00000000000..5bb3343b3ba
--- /dev/null
+++ b/panda/plugins/frida/Cargo.lock
@@ -0,0 +1,608 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 3
+
+[[package]]
+name = "aho-corasick"
+version = "0.7.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e37cfd5e7657ada45f742d6e99ca5788580b5c529dc78faf11ece6dc702656f"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "atty"
+version = "0.2.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d9b39be18770d11421cdb1b9947a45dd3f37e93092cbf377614828a319d5fee8"
+dependencies = [
+ "hermit-abi",
+ "libc",
+ "winapi",
+]
+
+[[package]]
+name = "bitflags"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
+
+[[package]]
+name = "cfg-if"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
+
+[[package]]
+name = "ctor"
+version = "0.1.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ccc0a48a9b826acdf4028595adc9db92caea352f7af011a3034acd172a52a0aa"
+dependencies = [
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "darling"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0d706e75d87e35569db781a9b5e2416cff1236a47ed380831f959382ccd5f858"
+dependencies = [
+ "darling_core",
+ "darling_macro",
+]
+
+[[package]]
+name = "darling_core"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0c960ae2da4de88a91b2d920c2a7233b400bc33cb28453a2987822d8392519b"
+dependencies = [
+ "fnv",
+ "ident_case",
+ "proc-macro2",
+ "quote",
+ "strsim",
+ "syn",
+]
+
+[[package]]
+name = "darling_macro"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d9b5a2f4ac4969822c62224815d069952656cadc7084fdca9751e6d959189b72"
+dependencies = [
+ "darling_core",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "dirs"
+version = "3.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "30baa043103c9d0c2a57cf537cc2f35623889dc0d405e6c3cccfadbc81c71309"
+dependencies = [
+ "dirs-sys",
+]
+
+[[package]]
+name = "dirs-sys"
+version = "0.3.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "03d86534ed367a67548dc68113a0f5db55432fdfbb6e6f9d77704397d95d5780"
+dependencies = [
+ "libc",
+ "redox_users",
+ "winapi",
+]
+
+[[package]]
+name = "doc-comment"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fea41bba32d969b513997752735605054bc0dfa92b4c56bf1189f2e174be7a10"
+
+[[package]]
+name = "env_logger"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "44533bbbb3bb3c1fa17d9f2e4e38bbbaf8396ba82193c4cb1b6445d711445d36"
+dependencies = [
+ "atty",
+ "humantime",
+ "log",
+ "regex",
+ "termcolor",
+]
+
+[[package]]
+name = "fnv"
+version = "1.0.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
+
+[[package]]
+name = "frida"
+version = "0.1.0"
+dependencies = [
+ "log",
+ "panda-re",
+ "parking_lot",
+ "pretty_env_logger",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7fcd999463524c52659517fe2cea98493cfe485d10565e7b0fb07dbba7ad2753"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "wasi",
+]
+
+[[package]]
+name = "ghost"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1a5bcf1bbeab73aa4cf2fde60a846858dc036163c7c33bec309f8d17de785479"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "glib-sys"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c7e9b997a66e9a23d073f2b1abb4dbfc3925e0b8952f67efd8d9b6e168e4cdc1"
+dependencies = [
+ "libc",
+ "system-deps",
+]
+
+[[package]]
+name = "heck"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6d621efb26863f0e9924c6ac577e8275e5e6b77455db64ffa6c65c904e9e132c"
+dependencies = [
+ "unicode-segmentation",
+]
+
+[[package]]
+name = "hermit-abi"
+version = "0.1.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "62b467343b94ba476dcb2500d242dadbb39557df889310ac77c5d99100aaac33"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "humantime"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df004cfca50ef23c36850aaaa59ad52cc70d0e90243c3c7737a4dd32dc7a3c4f"
+dependencies = [
+ "quick-error",
+]
+
+[[package]]
+name = "ident_case"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9e0384b61958566e926dc50660321d12159025e767c18e043daf26b70104c39"
+
+[[package]]
+name = "instant"
+version = "0.1.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7a5bbe824c507c5da5956355e86a746d82e0e1464f65d862cc5e71da70e94b2c"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "inventory"
+version = "0.1.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0eb5160c60ba1e809707918ee329adb99d222888155835c6feedba19f6c3fd4"
+dependencies = [
+ "ctor",
+ "ghost",
+ "inventory-impl",
+]
+
+[[package]]
+name = "inventory-impl"
+version = "0.1.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e41b53715c6f0c4be49510bb82dee2c1e51c8586d885abe65396e82ed518548"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "lazy_static"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
+
+[[package]]
+name = "libc"
+version = "0.2.112"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1b03d17f364a3a042d5e5d46b053bbbf82c92c9430c592dd4c064dc6ee997125"
+
+[[package]]
+name = "libloading"
+version = "0.6.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "351a32417a12d5f7e82c368a66781e307834dae04c6ce0cd4456d52989229883"
+dependencies = [
+ "cfg-if",
+ "winapi",
+]
+
+[[package]]
+name = "lock_api"
+version = "0.4.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "712a4d093c9976e24e7dbca41db895dabcbac38eb5f4045393d17a95bdfb1109"
+dependencies = [
+ "scopeguard",
+]
+
+[[package]]
+name = "log"
+version = "0.4.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "51b9bbe6c47d51fc3e1a9b945965946b4c44142ab8792c50835a980d362c2710"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "memchr"
+version = "2.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "308cc39be01b73d0d18f82a0e7b2a3df85245f84af96fdddc5d202d27e47b86a"
+
+[[package]]
+name = "once_cell"
+version = "1.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da32515d9f6e6e489d7bc9d84c71b060db7247dc035bbe44eac88cf87486d8d5"
+
+[[package]]
+name = "panda-re"
+version = "0.26.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2dfc5b9d238b9f1d4785346b7d611dcc4236f615334e0719afbf3033f8c26e0e"
+dependencies = [
+ "dirs",
+ "glib-sys",
+ "inventory",
+ "lazy_static",
+ "libloading",
+ "once_cell",
+ "panda-re-macros",
+ "panda-re-sys",
+ "paste",
+ "strum 0.20.0",
+ "strum_macros 0.20.1",
+ "thiserror",
+]
+
+[[package]]
+name = "panda-re-macros"
+version = "0.16.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5be1d7a86fc7fc5c32ca9d7b430e5f12f76b664f381c4213c7071d14e88fc588"
+dependencies = [
+ "darling",
+ "doc-comment",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "panda-re-sys"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e00ee000dc315bf4a0a55d78b6d97456a7540d6ed01768da5f5aa89fdb660783"
+
+[[package]]
+name = "parking_lot"
+version = "0.11.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d17b78036a60663b797adeaee46f5c9dfebb86948d1255007a1d6be0271ff99"
+dependencies = [
+ "instant",
+ "lock_api",
+ "parking_lot_core",
+]
+
+[[package]]
+name = "parking_lot_core"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d76e8e1493bcac0d2766c42737f34458f1c8c50c0d23bcb24ea953affb273216"
+dependencies = [
+ "cfg-if",
+ "instant",
+ "libc",
+ "redox_syscall",
+ "smallvec",
+ "winapi",
+]
+
+[[package]]
+name = "paste"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0744126afe1a6dd7f394cb50a716dbe086cb06e255e53d8d0185d82828358fb5"
+
+[[package]]
+name = "pkg-config"
+version = "0.3.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "58893f751c9b0412871a09abd62ecd2a00298c6c83befa223ef98c52aef40cbe"
+
+[[package]]
+name = "pretty_env_logger"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "926d36b9553851b8b0005f1275891b392ee4d2d833852c417ed025477350fb9d"
+dependencies = [
+ "env_logger",
+ "log",
+]
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2f84e92c0f7c9d58328b85a78557813e4bd845130db68d7184635344399423b1"
+dependencies = [
+ "unicode-xid",
+]
+
+[[package]]
+name = "quick-error"
+version = "1.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a1d01941d82fa2ab50be1e79e6714289dd7cde78eba4c074bc5a4374f650dfe0"
+
+[[package]]
+name = "quote"
+version = "1.0.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "38bc8cc6a5f2e3655e0899c1b848643b2562f853f114bfec7be120678e3ace05"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "redox_syscall"
+version = "0.2.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8383f39639269cde97d255a32bdb68c047337295414940c68bdd30c2e13203ff"
+dependencies = [
+ "bitflags",
+]
+
+[[package]]
+name = "redox_users"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "528532f3d801c87aec9def2add9ca802fe569e44a544afe633765267840abe64"
+dependencies = [
+ "getrandom",
+ "redox_syscall",
+]
+
+[[package]]
+name = "regex"
+version = "1.5.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d07a8629359eb56f1e2fb1652bb04212c072a87ba68546a04065d525673ac461"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-syntax"
+version = "0.6.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f497285884f3fcff424ffc933e56d7cbca511def0c9831a7f9b5f6153e3cc89b"
+
+[[package]]
+name = "scopeguard"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d29ab0c6d3fc0ee92fe66e2d99f700eab17a8d57d1c1d3b748380fb20baa78cd"
+
+[[package]]
+name = "serde"
+version = "1.0.131"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4ad69dfbd3e45369132cc64e6748c2d65cdfb001a2b1c232d128b4ad60561c1"
+
+[[package]]
+name = "smallvec"
+version = "1.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ecab6c735a6bb4139c0caafd0cc3635748bbb3acf4550e8138122099251f309"
+
+[[package]]
+name = "strsim"
+version = "0.9.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6446ced80d6c486436db5c078dde11a9f73d42b57fb273121e160b84f63d894c"
+
+[[package]]
+name = "strum"
+version = "0.18.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "57bd81eb48f4c437cadc685403cad539345bf703d78e63707418431cecd4522b"
+
+[[package]]
+name = "strum"
+version = "0.20.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7318c509b5ba57f18533982607f24070a55d353e90d4cae30c467cdb2ad5ac5c"
+
+[[package]]
+name = "strum_macros"
+version = "0.18.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "87c85aa3f8ea653bfd3ddf25f7ee357ee4d204731f6aa9ad04002306f6e2774c"
+dependencies = [
+ "heck",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "strum_macros"
+version = "0.20.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee8bc6b87a5112aeeab1f4a9f7ab634fe6cbefc4850006df31267f4cfb9e3149"
+dependencies = [
+ "heck",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "syn"
+version = "1.0.82"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8daf5dd0bb60cbd4137b1b587d2fc0ae729bc07cf01cd70b36a1ed5ade3b9d59"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-xid",
+]
+
+[[package]]
+name = "system-deps"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0f3ecc17269a19353b3558b313bba738b25d82993e30d62a18406a24aba4649b"
+dependencies = [
+ "heck",
+ "pkg-config",
+ "strum 0.18.0",
+ "strum_macros 0.18.0",
+ "thiserror",
+ "toml",
+ "version-compare",
+]
+
+[[package]]
+name = "termcolor"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2dfed899f0eb03f32ee8c6a0aabdb8a7949659e3466561fc0adf54e26d88c5f4"
+dependencies = [
+ "winapi-util",
+]
+
+[[package]]
+name = "thiserror"
+version = "1.0.30"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "854babe52e4df1653706b98fcfc05843010039b406875930a70e4d9644e5c417"
+dependencies = [
+ "thiserror-impl",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "1.0.30"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aa32fd3f627f367fe16f893e2597ae3c05020f8bba2666a4e6ea73d377e5714b"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "toml"
+version = "0.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a31142970826733df8241ef35dc040ef98c679ab14d7c3e54d827099b3acecaa"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "unicode-segmentation"
+version = "1.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8895849a949e7845e06bd6dc1aa51731a103c42707010a5b591c0038fb73385b"
+
+[[package]]
+name = "unicode-xid"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ccb82d61f80a663efe1f787a51b16b5a51e3314d6ac365b08639f52387b33f3"
+
+[[package]]
+name = "version-compare"
+version = "0.0.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d63556a25bae6ea31b52e640d7c41d1ab27faba4ccb600013837a3d0b3994ca1"
+
+[[package]]
+name = "wasi"
+version = "0.10.2+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fd6fbd9a79829dd1ad0cc20627bf1ed606756a7f77edff7b66b7064f9cb327c6"
+
+[[package]]
+name = "winapi"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
+dependencies = [
+ "winapi-i686-pc-windows-gnu",
+ "winapi-x86_64-pc-windows-gnu",
+]
+
+[[package]]
+name = "winapi-i686-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
+
+[[package]]
+name = "winapi-util"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "70ec6ce85bb158151cae5e5c87f95a8e97d2c0c4b001223f33a334e3ce5de178"
+dependencies = [
+ "winapi",
+]
+
+[[package]]
+name = "winapi-x86_64-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
diff --git a/panda/plugins/frida/Cargo.toml b/panda/plugins/frida/Cargo.toml
new file mode 100644
index 00000000000..a7c8a783ec0
--- /dev/null
+++ b/panda/plugins/frida/Cargo.toml
@@ -0,0 +1,26 @@
+[package]
+name = "frida"
+version = "0.1.0"
+authors = ["Jordan McLeod <Jordan.McLeod@ll.mit.edu>"]
+edition = "2018"
+
+[lib]
+crate-type = ["cdylib"]
+
+[dependencies]
+panda-re = { version = "0.26", default-features = false }
+parking_lot = "0.11"
+log = "0.4"
+pretty_env_logger = "0.4"
+
+[features]
+default = ["x86_64"]
+
+x86_64 = ["panda-re/x86_64"]
+i386 = ["panda-re/i386"]
+arm = ["panda-re/arm"]
+ppc = ["panda-re/ppc"]
+mips = ["panda-re/mips"]
+mipsel = ["panda-re/mipsel"]
+aarch64 = ["panda-re/aarch64"]
+mips64 = ["panda-re/mips64"]
diff --git a/panda/plugins/frida/Makefile b/panda/plugins/frida/Makefile
new file mode 100644
index 00000000000..2234476df57
--- /dev/null
+++ b/panda/plugins/frida/Makefile
@@ -0,0 +1,18 @@
+# Don't forget to add your plugin to config.panda!
+
+# Build rust plugins with make!
+
+# The main rule for your plugin. List all object-file dependencies.
+
+PANDA_PATH = $(realpath $(shell pwd)/..)
+PLUGIN_DIR = $(realpath $(join $(PANDA_PATH), /../panda/plugins/$(PLUGIN_NAME)/))
+RUST_SOURCE = $(wildcard $(PLUGIN_DIR)/src/*.rs)
+PLUGIN_ARTIFACTS_DIR = $(PLUGIN_TARGET_DIR)/$(PLUGIN_NAME)/target
+
+$(PLUGIN_TARGET_DIR)/panda_$(PLUGIN_NAME).so : $(RUST_SOURCE) $(PLUGIN_DIR)/Cargo.toml
+	@echo "  CARGO   $(PLUGIN_DIR)"
+	@CARGO_TERM_PROGRESS_WHEN=never cargo build --release \
+		--no-default-features --features=$(TARGET_NAME) \
+		--manifest-path=$(PLUGIN_DIR)/Cargo.toml \
+		--target-dir=$(PLUGIN_ARTIFACTS_DIR)
+	@cp -p $(PLUGIN_ARTIFACTS_DIR)/release/lib$(PLUGIN_NAME).so $@
diff --git a/panda/plugins/frida/README.md b/panda/plugins/frida/README.md
new file mode 100644
index 00000000000..cbd6557ee87
--- /dev/null
+++ b/panda/plugins/frida/README.md
@@ -0,0 +1,6 @@
+# Guest Plugin Example
+
+This is a basic example of how to build a PANDA plugin for communicating with a guest
+plugin using Rust.
+
+See [`guest_plugins/rust_example`](/panda/guest_plugins/rust_example) for the corresponding guest plugin.
diff --git a/panda/plugins/frida/src/lib.rs b/panda/plugins/frida/src/lib.rs
new file mode 100644
index 00000000000..a721f07e8ec
--- /dev/null
+++ b/panda/plugins/frida/src/lib.rs
@@ -0,0 +1,33 @@
+use panda::{plugins::guest_plugin_manager::*, prelude::*};
+use parking_lot::{const_mutex, Mutex};
+use std::io::Write;
+use std::net::{TcpListener, TcpStream};
+
+#[channel_recv]
+fn message_recv(_: u32, data: &[u8]) {
+    if let Some(socket) = SOCKET.lock().as_mut() {
+        socket.write_all(data).unwrap();
+    }
+}
+
+static SOCKET: Mutex<Option<TcpStream>> = const_mutex(None);
+
+#[panda::init]
+fn init(_: &mut PluginHandle) {
+    pretty_env_logger::init_custom_env("FRIDA_LOG");
+    let mut channel = load_guest_plugin("frida_server", message_recv);
+
+    std::thread::spawn(move || {
+        let server = TcpListener::bind("localhost:27042").unwrap();
+
+        for socket in server.incoming() {
+            let mut socket = socket.unwrap();
+            log::debug!("Socket connected");
+            SOCKET.lock().replace(socket.try_clone().unwrap());
+            log::debug!("Forwarding socket...");
+            std::io::copy(&mut socket, &mut channel).unwrap();
+            log::debug!("Socket disconnected");
+            SOCKET.lock().take();
+        }
+    });
+}
diff --git a/panda/plugins/guest_plugin_example/Cargo.lock b/panda/plugins/guest_plugin_example/Cargo.lock
new file mode 100644
index 00000000000..6631ad52b15
--- /dev/null
+++ b/panda/plugins/guest_plugin_example/Cargo.lock
@@ -0,0 +1,489 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 3
+
+[[package]]
+name = "bitflags"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
+
+[[package]]
+name = "cfg-if"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
+
+[[package]]
+name = "ctor"
+version = "0.1.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ccc0a48a9b826acdf4028595adc9db92caea352f7af011a3034acd172a52a0aa"
+dependencies = [
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "darling"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0d706e75d87e35569db781a9b5e2416cff1236a47ed380831f959382ccd5f858"
+dependencies = [
+ "darling_core",
+ "darling_macro",
+]
+
+[[package]]
+name = "darling_core"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0c960ae2da4de88a91b2d920c2a7233b400bc33cb28453a2987822d8392519b"
+dependencies = [
+ "fnv",
+ "ident_case",
+ "proc-macro2",
+ "quote",
+ "strsim",
+ "syn",
+]
+
+[[package]]
+name = "darling_macro"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d9b5a2f4ac4969822c62224815d069952656cadc7084fdca9751e6d959189b72"
+dependencies = [
+ "darling_core",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "dirs"
+version = "3.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "30baa043103c9d0c2a57cf537cc2f35623889dc0d405e6c3cccfadbc81c71309"
+dependencies = [
+ "dirs-sys",
+]
+
+[[package]]
+name = "dirs-sys"
+version = "0.3.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "03d86534ed367a67548dc68113a0f5db55432fdfbb6e6f9d77704397d95d5780"
+dependencies = [
+ "libc",
+ "redox_users",
+ "winapi",
+]
+
+[[package]]
+name = "doc-comment"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fea41bba32d969b513997752735605054bc0dfa92b4c56bf1189f2e174be7a10"
+
+[[package]]
+name = "fnv"
+version = "1.0.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
+
+[[package]]
+name = "getrandom"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7fcd999463524c52659517fe2cea98493cfe485d10565e7b0fb07dbba7ad2753"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "wasi",
+]
+
+[[package]]
+name = "ghost"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1a5bcf1bbeab73aa4cf2fde60a846858dc036163c7c33bec309f8d17de785479"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "glib-sys"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c7e9b997a66e9a23d073f2b1abb4dbfc3925e0b8952f67efd8d9b6e168e4cdc1"
+dependencies = [
+ "libc",
+ "system-deps",
+]
+
+[[package]]
+name = "guest_plugin_example"
+version = "0.1.0"
+dependencies = [
+ "panda-re",
+ "parking_lot",
+]
+
+[[package]]
+name = "heck"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6d621efb26863f0e9924c6ac577e8275e5e6b77455db64ffa6c65c904e9e132c"
+dependencies = [
+ "unicode-segmentation",
+]
+
+[[package]]
+name = "ident_case"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9e0384b61958566e926dc50660321d12159025e767c18e043daf26b70104c39"
+
+[[package]]
+name = "instant"
+version = "0.1.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7a5bbe824c507c5da5956355e86a746d82e0e1464f65d862cc5e71da70e94b2c"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "inventory"
+version = "0.1.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0eb5160c60ba1e809707918ee329adb99d222888155835c6feedba19f6c3fd4"
+dependencies = [
+ "ctor",
+ "ghost",
+ "inventory-impl",
+]
+
+[[package]]
+name = "inventory-impl"
+version = "0.1.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e41b53715c6f0c4be49510bb82dee2c1e51c8586d885abe65396e82ed518548"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "lazy_static"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
+
+[[package]]
+name = "libc"
+version = "0.2.112"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1b03d17f364a3a042d5e5d46b053bbbf82c92c9430c592dd4c064dc6ee997125"
+
+[[package]]
+name = "libloading"
+version = "0.6.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "351a32417a12d5f7e82c368a66781e307834dae04c6ce0cd4456d52989229883"
+dependencies = [
+ "cfg-if",
+ "winapi",
+]
+
+[[package]]
+name = "lock_api"
+version = "0.4.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "712a4d093c9976e24e7dbca41db895dabcbac38eb5f4045393d17a95bdfb1109"
+dependencies = [
+ "scopeguard",
+]
+
+[[package]]
+name = "once_cell"
+version = "1.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da32515d9f6e6e489d7bc9d84c71b060db7247dc035bbe44eac88cf87486d8d5"
+
+[[package]]
+name = "panda-re"
+version = "0.26.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2dfc5b9d238b9f1d4785346b7d611dcc4236f615334e0719afbf3033f8c26e0e"
+dependencies = [
+ "dirs",
+ "glib-sys",
+ "inventory",
+ "lazy_static",
+ "libloading",
+ "once_cell",
+ "panda-re-macros",
+ "panda-re-sys",
+ "paste",
+ "strum 0.20.0",
+ "strum_macros 0.20.1",
+ "thiserror",
+]
+
+[[package]]
+name = "panda-re-macros"
+version = "0.16.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5be1d7a86fc7fc5c32ca9d7b430e5f12f76b664f381c4213c7071d14e88fc588"
+dependencies = [
+ "darling",
+ "doc-comment",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "panda-re-sys"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e00ee000dc315bf4a0a55d78b6d97456a7540d6ed01768da5f5aa89fdb660783"
+
+[[package]]
+name = "parking_lot"
+version = "0.11.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d17b78036a60663b797adeaee46f5c9dfebb86948d1255007a1d6be0271ff99"
+dependencies = [
+ "instant",
+ "lock_api",
+ "parking_lot_core",
+]
+
+[[package]]
+name = "parking_lot_core"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d76e8e1493bcac0d2766c42737f34458f1c8c50c0d23bcb24ea953affb273216"
+dependencies = [
+ "cfg-if",
+ "instant",
+ "libc",
+ "redox_syscall",
+ "smallvec",
+ "winapi",
+]
+
+[[package]]
+name = "paste"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0744126afe1a6dd7f394cb50a716dbe086cb06e255e53d8d0185d82828358fb5"
+
+[[package]]
+name = "pkg-config"
+version = "0.3.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "58893f751c9b0412871a09abd62ecd2a00298c6c83befa223ef98c52aef40cbe"
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2f84e92c0f7c9d58328b85a78557813e4bd845130db68d7184635344399423b1"
+dependencies = [
+ "unicode-xid",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "38bc8cc6a5f2e3655e0899c1b848643b2562f853f114bfec7be120678e3ace05"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "redox_syscall"
+version = "0.2.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8383f39639269cde97d255a32bdb68c047337295414940c68bdd30c2e13203ff"
+dependencies = [
+ "bitflags",
+]
+
+[[package]]
+name = "redox_users"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "528532f3d801c87aec9def2add9ca802fe569e44a544afe633765267840abe64"
+dependencies = [
+ "getrandom",
+ "redox_syscall",
+]
+
+[[package]]
+name = "scopeguard"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d29ab0c6d3fc0ee92fe66e2d99f700eab17a8d57d1c1d3b748380fb20baa78cd"
+
+[[package]]
+name = "serde"
+version = "1.0.131"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4ad69dfbd3e45369132cc64e6748c2d65cdfb001a2b1c232d128b4ad60561c1"
+
+[[package]]
+name = "smallvec"
+version = "1.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ecab6c735a6bb4139c0caafd0cc3635748bbb3acf4550e8138122099251f309"
+
+[[package]]
+name = "strsim"
+version = "0.9.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6446ced80d6c486436db5c078dde11a9f73d42b57fb273121e160b84f63d894c"
+
+[[package]]
+name = "strum"
+version = "0.18.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "57bd81eb48f4c437cadc685403cad539345bf703d78e63707418431cecd4522b"
+
+[[package]]
+name = "strum"
+version = "0.20.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7318c509b5ba57f18533982607f24070a55d353e90d4cae30c467cdb2ad5ac5c"
+
+[[package]]
+name = "strum_macros"
+version = "0.18.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "87c85aa3f8ea653bfd3ddf25f7ee357ee4d204731f6aa9ad04002306f6e2774c"
+dependencies = [
+ "heck",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "strum_macros"
+version = "0.20.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee8bc6b87a5112aeeab1f4a9f7ab634fe6cbefc4850006df31267f4cfb9e3149"
+dependencies = [
+ "heck",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "syn"
+version = "1.0.82"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8daf5dd0bb60cbd4137b1b587d2fc0ae729bc07cf01cd70b36a1ed5ade3b9d59"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-xid",
+]
+
+[[package]]
+name = "system-deps"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0f3ecc17269a19353b3558b313bba738b25d82993e30d62a18406a24aba4649b"
+dependencies = [
+ "heck",
+ "pkg-config",
+ "strum 0.18.0",
+ "strum_macros 0.18.0",
+ "thiserror",
+ "toml",
+ "version-compare",
+]
+
+[[package]]
+name = "thiserror"
+version = "1.0.30"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "854babe52e4df1653706b98fcfc05843010039b406875930a70e4d9644e5c417"
+dependencies = [
+ "thiserror-impl",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "1.0.30"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aa32fd3f627f367fe16f893e2597ae3c05020f8bba2666a4e6ea73d377e5714b"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "toml"
+version = "0.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a31142970826733df8241ef35dc040ef98c679ab14d7c3e54d827099b3acecaa"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "unicode-segmentation"
+version = "1.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8895849a949e7845e06bd6dc1aa51731a103c42707010a5b591c0038fb73385b"
+
+[[package]]
+name = "unicode-xid"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ccb82d61f80a663efe1f787a51b16b5a51e3314d6ac365b08639f52387b33f3"
+
+[[package]]
+name = "version-compare"
+version = "0.0.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d63556a25bae6ea31b52e640d7c41d1ab27faba4ccb600013837a3d0b3994ca1"
+
+[[package]]
+name = "wasi"
+version = "0.10.2+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fd6fbd9a79829dd1ad0cc20627bf1ed606756a7f77edff7b66b7064f9cb327c6"
+
+[[package]]
+name = "winapi"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
+dependencies = [
+ "winapi-i686-pc-windows-gnu",
+ "winapi-x86_64-pc-windows-gnu",
+]
+
+[[package]]
+name = "winapi-i686-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
+
+[[package]]
+name = "winapi-x86_64-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
diff --git a/panda/plugins/guest_plugin_example/Cargo.toml b/panda/plugins/guest_plugin_example/Cargo.toml
new file mode 100644
index 00000000000..c9147ac88eb
--- /dev/null
+++ b/panda/plugins/guest_plugin_example/Cargo.toml
@@ -0,0 +1,24 @@
+[package]
+name = "guest_plugin_example"
+version = "0.1.0"
+authors = ["Jordan McLeod <Jordan.McLeod@ll.mit.edu>"]
+edition = "2018"
+
+[lib]
+crate-type = ["cdylib"]
+
+[dependencies]
+panda-re = { version = "0.26", default-features = false }
+parking_lot = "0.11"
+
+[features]
+default = ["x86_64"]
+
+x86_64 = ["panda-re/x86_64"]
+i386 = ["panda-re/i386"]
+arm = ["panda-re/arm"]
+ppc = ["panda-re/ppc"]
+mips = ["panda-re/mips"]
+mipsel = ["panda-re/mipsel"]
+aarch64 = ["panda-re/aarch64"]
+mips64 = ["panda-re/mips64"]
diff --git a/panda/plugins/guest_plugin_example/Makefile b/panda/plugins/guest_plugin_example/Makefile
new file mode 100644
index 00000000000..2234476df57
--- /dev/null
+++ b/panda/plugins/guest_plugin_example/Makefile
@@ -0,0 +1,18 @@
+# Don't forget to add your plugin to config.panda!
+
+# Build rust plugins with make!
+
+# The main rule for your plugin. List all object-file dependencies.
+
+PANDA_PATH = $(realpath $(shell pwd)/..)
+PLUGIN_DIR = $(realpath $(join $(PANDA_PATH), /../panda/plugins/$(PLUGIN_NAME)/))
+RUST_SOURCE = $(wildcard $(PLUGIN_DIR)/src/*.rs)
+PLUGIN_ARTIFACTS_DIR = $(PLUGIN_TARGET_DIR)/$(PLUGIN_NAME)/target
+
+$(PLUGIN_TARGET_DIR)/panda_$(PLUGIN_NAME).so : $(RUST_SOURCE) $(PLUGIN_DIR)/Cargo.toml
+	@echo "  CARGO   $(PLUGIN_DIR)"
+	@CARGO_TERM_PROGRESS_WHEN=never cargo build --release \
+		--no-default-features --features=$(TARGET_NAME) \
+		--manifest-path=$(PLUGIN_DIR)/Cargo.toml \
+		--target-dir=$(PLUGIN_ARTIFACTS_DIR)
+	@cp -p $(PLUGIN_ARTIFACTS_DIR)/release/lib$(PLUGIN_NAME).so $@
diff --git a/panda/plugins/guest_plugin_example/README.md b/panda/plugins/guest_plugin_example/README.md
new file mode 100644
index 00000000000..cbd6557ee87
--- /dev/null
+++ b/panda/plugins/guest_plugin_example/README.md
@@ -0,0 +1,6 @@
+# Guest Plugin Example
+
+This is a basic example of how to build a PANDA plugin for communicating with a guest
+plugin using Rust.
+
+See [`guest_plugins/rust_example`](/panda/guest_plugins/rust_example) for the corresponding guest plugin.
diff --git a/panda/plugins/guest_plugin_example/src/lib.rs b/panda/plugins/guest_plugin_example/src/lib.rs
new file mode 100644
index 00000000000..5ea9fd93a08
--- /dev/null
+++ b/panda/plugins/guest_plugin_example/src/lib.rs
@@ -0,0 +1,18 @@
+use panda::{plugins::guest_plugin_manager::*, prelude::*};
+use std::io::Write;
+
+// Print out all the messages sent from the guest
+#[channel_recv]
+fn message_recv(_: u32, data: &str) {
+    println!("[rust_example] {}", data);
+}
+
+#[panda::init]
+fn init(_: &mut PluginHandle) {
+    let mut channel = load_guest_plugin("rust_example", message_recv);
+
+    // the `rust_example` plugin expects to be sent a u32 which it will log
+    // so let's sent it one.
+    let num: u32 = 1234;
+    channel.write_all(&num.to_le_bytes()).unwrap();
+}
diff --git a/panda/plugins/guest_plugin_example/try_it.py b/panda/plugins/guest_plugin_example/try_it.py
new file mode 100644
index 00000000000..8df6c35a626
--- /dev/null
+++ b/panda/plugins/guest_plugin_example/try_it.py
@@ -0,0 +1,13 @@
+from pandare import Panda
+
+panda = Panda(generic="x86_64")
+panda.load_plugin("guest_plugin_example")
+
+@panda.queue_blocking
+def run_cmd():
+    panda.revert_sync("root")
+    panda.run_serial_cmd("cat", no_timeout=True)
+    panda.run_serial_cmd("cat", no_timeout=True)
+    panda.end_analysis()
+
+panda.run()
diff --git a/panda/plugins/guest_plugin_manager/Cargo.lock b/panda/plugins/guest_plugin_manager/Cargo.lock
new file mode 100644
index 00000000000..738462e6c85
--- /dev/null
+++ b/panda/plugins/guest_plugin_manager/Cargo.lock
@@ -0,0 +1,511 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 3
+
+[[package]]
+name = "bitflags"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf1de2fe8c75bc145a2f577add951f8134889b4795d47466a54a5c846d691693"
+
+[[package]]
+name = "cfg-if"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
+
+[[package]]
+name = "crossbeam-queue"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b10ddc024425c88c2ad148c1b0fd53f4c6d38db9697c9f1588381212fa657c9"
+dependencies = [
+ "cfg-if",
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-utils"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d82cfc11ce7f2c3faef78d8a684447b40d503d9681acebed6cb728d45940c4db"
+dependencies = [
+ "cfg-if",
+ "lazy_static",
+]
+
+[[package]]
+name = "ctor"
+version = "0.1.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5e98e2ad1a782e33928b96fc3948e7c355e5af34ba4de7670fe8bac2a3b2006d"
+dependencies = [
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "darling"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0d706e75d87e35569db781a9b5e2416cff1236a47ed380831f959382ccd5f858"
+dependencies = [
+ "darling_core",
+ "darling_macro",
+]
+
+[[package]]
+name = "darling_core"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0c960ae2da4de88a91b2d920c2a7233b400bc33cb28453a2987822d8392519b"
+dependencies = [
+ "fnv",
+ "ident_case",
+ "proc-macro2",
+ "quote",
+ "strsim",
+ "syn",
+]
+
+[[package]]
+name = "darling_macro"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d9b5a2f4ac4969822c62224815d069952656cadc7084fdca9751e6d959189b72"
+dependencies = [
+ "darling_core",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "dirs"
+version = "3.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "30baa043103c9d0c2a57cf537cc2f35623889dc0d405e6c3cccfadbc81c71309"
+dependencies = [
+ "dirs-sys",
+]
+
+[[package]]
+name = "dirs-sys"
+version = "0.3.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "03d86534ed367a67548dc68113a0f5db55432fdfbb6e6f9d77704397d95d5780"
+dependencies = [
+ "libc",
+ "redox_users",
+ "winapi",
+]
+
+[[package]]
+name = "doc-comment"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fea41bba32d969b513997752735605054bc0dfa92b4c56bf1189f2e174be7a10"
+
+[[package]]
+name = "fnv"
+version = "1.0.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
+
+[[package]]
+name = "getrandom"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7fcd999463524c52659517fe2cea98493cfe485d10565e7b0fb07dbba7ad2753"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "wasi",
+]
+
+[[package]]
+name = "ghost"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1a5bcf1bbeab73aa4cf2fde60a846858dc036163c7c33bec309f8d17de785479"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "glib-sys"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c7e9b997a66e9a23d073f2b1abb4dbfc3925e0b8952f67efd8d9b6e168e4cdc1"
+dependencies = [
+ "libc",
+ "system-deps",
+]
+
+[[package]]
+name = "guest_plugin_manager"
+version = "0.1.0"
+dependencies = [
+ "crossbeam-queue",
+ "lazy_static",
+ "once_cell",
+ "panda-re",
+ "parking_lot",
+]
+
+[[package]]
+name = "heck"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6d621efb26863f0e9924c6ac577e8275e5e6b77455db64ffa6c65c904e9e132c"
+dependencies = [
+ "unicode-segmentation",
+]
+
+[[package]]
+name = "ident_case"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9e0384b61958566e926dc50660321d12159025e767c18e043daf26b70104c39"
+
+[[package]]
+name = "instant"
+version = "0.1.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "716d3d89f35ac6a34fd0eed635395f4c3b76fa889338a4632e5231a8684216bd"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "inventory"
+version = "0.1.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0f0f7efb804ec95e33db9ad49e4252f049e37e8b0a4652e3cd61f7999f2eff7f"
+dependencies = [
+ "ctor",
+ "ghost",
+ "inventory-impl",
+]
+
+[[package]]
+name = "inventory-impl"
+version = "0.1.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "75c094e94816723ab936484666968f5b58060492e880f3c8d00489a1e244fa51"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "lazy_static"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
+
+[[package]]
+name = "libc"
+version = "0.2.98"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "320cfe77175da3a483efed4bc0adc1968ca050b098ce4f2f1c13a56626128790"
+
+[[package]]
+name = "libloading"
+version = "0.6.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "351a32417a12d5f7e82c368a66781e307834dae04c6ce0cd4456d52989229883"
+dependencies = [
+ "cfg-if",
+ "winapi",
+]
+
+[[package]]
+name = "lock_api"
+version = "0.4.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "712a4d093c9976e24e7dbca41db895dabcbac38eb5f4045393d17a95bdfb1109"
+dependencies = [
+ "scopeguard",
+]
+
+[[package]]
+name = "once_cell"
+version = "1.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "692fcb63b64b1758029e0a96ee63e049ce8c5948587f2f7208df04625e5f6b56"
+
+[[package]]
+name = "panda-re"
+version = "0.25.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bfd819f91df8381e0b6255a47f749a1dd52589c34a0b007bbee41f27630ff7ee"
+dependencies = [
+ "dirs",
+ "glib-sys",
+ "inventory",
+ "lazy_static",
+ "libloading",
+ "once_cell",
+ "panda-re-macros",
+ "panda-re-sys",
+ "paste",
+ "strum 0.20.0",
+ "strum_macros 0.20.1",
+ "thiserror",
+]
+
+[[package]]
+name = "panda-re-macros"
+version = "0.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d807aa10d149e5ddde4e9cd386df1791efda6d6716077349da9f78cb6d32460"
+dependencies = [
+ "darling",
+ "doc-comment",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "panda-re-sys"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e00ee000dc315bf4a0a55d78b6d97456a7540d6ed01768da5f5aa89fdb660783"
+
+[[package]]
+name = "parking_lot"
+version = "0.11.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d17b78036a60663b797adeaee46f5c9dfebb86948d1255007a1d6be0271ff99"
+dependencies = [
+ "instant",
+ "lock_api",
+ "parking_lot_core",
+]
+
+[[package]]
+name = "parking_lot_core"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d76e8e1493bcac0d2766c42737f34458f1c8c50c0d23bcb24ea953affb273216"
+dependencies = [
+ "cfg-if",
+ "instant",
+ "libc",
+ "redox_syscall",
+ "smallvec",
+ "winapi",
+]
+
+[[package]]
+name = "paste"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "acbf547ad0c65e31259204bd90935776d1c693cec2f4ff7abb7a1bbbd40dfe58"
+
+[[package]]
+name = "pkg-config"
+version = "0.3.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3831453b3449ceb48b6d9c7ad7c96d5ea673e9b470a1dc578c2ce6521230884c"
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0d8caf72986c1a598726adc988bb5984792ef84f5ee5aa50209145ee8077038"
+dependencies = [
+ "unicode-xid",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3d0b9745dc2debf507c8422de05d7226cc1f0644216dfdfead988f9b1ab32a7"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "redox_syscall"
+version = "0.2.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5ab49abadf3f9e1c4bc499e8845e152ad87d2ad2d30371841171169e9d75feee"
+dependencies = [
+ "bitflags",
+]
+
+[[package]]
+name = "redox_users"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "528532f3d801c87aec9def2add9ca802fe569e44a544afe633765267840abe64"
+dependencies = [
+ "getrandom",
+ "redox_syscall",
+]
+
+[[package]]
+name = "scopeguard"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d29ab0c6d3fc0ee92fe66e2d99f700eab17a8d57d1c1d3b748380fb20baa78cd"
+
+[[package]]
+name = "serde"
+version = "1.0.126"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec7505abeacaec74ae4778d9d9328fe5a5d04253220a85c4ee022239fc996d03"
+
+[[package]]
+name = "smallvec"
+version = "1.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ecab6c735a6bb4139c0caafd0cc3635748bbb3acf4550e8138122099251f309"
+
+[[package]]
+name = "strsim"
+version = "0.9.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6446ced80d6c486436db5c078dde11a9f73d42b57fb273121e160b84f63d894c"
+
+[[package]]
+name = "strum"
+version = "0.18.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "57bd81eb48f4c437cadc685403cad539345bf703d78e63707418431cecd4522b"
+
+[[package]]
+name = "strum"
+version = "0.20.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7318c509b5ba57f18533982607f24070a55d353e90d4cae30c467cdb2ad5ac5c"
+
+[[package]]
+name = "strum_macros"
+version = "0.18.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "87c85aa3f8ea653bfd3ddf25f7ee357ee4d204731f6aa9ad04002306f6e2774c"
+dependencies = [
+ "heck",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "strum_macros"
+version = "0.20.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee8bc6b87a5112aeeab1f4a9f7ab634fe6cbefc4850006df31267f4cfb9e3149"
+dependencies = [
+ "heck",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "syn"
+version = "1.0.74"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1873d832550d4588c3dbc20f01361ab00bfe741048f71e3fecf145a7cc18b29c"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-xid",
+]
+
+[[package]]
+name = "system-deps"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0f3ecc17269a19353b3558b313bba738b25d82993e30d62a18406a24aba4649b"
+dependencies = [
+ "heck",
+ "pkg-config",
+ "strum 0.18.0",
+ "strum_macros 0.18.0",
+ "thiserror",
+ "toml",
+ "version-compare",
+]
+
+[[package]]
+name = "thiserror"
+version = "1.0.26"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93119e4feac1cbe6c798c34d3a53ea0026b0b1de6a120deef895137c0529bfe2"
+dependencies = [
+ "thiserror-impl",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "1.0.26"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "060d69a0afe7796bf42e9e2ff91f5ee691fb15c53d38b4b62a9a53eb23164745"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "toml"
+version = "0.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a31142970826733df8241ef35dc040ef98c679ab14d7c3e54d827099b3acecaa"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "unicode-segmentation"
+version = "1.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8895849a949e7845e06bd6dc1aa51731a103c42707010a5b591c0038fb73385b"
+
+[[package]]
+name = "unicode-xid"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ccb82d61f80a663efe1f787a51b16b5a51e3314d6ac365b08639f52387b33f3"
+
+[[package]]
+name = "version-compare"
+version = "0.0.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d63556a25bae6ea31b52e640d7c41d1ab27faba4ccb600013837a3d0b3994ca1"
+
+[[package]]
+name = "wasi"
+version = "0.10.2+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fd6fbd9a79829dd1ad0cc20627bf1ed606756a7f77edff7b66b7064f9cb327c6"
+
+[[package]]
+name = "winapi"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
+dependencies = [
+ "winapi-i686-pc-windows-gnu",
+ "winapi-x86_64-pc-windows-gnu",
+]
+
+[[package]]
+name = "winapi-i686-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
+
+[[package]]
+name = "winapi-x86_64-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
diff --git a/panda/plugins/guest_plugin_manager/Cargo.toml b/panda/plugins/guest_plugin_manager/Cargo.toml
new file mode 100644
index 00000000000..04de54370a2
--- /dev/null
+++ b/panda/plugins/guest_plugin_manager/Cargo.toml
@@ -0,0 +1,28 @@
+[package]
+name = "guest_plugin_manager"
+version = "0.1.0"
+authors = ["Luke Craig <Luke.Craig@ll.mit.edu>", "Jordan McLeod <Jordan.McLeod@ll.mit.edu>"]
+edition = "2018"
+
+[lib]
+crate-type = ["cdylib"]
+path = "./src/guest_plugin_manager.rs"
+
+[dependencies]
+panda-re = { version = "0.25", default-features = false }
+crossbeam-queue = "0.3.2"
+parking_lot = "0.11.2"
+lazy_static = "1.4.0"
+once_cell = "1.8.0"
+
+[features]
+default = ["x86_64"]
+
+x86_64 = ["panda-re/x86_64"]
+i386 = ["panda-re/i386"]
+arm = ["panda-re/arm"]
+ppc = ["panda-re/ppc"]
+mips = ["panda-re/mips"]
+mipsel = ["panda-re/mipsel"]
+aarch64 = ["panda-re/aarch64"]
+mips64 = ["panda-re/mips64"]
diff --git a/panda/plugins/guest_plugin_manager/Makefile b/panda/plugins/guest_plugin_manager/Makefile
new file mode 100644
index 00000000000..d34fc42957c
--- /dev/null
+++ b/panda/plugins/guest_plugin_manager/Makefile
@@ -0,0 +1,18 @@
+# Don't forget to add your plugin to config.panda!
+
+# Build rust plugins with make!
+
+# The main rule for your plugin. List all object-file dependencies.
+
+PANDA_PATH = $(realpath $(shell pwd)/..)
+PLUGIN_DIR = $(realpath $(join $(PANDA_PATH), /../panda/plugins/$(PLUGIN_NAME)/))
+RUST_SOURCE = $(shell find $(PLUGIN_DIR)/src/ -name "*.rs")
+PLUGIN_ARTIFACTS_DIR = $(PLUGIN_TARGET_DIR)/$(PLUGIN_NAME)/target
+
+$(PLUGIN_TARGET_DIR)/panda_$(PLUGIN_NAME).so : $(RUST_SOURCE) $(PLUGIN_DIR)/Cargo.toml
+	@echo "  CARGO   $(PLUGIN_DIR)"
+	@CARGO_TERM_PROGRESS_WHEN=never cargo build --release \
+		--no-default-features --features=$(TARGET_NAME) \
+		--manifest-path=$(PLUGIN_DIR)/Cargo.toml \
+		--target-dir=$(PLUGIN_ARTIFACTS_DIR)
+	@cp -p $(PLUGIN_ARTIFACTS_DIR)/release/lib$(PLUGIN_NAME).so $@
diff --git a/panda/plugins/guest_plugin_manager/README.md b/panda/plugins/guest_plugin_manager/README.md
new file mode 100644
index 00000000000..5a6e48a76c6
--- /dev/null
+++ b/panda/plugins/guest_plugin_manager/README.md
@@ -0,0 +1,94 @@
+# Guest Plugin Manager
+
+The guest plugin manager is a PANDA plugin which handles loading guest agent plugins 
+into the guest, managing communication channels between the guest and the host. 
+Typical usage involves writing a host PANDA plugin which calls the plugin manager in
+order to load the executable, then loading that PANDA plugin as normal (from either the
+PANDA command line or from pypanda).
+
+Currently the guest plugin manager only supports Linux guests via the `linjector` plugin
+however support for other guest OS' would be possible in the presence of other backends.
+The responsibility of `linjector` is, as the name would imply, inject a single binary
+into the guest as a new process. The guest plugin manager uses this capability in order
+to load the "Guest Daemon", an executable running the guest responsible for handling
+the spawning of future guest processes and is responsible for communicating with the
+guest_plugin_manager directly.
+
+**Note:** injection of `guest_daemon` plugin must be done before guest plugin manager takes effect.
+
+## APIs and Callbacks
+
+---
+
+Name: **add_guest_plugin**
+
+Signature:
+
+```c
+typedef ChannelId (*add_guest_plugin)(GuestPlugin);
+```
+
+Description: Adds a guest plugin to be loaded, returns a channel ID representing the
+main channel of the to-be-loaded plugin. Writes to this channel ID before plugin
+load will be queued and will thus be available when the plugin begins reading.
+
+---
+
+Name: **channel_write**
+
+Signature:
+
+```c
+typedef void (*channel_write)(ChannelId, const u8*, size_t);
+```
+
+Description: Writes bytes from a buffer to the given channel ID, queuing them up for 
+the next guest plugin read. The buffer is copied into a new allocation before being 
+added to the queue, so the act of writing has no strict lifetime requirements.
+
+---
+
+Name: **get_channel_from_name**
+
+Signature:
+
+```c
+typedef ChannelId (*get_channel_from_name)(const char*);
+```
+
+Description:
+
+Given the name of a plugin or channel, return the associated channel, panicking
+if a channel of the given name cannot be found. Channel name should be passed
+as a null-terminated string.
+
+The provided string has no lifetime requirements, but must be a non-null pointer
+to a valid C string.
+
+---
+
+## Types
+
+```c
+// A globally unique identifier for a given channel
+typedef uint32_t ChannelId;
+
+// ChannelId - the unique identifier for the channel the message came from
+// const unsigned char* - a pointer to the data being sent from the guest
+// size_t - the length of the data buffer in bytes
+typedef void (*ChannelCB)(ChannelId, const unsigned char*, size_t);
+
+// A plugin to be passed to guest_plugin_manager to be registered
+typedef struct guest_plugin {
+    // A unique name for the given plugin, provided as a non-null C string
+    const char* plugin_name;
+
+    // An optional path to load the guest agent binary. If null, a lookup will be
+    // performed to find the binary from the given name. If non-null must be a valid
+    // C string.
+    const char* guest_binary_path;
+
+    // A callback for when this guest plugin sends a message to the host
+    ChannelCB msg_recieve_cb;
+} GuestPlugin;
+```
diff --git a/panda/plugins/guest_plugin_manager/guest_plugin_manager_ppp.h b/panda/plugins/guest_plugin_manager/guest_plugin_manager_ppp.h
new file mode 100644
index 00000000000..7f4db0ae3e1
--- /dev/null
+++ b/panda/plugins/guest_plugin_manager/guest_plugin_manager_ppp.h
@@ -0,0 +1,11 @@
+#ifndef __GUEST_PLUGIN_MANAGER_PPP_H
+#define __GUEST_PLUGIN_MANAGER_PPP_H
+// BEGIN_PYPANDA_NEEDS_THIS -- do not delete this comment bc pypanda
+// api autogen needs it.  And don't put any compiler directives
+// between this and END_PYPANDA_NEEDS_THIS except includes of other
+// files in this directory that contain subsections like this one.
+
+PPP_CB_TYPEDEF(void,on_guest_agent_load,CPUState *);
+
+// END_PYPANDA_NEEDS_THIS -- do not delete this comment!
+#endif
diff --git a/panda/plugins/guest_plugin_manager/rustfmt.toml b/panda/plugins/guest_plugin_manager/rustfmt.toml
new file mode 100644
index 00000000000..5c8d9318b3b
--- /dev/null
+++ b/panda/plugins/guest_plugin_manager/rustfmt.toml
@@ -0,0 +1 @@
+max_width = 80
\ No newline at end of file
diff --git a/panda/plugins/guest_plugin_manager/src/guest_plugin_manager.rs b/panda/plugins/guest_plugin_manager/src/guest_plugin_manager.rs
new file mode 100644
index 00000000000..41868b1fc43
--- /dev/null
+++ b/panda/plugins/guest_plugin_manager/src/guest_plugin_manager.rs
@@ -0,0 +1,148 @@
+use panda::plugins::guest_plugin_manager::guest_plugin_path;
+use panda::prelude::*;
+use panda::PppCallback;
+
+use std::convert::TryFrom;
+use std::sync::atomic::{AtomicBool, Ordering};
+
+mod hyp_regs;
+use hyp_regs::{get_hyp_reg, set_hyp_ret_reg};
+
+mod interface;
+use interface::hci::{
+    hyp_error, hyp_get_channel_by_name, hyp_get_manager, hyp_read, hyp_start,
+    hyp_stop, hyp_write,
+};
+
+const MAGIC: usize = 0x1337c0d3;
+
+#[derive(Copy, Clone)]
+pub enum HcCmd {
+    Start = 1,        /* start new action */
+    Stop,             /* stop action */
+    Read,             /* read buffer from hypervisor */
+    Write,            /* write buffer TO hypervisor*/
+    Error,            /* report error to hypervisor*/
+    GetManager,       /* returns unique chanenl ID to manager from plugin */
+    GetChannelByName, /* returns existing channel mapped to unique name */
+}
+
+impl TryFrom<usize> for HcCmd {
+    type Error = ();
+
+    fn try_from(value: usize) -> Result<Self, ()> {
+        match value {
+            1 => Ok(HcCmd::Start),
+            2 => Ok(HcCmd::Stop),
+            3 => Ok(HcCmd::Read),
+            4 => Ok(HcCmd::Write),
+            5 => Ok(HcCmd::Error),
+            6 => Ok(HcCmd::GetManager),
+            7 => Ok(HcCmd::GetChannelByName),
+            _ => Err(()),
+        }
+    }
+}
+
+#[panda::guest_hypercall]
+fn hypercall_handler(cpu: &mut CPUState) -> bool {
+    let magicval = get_hyp_reg(cpu, 0);
+    if magicval == MAGIC {
+        let action = get_hyp_reg(cpu, 1);
+        // dbg!(action);
+        let chan_id = get_hyp_reg(cpu, 2) as u32;
+        let arg1 = get_hyp_reg(cpu, 3);
+        let arg2 = get_hyp_reg(cpu, 4);
+
+        let retval = match HcCmd::try_from(action) {
+            Ok(HcCmd::Start) => hyp_start(cpu, chan_id, arg1, arg2),
+            Ok(HcCmd::Write) => hyp_write(cpu, chan_id, arg1, arg2),
+            Ok(HcCmd::Read) => hyp_read(cpu, chan_id, arg1, arg2),
+            Ok(HcCmd::Stop) => hyp_stop(cpu, chan_id, arg1, arg2),
+            Ok(HcCmd::Error) => hyp_error(cpu, chan_id, arg1, arg2),
+            Ok(HcCmd::GetManager) => hyp_get_manager(cpu, chan_id, arg1, arg2),
+            Ok(HcCmd::GetChannelByName) => {
+                hyp_get_channel_by_name(cpu, chan_id, arg1, arg2)
+            }
+            _ => None,
+        };
+
+        if let Some(retval) = retval {
+            set_hyp_ret_reg(cpu, retval);
+        }
+
+        true
+    } else {
+        false
+    }
+}
+
+#[derive(PandaArgs)]
+#[name = "linjector"]
+struct Linjector {
+    guest_binary: String,
+    proc_name: String,
+}
+
+#[derive(PandaArgs)]
+#[name = "guest_plugin_manager"]
+struct Args {
+    #[arg(default = "cat")]
+    proc_name: String,
+}
+
+panda::plugin_import! {
+    static LINJECTOR: LinjectorApi = extern "linjector" {
+        callbacks {
+            fn before_guest_inject(cpu: &mut CPUState);
+        }
+    };
+}
+
+panda::export_ppp_callback! {
+    pub(crate) fn on_guest_agent_load(cpu: &mut CPUState);
+}
+
+lazy_static::lazy_static! {
+    static ref ARGS: Args = Args::from_panda_args();
+}
+
+static LOADED: AtomicBool = AtomicBool::new(false);
+
+#[panda::init]
+fn init(_: &mut PluginHandle) -> bool {
+    if LOADED.swap(true, Ordering::SeqCst) {
+        return true;
+    }
+
+    lazy_static::initialize(&ARGS);
+    interface::daemon_manager::init();
+
+    //let guest_binary = guest_plugin_path("guest_daemon")
+    //    .expect("Failed to retrieve guest_daemon guest plugin path")
+    //    .to_string_lossy()
+    //    .into_owned();
+
+    //assert!(
+    //    panda::os::family().is_linux(),
+    //    "Guest plugin manager currently only supports Linux"
+    //);
+
+    //std::thread::spawn(|| {
+    //    // TODO: automatically decide which process to inject into
+    //    panda::require_plugin(&Linjector {
+    //        guest_binary,
+    //        proc_name: ARGS.proc_name.clone(),
+    //    });
+
+    //    PppCallback::new()
+    //        .before_guest_inject(|cpu| on_guest_agent_load::trigger(cpu));
+    //});
+
+    true
+}
+
+#[panda::uninit]
+fn exit(_: &mut PluginHandle) {
+    println!("Exiting");
+}
diff --git a/panda/plugins/guest_plugin_manager/src/hyp_regs.rs b/panda/plugins/guest_plugin_manager/src/hyp_regs.rs
new file mode 100644
index 00000000000..2a19e082f50
--- /dev/null
+++ b/panda/plugins/guest_plugin_manager/src/hyp_regs.rs
@@ -0,0 +1,54 @@
+use panda::{
+    prelude::*,
+    regs::{
+        get_reg, set_reg,
+        Reg::{self, *},
+    },
+};
+
+// =================== Register Order ===================
+#[cfg(feature = "i386")]
+pub const REG_ORDER: [Reg; 5] = [EAX, EBX, ECX, EDX, EDI];
+
+#[cfg(feature = "x86_64")]
+pub const REG_ORDER: [Reg; 5] = [RAX, RBX, RCX, RDX, RDI];
+
+#[cfg(feature = "arm")]
+pub const REG_ORDER: [Reg; 5] = [R0, R1, R2, R3, R4];
+
+#[cfg(any(feature = "mips", feature = "mipsel", feature = "mips64"))]
+pub const REG_ORDER: [Reg; 5] = [V0, A0, A1, A2, A3];
+
+#[cfg(feature = "aarch64")]
+pub const REG_ORDER: [Reg; 5] = [X0, X1, X2, X3, X4];
+
+#[cfg(feature = "ppc")]
+pub const REG_ORDER: [Reg; 5] = [R3, R4, R5, R6, R7];
+
+// =================== Return Value ===================
+#[cfg(feature = "i386")]
+pub const RET_REG: Reg = EAX;
+
+#[cfg(feature = "x86_64")]
+pub const RET_REG: Reg = RAX;
+
+#[cfg(feature = "arm")]
+pub const RET_REG: Reg = R0;
+
+#[cfg(any(feature = "mips", feature = "mipsel", feature = "mips64"))]
+pub const RET_REG: Reg = V0;
+
+#[cfg(feature = "aarch64")]
+pub const RET_REG: Reg = X0;
+
+#[cfg(feature = "ppc")]
+pub const RET_REG: Reg = R3;
+
+pub fn get_hyp_reg(cpu: &mut CPUState, num: usize) -> usize {
+    let reg_to_read = REG_ORDER[num];
+    get_reg(cpu, reg_to_read) as usize
+}
+
+pub fn set_hyp_ret_reg(cpu: &mut CPUState, value: usize) {
+    set_reg(cpu, RET_REG, value as target_ulong)
+}
diff --git a/panda/plugins/guest_plugin_manager/src/interface/api.rs b/panda/plugins/guest_plugin_manager/src/interface/api.rs
new file mode 100644
index 00000000000..69988ec855e
--- /dev/null
+++ b/panda/plugins/guest_plugin_manager/src/interface/api.rs
@@ -0,0 +1,80 @@
+use super::channels::add_channel;
+use super::daemon_manager::load_binary;
+use std::ffi::CStr;
+use std::os::raw::c_char;
+use std::slice::from_raw_parts;
+
+use super::channels::{publish_message_to_guest, ChannelCB, ChannelId};
+
+#[repr(C)]
+pub struct GuestPlugin {
+    /// A unique name for the given plugin, provided as a non-null C string
+    pub plugin_name: *const c_char,
+
+    /// An optional path to load the guest agent binary. If null, a lookup will be
+    /// performed to find the binary from the given name. If non-null must be a valid
+    /// C string.
+    pub guest_binary_path: *const c_char,
+
+    /// A callback for when this guest plugin sends a message to the host
+    pub msg_receive_cb: ChannelCB,
+}
+
+/// Adds a guest plugin to be loaded, returns a channel ID representing the
+/// main channel of the to-be-loaded plugin. Writes to this channel ID before plugin
+/// load will be queued and will thus be available when the plugin begins reading.
+#[no_mangle]
+pub extern "C" fn add_guest_plugin(plugin: GuestPlugin) -> ChannelId {
+    let path_temp;
+    let name = unsafe { CStr::from_ptr(plugin.plugin_name).to_string_lossy() };
+    let binary_path = if plugin.guest_binary_path.is_null() {
+        match crate::guest_plugin_path(&name) {
+            Some(path) => {
+                path_temp = path;
+                path_temp.to_string_lossy()
+            }
+            None => panic!(
+                "No guest plugin path was provided but plugin {0:?} \
+                    could not be found, ensure {0:?} has been built.",
+                name
+            ),
+        }
+    } else {
+        unsafe { CStr::from_ptr(plugin.guest_binary_path).to_string_lossy() }
+    };
+    load_binary(&binary_path);
+    add_channel(Some(&name), plugin.msg_receive_cb)
+}
+
+/// Create a new anonymous channel provided a callback for writes performed by the guest,
+/// returning the channel ID.
+#[no_mangle]
+pub unsafe extern "C" fn allocate_channel(callback: ChannelCB) -> ChannelId {
+    add_channel(None, callback)
+}
+
+/// Writes bytes from a buffer to the given channel ID, queuing them up for the next
+/// guest plugin read. The buffer is copied into a new allocation before being added
+/// to the queue, so the act of writing has no strict lifetime requirements.
+#[no_mangle]
+pub unsafe extern "C" fn channel_write(
+    channel: ChannelId,
+    buf: *const u8,
+    buf_len: usize,
+) {
+    publish_message_to_guest(channel, from_raw_parts(buf, buf_len).to_vec())
+}
+
+/// Given the name of a plugin or channel, return the associated channel, panicking
+/// if a channel of the given name cannot be found. Channel name should be passed
+/// as a null-terminated string.
+///
+/// The provided string has no lifetime requirements, but must be a non-null pointer
+/// to a valid C string.
+#[no_mangle]
+pub extern "C" fn get_channel_from_name(
+    channel_name: *const c_char,
+) -> ChannelId {
+    let name = unsafe { CStr::from_ptr(channel_name).to_string_lossy() };
+    super::channels::get_channel_from_name(&name).unwrap()
+}
diff --git a/panda/plugins/guest_plugin_manager/src/interface/channels.rs b/panda/plugins/guest_plugin_manager/src/interface/channels.rs
new file mode 100644
index 00000000000..8182a6ad902
--- /dev/null
+++ b/panda/plugins/guest_plugin_manager/src/interface/channels.rs
@@ -0,0 +1,103 @@
+use crossbeam_queue::SegQueue;
+use lazy_static::lazy_static;
+use parking_lot::RwLock;
+use std::collections::HashMap;
+use std::sync::atomic::{AtomicU32, Ordering};
+
+pub type ChannelId = u32;
+pub type ChannelCB = extern "C" fn(ChannelId, *const u8, usize);
+
+static NEXT_CHANNEL_NUMBER: AtomicU32 = AtomicU32::new(0);
+
+lazy_static! {
+    static ref CHANNELS: RwLock<HashMap<ChannelId, Channel>> =
+        RwLock::new(HashMap::new());
+}
+
+struct Channel {
+    name: Option<String>,
+    msg_receive_cb: ChannelCB,
+    message_queue: SegQueue<Vec<u8>>,
+}
+
+pub fn add_channel(p_name: Option<&str>, cb: ChannelCB) -> ChannelId {
+    let mut plugins = CHANNELS.write();
+    let channel_id = NEXT_CHANNEL_NUMBER.fetch_add(1, Ordering::SeqCst);
+    if plugins
+        .insert(
+            channel_id,
+            Channel {
+                name: p_name.map(ToString::to_string),
+                msg_receive_cb: cb,
+                message_queue: SegQueue::new(),
+            },
+        )
+        .is_some()
+    {
+        panic!("We've somehow added a duplicate ID");
+    }
+    println!("Added channel {} FD: {}", p_name.unwrap_or("?"), channel_id);
+    channel_id
+}
+
+pub fn poll_plugin_message(channel_id: ChannelId) -> Option<Vec<u8>> {
+    let pm = CHANNELS.read();
+    if let Some(plugin) = pm.get(&channel_id) {
+        plugin.message_queue.pop()
+    } else {
+        panic!("poll_plugin_message for plugin with incorrect ID");
+    }
+}
+
+pub fn requeue_plugin_message(channel_id: ChannelId, message: Vec<u8>) {
+    let pm = CHANNELS.read();
+    let plugin = pm.get(&channel_id).unwrap();
+    let len = plugin.message_queue.len();
+
+    plugin.message_queue.push(message);
+
+    // len won't be greater than single digit, this is fine
+    for _ in 0..len {
+        plugin
+            .message_queue
+            .push(plugin.message_queue.pop().unwrap());
+    }
+}
+
+pub fn publish_message_from_guest(channel_id: ChannelId, msg: Vec<u8>) {
+    let pm = CHANNELS.read();
+    if let Some(plugin) = pm.get(&channel_id) {
+        let buf_ptr = msg.as_ptr();
+        (plugin.msg_receive_cb)(channel_id, buf_ptr, msg.len())
+    } else {
+        println!("failed publish message to FD {}", channel_id);
+    }
+}
+
+pub fn publish_message_to_guest(channel_id: ChannelId, msg: Vec<u8>) {
+    let pm = CHANNELS.read();
+    if let Some(plugin) = pm.get(&channel_id) {
+        // println!("message pushed");
+        plugin.message_queue.push(msg)
+    } else {
+        println!("failed to publish message");
+    }
+}
+
+pub fn get_channel_from_name(p_name: &str) -> Option<ChannelId> {
+    // let unnamed = "unnamed".to_owned();
+    println!("channel_from_name");
+    for ch in CHANNELS.read().iter() {
+        println!(
+            "channel name: {} FD: {}",
+            &ch.1.name.as_ref().unwrap_or(&"unnamed".to_string()),
+            ch.0
+        );
+    }
+
+    CHANNELS
+        .read()
+        .iter()
+        .find(|(_, v)| v.name.as_deref() == Some(p_name))
+        .map(|x| *x.0)
+}
diff --git a/panda/plugins/guest_plugin_manager/src/interface/daemon_manager.rs b/panda/plugins/guest_plugin_manager/src/interface/daemon_manager.rs
new file mode 100644
index 00000000000..cdd0bf279f5
--- /dev/null
+++ b/panda/plugins/guest_plugin_manager/src/interface/daemon_manager.rs
@@ -0,0 +1,54 @@
+use super::channels::{add_channel, publish_message_to_guest, ChannelId};
+use once_cell::sync::OnceCell;
+use std::path::Path;
+
+const CHANNEL_NAME: &str = "guest_daemon";
+static CHANNEL_DESC: OnceCell<ChannelId> = OnceCell::new();
+
+enum PacketKind {
+    LoadPlugin = 0,
+}
+
+#[allow(dead_code)]
+struct Packet {
+    kind: PacketKind,
+    payload: Vec<u8>,
+}
+
+#[allow(dead_code)]
+impl PacketKind {
+    fn from(kind: u32) -> Option<Self> {
+        match kind {
+            0 => Some(Self::LoadPlugin),
+            _ => None,
+        }
+    }
+}
+
+extern "C" fn read_callback(
+    _channel_id: ChannelId,
+    _ptr: *const u8,
+    _len: usize,
+) {
+}
+
+pub fn load_binary(binary_path: &str) {
+    if Path::new(binary_path).is_file() {
+        if let Ok(binary) = std::fs::read(binary_path) {
+            for chunk in binary.chunks(4096) {
+                let cd = CHANNEL_DESC.get().unwrap();
+                publish_message_to_guest(*cd, chunk.to_owned());
+            }
+        } else {
+            panic!("Failed to read binary at {}", binary_path);
+        }
+    } else {
+        panic!("failed to check for file {}", binary_path);
+    }
+}
+
+pub fn init() {
+    CHANNEL_DESC
+        .set(add_channel(Some(CHANNEL_NAME), read_callback))
+        .unwrap();
+}
diff --git a/panda/plugins/guest_plugin_manager/src/interface/hci.rs b/panda/plugins/guest_plugin_manager/src/interface/hci.rs
new file mode 100644
index 00000000000..bcd394cffff
--- /dev/null
+++ b/panda/plugins/guest_plugin_manager/src/interface/hci.rs
@@ -0,0 +1,105 @@
+use super::channels::{
+    get_channel_from_name, poll_plugin_message, publish_message_from_guest,
+    requeue_plugin_message, ChannelId,
+};
+use super::plugin_manager::new_manager_channel;
+use crate::MAGIC;
+use panda::mem::{virtual_memory_read, virtual_memory_write};
+use panda::prelude::*;
+
+pub fn hyp_start(
+    _cpu: &mut CPUState,
+    _channel_id: ChannelId,
+    _arg1: usize,
+    _arg2: usize,
+) -> Option<usize> {
+    println!("start");
+    Some(!MAGIC)
+}
+pub fn hyp_stop(
+    _cpu: &mut CPUState,
+    _channel_id: ChannelId,
+    _arg1: usize,
+    _arg2: usize,
+) -> Option<usize> {
+    println!("stop");
+    None
+}
+pub fn hyp_read(
+    cpu: &mut CPUState,
+    channel_id: ChannelId,
+    addr: usize,
+    max_size: usize,
+) -> Option<usize> {
+    if let Some(mut msg) = poll_plugin_message(channel_id) {
+        if msg.len() > max_size {
+            requeue_plugin_message(channel_id, msg[max_size..].to_owned());
+            msg.truncate(max_size);
+        }
+        // could check max len more
+        virtual_memory_write(cpu, addr as target_ulong, &msg);
+        Some(msg.len())
+    } else {
+        Some(0)
+    }
+}
+pub fn hyp_write(
+    cpu: &mut CPUState,
+    channel_id: ChannelId,
+    buf_ptr: usize,
+    buf_size: usize,
+) -> Option<usize> {
+    if let Ok(buf_out) =
+        virtual_memory_read(cpu, buf_ptr as target_ulong, buf_size)
+    {
+        let bytes_read = buf_out.len();
+        publish_message_from_guest(channel_id, buf_out);
+
+        Some(bytes_read)
+    } else {
+        println!("Failed to read virtual memory in hyp_write");
+        None
+    }
+}
+pub fn hyp_error(
+    _cpu: &mut CPUState,
+    _channel_id: ChannelId,
+    _arg1: usize,
+    _arg2: usize,
+) -> Option<usize> {
+    println!("error");
+    None
+}
+
+pub fn hyp_get_manager(
+    _cpu: &mut CPUState,
+    _channel_id: ChannelId,
+    _arg1: usize,
+    _arg2: usize,
+) -> Option<usize> {
+    dbg!(Some(new_manager_channel() as usize))
+}
+
+pub fn hyp_get_channel_by_name(
+    cpu: &mut CPUState,
+    _channel_id: ChannelId,
+    buf_ptr: usize,
+    buf_size: usize,
+) -> Option<usize> {
+    println!("channel_by_name");
+    if let Ok(buf_out) =
+        virtual_memory_read(cpu, buf_ptr as target_ulong, buf_size)
+    {
+        if let Some(cd) =
+            get_channel_from_name(dbg!(&String::from_utf8_lossy(&buf_out)))
+        {
+            println!("found channel number {}", cd);
+            Some(cd as usize)
+        } else {
+            println!("failed to find channel number");
+            Some(-1_isize as usize)
+        }
+    } else {
+        panic!("Failed to read virtual memory in hyp_write");
+    }
+}
diff --git a/panda/plugins/guest_plugin_manager/src/interface/mod.rs b/panda/plugins/guest_plugin_manager/src/interface/mod.rs
new file mode 100644
index 00000000000..b732c698581
--- /dev/null
+++ b/panda/plugins/guest_plugin_manager/src/interface/mod.rs
@@ -0,0 +1,5 @@
+pub mod api;
+pub mod plugin_manager;
+pub mod hci;
+pub mod channels;
+pub mod daemon_manager;
\ No newline at end of file
diff --git a/panda/plugins/guest_plugin_manager/src/interface/plugin_manager.rs b/panda/plugins/guest_plugin_manager/src/interface/plugin_manager.rs
new file mode 100644
index 00000000000..228e67db58a
--- /dev/null
+++ b/panda/plugins/guest_plugin_manager/src/interface/plugin_manager.rs
@@ -0,0 +1,61 @@
+use super::channels::{add_channel, publish_message_to_guest, ChannelId};
+use std::convert::TryFrom;
+use std::mem::size_of;
+use std::slice::from_raw_parts;
+
+type OperationID = u32;
+
+enum ManagerOp {
+    GetChannelFromName = 0,
+    DebugOutput = 2,
+}
+
+impl TryFrom<usize> for ManagerOp {
+    type Error = ();
+
+    fn try_from(value: usize) -> Result<Self, ()> {
+        match value {
+            0 => Ok(ManagerOp::GetChannelFromName),
+            2 => Ok(ManagerOp::DebugOutput),
+            _ => Err(()),
+        }
+    }
+}
+
+fn get_channel_from_name(origin_channel: ChannelId, buffer: Vec<u8>) {
+    let plugin_name = String::from_utf8_lossy(&buffer).into_owned();
+    if let Some(channel_id) =
+        super::channels::get_channel_from_name(&plugin_name)
+    {
+        println!(
+            "success got channel from name {} FD is {}",
+            plugin_name, channel_id
+        );
+        let buf = u32::to_le_bytes(channel_id);
+
+        publish_message_to_guest(origin_channel, buf.to_vec());
+    } else {
+        println!("Failed to get channel from name");
+    }
+}
+
+extern "C" fn read_callback(channel_id: ChannelId, ptr: *const u8, len: usize) {
+    let mut buf = unsafe { from_raw_parts(ptr, len).to_vec() };
+    const OPSIZE: usize = size_of::<OperationID>();
+    let mut operation: [u8; OPSIZE] = [0; 4];
+    operation.copy_from_slice(&buf[..OPSIZE]);
+    let op_num = OperationID::from_le_bytes(operation);
+    buf.drain(0..OPSIZE);
+    match ManagerOp::try_from(op_num as usize) {
+        Ok(ManagerOp::GetChannelFromName) => {
+            get_channel_from_name(channel_id, buf)
+        }
+        Ok(ManagerOp::DebugOutput) => {}
+        _ => {}
+    }
+}
+
+pub fn new_manager_channel() -> ChannelId {
+    dbg!(add_channel(None, read_callback))
+}
+
diff --git a/panda/plugins/guest_shell/Cargo.lock b/panda/plugins/guest_shell/Cargo.lock
new file mode 100644
index 00000000000..2127edfa02b
--- /dev/null
+++ b/panda/plugins/guest_shell/Cargo.lock
@@ -0,0 +1,489 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 3
+
+[[package]]
+name = "bitflags"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
+
+[[package]]
+name = "cfg-if"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
+
+[[package]]
+name = "ctor"
+version = "0.1.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ccc0a48a9b826acdf4028595adc9db92caea352f7af011a3034acd172a52a0aa"
+dependencies = [
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "darling"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0d706e75d87e35569db781a9b5e2416cff1236a47ed380831f959382ccd5f858"
+dependencies = [
+ "darling_core",
+ "darling_macro",
+]
+
+[[package]]
+name = "darling_core"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0c960ae2da4de88a91b2d920c2a7233b400bc33cb28453a2987822d8392519b"
+dependencies = [
+ "fnv",
+ "ident_case",
+ "proc-macro2",
+ "quote",
+ "strsim",
+ "syn",
+]
+
+[[package]]
+name = "darling_macro"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d9b5a2f4ac4969822c62224815d069952656cadc7084fdca9751e6d959189b72"
+dependencies = [
+ "darling_core",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "dirs"
+version = "3.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "30baa043103c9d0c2a57cf537cc2f35623889dc0d405e6c3cccfadbc81c71309"
+dependencies = [
+ "dirs-sys",
+]
+
+[[package]]
+name = "dirs-sys"
+version = "0.3.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "03d86534ed367a67548dc68113a0f5db55432fdfbb6e6f9d77704397d95d5780"
+dependencies = [
+ "libc",
+ "redox_users",
+ "winapi",
+]
+
+[[package]]
+name = "doc-comment"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fea41bba32d969b513997752735605054bc0dfa92b4c56bf1189f2e174be7a10"
+
+[[package]]
+name = "fnv"
+version = "1.0.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
+
+[[package]]
+name = "getrandom"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7fcd999463524c52659517fe2cea98493cfe485d10565e7b0fb07dbba7ad2753"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "wasi",
+]
+
+[[package]]
+name = "ghost"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1a5bcf1bbeab73aa4cf2fde60a846858dc036163c7c33bec309f8d17de785479"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "glib-sys"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c7e9b997a66e9a23d073f2b1abb4dbfc3925e0b8952f67efd8d9b6e168e4cdc1"
+dependencies = [
+ "libc",
+ "system-deps",
+]
+
+[[package]]
+name = "guest_shell"
+version = "0.1.0"
+dependencies = [
+ "panda-re",
+ "parking_lot",
+]
+
+[[package]]
+name = "heck"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6d621efb26863f0e9924c6ac577e8275e5e6b77455db64ffa6c65c904e9e132c"
+dependencies = [
+ "unicode-segmentation",
+]
+
+[[package]]
+name = "ident_case"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9e0384b61958566e926dc50660321d12159025e767c18e043daf26b70104c39"
+
+[[package]]
+name = "instant"
+version = "0.1.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7a5bbe824c507c5da5956355e86a746d82e0e1464f65d862cc5e71da70e94b2c"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "inventory"
+version = "0.1.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0eb5160c60ba1e809707918ee329adb99d222888155835c6feedba19f6c3fd4"
+dependencies = [
+ "ctor",
+ "ghost",
+ "inventory-impl",
+]
+
+[[package]]
+name = "inventory-impl"
+version = "0.1.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e41b53715c6f0c4be49510bb82dee2c1e51c8586d885abe65396e82ed518548"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "lazy_static"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
+
+[[package]]
+name = "libc"
+version = "0.2.109"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f98a04dce437184842841303488f70d0188c5f51437d2a834dc097eafa909a01"
+
+[[package]]
+name = "libloading"
+version = "0.6.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "351a32417a12d5f7e82c368a66781e307834dae04c6ce0cd4456d52989229883"
+dependencies = [
+ "cfg-if",
+ "winapi",
+]
+
+[[package]]
+name = "lock_api"
+version = "0.4.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "712a4d093c9976e24e7dbca41db895dabcbac38eb5f4045393d17a95bdfb1109"
+dependencies = [
+ "scopeguard",
+]
+
+[[package]]
+name = "once_cell"
+version = "1.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "692fcb63b64b1758029e0a96ee63e049ce8c5948587f2f7208df04625e5f6b56"
+
+[[package]]
+name = "panda-re"
+version = "0.26.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2dfc5b9d238b9f1d4785346b7d611dcc4236f615334e0719afbf3033f8c26e0e"
+dependencies = [
+ "dirs",
+ "glib-sys",
+ "inventory",
+ "lazy_static",
+ "libloading",
+ "once_cell",
+ "panda-re-macros",
+ "panda-re-sys",
+ "paste",
+ "strum 0.20.0",
+ "strum_macros 0.20.1",
+ "thiserror",
+]
+
+[[package]]
+name = "panda-re-macros"
+version = "0.16.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5be1d7a86fc7fc5c32ca9d7b430e5f12f76b664f381c4213c7071d14e88fc588"
+dependencies = [
+ "darling",
+ "doc-comment",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "panda-re-sys"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e00ee000dc315bf4a0a55d78b6d97456a7540d6ed01768da5f5aa89fdb660783"
+
+[[package]]
+name = "parking_lot"
+version = "0.11.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d17b78036a60663b797adeaee46f5c9dfebb86948d1255007a1d6be0271ff99"
+dependencies = [
+ "instant",
+ "lock_api",
+ "parking_lot_core",
+]
+
+[[package]]
+name = "parking_lot_core"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d76e8e1493bcac0d2766c42737f34458f1c8c50c0d23bcb24ea953affb273216"
+dependencies = [
+ "cfg-if",
+ "instant",
+ "libc",
+ "redox_syscall",
+ "smallvec",
+ "winapi",
+]
+
+[[package]]
+name = "paste"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0744126afe1a6dd7f394cb50a716dbe086cb06e255e53d8d0185d82828358fb5"
+
+[[package]]
+name = "pkg-config"
+version = "0.3.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d1a3ea4f0dd7f1f3e512cf97bf100819aa547f36a6eccac8dbaae839eb92363e"
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.33"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fb37d2df5df740e582f28f8560cf425f52bb267d872fe58358eadb554909f07a"
+dependencies = [
+ "unicode-xid",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "38bc8cc6a5f2e3655e0899c1b848643b2562f853f114bfec7be120678e3ace05"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "redox_syscall"
+version = "0.2.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8383f39639269cde97d255a32bdb68c047337295414940c68bdd30c2e13203ff"
+dependencies = [
+ "bitflags",
+]
+
+[[package]]
+name = "redox_users"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "528532f3d801c87aec9def2add9ca802fe569e44a544afe633765267840abe64"
+dependencies = [
+ "getrandom",
+ "redox_syscall",
+]
+
+[[package]]
+name = "scopeguard"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d29ab0c6d3fc0ee92fe66e2d99f700eab17a8d57d1c1d3b748380fb20baa78cd"
+
+[[package]]
+name = "serde"
+version = "1.0.130"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f12d06de37cf59146fbdecab66aa99f9fe4f78722e3607577a5375d66bd0c913"
+
+[[package]]
+name = "smallvec"
+version = "1.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ecab6c735a6bb4139c0caafd0cc3635748bbb3acf4550e8138122099251f309"
+
+[[package]]
+name = "strsim"
+version = "0.9.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6446ced80d6c486436db5c078dde11a9f73d42b57fb273121e160b84f63d894c"
+
+[[package]]
+name = "strum"
+version = "0.18.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "57bd81eb48f4c437cadc685403cad539345bf703d78e63707418431cecd4522b"
+
+[[package]]
+name = "strum"
+version = "0.20.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7318c509b5ba57f18533982607f24070a55d353e90d4cae30c467cdb2ad5ac5c"
+
+[[package]]
+name = "strum_macros"
+version = "0.18.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "87c85aa3f8ea653bfd3ddf25f7ee357ee4d204731f6aa9ad04002306f6e2774c"
+dependencies = [
+ "heck",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "strum_macros"
+version = "0.20.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee8bc6b87a5112aeeab1f4a9f7ab634fe6cbefc4850006df31267f4cfb9e3149"
+dependencies = [
+ "heck",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "syn"
+version = "1.0.82"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8daf5dd0bb60cbd4137b1b587d2fc0ae729bc07cf01cd70b36a1ed5ade3b9d59"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-xid",
+]
+
+[[package]]
+name = "system-deps"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0f3ecc17269a19353b3558b313bba738b25d82993e30d62a18406a24aba4649b"
+dependencies = [
+ "heck",
+ "pkg-config",
+ "strum 0.18.0",
+ "strum_macros 0.18.0",
+ "thiserror",
+ "toml",
+ "version-compare",
+]
+
+[[package]]
+name = "thiserror"
+version = "1.0.30"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "854babe52e4df1653706b98fcfc05843010039b406875930a70e4d9644e5c417"
+dependencies = [
+ "thiserror-impl",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "1.0.30"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aa32fd3f627f367fe16f893e2597ae3c05020f8bba2666a4e6ea73d377e5714b"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "toml"
+version = "0.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a31142970826733df8241ef35dc040ef98c679ab14d7c3e54d827099b3acecaa"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "unicode-segmentation"
+version = "1.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8895849a949e7845e06bd6dc1aa51731a103c42707010a5b591c0038fb73385b"
+
+[[package]]
+name = "unicode-xid"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ccb82d61f80a663efe1f787a51b16b5a51e3314d6ac365b08639f52387b33f3"
+
+[[package]]
+name = "version-compare"
+version = "0.0.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d63556a25bae6ea31b52e640d7c41d1ab27faba4ccb600013837a3d0b3994ca1"
+
+[[package]]
+name = "wasi"
+version = "0.10.2+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fd6fbd9a79829dd1ad0cc20627bf1ed606756a7f77edff7b66b7064f9cb327c6"
+
+[[package]]
+name = "winapi"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
+dependencies = [
+ "winapi-i686-pc-windows-gnu",
+ "winapi-x86_64-pc-windows-gnu",
+]
+
+[[package]]
+name = "winapi-i686-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
+
+[[package]]
+name = "winapi-x86_64-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
diff --git a/panda/plugins/guest_shell/Cargo.toml b/panda/plugins/guest_shell/Cargo.toml
new file mode 100644
index 00000000000..f11c725961c
--- /dev/null
+++ b/panda/plugins/guest_shell/Cargo.toml
@@ -0,0 +1,24 @@
+[package]
+name = "guest_shell"
+version = "0.1.0"
+authors = ["Luke Craig <Luke.Craig@ll.mit.edu>", "Jordan McLeod <Jordan.McLeod@ll.mit.edu>"]
+edition = "2018"
+
+[lib]
+crate-type = ["cdylib"]
+
+[dependencies]
+panda-re = { version = "0.26", default-features = false }
+parking_lot = "0.11"
+
+[features]
+default = ["x86_64"]
+
+x86_64 = ["panda-re/x86_64"]
+i386 = ["panda-re/i386"]
+arm = ["panda-re/arm"]
+ppc = ["panda-re/ppc"]
+mips = ["panda-re/mips"]
+mipsel = ["panda-re/mipsel"]
+aarch64 = ["panda-re/aarch64"]
+mips64 = ["panda-re/mips64"]
diff --git a/panda/plugins/guest_shell/Makefile b/panda/plugins/guest_shell/Makefile
new file mode 100644
index 00000000000..2234476df57
--- /dev/null
+++ b/panda/plugins/guest_shell/Makefile
@@ -0,0 +1,18 @@
+# Don't forget to add your plugin to config.panda!
+
+# Build rust plugins with make!
+
+# The main rule for your plugin. List all object-file dependencies.
+
+PANDA_PATH = $(realpath $(shell pwd)/..)
+PLUGIN_DIR = $(realpath $(join $(PANDA_PATH), /../panda/plugins/$(PLUGIN_NAME)/))
+RUST_SOURCE = $(wildcard $(PLUGIN_DIR)/src/*.rs)
+PLUGIN_ARTIFACTS_DIR = $(PLUGIN_TARGET_DIR)/$(PLUGIN_NAME)/target
+
+$(PLUGIN_TARGET_DIR)/panda_$(PLUGIN_NAME).so : $(RUST_SOURCE) $(PLUGIN_DIR)/Cargo.toml
+	@echo "  CARGO   $(PLUGIN_DIR)"
+	@CARGO_TERM_PROGRESS_WHEN=never cargo build --release \
+		--no-default-features --features=$(TARGET_NAME) \
+		--manifest-path=$(PLUGIN_DIR)/Cargo.toml \
+		--target-dir=$(PLUGIN_ARTIFACTS_DIR)
+	@cp -p $(PLUGIN_ARTIFACTS_DIR)/release/lib$(PLUGIN_NAME).so $@
diff --git a/panda/plugins/guest_shell/README.md b/panda/plugins/guest_shell/README.md
new file mode 100644
index 00000000000..81a52bc976b
--- /dev/null
+++ b/panda/plugins/guest_shell/README.md
@@ -0,0 +1,95 @@
+# Rust Skeleton
+
+This is a basic example of how to build a PANDA plugin with Rust.
+
+## Building
+
+To check if the plugin will build:
+
+```
+cargo check
+```
+
+To actually build the plugin:
+
+```
+cargo build --release
+```
+
+(remove `--release` if you want to build in debug mode)
+
+The resulting plugin will be located in `target/release/librust_skeleton.so`.
+
+## Structure
+
+```
+├── Cargo.toml
+├── Makefile
+├── README.md
+└── src
+   └── lib.rs
+```
+
+* Cargo.toml - The core plugin info. This informs `cargo` how to actually go about building the plugin. It includes the name, dependencies, and features of plugins.
+* Makefile - Instructions for how the PANDA build system will build the plugin.
+* lib.rs - The main source file of your plugin. Additional source files can be referenced from here.
+
+## Cargo.toml
+
+The dependencies section:
+
+```toml
+[dependencies]
+panda-re = { version = "0.5", default-features = false }
+```
+
+To add a new dependency, add a new line in the form `name = "version"`.
+
+For example to add [`libc`](https://docs.rs/libc), simply add the following line:
+
+```toml
+libc = "0.2"
+```
+
+## Targetting Multiple Architectures
+
+In PANDA, a plugin is recompiled once per target architecture (that is to say, the architecture of the guest). To enable this behavior in Rust plugins, we use ["features"](https://doc.rust-lang.org/cargo/reference/features.html) in order to specify which architecture we are building for.
+
+This is controlled by this section of Cargo.toml:
+
+```toml
+[features]
+default = ["x86_64"]
+
+x86_64 = ["panda-re/x86_64"]
+i386 = ["panda-re/i386"]
+arm = ["panda-re/arm"]
+ppc = ["panda-re/ppc"]
+mips = ["panda-re/mips"]
+mipsel = ["panda-re/mipsel"]
+```
+
+by default `x86_64` is the only feature enabled (which is why we don't need to specify any features to build), this is primarily so that IDE support (rust-analyzer for VSCode/vim/etc, IntelliJ/CLion integration) works out of the box, as IDEs typically do type checking with the default feature set.
+
+To build for, say, `arm` you can use the following command:
+
+```
+cargo build --release --no-default-features --features=arm
+```
+
+And if you wish to prevent certain code from compiling on certain platforms you can use the following:
+
+```rust
+#[cfg(not(feature = "arm"))]
+fn breaks_arm() {
+    // ...
+}
+```
+
+## Other Resources
+
+* [panda-rs documentation](https://docs.rs/panda-re) 
+* [panda-rs announcement blog post](https://panda.re/blog/panda-rs)
+* [panda-sys documentation](https://docs.rs/panda-re-sys)
+* [The Rust Programming Language](https://doc.rust-lang.org/book/)
+* [Some example Rust plugins](https://github.com/panda-re/panda-rs-plugins/)
diff --git a/panda/plugins/guest_shell/guest_shell_pty.sh b/panda/plugins/guest_shell/guest_shell_pty.sh
new file mode 100755
index 00000000000..8532b6fbda2
--- /dev/null
+++ b/panda/plugins/guest_shell/guest_shell_pty.sh
@@ -0,0 +1 @@
+socat UNIX-CONNECT:/tmp/guest_shell.sock PTY,link=/tmp/guest_shell_pty & screen /tmp/guest_shell_pty
diff --git a/panda/plugins/guest_shell/rusty_shell/Cargo.toml b/panda/plugins/guest_shell/rusty_shell/Cargo.toml
new file mode 100644
index 00000000000..230c5c70459
--- /dev/null
+++ b/panda/plugins/guest_shell/rusty_shell/Cargo.toml
@@ -0,0 +1,4 @@
+[package]
+name = "rusty_shell"
+version = "0.1.0"
+edition = "2018"
diff --git a/panda/plugins/guest_shell/rusty_shell/src/hypercall.rs b/panda/plugins/guest_shell/rusty_shell/src/hypercall.rs
new file mode 100644
index 00000000000..abf8e6ad513
--- /dev/null
+++ b/panda/plugins/guest_shell/rusty_shell/src/hypercall.rs
@@ -0,0 +1,113 @@
+use std::{io::Write, marker::PhantomData};
+
+const HC_MAGIC: usize = 0x666;
+
+#[allow(dead_code)]
+#[derive(Copy, Clone)]
+pub enum HcCmd {
+    Noop = 0,
+    Start,             /* start new action */
+    Stop,              /* stop action */
+    Read,              /* read buffer from hypervisor */
+    Write,             /* write buffer TO hypervisor*/
+    Error,             /* report error to hypervisor*/
+    ConditionalOp,     /* ask the hypervisor if op should be completed*/
+    NextStateMachine,  /* ask the hypervisor manager to move to the next
+                            state machine*/
+}
+
+pub struct HyperCall<'a> {
+    cmd : HcCmd,
+    args: Vec<usize>,
+    lifetime: PhantomData<&'a ()>,
+}
+
+impl HyperCall<'static> {
+    pub fn new(cmd: HcCmd) -> Self {
+        Self {
+            cmd,
+            args: vec![0; 2],
+            lifetime: PhantomData,
+        }
+    }
+}
+
+#[allow(dead_code)]
+impl<'a> HyperCall<'a> {
+    pub fn arg(&mut self, arg: usize) -> &mut Self {
+        self.args.push(arg);
+        self
+    }
+
+    pub fn from_string(command: HcCmd, s: &'a str) -> HyperCall<'a> {
+        Self {
+            cmd: command,
+            args: vec![
+                s.as_ptr() as usize,
+                s.len(),
+            ],
+            lifetime: PhantomData,
+        }
+    }
+
+    pub fn from_buf(command: HcCmd, buf: &'a [u8]) -> HyperCall<'a> {
+        Self {
+            cmd: command,
+            args: vec![
+                buf.as_ptr() as usize,
+                buf.len(),
+            ],
+            lifetime: PhantomData,
+        }
+    }
+
+    pub fn from_mut_buf(command: HcCmd, buf: &'a mut [u8]) -> HyperCall<'a> {
+        Self {
+            cmd: command,
+            args: vec![
+                buf.as_ptr() as usize,
+                buf.len(),
+            ],
+            lifetime: PhantomData,
+        }
+    }
+
+    #[cfg(any(target_arch = "x86", target_arch = "x86_64"))]
+    pub fn call(&mut self) -> usize {
+        let ret_val;
+
+        while self.args.len() < 2 {
+            self.args.push(0);
+        }
+
+        unsafe {
+            asm!(
+                "mov eax, {hc_magic}",
+                "mov ebx, {command:e}",
+                "cpuid",
+                hc_magic = const HC_MAGIC,
+                command = in(reg) self.cmd as u32,
+                in("ecx") self.args[0],
+                in("edx") self.args[1],
+                out("eax") ret_val,
+            );
+        }
+
+        ret_val
+    }
+}
+
+struct HyperWriter;
+
+impl Write for HyperWriter {
+    fn write(&mut self, buf: &[u8]) -> std::io::Result<usize> {
+        HyperCall::from_buf(HcCmd::Write, buf).call();
+
+        Ok(buf.len())
+    }
+
+    #[inline]
+    fn flush(&mut self) -> std::io::Result<()> {
+        Ok(())
+    }
+}
diff --git a/panda/plugins/guest_shell/rusty_shell/src/main.rs b/panda/plugins/guest_shell/rusty_shell/src/main.rs
new file mode 100644
index 00000000000..7d1308954f8
--- /dev/null
+++ b/panda/plugins/guest_shell/rusty_shell/src/main.rs
@@ -0,0 +1,52 @@
+#![feature(asm)]
+
+mod hypercall;
+use std::process::Command;
+
+use hypercall::{HyperCall, HcCmd};
+
+/// Read a line of input from the hypervisor
+fn read_line() -> String {
+    let mut buf = vec![0u8; 1024];
+
+    let len = loop {
+        let ret = HyperCall::from_mut_buf(HcCmd::Read, &mut buf).call() as isize;
+
+        if ret > 0 {
+            break ret
+        } else {
+            std::thread::yield_now();
+        }
+    };
+
+    buf.truncate(len as usize);
+
+    String::from_utf8(buf).unwrap()
+}
+
+/// Write a buffer or string across the hypervisor
+fn write(output: impl AsRef<[u8]>) {
+    HyperCall::from_buf(HcCmd::Write, output.as_ref()).call();
+}
+
+fn main() {
+    HyperCall::new(HcCmd::Start).call();
+
+    loop {
+        let input = read_line();
+
+        let args: Vec<&str> = input.trim().split_whitespace().collect();
+
+        if let [program, args @ ..] = &args[..] {
+            match Command::new(program).args(args).output() {
+                Ok(output) => {
+                    write(&output.stdout);
+                    write("[CMD_FINISHED]");
+                }
+                Err(_) => break,
+            }
+        }
+    }
+
+    HyperCall::new(HcCmd::Stop).call();
+}
diff --git a/panda/plugins/guest_shell/src/lib.rs b/panda/plugins/guest_shell/src/lib.rs
new file mode 100644
index 00000000000..d0ecfde8f15
--- /dev/null
+++ b/panda/plugins/guest_shell/src/lib.rs
@@ -0,0 +1,42 @@
+use panda::{plugins::guest_plugin_manager::*, prelude::*};
+use parking_lot::{const_mutex, Mutex};
+use std::{
+    io::{self, Write},
+    os::unix::net::{UnixListener, UnixStream},
+};
+
+static STDOUT: Mutex<Option<UnixStream>> = const_mutex(None);
+
+// Copy all messages from the guest to the unix socket
+#[channel_recv]
+fn message_recv(_: u32, data: &[u8]) {
+    STDOUT.lock().as_mut().unwrap().write_all(data).ok();
+}
+
+#[derive(PandaArgs)]
+#[name = "guest_shell"]
+struct Args {
+    #[arg(default = "/tmp/guest_shell.sock")]
+    socket_path: String,
+}
+
+fn get_split_socket(path: &str) -> io::Result<(UnixStream, UnixStream)> {
+    let (socket, _) = UnixListener::bind(path)?.accept()?;
+    Ok((socket.try_clone()?, socket))
+}
+
+#[panda::init]
+fn init(_: &mut PluginHandle) -> bool {
+    let args = Args::from_panda_args();
+    let mut guest_channel = load_guest_plugin("guest_shell", message_recv);
+
+    let (stdout, mut stdin) = get_split_socket(&args.socket_path).unwrap();
+    STDOUT.lock().replace(stdout);
+
+    std::thread::spawn(move || {
+        // Copy stdin from unix socket to guest
+        io::copy(&mut stdin, &mut guest_channel).unwrap();
+    });
+
+    true
+}
diff --git a/panda/plugins/hyperfuse/Cargo.lock b/panda/plugins/hyperfuse/Cargo.lock
new file mode 100644
index 00000000000..23a39475c0b
--- /dev/null
+++ b/panda/plugins/hyperfuse/Cargo.lock
@@ -0,0 +1,749 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 3
+
+[[package]]
+name = "aho-corasick"
+version = "0.7.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e37cfd5e7657ada45f742d6e99ca5788580b5c529dc78faf11ece6dc702656f"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "atty"
+version = "0.2.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d9b39be18770d11421cdb1b9947a45dd3f37e93092cbf377614828a319d5fee8"
+dependencies = [
+ "hermit-abi",
+ "libc",
+ "winapi",
+]
+
+[[package]]
+name = "bincode"
+version = "1.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b1f45e9417d87227c7a56d22e471c6206462cba514c7590c09aff4cf6d1ddcad"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "bitflags"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf1de2fe8c75bc145a2f577add951f8134889b4795d47466a54a5c846d691693"
+
+[[package]]
+name = "byteorder"
+version = "1.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "14c189c53d098945499cdfa7ecc63567cf3886b3332b312a5b4585d8d3a6a610"
+
+[[package]]
+name = "cached"
+version = "0.26.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2bc2fd249a24a9cdd4276f3a3e0461713271ab63b0e9e656e200e8e21c8c927"
+dependencies = [
+ "hashbrown",
+ "once_cell",
+]
+
+[[package]]
+name = "cfg-if"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
+
+[[package]]
+name = "crossbeam-queue"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b10ddc024425c88c2ad148c1b0fd53f4c6d38db9697c9f1588381212fa657c9"
+dependencies = [
+ "cfg-if",
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-utils"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d82cfc11ce7f2c3faef78d8a684447b40d503d9681acebed6cb728d45940c4db"
+dependencies = [
+ "cfg-if",
+ "lazy_static",
+]
+
+[[package]]
+name = "ctor"
+version = "0.1.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5e98e2ad1a782e33928b96fc3948e7c355e5af34ba4de7670fe8bac2a3b2006d"
+dependencies = [
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "darling"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0d706e75d87e35569db781a9b5e2416cff1236a47ed380831f959382ccd5f858"
+dependencies = [
+ "darling_core",
+ "darling_macro",
+]
+
+[[package]]
+name = "darling_core"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0c960ae2da4de88a91b2d920c2a7233b400bc33cb28453a2987822d8392519b"
+dependencies = [
+ "fnv",
+ "ident_case",
+ "proc-macro2",
+ "quote",
+ "strsim",
+ "syn",
+]
+
+[[package]]
+name = "darling_macro"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d9b5a2f4ac4969822c62224815d069952656cadc7084fdca9751e6d959189b72"
+dependencies = [
+ "darling_core",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "dirs"
+version = "3.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "30baa043103c9d0c2a57cf537cc2f35623889dc0d405e6c3cccfadbc81c71309"
+dependencies = [
+ "dirs-sys",
+]
+
+[[package]]
+name = "dirs-sys"
+version = "0.3.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "03d86534ed367a67548dc68113a0f5db55432fdfbb6e6f9d77704397d95d5780"
+dependencies = [
+ "libc",
+ "redox_users",
+ "winapi",
+]
+
+[[package]]
+name = "doc-comment"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fea41bba32d969b513997752735605054bc0dfa92b4c56bf1189f2e174be7a10"
+
+[[package]]
+name = "env_logger"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "44533bbbb3bb3c1fa17d9f2e4e38bbbaf8396ba82193c4cb1b6445d711445d36"
+dependencies = [
+ "atty",
+ "humantime",
+ "log",
+ "regex",
+ "termcolor",
+]
+
+[[package]]
+name = "fnv"
+version = "1.0.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
+
+[[package]]
+name = "fuser"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "096c834eabc44f7151b8f17d28eb0501e30ea9139b4a2d64f33ad9ef4bdae8d3"
+dependencies = [
+ "libc",
+ "log",
+ "memchr",
+ "page_size",
+ "pkg-config",
+ "serde",
+ "smallvec",
+ "users",
+ "zerocopy",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7fcd999463524c52659517fe2cea98493cfe485d10565e7b0fb07dbba7ad2753"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "wasi",
+]
+
+[[package]]
+name = "ghost"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1a5bcf1bbeab73aa4cf2fde60a846858dc036163c7c33bec309f8d17de785479"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "glib-sys"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c7e9b997a66e9a23d073f2b1abb4dbfc3925e0b8952f67efd8d9b6e168e4cdc1"
+dependencies = [
+ "libc",
+ "system-deps",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.11.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ab5ef0d4909ef3724cc8cce6ccc8572c5c817592e9285f5464f8e86f8bd3726e"
+
+[[package]]
+name = "heck"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6d621efb26863f0e9924c6ac577e8275e5e6b77455db64ffa6c65c904e9e132c"
+dependencies = [
+ "unicode-segmentation",
+]
+
+[[package]]
+name = "hermit-abi"
+version = "0.1.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "62b467343b94ba476dcb2500d242dadbb39557df889310ac77c5d99100aaac33"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "humantime"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df004cfca50ef23c36850aaaa59ad52cc70d0e90243c3c7737a4dd32dc7a3c4f"
+dependencies = [
+ "quick-error",
+]
+
+[[package]]
+name = "hyperfuse"
+version = "0.1.0"
+dependencies = [
+ "bincode",
+ "cached",
+ "crossbeam-queue",
+ "fuser",
+ "lazy_static",
+ "libc",
+ "panda-re",
+ "parking_lot",
+ "pretty_env_logger",
+ "serde",
+]
+
+[[package]]
+name = "ident_case"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9e0384b61958566e926dc50660321d12159025e767c18e043daf26b70104c39"
+
+[[package]]
+name = "instant"
+version = "0.1.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "716d3d89f35ac6a34fd0eed635395f4c3b76fa889338a4632e5231a8684216bd"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "inventory"
+version = "0.1.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0f0f7efb804ec95e33db9ad49e4252f049e37e8b0a4652e3cd61f7999f2eff7f"
+dependencies = [
+ "ctor",
+ "ghost",
+ "inventory-impl",
+]
+
+[[package]]
+name = "inventory-impl"
+version = "0.1.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "75c094e94816723ab936484666968f5b58060492e880f3c8d00489a1e244fa51"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "lazy_static"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
+
+[[package]]
+name = "libc"
+version = "0.2.98"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "320cfe77175da3a483efed4bc0adc1968ca050b098ce4f2f1c13a56626128790"
+
+[[package]]
+name = "libloading"
+version = "0.6.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "351a32417a12d5f7e82c368a66781e307834dae04c6ce0cd4456d52989229883"
+dependencies = [
+ "cfg-if",
+ "winapi",
+]
+
+[[package]]
+name = "lock_api"
+version = "0.4.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "712a4d093c9976e24e7dbca41db895dabcbac38eb5f4045393d17a95bdfb1109"
+dependencies = [
+ "scopeguard",
+]
+
+[[package]]
+name = "log"
+version = "0.4.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "51b9bbe6c47d51fc3e1a9b945965946b4c44142ab8792c50835a980d362c2710"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "memchr"
+version = "2.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "308cc39be01b73d0d18f82a0e7b2a3df85245f84af96fdddc5d202d27e47b86a"
+
+[[package]]
+name = "once_cell"
+version = "1.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "692fcb63b64b1758029e0a96ee63e049ce8c5948587f2f7208df04625e5f6b56"
+
+[[package]]
+name = "page_size"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eebde548fbbf1ea81a99b128872779c437752fb99f217c45245e1a61dcd9edcd"
+dependencies = [
+ "libc",
+ "winapi",
+]
+
+[[package]]
+name = "panda-re"
+version = "0.26.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2dfc5b9d238b9f1d4785346b7d611dcc4236f615334e0719afbf3033f8c26e0e"
+dependencies = [
+ "dirs",
+ "glib-sys",
+ "inventory",
+ "lazy_static",
+ "libloading",
+ "once_cell",
+ "panda-re-macros",
+ "panda-re-sys",
+ "paste",
+ "strum 0.20.0",
+ "strum_macros 0.20.1",
+ "thiserror",
+]
+
+[[package]]
+name = "panda-re-macros"
+version = "0.16.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5be1d7a86fc7fc5c32ca9d7b430e5f12f76b664f381c4213c7071d14e88fc588"
+dependencies = [
+ "darling",
+ "doc-comment",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "panda-re-sys"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e00ee000dc315bf4a0a55d78b6d97456a7540d6ed01768da5f5aa89fdb660783"
+
+[[package]]
+name = "parking_lot"
+version = "0.11.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d17b78036a60663b797adeaee46f5c9dfebb86948d1255007a1d6be0271ff99"
+dependencies = [
+ "instant",
+ "lock_api",
+ "parking_lot_core",
+]
+
+[[package]]
+name = "parking_lot_core"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d76e8e1493bcac0d2766c42737f34458f1c8c50c0d23bcb24ea953affb273216"
+dependencies = [
+ "cfg-if",
+ "instant",
+ "libc",
+ "redox_syscall",
+ "smallvec",
+ "winapi",
+]
+
+[[package]]
+name = "paste"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "acbf547ad0c65e31259204bd90935776d1c693cec2f4ff7abb7a1bbbd40dfe58"
+
+[[package]]
+name = "pkg-config"
+version = "0.3.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3831453b3449ceb48b6d9c7ad7c96d5ea673e9b470a1dc578c2ce6521230884c"
+
+[[package]]
+name = "pretty_env_logger"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "926d36b9553851b8b0005f1275891b392ee4d2d833852c417ed025477350fb9d"
+dependencies = [
+ "env_logger",
+ "log",
+]
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0d8caf72986c1a598726adc988bb5984792ef84f5ee5aa50209145ee8077038"
+dependencies = [
+ "unicode-xid",
+]
+
+[[package]]
+name = "quick-error"
+version = "1.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a1d01941d82fa2ab50be1e79e6714289dd7cde78eba4c074bc5a4374f650dfe0"
+
+[[package]]
+name = "quote"
+version = "1.0.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3d0b9745dc2debf507c8422de05d7226cc1f0644216dfdfead988f9b1ab32a7"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "redox_syscall"
+version = "0.2.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5ab49abadf3f9e1c4bc499e8845e152ad87d2ad2d30371841171169e9d75feee"
+dependencies = [
+ "bitflags",
+]
+
+[[package]]
+name = "redox_users"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "528532f3d801c87aec9def2add9ca802fe569e44a544afe633765267840abe64"
+dependencies = [
+ "getrandom",
+ "redox_syscall",
+]
+
+[[package]]
+name = "regex"
+version = "1.5.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d07a8629359eb56f1e2fb1652bb04212c072a87ba68546a04065d525673ac461"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-syntax"
+version = "0.6.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f497285884f3fcff424ffc933e56d7cbca511def0c9831a7f9b5f6153e3cc89b"
+
+[[package]]
+name = "scopeguard"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d29ab0c6d3fc0ee92fe66e2d99f700eab17a8d57d1c1d3b748380fb20baa78cd"
+
+[[package]]
+name = "serde"
+version = "1.0.126"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec7505abeacaec74ae4778d9d9328fe5a5d04253220a85c4ee022239fc996d03"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.126"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "963a7dbc9895aeac7ac90e74f34a5d5261828f79df35cbed41e10189d3804d43"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "smallvec"
+version = "1.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ecab6c735a6bb4139c0caafd0cc3635748bbb3acf4550e8138122099251f309"
+
+[[package]]
+name = "strsim"
+version = "0.9.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6446ced80d6c486436db5c078dde11a9f73d42b57fb273121e160b84f63d894c"
+
+[[package]]
+name = "strum"
+version = "0.18.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "57bd81eb48f4c437cadc685403cad539345bf703d78e63707418431cecd4522b"
+
+[[package]]
+name = "strum"
+version = "0.20.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7318c509b5ba57f18533982607f24070a55d353e90d4cae30c467cdb2ad5ac5c"
+
+[[package]]
+name = "strum_macros"
+version = "0.18.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "87c85aa3f8ea653bfd3ddf25f7ee357ee4d204731f6aa9ad04002306f6e2774c"
+dependencies = [
+ "heck",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "strum_macros"
+version = "0.20.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee8bc6b87a5112aeeab1f4a9f7ab634fe6cbefc4850006df31267f4cfb9e3149"
+dependencies = [
+ "heck",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "syn"
+version = "1.0.74"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1873d832550d4588c3dbc20f01361ab00bfe741048f71e3fecf145a7cc18b29c"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-xid",
+]
+
+[[package]]
+name = "synstructure"
+version = "0.12.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "474aaa926faa1603c40b7885a9eaea29b444d1cb2850cb7c0e37bb1a4182f4fa"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+ "unicode-xid",
+]
+
+[[package]]
+name = "system-deps"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0f3ecc17269a19353b3558b313bba738b25d82993e30d62a18406a24aba4649b"
+dependencies = [
+ "heck",
+ "pkg-config",
+ "strum 0.18.0",
+ "strum_macros 0.18.0",
+ "thiserror",
+ "toml",
+ "version-compare",
+]
+
+[[package]]
+name = "termcolor"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2dfed899f0eb03f32ee8c6a0aabdb8a7949659e3466561fc0adf54e26d88c5f4"
+dependencies = [
+ "winapi-util",
+]
+
+[[package]]
+name = "thiserror"
+version = "1.0.26"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93119e4feac1cbe6c798c34d3a53ea0026b0b1de6a120deef895137c0529bfe2"
+dependencies = [
+ "thiserror-impl",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "1.0.26"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "060d69a0afe7796bf42e9e2ff91f5ee691fb15c53d38b4b62a9a53eb23164745"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "toml"
+version = "0.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a31142970826733df8241ef35dc040ef98c679ab14d7c3e54d827099b3acecaa"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "unicode-segmentation"
+version = "1.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8895849a949e7845e06bd6dc1aa51731a103c42707010a5b591c0038fb73385b"
+
+[[package]]
+name = "unicode-xid"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ccb82d61f80a663efe1f787a51b16b5a51e3314d6ac365b08639f52387b33f3"
+
+[[package]]
+name = "users"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "24cc0f6d6f267b73e5a2cadf007ba8f9bc39c6a6f9666f8cf25ea809a153b032"
+dependencies = [
+ "libc",
+ "log",
+]
+
+[[package]]
+name = "version-compare"
+version = "0.0.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d63556a25bae6ea31b52e640d7c41d1ab27faba4ccb600013837a3d0b3994ca1"
+
+[[package]]
+name = "wasi"
+version = "0.10.2+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fd6fbd9a79829dd1ad0cc20627bf1ed606756a7f77edff7b66b7064f9cb327c6"
+
+[[package]]
+name = "winapi"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
+dependencies = [
+ "winapi-i686-pc-windows-gnu",
+ "winapi-x86_64-pc-windows-gnu",
+]
+
+[[package]]
+name = "winapi-i686-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
+
+[[package]]
+name = "winapi-util"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "70ec6ce85bb158151cae5e5c87f95a8e97d2c0c4b001223f33a334e3ce5de178"
+dependencies = [
+ "winapi",
+]
+
+[[package]]
+name = "winapi-x86_64-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
+
+[[package]]
+name = "zerocopy"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5e59ec1d2457bd6c0dd89b50e7d9d6b0b647809bf3f0a59ac85557046950b7b2"
+dependencies = [
+ "byteorder",
+ "zerocopy-derive",
+]
+
+[[package]]
+name = "zerocopy-derive"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a0fbc82b82efe24da867ee52e015e58178684bd9dd64c34e66bdf21da2582a9f"
+dependencies = [
+ "proc-macro2",
+ "syn",
+ "synstructure",
+]
diff --git a/panda/plugins/hyperfuse/Cargo.toml b/panda/plugins/hyperfuse/Cargo.toml
new file mode 100644
index 00000000000..b8b9dab060c
--- /dev/null
+++ b/panda/plugins/hyperfuse/Cargo.toml
@@ -0,0 +1,33 @@
+[package]
+name = "hyperfuse"
+version = "0.1.0"
+authors = ["Luke Craig <Luke.Craig@ll.mit.edu>", "Jordan McLeod <Jordan.McLeod@ll.mit.edu>"]
+edition = "2018"
+
+[lib]
+crate-type = ["cdylib"]
+
+[dependencies]
+panda-re = { version = "0.26", default-features = false }
+fuser = { version = "0.9", features = ["serializable"] }
+#fuser = { git = "https://github.com/cberner/fuser", features = ["serializable"] }
+libc = "0.2.98"
+pretty_env_logger = "0.4.0"
+serde = { version = "1", features = ["derive"] }
+bincode = "1.3.3"
+lazy_static = "1"
+parking_lot = "0.11"
+crossbeam-queue = "0.3"
+cached = { version = "0.26", default-features = false }
+
+[features]
+default = ["x86_64"]
+
+x86_64 = ["panda-re/x86_64"]
+i386 = ["panda-re/i386"]
+arm = ["panda-re/arm"]
+ppc = ["panda-re/ppc"]
+mips = ["panda-re/mips"]
+mipsel = ["panda-re/mipsel"]
+aarch64 = ["panda-re/aarch64"]
+mips64 = ["panda-re/mips64"]
diff --git a/panda/plugins/hyperfuse/Makefile b/panda/plugins/hyperfuse/Makefile
new file mode 100644
index 00000000000..2234476df57
--- /dev/null
+++ b/panda/plugins/hyperfuse/Makefile
@@ -0,0 +1,18 @@
+# Don't forget to add your plugin to config.panda!
+
+# Build rust plugins with make!
+
+# The main rule for your plugin. List all object-file dependencies.
+
+PANDA_PATH = $(realpath $(shell pwd)/..)
+PLUGIN_DIR = $(realpath $(join $(PANDA_PATH), /../panda/plugins/$(PLUGIN_NAME)/))
+RUST_SOURCE = $(wildcard $(PLUGIN_DIR)/src/*.rs)
+PLUGIN_ARTIFACTS_DIR = $(PLUGIN_TARGET_DIR)/$(PLUGIN_NAME)/target
+
+$(PLUGIN_TARGET_DIR)/panda_$(PLUGIN_NAME).so : $(RUST_SOURCE) $(PLUGIN_DIR)/Cargo.toml
+	@echo "  CARGO   $(PLUGIN_DIR)"
+	@CARGO_TERM_PROGRESS_WHEN=never cargo build --release \
+		--no-default-features --features=$(TARGET_NAME) \
+		--manifest-path=$(PLUGIN_DIR)/Cargo.toml \
+		--target-dir=$(PLUGIN_ARTIFACTS_DIR)
+	@cp -p $(PLUGIN_ARTIFACTS_DIR)/release/lib$(PLUGIN_NAME).so $@
diff --git a/panda/plugins/hyperfuse/README.md b/panda/plugins/hyperfuse/README.md
new file mode 100644
index 00000000000..81a52bc976b
--- /dev/null
+++ b/panda/plugins/hyperfuse/README.md
@@ -0,0 +1,95 @@
+# Rust Skeleton
+
+This is a basic example of how to build a PANDA plugin with Rust.
+
+## Building
+
+To check if the plugin will build:
+
+```
+cargo check
+```
+
+To actually build the plugin:
+
+```
+cargo build --release
+```
+
+(remove `--release` if you want to build in debug mode)
+
+The resulting plugin will be located in `target/release/librust_skeleton.so`.
+
+## Structure
+
+```
+├── Cargo.toml
+├── Makefile
+├── README.md
+└── src
+   └── lib.rs
+```
+
+* Cargo.toml - The core plugin info. This informs `cargo` how to actually go about building the plugin. It includes the name, dependencies, and features of plugins.
+* Makefile - Instructions for how the PANDA build system will build the plugin.
+* lib.rs - The main source file of your plugin. Additional source files can be referenced from here.
+
+## Cargo.toml
+
+The dependencies section:
+
+```toml
+[dependencies]
+panda-re = { version = "0.5", default-features = false }
+```
+
+To add a new dependency, add a new line in the form `name = "version"`.
+
+For example to add [`libc`](https://docs.rs/libc), simply add the following line:
+
+```toml
+libc = "0.2"
+```
+
+## Targetting Multiple Architectures
+
+In PANDA, a plugin is recompiled once per target architecture (that is to say, the architecture of the guest). To enable this behavior in Rust plugins, we use ["features"](https://doc.rust-lang.org/cargo/reference/features.html) in order to specify which architecture we are building for.
+
+This is controlled by this section of Cargo.toml:
+
+```toml
+[features]
+default = ["x86_64"]
+
+x86_64 = ["panda-re/x86_64"]
+i386 = ["panda-re/i386"]
+arm = ["panda-re/arm"]
+ppc = ["panda-re/ppc"]
+mips = ["panda-re/mips"]
+mipsel = ["panda-re/mipsel"]
+```
+
+by default `x86_64` is the only feature enabled (which is why we don't need to specify any features to build), this is primarily so that IDE support (rust-analyzer for VSCode/vim/etc, IntelliJ/CLion integration) works out of the box, as IDEs typically do type checking with the default feature set.
+
+To build for, say, `arm` you can use the following command:
+
+```
+cargo build --release --no-default-features --features=arm
+```
+
+And if you wish to prevent certain code from compiling on certain platforms you can use the following:
+
+```rust
+#[cfg(not(feature = "arm"))]
+fn breaks_arm() {
+    // ...
+}
+```
+
+## Other Resources
+
+* [panda-rs documentation](https://docs.rs/panda-re) 
+* [panda-rs announcement blog post](https://panda.re/blog/panda-rs)
+* [panda-sys documentation](https://docs.rs/panda-re-sys)
+* [The Rust Programming Language](https://doc.rust-lang.org/book/)
+* [Some example Rust plugins](https://github.com/panda-re/panda-rs-plugins/)
diff --git a/panda/plugins/hyperfuse/src/lib.rs b/panda/plugins/hyperfuse/src/lib.rs
new file mode 100644
index 00000000000..468658441eb
--- /dev/null
+++ b/panda/plugins/hyperfuse/src/lib.rs
@@ -0,0 +1,308 @@
+use cached::{stores::TimedCache, Cached};
+use fuser::{
+    Filesystem, MountOption, ReplyAttr, ReplyData, ReplyDirectory, ReplyEntry, ReplyOpen,
+    ReplyWrite,
+};
+use libc::ENOENT;
+use panda::prelude::*;
+use serde::de::DeserializeOwned;
+use serde::Serialize;
+use std::borrow::Borrow;
+use std::ffi::{OsStr, OsString};
+use std::marker::PhantomData;
+
+mod types;
+use types::*;
+
+struct HyperFilesystem {
+    reply: Receiver<Reply>,
+    request: Sender<types::Request>,
+
+    link_target_cache: TimedCache<u64, Vec<u8>>,
+    lookup_cache: TimedCache<(u64, OsString), LookupCacheEntry>,
+}
+
+macro_rules! on_reply {
+    (
+        $self:ident => $reply:ident (
+            $type:ident { $($field:ident),* }
+
+            => $reply_ty:ident $({ $(
+                    $reply_field:ident
+                ),*})?
+
+                // tuple type
+                $(( $(
+                    $reply_field_tuple:ident
+                ),*))?
+
+            => $code:block
+        ) $(;)?
+    ) => {
+        $self.request.send(Request::$type { $( $field ),* }).unwrap();
+
+        match $self.reply.recv() {
+            Ok(Reply::$reply_ty
+               // struct variant
+               $({ $( $reply_field ),* })?
+               // tuple variant
+               $(( $( $reply_field_tuple ),* ))?
+            ) => $code,
+            Ok(Reply::Error(err)) => $reply.error(err),
+            Ok(reply) => panic!("Invalid reply {:?}", reply),
+            Err(_) => $reply.error(ENOENT),
+        }
+    };
+}
+
+macro_rules! send_reply {
+    (
+        $self:ident => $reply:ident.$method:ident (
+            $type:ident { $($field:ident),* }
+
+            => $reply_ty:ident
+                // struct type
+                $({$(
+                    $reply_field:ident $( . $reply_field_method:ident () )?
+                ),*})?
+                // tuple type
+                $(($(
+                    $reply_field_tup:ident $( . $reply_field_method_tup:ident () )?
+                ),*))?
+        ) $(;)?
+    ) => {
+        println!("{}(...)", stringify!($method));
+        on_reply! {
+            $self => $reply (
+                $type { $($field),* }
+
+                => $reply_ty
+                    // struct type
+                    $({ $(
+                        $reply_field
+                    ),*})?
+                    // tuple type
+                    $(( $(
+                        $reply_field_tup
+                    ),*))?
+
+                => {
+                    // struct type
+                    $(
+                        $(
+                            let $reply_field = $reply_field $( .$reply_field_method () )?;
+                        )*
+                        $reply.$method( $($reply_field),* );
+                    )?
+                    $(
+                        $(
+                            let $reply_field_tup = $reply_field_tup $( .$reply_field_method_tup () )?;
+                        )*
+                        $reply.$method( $($reply_field_tup),* );
+                    )?
+                }
+            )
+        }
+    };
+}
+
+impl Filesystem for HyperFilesystem {
+    fn lookup(&mut self, _req: &fuser::Request, parent_ino: u64, name: &OsStr, reply: ReplyEntry) {
+        if let Some(LookupCacheEntry {
+            ttl,
+            attr,
+            generation,
+        }) = self
+            .lookup_cache
+            .cache_get(&(parent_ino, name.to_os_string()))
+        {
+            reply.entry(ttl, attr, *generation);
+            return;
+        }
+
+        let name = name.to_string_lossy().into_owned();
+        send_reply! {
+            self => reply.entry(
+                Lookup { parent_ino, name } => Entry { ttl.borrow(), attr.borrow(), generation }
+            );
+        }
+    }
+
+    fn getattr(&mut self, _req: &fuser::Request, ino: u64, reply: ReplyAttr) {
+        send_reply! {
+            self => reply.attr(
+                GetAttr { ino } => Attr { ttl.borrow(), attr.borrow() }
+            );
+        }
+    }
+
+    fn read(
+        &mut self,
+        _req: &fuser::Request,
+        ino: u64,
+        _fh: u64,
+        offset: i64,
+        size: u32,
+        flags: i32,
+        _lock: Option<u64>,
+        reply: ReplyData,
+    ) {
+        send_reply! {
+            self => reply.data(
+                Read { ino, offset, size, flags } => Data(data.as_ref())
+            );
+        }
+    }
+
+    fn readlink(&mut self, _req: &fuser::Request<'_>, ino: u64, reply: ReplyData) {
+        if let Some(data) = self.link_target_cache.cache_get(&ino) {
+            reply.data(&data);
+            return;
+        }
+
+        send_reply! {
+            self => reply.data(
+                ReadLink { ino } => Data(data.as_ref())
+            );
+        }
+    }
+
+    fn readdir(
+        &mut self,
+        _req: &fuser::Request,
+        ino: u64,
+        _fh: u64,
+        offset: i64,
+        mut reply: ReplyDirectory,
+    ) {
+        let parent_ino = ino;
+        on_reply! {
+            self => reply(
+                ReadDir { ino, offset }
+                    => Directory { dir_entries }
+                    => {
+                        for DirEntry { ino, offset, kind, name, link_target, lookup_cache } in dir_entries {
+                            if let Some(LinkTarget { path, parent_ino, target_name, target_lookup }) = link_target {
+                                self.link_target_cache.cache_set(ino, path);
+                                self.lookup_cache.cache_set((parent_ino, target_name.into()), target_lookup);
+                            }
+                            self.lookup_cache.cache_set((parent_ino, name.clone().into()), lookup_cache);
+                            if reply.add(ino, offset, kind, name) {
+                                break
+                            }
+                        }
+
+                        reply.ok();
+                    }
+            );
+        }
+        println!("Finished reply");
+    }
+
+    fn open(&mut self, _req: &fuser::Request<'_>, ino: u64, flags: i32, reply: ReplyOpen) {
+        send_reply! {
+            self => reply.opened(
+                Open { ino, flags } => Opened { file_handle, flags }
+            );
+        }
+    }
+
+    fn write(
+        &mut self,
+        _req: &fuser::Request<'_>,
+        ino: u64,
+        _fh: u64,
+        offset: i64,
+        data: &[u8],
+        write_flags: u32,
+        flags: i32,
+        _lock_owner: Option<u64>,
+        reply: ReplyWrite,
+    ) {
+        let data = data.to_owned();
+        send_reply! {
+            self => reply.written(
+                Write { ino, offset, data, write_flags, flags } => Written { size }
+            );
+        }
+    }
+}
+
+struct Sender<T: Serialize>(Channel, PhantomData<T>);
+
+impl<T: Serialize> Sender<T> {
+    fn send(&mut self, val: T) -> Result<(), ()> {
+        bincode::serialize_into(&mut self.0, &val).map_err(|_| ())
+    }
+}
+
+struct Receiver<T: DeserializeOwned>(PhantomData<T>);
+
+impl<T: DeserializeOwned> Receiver<T> {
+    fn recv(&self) -> Result<Reply, ()> {
+        loop {
+            match MESSAGE_QUEUE.pop() {
+                Some(bytes) => break bincode::deserialize(&bytes).map_err(|_| ()),
+                None => {
+                    println!("Nothing recieved, sleeping...");
+                    std::thread::sleep(std::time::Duration::from_millis(500));
+                }
+            }
+        }
+    }
+}
+
+fn split_channel<InType, OutType>(channel: Channel) -> (Sender<OutType>, Receiver<InType>)
+where
+    InType: DeserializeOwned,
+    OutType: Serialize,
+{
+    (Sender(channel, PhantomData), Receiver(PhantomData))
+}
+
+fn mount(channel: Channel) {
+    // TODO: make this programatically configurable via a plugin-to-plugin API
+    let mountpoint = std::env::var("HYPERFUSE_MOUNT")
+        .expect("HYPERFUSE_MOUNT is not set but is required by 'hyperfuse' plugin");
+
+    let options = vec![
+        MountOption::FSName("hello".to_string()),
+        MountOption::AutoUnmount,
+    ];
+
+    let (request, reply) = split_channel(channel);
+
+    fuser::mount2(
+        HyperFilesystem {
+            request,
+            reply,
+            link_target_cache: TimedCache::with_lifespan(1),
+            lookup_cache: TimedCache::with_lifespan(1),
+        },
+        mountpoint,
+        &options,
+    )
+    .unwrap();
+    println!("Unmounted");
+}
+
+use crossbeam_queue::SegQueue;
+use panda::plugins::guest_plugin_manager::*; //GUEST_PLUGIN_MANAGER;
+
+static MESSAGE_QUEUE: SegQueue<Vec<u8>> = SegQueue::new();
+
+#[channel_recv]
+fn message_recv(_: u32, bytes: Vec<u8>) {
+    MESSAGE_QUEUE.push(bytes.to_owned());
+}
+
+#[panda::init]
+fn init(_: &mut PluginHandle) -> bool {
+    pretty_env_logger::init_custom_env("HYPERFUSE_LOG");
+
+    let channel = load_guest_plugin("hyperfuse_guest", message_recv);
+
+    std::thread::spawn(move || mount(channel));
+
+    true
+}
diff --git a/panda/plugins/hyperfuse/src/types.rs b/panda/plugins/hyperfuse/src/types.rs
new file mode 100644
index 00000000000..262d5eb9540
--- /dev/null
+++ b/panda/plugins/hyperfuse/src/types.rs
@@ -0,0 +1,104 @@
+use libc::c_int;
+use std::time::Duration;
+
+use fuser::{FileAttr, FileType};
+use serde::{Deserialize, Serialize};
+
+#[derive(Serialize, Deserialize)]
+pub enum Request {
+    Lookup {
+        parent_ino: u64,
+        name: String,
+    },
+    GetAttr {
+        ino: u64,
+    },
+    Read {
+        ino: u64,
+        offset: i64,
+        size: u32,
+        flags: i32,
+    },
+    ReadLink {
+        ino: u64,
+    },
+    ReadDir {
+        ino: u64,
+        offset: i64,
+    },
+    Open {
+        ino: u64,
+        flags: i32,
+    },
+    Write {
+        ino: u64,
+        offset: i64,
+        data: Vec<u8>,
+        write_flags: u32,
+        flags: i32,
+    },
+    Create {
+        parent: u64,
+        name: String,
+        mode: u32,
+        umask: u32,
+        flags: u32,
+    },
+}
+
+#[derive(Serialize, Deserialize, Debug)]
+pub enum Reply {
+    Entry {
+        ttl: Duration,
+        attr: FileAttr,
+        generation: u64,
+    },
+    Attr {
+        ttl: Duration,
+        attr: FileAttr,
+    },
+    Data(Vec<u8>),
+    Directory {
+        dir_entries: Vec<DirEntry>,
+    },
+    Opened {
+        file_handle: u64,
+        flags: u32,
+    },
+    Written {
+        size: u32,
+    },
+    Created {
+        ttl: Duration,
+        attr: FileAttr,
+        generation: u64,
+        fh: u64,
+        flags: u32,
+    },
+    Error(c_int),
+}
+
+#[derive(Serialize, Deserialize, Debug)]
+pub struct LinkTarget {
+    pub path: Vec<u8>,
+    pub parent_ino: u64,
+    pub target_name: String,
+    pub target_lookup: LookupCacheEntry,
+}
+
+#[derive(Serialize, Deserialize, Debug)]
+pub struct DirEntry {
+    pub ino: u64,
+    pub offset: i64,
+    pub kind: FileType,
+    pub name: String,
+    pub link_target: Option<LinkTarget>,
+    pub lookup_cache: LookupCacheEntry,
+}
+
+#[derive(Serialize, Deserialize, Debug)]
+pub struct LookupCacheEntry {
+    pub ttl: Duration,
+    pub attr: FileAttr,
+    pub generation: u64,
+}
diff --git a/panda/plugins/linjector/.gitignore b/panda/plugins/linjector/.gitignore
new file mode 100644
index 00000000000..bdb80413b49
--- /dev/null
+++ b/panda/plugins/linjector/.gitignore
@@ -0,0 +1,3 @@
+/target
+src/injectables/injector
+src/injectables/tiny_mmap
diff --git a/panda/plugins/linjector/Cargo.lock b/panda/plugins/linjector/Cargo.lock
new file mode 100644
index 00000000000..2250e0b1dbe
--- /dev/null
+++ b/panda/plugins/linjector/Cargo.lock
@@ -0,0 +1,705 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 3
+
+[[package]]
+name = "adler"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f26201604c87b1e01bd3d98f8d5d9a8fcbb815e8cedb41ffccbeb4bf593a35fe"
+
+[[package]]
+name = "aho-corasick"
+version = "0.7.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e37cfd5e7657ada45f742d6e99ca5788580b5c529dc78faf11ece6dc702656f"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "array-init"
+version = "2.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6945cc5422176fc5e602e590c2878d2c2acd9a4fe20a4baa7c28022521698ec6"
+
+[[package]]
+name = "async-trait"
+version = "0.1.51"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "44318e776df68115a881de9a8fd1b9e53368d7a4a5ce4cc48517da3393233a5e"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "atty"
+version = "0.2.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d9b39be18770d11421cdb1b9947a45dd3f37e93092cbf377614828a319d5fee8"
+dependencies = [
+ "hermit-abi",
+ "libc",
+ "winapi",
+]
+
+[[package]]
+name = "autocfg"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cdb031dd78e28731d87d56cc8ffef4a8f36ca26c38fe2de700543e627f8a464a"
+
+[[package]]
+name = "bitflags"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
+
+[[package]]
+name = "cfg-if"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
+
+[[package]]
+name = "crc32fast"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "81156fece84ab6a9f2afdb109ce3ae577e42b1228441eded99bd77f627953b1a"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "ctor"
+version = "0.1.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ccc0a48a9b826acdf4028595adc9db92caea352f7af011a3034acd172a52a0aa"
+dependencies = [
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "darling"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0d706e75d87e35569db781a9b5e2416cff1236a47ed380831f959382ccd5f858"
+dependencies = [
+ "darling_core",
+ "darling_macro",
+]
+
+[[package]]
+name = "darling_core"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0c960ae2da4de88a91b2d920c2a7233b400bc33cb28453a2987822d8392519b"
+dependencies = [
+ "fnv",
+ "ident_case",
+ "proc-macro2",
+ "quote",
+ "strsim",
+ "syn",
+]
+
+[[package]]
+name = "darling_macro"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d9b5a2f4ac4969822c62224815d069952656cadc7084fdca9751e6d959189b72"
+dependencies = [
+ "darling_core",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "dashmap"
+version = "4.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e77a43b28d0668df09411cb0bc9a8c2adc40f9a048afe863e05fd43251e8e39c"
+dependencies = [
+ "cfg-if",
+ "num_cpus",
+]
+
+[[package]]
+name = "dirs"
+version = "3.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "30baa043103c9d0c2a57cf537cc2f35623889dc0d405e6c3cccfadbc81c71309"
+dependencies = [
+ "dirs-sys",
+]
+
+[[package]]
+name = "dirs-sys"
+version = "0.3.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "03d86534ed367a67548dc68113a0f5db55432fdfbb6e6f9d77704397d95d5780"
+dependencies = [
+ "libc",
+ "redox_users",
+ "winapi",
+]
+
+[[package]]
+name = "doc-comment"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fea41bba32d969b513997752735605054bc0dfa92b4c56bf1189f2e174be7a10"
+
+[[package]]
+name = "env_logger"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "44533bbbb3bb3c1fa17d9f2e4e38bbbaf8396ba82193c4cb1b6445d711445d36"
+dependencies = [
+ "atty",
+ "humantime",
+ "log",
+ "regex",
+ "termcolor",
+]
+
+[[package]]
+name = "flate2"
+version = "1.0.22"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e6988e897c1c9c485f43b47a529cef42fde0547f9d8d41a7062518f1d8fc53f"
+dependencies = [
+ "cfg-if",
+ "crc32fast",
+ "libc",
+ "miniz_oxide",
+]
+
+[[package]]
+name = "fnv"
+version = "1.0.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
+
+[[package]]
+name = "getrandom"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7fcd999463524c52659517fe2cea98493cfe485d10565e7b0fb07dbba7ad2753"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "wasi",
+]
+
+[[package]]
+name = "ghost"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1a5bcf1bbeab73aa4cf2fde60a846858dc036163c7c33bec309f8d17de785479"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "glib-sys"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c7e9b997a66e9a23d073f2b1abb4dbfc3925e0b8952f67efd8d9b6e168e4cdc1"
+dependencies = [
+ "libc",
+ "system-deps",
+]
+
+[[package]]
+name = "heck"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6d621efb26863f0e9924c6ac577e8275e5e6b77455db64ffa6c65c904e9e132c"
+dependencies = [
+ "unicode-segmentation",
+]
+
+[[package]]
+name = "hermit-abi"
+version = "0.1.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "62b467343b94ba476dcb2500d242dadbb39557df889310ac77c5d99100aaac33"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "humantime"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df004cfca50ef23c36850aaaa59ad52cc70d0e90243c3c7737a4dd32dc7a3c4f"
+dependencies = [
+ "quick-error",
+]
+
+[[package]]
+name = "ident_case"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9e0384b61958566e926dc50660321d12159025e767c18e043daf26b70104c39"
+
+[[package]]
+name = "instant"
+version = "0.1.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7a5bbe824c507c5da5956355e86a746d82e0e1464f65d862cc5e71da70e94b2c"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "inventory"
+version = "0.1.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0f0f7efb804ec95e33db9ad49e4252f049e37e8b0a4652e3cd61f7999f2eff7f"
+dependencies = [
+ "ctor",
+ "ghost",
+ "inventory-impl",
+]
+
+[[package]]
+name = "inventory-impl"
+version = "0.1.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "75c094e94816723ab936484666968f5b58060492e880f3c8d00489a1e244fa51"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "lazy_static"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
+
+[[package]]
+name = "libc"
+version = "0.2.103"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dd8f7255a17a627354f321ef0055d63b898c6fb27eff628af4d1b66b7331edf6"
+
+[[package]]
+name = "libloading"
+version = "0.6.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "351a32417a12d5f7e82c368a66781e307834dae04c6ce0cd4456d52989229883"
+dependencies = [
+ "cfg-if",
+ "winapi",
+]
+
+[[package]]
+name = "linjector"
+version = "0.1.0"
+dependencies = [
+ "lazy_static",
+ "log",
+ "object",
+ "once_cell",
+ "panda-re",
+ "pretty_env_logger",
+]
+
+[[package]]
+name = "lock_api"
+version = "0.4.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "712a4d093c9976e24e7dbca41db895dabcbac38eb5f4045393d17a95bdfb1109"
+dependencies = [
+ "scopeguard",
+]
+
+[[package]]
+name = "log"
+version = "0.4.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "51b9bbe6c47d51fc3e1a9b945965946b4c44142ab8792c50835a980d362c2710"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "memchr"
+version = "2.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "308cc39be01b73d0d18f82a0e7b2a3df85245f84af96fdddc5d202d27e47b86a"
+
+[[package]]
+name = "miniz_oxide"
+version = "0.4.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a92518e98c078586bc6c934028adcca4c92a53d6a958196de835170a01d84e4b"
+dependencies = [
+ "adler",
+ "autocfg",
+]
+
+[[package]]
+name = "num_cpus"
+version = "1.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "05499f3756671c15885fee9034446956fff3f243d6077b91e5767df161f766b3"
+dependencies = [
+ "hermit-abi",
+ "libc",
+]
+
+[[package]]
+name = "object"
+version = "0.26.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "39f37e50073ccad23b6d09bcb5b263f4e76d3bb6038e4a3c08e52162ffa8abc2"
+dependencies = [
+ "flate2",
+ "memchr",
+]
+
+[[package]]
+name = "once_cell"
+version = "1.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "692fcb63b64b1758029e0a96ee63e049ce8c5948587f2f7208df04625e5f6b56"
+
+[[package]]
+name = "panda-re"
+version = "0.38.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b59ef8fd95e7cecece17cf5d4d1c9aeafe79f020cc2b622cec18dd0a903b44ce"
+dependencies = [
+ "array-init",
+ "async-trait",
+ "dashmap",
+ "dirs",
+ "glib-sys",
+ "inventory",
+ "lazy_static",
+ "libloading",
+ "log",
+ "once_cell",
+ "panda-re-macros",
+ "panda-re-sys",
+ "parking_lot",
+ "paste",
+ "strum 0.20.0",
+ "strum_macros 0.20.1",
+ "thiserror",
+]
+
+[[package]]
+name = "panda-re-macros"
+version = "0.21.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29772398be20723c90088ae4380d62e25cefe54c174d9082532b258985e41d04"
+dependencies = [
+ "darling",
+ "doc-comment",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "panda-re-sys"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e00ee000dc315bf4a0a55d78b6d97456a7540d6ed01768da5f5aa89fdb660783"
+
+[[package]]
+name = "parking_lot"
+version = "0.11.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d17b78036a60663b797adeaee46f5c9dfebb86948d1255007a1d6be0271ff99"
+dependencies = [
+ "instant",
+ "lock_api",
+ "parking_lot_core",
+]
+
+[[package]]
+name = "parking_lot_core"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d76e8e1493bcac0d2766c42737f34458f1c8c50c0d23bcb24ea953affb273216"
+dependencies = [
+ "cfg-if",
+ "instant",
+ "libc",
+ "redox_syscall",
+ "smallvec",
+ "winapi",
+]
+
+[[package]]
+name = "paste"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "acbf547ad0c65e31259204bd90935776d1c693cec2f4ff7abb7a1bbbd40dfe58"
+
+[[package]]
+name = "pkg-config"
+version = "0.3.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7c9b1041b4387893b91ee6746cddfc28516aff326a3519fb2adf820932c5e6cb"
+
+[[package]]
+name = "pretty_env_logger"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "926d36b9553851b8b0005f1275891b392ee4d2d833852c417ed025477350fb9d"
+dependencies = [
+ "env_logger",
+ "log",
+]
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.29"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9f5105d4fdaab20335ca9565e106a5d9b82b6219b5ba735731124ac6711d23d"
+dependencies = [
+ "unicode-xid",
+]
+
+[[package]]
+name = "quick-error"
+version = "1.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a1d01941d82fa2ab50be1e79e6714289dd7cde78eba4c074bc5a4374f650dfe0"
+
+[[package]]
+name = "quote"
+version = "1.0.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3d0b9745dc2debf507c8422de05d7226cc1f0644216dfdfead988f9b1ab32a7"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "redox_syscall"
+version = "0.2.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8383f39639269cde97d255a32bdb68c047337295414940c68bdd30c2e13203ff"
+dependencies = [
+ "bitflags",
+]
+
+[[package]]
+name = "redox_users"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "528532f3d801c87aec9def2add9ca802fe569e44a544afe633765267840abe64"
+dependencies = [
+ "getrandom",
+ "redox_syscall",
+]
+
+[[package]]
+name = "regex"
+version = "1.5.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d07a8629359eb56f1e2fb1652bb04212c072a87ba68546a04065d525673ac461"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-syntax"
+version = "0.6.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f497285884f3fcff424ffc933e56d7cbca511def0c9831a7f9b5f6153e3cc89b"
+
+[[package]]
+name = "scopeguard"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d29ab0c6d3fc0ee92fe66e2d99f700eab17a8d57d1c1d3b748380fb20baa78cd"
+
+[[package]]
+name = "serde"
+version = "1.0.130"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f12d06de37cf59146fbdecab66aa99f9fe4f78722e3607577a5375d66bd0c913"
+
+[[package]]
+name = "smallvec"
+version = "1.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ecab6c735a6bb4139c0caafd0cc3635748bbb3acf4550e8138122099251f309"
+
+[[package]]
+name = "strsim"
+version = "0.9.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6446ced80d6c486436db5c078dde11a9f73d42b57fb273121e160b84f63d894c"
+
+[[package]]
+name = "strum"
+version = "0.18.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "57bd81eb48f4c437cadc685403cad539345bf703d78e63707418431cecd4522b"
+
+[[package]]
+name = "strum"
+version = "0.20.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7318c509b5ba57f18533982607f24070a55d353e90d4cae30c467cdb2ad5ac5c"
+
+[[package]]
+name = "strum_macros"
+version = "0.18.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "87c85aa3f8ea653bfd3ddf25f7ee357ee4d204731f6aa9ad04002306f6e2774c"
+dependencies = [
+ "heck",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "strum_macros"
+version = "0.20.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee8bc6b87a5112aeeab1f4a9f7ab634fe6cbefc4850006df31267f4cfb9e3149"
+dependencies = [
+ "heck",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "syn"
+version = "1.0.77"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5239bc68e0fef57495900cfea4e8dc75596d9a319d7e16b1e0a440d24e6fe0a0"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-xid",
+]
+
+[[package]]
+name = "system-deps"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0f3ecc17269a19353b3558b313bba738b25d82993e30d62a18406a24aba4649b"
+dependencies = [
+ "heck",
+ "pkg-config",
+ "strum 0.18.0",
+ "strum_macros 0.18.0",
+ "thiserror",
+ "toml",
+ "version-compare",
+]
+
+[[package]]
+name = "termcolor"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2dfed899f0eb03f32ee8c6a0aabdb8a7949659e3466561fc0adf54e26d88c5f4"
+dependencies = [
+ "winapi-util",
+]
+
+[[package]]
+name = "thiserror"
+version = "1.0.29"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "602eca064b2d83369e2b2f34b09c70b605402801927c65c11071ac911d299b88"
+dependencies = [
+ "thiserror-impl",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "1.0.29"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bad553cc2c78e8de258400763a647e80e6d1b31ee237275d756f6836d204494c"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "toml"
+version = "0.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a31142970826733df8241ef35dc040ef98c679ab14d7c3e54d827099b3acecaa"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "unicode-segmentation"
+version = "1.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8895849a949e7845e06bd6dc1aa51731a103c42707010a5b591c0038fb73385b"
+
+[[package]]
+name = "unicode-xid"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ccb82d61f80a663efe1f787a51b16b5a51e3314d6ac365b08639f52387b33f3"
+
+[[package]]
+name = "version-compare"
+version = "0.0.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d63556a25bae6ea31b52e640d7c41d1ab27faba4ccb600013837a3d0b3994ca1"
+
+[[package]]
+name = "wasi"
+version = "0.10.2+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fd6fbd9a79829dd1ad0cc20627bf1ed606756a7f77edff7b66b7064f9cb327c6"
+
+[[package]]
+name = "winapi"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
+dependencies = [
+ "winapi-i686-pc-windows-gnu",
+ "winapi-x86_64-pc-windows-gnu",
+]
+
+[[package]]
+name = "winapi-i686-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
+
+[[package]]
+name = "winapi-util"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "70ec6ce85bb158151cae5e5c87f95a8e97d2c0c4b001223f33a334e3ce5de178"
+dependencies = [
+ "winapi",
+]
+
+[[package]]
+name = "winapi-x86_64-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
diff --git a/panda/plugins/linjector/Cargo.toml b/panda/plugins/linjector/Cargo.toml
new file mode 100644
index 00000000000..20e981ade48
--- /dev/null
+++ b/panda/plugins/linjector/Cargo.toml
@@ -0,0 +1,28 @@
+[package]
+name = "linjector"
+version = "0.1.0"
+authors = ["Luke Craig <Luke.Craig@ll.mit.edu>", "Jordan McLeod <Jordan.McLeod@ll.mit.edu>"]
+edition = "2018"
+
+[lib]
+crate-type = ["cdylib"]
+
+[dependencies]
+panda-re = { version = "0.38.0", default-features = false, features = ["syscall-injection"] }
+once_cell = "1.8.0"
+object = "0.26.2"
+lazy_static = "1.4.0"
+log = "0.4"
+pretty_env_logger = "0.4"
+
+[features]
+default = ["x86_64"]
+
+x86_64 = ["panda-re/x86_64"]
+i386 = ["panda-re/i386"]
+arm = ["panda-re/arm"]
+ppc = ["panda-re/ppc"]
+mips = ["panda-re/mips"]
+mipsel = ["panda-re/mipsel"]
+aarch64 = ["panda-re/aarch64"]
+mips64 = ["panda-re/mips64"]
diff --git a/panda/plugins/linjector/Makefile b/panda/plugins/linjector/Makefile
new file mode 100644
index 00000000000..2234476df57
--- /dev/null
+++ b/panda/plugins/linjector/Makefile
@@ -0,0 +1,18 @@
+# Don't forget to add your plugin to config.panda!
+
+# Build rust plugins with make!
+
+# The main rule for your plugin. List all object-file dependencies.
+
+PANDA_PATH = $(realpath $(shell pwd)/..)
+PLUGIN_DIR = $(realpath $(join $(PANDA_PATH), /../panda/plugins/$(PLUGIN_NAME)/))
+RUST_SOURCE = $(wildcard $(PLUGIN_DIR)/src/*.rs)
+PLUGIN_ARTIFACTS_DIR = $(PLUGIN_TARGET_DIR)/$(PLUGIN_NAME)/target
+
+$(PLUGIN_TARGET_DIR)/panda_$(PLUGIN_NAME).so : $(RUST_SOURCE) $(PLUGIN_DIR)/Cargo.toml
+	@echo "  CARGO   $(PLUGIN_DIR)"
+	@CARGO_TERM_PROGRESS_WHEN=never cargo build --release \
+		--no-default-features --features=$(TARGET_NAME) \
+		--manifest-path=$(PLUGIN_DIR)/Cargo.toml \
+		--target-dir=$(PLUGIN_ARTIFACTS_DIR)
+	@cp -p $(PLUGIN_ARTIFACTS_DIR)/release/lib$(PLUGIN_NAME).so $@
diff --git a/panda/plugins/linjector/README.md b/panda/plugins/linjector/README.md
new file mode 100644
index 00000000000..af971ae6d1f
--- /dev/null
+++ b/panda/plugins/linjector/README.md
@@ -0,0 +1,15 @@
+# linjector
+
+linjector is a PANDA plugin responsible for non-cooperatively injecting a binary into
+a linux guest. This process is done via system call injection, chaining system calls
+together in order to run the provided executable. It is not recommended to use this directly, but rather to use `guest_plugin_manager` in order to spawn your executable as a child of the PANDA-provided guest agent (`guest_daemon`).
+
+### Arguments
+
+* `guest_binary` - string, the path of the executable to load into the guest
+* `proc_name` - string, the process name to inject into. Defaults to `[any]`.
+* `require_root` - bool, whether or not to require the process being injected into to have a UID of root
+
+### Compatibility
+
+Currently linjector only has support for x86_64 and arm guests. For other targets one may need to provide their own process injection mechanism.
diff --git a/panda/plugins/linjector/linjector_ppp.h b/panda/plugins/linjector/linjector_ppp.h
new file mode 100644
index 00000000000..2a407a8ee0f
--- /dev/null
+++ b/panda/plugins/linjector/linjector_ppp.h
@@ -0,0 +1,11 @@
+#ifndef __LINJECTOR_PPP_H
+#define __LINJECTOR_PPP_H
+// BEGIN_PYPANDA_NEEDS_THIS -- do not delete this comment bc pypanda
+// api autogen needs it.  And don't put any compiler directives
+// between this and END_PYPANDA_NEEDS_THIS except includes of other
+// files in this directory that contain subsections like this one.
+
+PPP_CB_TYPEDEF(void,before_guest_inject,CPUState *);
+
+// END_PYPANDA_NEEDS_THIS -- do not delete this comment!
+#endif
diff --git a/panda/plugins/linjector/rustfmt.toml b/panda/plugins/linjector/rustfmt.toml
new file mode 100644
index 00000000000..5c8d9318b3b
--- /dev/null
+++ b/panda/plugins/linjector/rustfmt.toml
@@ -0,0 +1 @@
+max_width = 80
\ No newline at end of file
diff --git a/panda/plugins/linjector/src/args.rs b/panda/plugins/linjector/src/args.rs
new file mode 100644
index 00000000000..f740916a27a
--- /dev/null
+++ b/panda/plugins/linjector/src/args.rs
@@ -0,0 +1,55 @@
+use once_cell::sync::OnceCell;
+use panda::plugins::guest_plugin_manager::guest_plugin_path;
+use panda::prelude::*;
+
+use std::fs;
+use std::path::Path;
+
+static ELF_TO_INJECT: OnceCell<Vec<u8>> = OnceCell::new();
+
+#[derive(PandaArgs)]
+#[name = "linjector"] // plugin name
+pub struct Args {
+    #[arg(default = "guest_daemon")]
+    pub guest_binary: String,
+
+    #[arg(default = "[any]")]
+    pub proc_name: String,
+
+    #[arg(default = true)]
+    pub require_root: bool,
+}
+
+lazy_static::lazy_static! {
+    pub static ref ARGS: Args = Args::from_panda_args();
+}
+
+pub fn ensure_init() {
+    lazy_static::initialize(&ARGS);
+}
+
+pub fn load_elf() {
+    log::info!("Loading binary: {:?}", ARGS.guest_binary);
+
+    let binary_name = &ARGS.guest_binary;
+
+    let guest_binary = match guest_plugin_path(binary_name) {
+        Some(path) => path.to_string_lossy().into_owned(),
+        None if Path::new(binary_name).exists() => binary_name.clone(),
+        None => panic!("Failed to get binary {:?}", binary_name),
+    };
+
+    ELF_TO_INJECT.get_or_init(|| fs::read(&guest_binary).unwrap());
+}
+
+pub fn elf_to_inject() -> &'static [u8] {
+    &ELF_TO_INJECT.get().expect("No elf file loaded")[..]
+}
+
+pub fn require_root() -> bool {
+    ARGS.require_root
+}
+
+pub fn proc_name() -> &'static str {
+    ARGS.proc_name.as_str()
+}
diff --git a/panda/plugins/linjector/src/injectables/Makefile b/panda/plugins/linjector/src/injectables/Makefile
new file mode 100644
index 00000000000..1616672f058
--- /dev/null
+++ b/panda/plugins/linjector/src/injectables/Makefile
@@ -0,0 +1,31 @@
+.DEFAULT_GOAL := all
+LIST=injector tiny_mmap
+
+all: $(LIST)
+
+.PHONY: all
+
+CC=gcc -m32
+EXTRA_GCC_ARGS= -fomit-frame-pointer -nodefaultlibs -nostdlib -fpic
+
+
+hello_world: hello_world.c
+	$(CC) $(EXTRA_GCC_ARGS) $< -o $@
+
+read_file: read_file.c
+	$(CC) $(EXTRA_GCC_ARGS) $< -o $@
+
+read_all_files: read_all_files.c
+	$(CC) $(EXTRA_GCC_ARGS) $< -o $@
+
+injector: injector.c
+	$(CC) -O3 $(EXTRA_GCC_ARGS) $< -o $@
+
+tiny_mmap: tiny_mmap.c
+	$(CC) $(EXTRA_GCC_ARGS) $< -o $@
+
+basic_hello_world: basic_hello_world.c
+	$(CC) -static $< -o $@
+
+clean: 
+	rm -rf  $(LIST)
diff --git a/panda/plugins/linjector/src/injectables/include/hypercall.h b/panda/plugins/linjector/src/injectables/include/hypercall.h
new file mode 100644
index 00000000000..c1235ede477
--- /dev/null
+++ b/panda/plugins/linjector/src/injectables/include/hypercall.h
@@ -0,0 +1,66 @@
+// stolen from recctrl.h; modified to make more generic
+#include "hypercall_constants.h"
+
+
+#if defined(__x86_64__) || defined(__i386__)
+static inline __attribute__((always_inline)) int hc_rec(hc_cmd action, char *s, int len) {
+    int eax = HC_MAGIC;
+    int ret = HC_ERROR;
+
+    asm __volatile__(
+	"mov %1, %%eax \t\n\
+     mov %2, %%ebx \t\n\
+     mov %3, %%ecx \t\n\
+     mov %4, %%edx \t\n\
+     cpuid \t\n\
+     mov %%eax, %0 \t\n\
+    "
+	: "=g"(ret) /* output operand */
+	: "g" (eax), "g" (action), "g" (s), "g" (len)/* input operands */
+	: "eax", "ebx", "ecx", "edx" /* clobbered registers */
+    );
+
+    return ret;
+}
+static inline __attribute__((always_inline)) int hc(hc_cmd action, char *s) {
+    int eax = HC_MAGIC;
+    int ret = HC_ERROR;
+
+    asm __volatile__(
+	"mov %1, %%eax \t\n\
+     mov %2, %%ebx \t\n\
+     mov %3, %%ecx \t\n\
+     cpuid \t\n\
+     mov %%eax, %0 \t\n\
+    "
+	: "=g"(ret) /* output operand */
+	: "g" (eax), "g" (action), "g" (s) /* input operands */
+	: "eax", "ebx", "ecx", "edx" /* clobbered registers */
+    );
+
+    return ret;
+}
+#elif defined(__arm__)
+static inline __attribute__((always_inline)) int hc(hc_cmd action, char *s) {
+    unsigned long r0 = HC_MAGIC;
+    int ret = HC_ERROR;
+
+    asm __volatile__(
+    "push {r0-r4} \t\n\
+     ldr r0, %1 \t\n\
+     ldr r1, %2 \t\n\
+     ldr r2, %3 \t\n\
+     ldr p7, 0, r0, c0, c0, 0 \t\n\
+     sdr r0, %0 \t\n\
+     pop {r0-r4} \t\n\
+    "
+    : "=g"(ret) /* output operand */
+    : "g" (r0), "g" (action), "g" (s) /* input operands */
+    : "r0", "r1", "r2", "r3" /* clobbered registers */
+    );
+
+    return ret;
+}
+#else
+#error Unsupported platform.
+#endif
diff --git a/panda/plugins/linjector/src/injectables/include/hypercall_constants.h b/panda/plugins/linjector/src/injectables/include/hypercall_constants.h
new file mode 100644
index 00000000000..d2b234195f8
--- /dev/null
+++ b/panda/plugins/linjector/src/injectables/include/hypercall_constants.h
@@ -0,0 +1,15 @@
+/** @brief Magic code to use in cpuid hypercall. */
+#define HC_MAGIC 0x10adc0d3
+
+typedef enum {
+    HC_NOOP = 0,
+    HC_START,               /* start new action */
+    HC_STOP,                /* stop action */
+    HC_READ,                /* read buffer from hypervisor */
+    HC_WRITE,               /* write buffer TO hypervisor*/
+    HC_ERROR,               /* report error to hypervisor*/
+    HC_CONDITIONAL_OP,      /* ask the hypervisor if op should be completed*/
+    HC_NEXT_STATE_MACHINE,  /* ask the hypervisor manager to move to the next
+                            state machine*/
+} hc_cmd;
+
diff --git a/panda/plugins/linjector/src/injectables/include/syscall_x86.h b/panda/plugins/linjector/src/injectables/include/syscall_x86.h
new file mode 100644
index 00000000000..cf20621a6d7
--- /dev/null
+++ b/panda/plugins/linjector/src/injectables/include/syscall_x86.h
@@ -0,0 +1,103 @@
+#ifndef BASE_C_EXAMPLE
+#include "/usr/include/i386-linux-gnu/asm/unistd_32.h"
+#include "/usr/include/asm-generic/fcntl.h"
+#define _SYS_MMAN_H // it's a lie. but it's a good intention
+#define __USE_MISC
+#include "/usr/include/bits/mman-linux.h"
+#endif
+#define NULL 0L
+
+#define SYSINL static inline __attribute__((always_inline))
+
+/*
+* All the syscall stuff is from musl /arch/i386/syscall_arch.h
+*/
+
+#define SYSCALL_INSNS "int $128"
+
+#define SYSCALL_INSNS_12 "xchg %%ebx,%%edx ; " SYSCALL_INSNS " ; xchg %%ebx,%%edx"
+#define SYSCALL_INSNS_34 "xchg %%ebx,%%edi ; " SYSCALL_INSNS " ; xchg %%ebx,%%edi"
+
+
+SYSINL long syscall_0(long n)
+{
+	unsigned long __ret;
+	__asm__ __volatile__ (SYSCALL_INSNS : "=a"(__ret) : "a"(n) : "memory");
+	return __ret;
+}
+
+SYSINL long syscall_1(long n, long a1)
+{
+	unsigned long __ret;
+	__asm__ __volatile__ (SYSCALL_INSNS_12 : "=a"(__ret) : "a"(n), "d"(a1) : "memory");
+	return __ret;
+}
+
+SYSINL long syscall_2(long n, long a1, long a2)
+{
+	unsigned long __ret;
+	__asm__ __volatile__ (SYSCALL_INSNS_12 : "=a"(__ret) : "a"(n), "d"(a1), "c"(a2) : "memory");
+	return __ret;
+}
+
+SYSINL long syscall_3(long n, long a1, long a2, long a3)
+{
+	unsigned long __ret;
+#if !defined(__PIC__) || !defined(BROKEN_EBX_ASM)
+	__asm__ __volatile__ (SYSCALL_INSNS : "=a"(__ret) : "a"(n), "b"(a1), "c"(a2), "d"(a3) : "memory");
+#else
+	__asm__ __volatile__ (SYSCALL_INSNS_34 : "=a"(__ret) : "a"(n), "D"(a1), "c"(a2), "d"(a3) : "memory");
+#endif
+	return __ret;
+}
+
+SYSINL long syscall_4(long n, long a1, long a2, long a3, long a4)
+{
+	unsigned long __ret;
+#if !defined(__PIC__) || !defined(BROKEN_EBX_ASM)
+	__asm__ __volatile__ (SYSCALL_INSNS : "=a"(__ret) : "a"(n), "b"(a1), "c"(a2), "d"(a3), "S"(a4) : "memory");
+#else
+	__asm__ __volatile__ (SYSCALL_INSNS_34 : "=a"(__ret) : "a"(n), "D"(a1), "c"(a2), "d"(a3), "S"(a4) : "memory");
+#endif
+	return __ret;
+}
+
+SYSINL long syscall_5(long n, long a1, long a2, long a3, long a4, long a5)
+{
+	unsigned long __ret;
+#if !defined(__PIC__) || !defined(BROKEN_EBX_ASM)
+	__asm__ __volatile__ (SYSCALL_INSNS
+		: "=a"(__ret) : "a"(n), "b"(a1), "c"(a2), "d"(a3), "S"(a4), "D"(a5) : "memory");
+#else
+	__asm__ __volatile__ ("pushl %2 ; push %%ebx ; mov 4(%%esp),%%ebx ; " SYSCALL_INSNS " ; pop %%ebx ; add $4,%%esp"
+		: "=a"(__ret) : "a"(n), "g"(a1), "c"(a2), "d"(a3), "S"(a4), "D"(a5) : "memory");
+#endif
+	return __ret;
+}
+
+SYSINL long syscall_6(long n, long a1, long a2, long a3, long a4, long a5, long a6)
+{
+	unsigned long __ret;
+#if !defined(__PIC__) || !defined(BROKEN_EBX_ASM)
+	__asm__ __volatile__ ("pushl %7 ; push %%ebp ; mov 4(%%esp),%%ebp ; " SYSCALL_INSNS " ; pop %%ebp ; add $4,%%esp"
+		: "=a"(__ret) : "a"(n), "b"(a1), "c"(a2), "d"(a3), "S"(a4), "D"(a5), "g"(a6) : "memory");
+#else
+	unsigned long a1a6[2] = { a1, a6 };
+	__asm__ __volatile__ ("pushl %1 ; push %%ebx ; push %%ebp ; mov 8(%%esp),%%ebx ; mov 4(%%ebx),%%ebp ; mov (%%ebx),%%ebx ; " SYSCALL_INSNS " ; pop %%ebp ; pop %%ebx ; add $4,%%esp"
+		: "=a"(__ret) : "g"(&a1a6), "a"(n), "c"(a2), "d"(a3), "S"(a4), "D"(a5) : "memory");
+#endif
+	return __ret;
+}
+
+
+
+
+static inline void* memset(void *buf, int num, int l){
+    char* writer  = (char*) buf;
+    void* end = buf + l;
+    while ((void*)writer < end){
+        *writer = num;
+        writer++;
+    }
+    return buf;
+}
\ No newline at end of file
diff --git a/panda/plugins/linjector/src/injectables/injector.c b/panda/plugins/linjector/src/injectables/injector.c
new file mode 100644
index 00000000000..4dfdd114ab6
--- /dev/null
+++ b/panda/plugins/linjector/src/injectables/injector.c
@@ -0,0 +1,54 @@
+#include "include/syscall_x86.h"
+#include "include/hypercall.h"
+#define MFD_CLOEXEC		0x0001U
+
+int _start(void){
+    int pid = syscall_0(__NR_fork);
+    if (pid == 0){
+        // child process
+        int val = 0;
+        while(!val){
+            hc(HC_STOP, (char*)&val);
+            syscall_0(__NR_sched_yield);
+        }
+        char none = '\0';
+        int fd = syscall_2(__NR_memfd_create, (int)&none, MFD_CLOEXEC);
+        char buf[512];
+        int rlen;
+        while ((rlen = hc_rec(HC_WRITE, (char*)&buf,sizeof(buf)/sizeof(buf[0])))>0){
+            syscall_3(__NR_write, fd, (int)buf, rlen);
+        }
+        hc(HC_NEXT_STATE_MACHINE, (char*)0);
+        unsigned char execbuf[] = {47, 112, 114, 111, 99, 47, 115, 101, 108, 102, 47, 102, 100, 47, 48, 0};
+        execbuf[14] += fd;
+        char* argv[] = {(char*)0};
+        syscall_3(__NR_execve, (int)execbuf, (int)argv, (int)argv);
+    }else{
+        // parent process
+        int pathname = hc(HC_READ,(char*)pid);
+        int argv = hc(HC_READ, (char*) pid);
+        int envp = hc(HC_READ, (char*) pid);
+        syscall_3(__NR_execve, pathname, argv, envp);
+    }
+}
+
+        //int pc = hc(HC_READ, (char*)pid);
+        //int eax = hc(HC_READ, (char*)pid);
+        //int ecx = hc(HC_READ, (char*)pid);
+        //int edx = hc(HC_READ, (char*)pid);
+        //int ebx = hc(HC_READ, (char*)pid);
+        //int esp = hc(HC_READ, (char*)pid);
+        //int ebp = hc(HC_READ, (char*)pid);
+        //int esi = hc(HC_READ, (char*)pid);
+        //int edi = hc(HC_READ, (char*)pid);
+        //asm volatile("mov %%eax, %0" : : "r"(eax));
+        //asm volatile("mov %%ecx, %0" : : "r"(ecx));
+        //asm volatile("mov %%edx, %0" : : "r"(edx));
+        //asm volatile("mov %%ebx, %0" : : "r"(ebx));
+        //asm volatile("mov %%esi, %0" : : "r"(esi));
+        //asm volatile("mov %%edi, %0" : : "r"(edi));
+        //asm volatile("mov %%esp, %0" : : "r"(esp));
+        //asm volatile("mov %%ebp, %0" : : "r"(ebp));
+        ////asm volatile ("jmp *%0" : : "r" (pc));
+        //asm volatile ("jmp -2");
+        //while(1);
\ No newline at end of file
diff --git a/panda/plugins/linjector/src/injectables/tiny_mmap.c b/panda/plugins/linjector/src/injectables/tiny_mmap.c
new file mode 100644
index 00000000000..7ea79d1250e
--- /dev/null
+++ b/panda/plugins/linjector/src/injectables/tiny_mmap.c
@@ -0,0 +1,11 @@
+#include "include/syscall_x86.h"
+#include "include/hypercall.h"
+
+// how much memory we give the injector
+#define PAGE_SIZE 0x1000
+
+int _start(void){
+    void* region = syscall_6(__NR_mmap2, NULL, PAGE_SIZE, PROT_READ | PROT_WRITE | PROT_EXEC, MAP_SHARED | MAP_ANON,-1,0);
+    hc(HC_START,(char*)region);
+    (*(void(*)()) region)();
+}
\ No newline at end of file
diff --git a/panda/plugins/linjector/src/lib.rs b/panda/plugins/linjector/src/lib.rs
new file mode 100644
index 00000000000..f37592a7df2
--- /dev/null
+++ b/panda/plugins/linjector/src/lib.rs
@@ -0,0 +1,274 @@
+use panda::{
+    current_asid, enums::MemRWStatus, mem::virtual_memory_write,
+    plugins::osi::OSI, prelude::*, sys::get_cpu,
+};
+
+#[cfg(not(feature = "ppc"))]
+use panda::{
+    plugins::syscalls2::SYSCALLS,
+    syscall_injection::{fork, run_injector},
+};
+
+use std::sync::atomic::{AtomicBool, Ordering};
+
+mod args;
+
+#[cfg(not(feature = "ppc"))]
+mod syscalls;
+
+#[cfg(not(feature = "ppc"))]
+use syscalls::{
+    chdir, close, do_execve, do_memfd_create, do_mmap, do_write, getpid, open,
+    setsid, O_CLOEXEC, O_CREAT, O_RDWR, O_TRUNC, PAGE_SIZE,
+};
+
+#[cfg(not(feature = "ppc"))]
+/// mmap a buffer and ensure it's paged in, then return the address to it
+async fn get_guest_buffer() -> target_ptr_t {
+    // mmap in a new page
+    let mmap_addr = do_mmap().await;
+    log::debug!("mmap addr {:#x}", mmap_addr);
+
+    if (mmap_addr as target_long).is_negative() && mmap_addr > 0xffff_0000 {
+        log::error!("linjector mmap error: {}", mmap_addr as target_long);
+    }
+
+    // Ensure the page is mapped in
+    let chdir_return = chdir(mmap_addr).await;
+    log::debug!("Chdir return: {:#x}", chdir_return);
+
+    mmap_addr as target_ptr_t
+}
+
+fn current_process_name(cpu: &mut CPUState) -> String {
+    let proc = OSI.get_current_process(cpu);
+    proc.map(|name| name.get_name().into_owned())
+        .unwrap_or_default()
+}
+
+/// Convert to bytes and add null terminator
+fn cstr_bytes(string: impl Into<String>) -> Vec<u8> {
+    let mut string = string.into().into_bytes();
+    string.push(0);
+    string
+}
+
+/// Format a string and copy it to the guest
+macro_rules! guest_string {
+    ($cpu:ident, $($tt:tt)*) => {{
+        let bytes = cstr_bytes(format!($($tt)*));
+        let guest_buf = get_guest_buffer().await;
+
+        let write_result = virtual_memory_write($cpu, guest_buf, &bytes);
+
+        if !matches!(write_result, MemRWStatus::MemTxOk) {
+            log::error!("Write to guest status: {:?}", write_result);
+        }
+
+        guest_buf
+    }};
+}
+
+panda::export_ppp_callback! {
+    pub(crate) fn before_guest_inject(cpu: &mut CPUState);
+}
+
+#[cfg(not(feature = "ppc"))]
+extern "C" fn on_sys_enter(
+    cpu: &mut CPUState,
+    pc: SyscallPc,
+    syscall_num: target_ulong,
+) {
+    // Only check process name when a target process name is provided
+    if args::proc_name() != "[any]" {
+        let proc_name = current_process_name(cpu);
+
+        // Only inject into this process if the process matches the provided name
+        if proc_name == args::proc_name() {
+            log::trace!("Injecting into process {:?}", proc_name);
+        } else {
+            log::trace!("Not injecting into process {:?}", proc_name);
+            return;
+        }
+    }
+
+    // Once we inject to a process stop looking for syscalls to inject into
+    SYSCALLS.remove_callback_on_all_sys_enter(on_sys_enter);
+
+    log::debug!("Attempting injection into syscall {}", syscall_num);
+    let file_data = args::elf_to_inject();
+
+    // Inject our syscall chain into the current system call. This injector
+    // copies our ELF to a memory file descriptor then forks and runs it as
+    // a daemon process.
+    run_injector(pc, async move {
+        let cpu = unsafe { &mut *get_cpu() };
+        if args::require_root() {
+            if getpid().await == 0 {
+                log::debug!("Got root!");
+            } else {
+                // Set the injector back up for next syscall
+                log::trace!("Not root, retrying next syscall...");
+                SYSCALLS.add_callback_on_all_sys_enter(on_sys_enter);
+                return;
+            }
+        }
+
+        log::debug!("current asid: {:x}", current_asid(cpu));
+
+        // mmap a region so we have a buffer in the guest to use
+        let guest_buf = get_guest_buffer().await;
+
+        // Create a memory file descriptor for loading our binary into
+        let mem_fd = loop {
+            match do_memfd_create(guest_buf).await {
+                0 => log::trace!("Got memfd of 0, retrying..."),
+                fd => break fd,
+            }
+        };
+        log::debug!("Got memory fd {:#x}", mem_fd);
+
+        let (fd, is_mem_fd) = if (mem_fd as target_long).is_negative() {
+            log::error!("linjector mem_fd error: {}", mem_fd as target_long);
+
+            log::debug!("linjector trying to write to /tmp instead...");
+
+            let path = guest_string!(cpu, "/tmp/payload");
+            let fd =
+                open(path, O_CREAT | O_CLOEXEC | O_RDWR | O_TRUNC, 0o777).await;
+
+            log::debug!("open of /tmp/payload returned {}", fd);
+
+            if (fd as target_long).is_negative() {
+                log::error!("open of /tmp/payload returned error {}", fd);
+            }
+
+            (fd, false)
+        } else {
+            (mem_fd, true)
+        };
+
+        // Write our file to our memory fd
+        let mut elf_write_pos = 0;
+        while elf_write_pos < file_data.len() {
+            // Calculate max size to attempt to copy to our guest buffer
+            let attempt_write_size =
+                usize::min(PAGE_SIZE as usize, file_data.len() - elf_write_pos);
+
+            // Calculate the end of the range we're attempting to copy
+            let end_write = elf_write_pos + attempt_write_size;
+
+            log::debug!(
+                "Writing {} bytes [{}-{}]... (file len: {})",
+                PAGE_SIZE,
+                elf_write_pos,
+                end_write,
+                file_data.len(),
+            );
+
+            // Copy to guest buffer
+            virtual_memory_write(
+                cpu,
+                guest_buf,
+                &file_data[elf_write_pos..end_write],
+            );
+
+            // Write guest buffer to memory file descriptor
+            let written = do_write(fd, guest_buf, PAGE_SIZE).await;
+
+            if written < 0 {
+                log::error!("Write returned error {}", written);
+                panic!();
+            } else {
+                elf_write_pos += written as usize;
+            }
+        }
+
+        log::debug!("Finished writing to memfd");
+
+        if !is_mem_fd {
+            let close_ret = close(fd).await;
+            if close_ret != 0 {
+                log::error!("Close of fd failed: {}", close_ret);
+            }
+        }
+
+        log::debug!("Forking...");
+
+        // Fork and have the child process spawn the injected elf
+        let child_pid = fork(async move {
+            log::debug!("Child process began");
+            log::debug!(
+                "Child process pid: {:#x?}, Child's parent: {:#x?}",
+                OSI.get_current_process(cpu).map(|proc| proc.pid),
+                OSI.get_current_process(cpu).map(|proc| proc.ppid),
+            );
+            log::debug!("Child asid: {:#x?}", panda::current_asid(cpu));
+
+            // Daemonize child process
+            let session_id = setsid().await;
+            log::debug!("Session id: {:#x}", session_id);
+
+            // Path should be "/proc/self/fd/#" where # is the memory file descriptor we
+            // loaded our executable into,
+            let guest_path_buf = if is_mem_fd {
+                guest_string!(cpu, "/proc/self/fd/{}", fd)
+            } else {
+                guest_string!(cpu, "/tmp/payload")
+            };
+
+            before_guest_inject::trigger(cpu);
+
+            // Execute the guest binary
+            log::debug!("Performing execve");
+            dbg!(do_execve(guest_path_buf, 0, 0).await);
+            panic!();
+        })
+        .await;
+
+        log::debug!("Fork returned pid: {:#x?}", child_pid);
+        let cpu = unsafe { &mut *get_cpu() };
+        log::debug!(
+            "Parent process pid: {:#x?}, Parent's parent: {:#x?}",
+            OSI.get_current_process(cpu).map(|proc| proc.pid),
+            OSI.get_current_process(cpu).map(|proc| proc.ppid),
+        );
+        log::debug!("Parent asid: {:#x?}", panda::current_asid(cpu));
+
+        // Allow the original process to resume executing
+    });
+}
+
+static LOADED: AtomicBool = AtomicBool::new(false);
+
+#[cfg(not(feature = "ppc"))]
+#[panda::init]
+fn init(_: &mut PluginHandle) -> bool {
+    if LOADED.swap(true, Ordering::SeqCst) {
+        return true;
+    }
+
+    args::ensure_init();
+    SYSCALLS.add_callback_on_all_sys_enter(on_sys_enter);
+
+    pretty_env_logger::init_custom_env("LINJECTOR_LOG");
+    args::load_elf();
+
+    log::info!("linjector loaded");
+    if args::require_root() {
+        log::info!("linjector requiring root");
+    } else {
+        log::info!("linjector not requiring root");
+    }
+
+    true
+}
+
+#[cfg(feature = "ppc")]
+#[panda::init]
+fn init(_: &mut PluginHandle) -> bool {
+    panic!("linjector not supported on PowerPC")
+}
+
+#[panda::uninit]
+fn exit(_: &mut PluginHandle) {}
diff --git a/panda/plugins/linjector/src/regs.rs b/panda/plugins/linjector/src/regs.rs
new file mode 100644
index 00000000000..c3bfe36d056
--- /dev/null
+++ b/panda/plugins/linjector/src/regs.rs
@@ -0,0 +1,16 @@
+use panda::regs::Reg;
+
+// =================== Register Order ===================
+#[cfg(feature = "i386")]
+pub const REG_ORDER: [Reg; 4] = [Reg::EAX, Reg::EBX, Reg::ECX, Reg::EDX];
+
+// XXX: is this right?
+#[cfg(feature = "x86_64")]
+pub const REG_ORDER: [Reg; 4] = [Reg::RAX, Reg::RBX, Reg::RCX, Reg::RDX];
+
+// =================== Return Value ===================
+#[cfg(feature = "i386")]
+pub const RET_REG: Reg = Reg::EAX;
+
+#[cfg(feature = "x86_64")]
+pub const RET_REG: Reg = Reg::RAX;
diff --git a/panda/plugins/linjector/src/syscalls.rs b/panda/plugins/linjector/src/syscalls.rs
new file mode 100644
index 00000000000..5ba9ac0f6fe
--- /dev/null
+++ b/panda/plugins/linjector/src/syscalls.rs
@@ -0,0 +1,107 @@
+use panda::prelude::*;
+use panda::syscall_injection::{syscall, syscall_no_return};
+
+// i386
+// const MMAP2: target_ulong = 192;
+// const WRITE: target_ulong = 4;
+// const FORK: target_ulong = 2;
+// const EXECVE: target_ulong = 11;
+// const MEMFD_CREATE: target_ulong = 356;
+
+#[cfg(feature = "x86_64")]
+#[path = "syscalls/x86_64.rs"]
+mod sys_nums;
+
+#[cfg(feature = "i386")]
+#[path = "syscalls/i386.rs"]
+mod sys_nums;
+
+#[cfg(feature = "arm")]
+#[path = "syscalls/arm.rs"]
+mod sys_nums;
+
+#[cfg(any(feature = "mips", feature = "mipsel"))]
+#[path = "syscalls/mips.rs"]
+mod sys_nums;
+
+#[cfg(feature = "mips64")]
+#[path = "syscalls/mips64.rs"]
+mod sys_nums;
+
+#[cfg(feature = "aarch64")]
+#[path = "syscalls/aarch64.rs"]
+mod sys_nums;
+
+use sys_nums::*;
+
+const NULL: target_ulong = 0;
+const NEG_1: target_ulong = u32::MAX as target_ulong;
+pub const PAGE_SIZE: target_ulong = 1024;
+
+pub async fn do_mmap() -> target_ulong {
+    syscall(
+        MMAP,
+        (
+            0u64,
+            PAGE_SIZE,
+            PROT_READ | PROT_WRITE,
+            MAP_SHARED | MAP_ANON,
+            NEG_1,
+            NULL,
+        ),
+    )
+    .await
+}
+
+pub const O_CREAT: i32 = 0o100;
+pub const O_RDWR: i32 = 0o002;
+pub const O_CLOEXEC: i32 = 0o2000000;
+pub const O_TRUNC: i32 = 0o1000;
+
+const MFD_CLOEXEC: target_ulong = 1;
+
+pub async fn do_memfd_create(mmap_addr: target_ulong) -> target_ulong {
+    // we use the mmap_addr for the name because we've zeroed it
+    // so it will be a '\0' literal name
+    syscall(MEMFD_CREATE, (mmap_addr, MFD_CLOEXEC)).await
+}
+
+pub async fn do_write(
+    mem_fd: target_ulong,
+    mmap_addr: target_ulong,
+    len: target_ulong,
+) -> target_long {
+    syscall(WRITE, (mem_fd, mmap_addr, len)).await as target_long
+}
+
+pub async fn do_execve(
+    path: target_ulong,
+    argv: target_ulong,
+    envp: target_ulong,
+) -> target_ulong {
+    syscall_no_return(EXECVE, (path, argv, envp)).await
+}
+
+pub async fn getpid() -> target_ulong {
+    syscall(GETPID, ()).await
+}
+
+pub async fn chdir(addr: target_ulong) -> target_ulong {
+    syscall(CHDIR, (addr,)).await
+}
+
+pub async fn setsid() -> target_ulong {
+    syscall(SETSID, ()).await
+}
+
+pub async fn close(fd: target_ulong) -> target_ulong {
+    syscall(CLOSE, (fd,)).await
+}
+
+pub async fn open(
+    path_ptr: target_ulong,
+    flags: i32,
+    mode: target_ulong,
+) -> target_ulong {
+    syscall(OPEN, (path_ptr, flags as target_long as target_ulong, mode)).await
+}
diff --git a/panda/plugins/linjector/src/syscalls/aarch64.rs b/panda/plugins/linjector/src/syscalls/aarch64.rs
new file mode 100644
index 00000000000..781a05afeb4
--- /dev/null
+++ b/panda/plugins/linjector/src/syscalls/aarch64.rs
@@ -0,0 +1,17 @@
+use panda::prelude::*;
+
+pub(crate) const GETPID: target_ulong = 0xAC;
+pub(crate) const MMAP: target_ulong = 222;
+pub(crate) const WRITE: target_ulong = 64;
+pub(crate) const EXECVE: target_ulong = 221;
+pub(crate) const MEMFD_CREATE: target_ulong = 279;
+pub(crate) const CHDIR: target_ulong = 49;
+pub(crate) const SETSID: target_ulong = 157;
+pub(crate) const OPEN: target_ulong = 0x400;
+pub(crate) const CLOSE: target_ulong = 0x39;
+
+pub(crate) const PROT_READ: target_ulong = 1;
+pub(crate) const PROT_WRITE: target_ulong = 2;
+
+pub(crate) const MAP_SHARED: target_ulong = 1;
+pub(crate) const MAP_ANON: target_ulong = 0x20;
diff --git a/panda/plugins/linjector/src/syscalls/arm.rs b/panda/plugins/linjector/src/syscalls/arm.rs
new file mode 100644
index 00000000000..a03a0e16dd8
--- /dev/null
+++ b/panda/plugins/linjector/src/syscalls/arm.rs
@@ -0,0 +1,17 @@
+use panda::prelude::*;
+
+pub(crate) const GETPID: target_ulong = 20;
+pub(crate) const MMAP: target_ulong = 192; // mmap2, must not use page offset != 0
+pub(crate) const WRITE: target_ulong = 4;
+pub(crate) const EXECVE: target_ulong = 11;
+pub(crate) const MEMFD_CREATE: target_ulong = 385;
+pub(crate) const CHDIR: target_ulong = 12;
+pub(crate) const SETSID: target_ulong = 66;
+pub(crate) const OPEN: target_ulong = 5;
+pub(crate) const CLOSE: target_ulong = 6;
+
+pub(crate) const PROT_READ: target_ulong = 1;
+pub(crate) const PROT_WRITE: target_ulong = 2;
+
+pub(crate) const MAP_SHARED: target_ulong = 0x1;
+pub(crate) const MAP_ANON: target_ulong = 0x20;
diff --git a/panda/plugins/linjector/src/syscalls/i386.rs b/panda/plugins/linjector/src/syscalls/i386.rs
new file mode 100644
index 00000000000..bbb840bf76e
--- /dev/null
+++ b/panda/plugins/linjector/src/syscalls/i386.rs
@@ -0,0 +1,19 @@
+use panda::prelude::*;
+
+pub(crate) const GETPID: target_ulong = 20;
+pub(crate) const MMAP: target_ulong = 192;
+pub(crate) const WRITE: target_ulong = 4;
+pub(crate) const EXECVE: target_ulong = 11;
+pub(crate) const MEMFD_CREATE: target_ulong = 356;
+pub(crate) const CHDIR: target_ulong = 12;
+pub(crate) const SETSID: target_ulong = 66;
+pub(crate) const OPEN: target_ulong = 5;
+pub(crate) const CLOSE: target_ulong = 6;
+
+pub(crate) const PROT_READ: target_ulong = 1;
+pub(crate) const PROT_WRITE: target_ulong = 2;
+
+pub(crate) const MAP_SHARED: target_ulong = 0x1;
+pub(crate) const MAP_ANON: target_ulong = 0x20;
+//pub(crate) const MAP_SHARED: target_ulong = 0x2;
+//pub(crate) const MAP_ANON: target_ulong = 0x20;
diff --git a/panda/plugins/linjector/src/syscalls/mips.rs b/panda/plugins/linjector/src/syscalls/mips.rs
new file mode 100644
index 00000000000..0c540f5ff44
--- /dev/null
+++ b/panda/plugins/linjector/src/syscalls/mips.rs
@@ -0,0 +1,17 @@
+use panda::prelude::*;
+
+pub(crate) const GETPID: target_ulong = 4020;
+pub(crate) const MMAP: target_ulong = 4090;
+pub(crate) const WRITE: target_ulong = 4004;
+pub(crate) const EXECVE: target_ulong = 4011;
+pub(crate) const MEMFD_CREATE: target_ulong = 4354;
+pub(crate) const CHDIR: target_ulong = 4012;
+pub(crate) const SETSID: target_ulong = 4066;
+pub(crate) const OPEN: target_ulong = 4005;
+pub(crate) const CLOSE: target_ulong = 4006;
+
+pub(crate) const PROT_READ: target_ulong = 1;
+pub(crate) const PROT_WRITE: target_ulong = 2;
+
+pub(crate) const MAP_SHARED: target_ulong = 0x1;
+pub(crate) const MAP_ANON: target_ulong = 0x800;
diff --git a/panda/plugins/linjector/src/syscalls/mips64.rs b/panda/plugins/linjector/src/syscalls/mips64.rs
new file mode 100644
index 00000000000..780119d5ba7
--- /dev/null
+++ b/panda/plugins/linjector/src/syscalls/mips64.rs
@@ -0,0 +1,17 @@
+use panda::prelude::*;
+
+pub(crate) const GETPID: target_ulong = 5038;
+pub(crate) const MMAP: target_ulong = 5009;
+pub(crate) const WRITE: target_ulong = 5001;
+pub(crate) const EXECVE: target_ulong = 5057;
+pub(crate) const MEMFD_CREATE: target_ulong = 5314;
+pub(crate) const CHDIR: target_ulong = 5078;
+pub(crate) const SETSID: target_ulong = 5110;
+pub(crate) const OPEN: target_ulong = 5002;
+pub(crate) const CLOSE: target_ulong = 5003;
+
+pub(crate) const PROT_READ: target_ulong = 1;
+pub(crate) const PROT_WRITE: target_ulong = 2;
+
+pub(crate) const MAP_SHARED: target_ulong = 1;
+pub(crate) const MAP_ANON: target_ulong = 0x800;
diff --git a/panda/plugins/linjector/src/syscalls/x86_64.rs b/panda/plugins/linjector/src/syscalls/x86_64.rs
new file mode 100644
index 00000000000..d24db3c7786
--- /dev/null
+++ b/panda/plugins/linjector/src/syscalls/x86_64.rs
@@ -0,0 +1,17 @@
+use panda::prelude::*;
+
+pub(crate) const GETPID: target_ulong = 39;
+pub(crate) const MMAP: target_ulong = 9;
+pub(crate) const WRITE: target_ulong = 1;
+pub(crate) const EXECVE: target_ulong = 59;
+pub(crate) const MEMFD_CREATE: target_ulong = 319;
+pub(crate) const CHDIR: target_ulong = 80;
+pub(crate) const SETSID: target_ulong = 112;
+pub(crate) const OPEN: target_ulong = 2;
+pub(crate) const CLOSE: target_ulong = 3;
+
+pub(crate) const PROT_READ: target_ulong = 1;
+pub(crate) const PROT_WRITE: target_ulong = 2;
+
+pub(crate) const MAP_SHARED: target_ulong = 0x1;
+pub(crate) const MAP_ANON: target_ulong = 0x20;
diff --git a/panda/plugins/rust_skeleton/Cargo.lock b/panda/plugins/rust_skeleton/Cargo.lock
index 20f84875f86..f50fe556365 100644
--- a/panda/plugins/rust_skeleton/Cargo.lock
+++ b/panda/plugins/rust_skeleton/Cargo.lock
@@ -2,6 +2,12 @@
 # It is not intended for manual editing.
 version = 3
 
+[[package]]
+name = "array-init"
+version = "2.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6945cc5422176fc5e602e590c2878d2c2acd9a4fe20a4baa7c28022521698ec6"
+
 [[package]]
 name = "bitflags"
 version = "1.2.1"
@@ -182,17 +188,25 @@ dependencies = [
  "winapi",
 ]
 
+[[package]]
+name = "once_cell"
+version = "1.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7709cef83f0c1f58f666e746a08b21e0085f7440fa6a29cc194d68aac97a4225"
+
 [[package]]
 name = "panda-re"
-version = "0.14.0"
+version = "0.34.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "03153860245f365c1f01452404eddd0a0741beafd88acf6e6afe167d1ac6c874"
+checksum = "6848dfa0312ec610a889292351238c728a1e2622d9fbff94194475dc0eb29de0"
 dependencies = [
+ "array-init",
  "dirs",
  "glib-sys",
  "inventory",
  "lazy_static",
  "libloading",
+ "once_cell",
  "panda-re-macros",
  "panda-re-sys",
  "paste",
@@ -203,21 +217,22 @@ dependencies = [
 
 [[package]]
 name = "panda-re-macros"
-version = "0.10.0"
+version = "0.21.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f0ebc6c9d873a7285c7a09bfe4c80dc80efa8d3ea28bcb18a1d6a933dd3242be"
+checksum = "29772398be20723c90088ae4380d62e25cefe54c174d9082532b258985e41d04"
 dependencies = [
  "darling",
  "doc-comment",
+ "proc-macro2",
  "quote",
  "syn",
 ]
 
 [[package]]
 name = "panda-re-sys"
-version = "0.5.0"
+version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b9fe3ab684d3cf027c816a724de1ea40373b6438dc2240d64bdca0ca99f2e01"
+checksum = "e00ee000dc315bf4a0a55d78b6d97456a7540d6ed01768da5f5aa89fdb660783"
 
 [[package]]
 name = "paste"
diff --git a/panda/plugins/rust_skeleton/Cargo.toml b/panda/plugins/rust_skeleton/Cargo.toml
index e213def62c5..251bce5f44d 100644
--- a/panda/plugins/rust_skeleton/Cargo.toml
+++ b/panda/plugins/rust_skeleton/Cargo.toml
@@ -8,7 +8,7 @@ edition = "2018"
 crate-type = ["cdylib"]
 
 [dependencies]
-panda-re = { version = "0.14.0", default-features = false }
+panda-re = { version = "0.34.0", default-features = false }
 
 [features]
 default = ["x86_64"]
diff --git a/panda/plugins/rust_skeleton/src/lib.rs b/panda/plugins/rust_skeleton/src/lib.rs
index 91a376fc22b..0648edae7d3 100644
--- a/panda/plugins/rust_skeleton/src/lib.rs
+++ b/panda/plugins/rust_skeleton/src/lib.rs
@@ -1,16 +1,10 @@
 use panda::prelude::*;
 
 #[panda::init]
-fn init(_: &mut PluginHandle) -> bool {
+fn init(_: &mut PluginHandle) {
     println!("Initialized!");
-    true
 }
 
-#[panda::uninit]
-fn exit(_: &mut PluginHandle) {
-    println!("Exiting");
-}
-
-#[panda::before_block_exec]
-fn bbe(_cpu: &mut CPUState, _tb: &mut TranslationBlock){
-}
+//#[panda::before_block_exec]
+//fn bbe(_cpu: &mut CPUState, _tb: &mut TranslationBlock){
+//}
diff --git a/panda/plugins/snake_hook/Cargo.lock b/panda/plugins/snake_hook/Cargo.lock
index a0924079ab1..605dfa90f77 100644
--- a/panda/plugins/snake_hook/Cargo.lock
+++ b/panda/plugins/snake_hook/Cargo.lock
@@ -163,9 +163,9 @@ dependencies = [
 
 [[package]]
 name = "inline-python"
-version = "0.7.0"
+version = "0.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c178e725a9d7a2cd53fedcc0411424c48b240f7d7416a4803a46381a0ef8788d"
+checksum = "e2090a070ce14a62b0605bb08e545b28ff785b24b9fabfc56a402a5987e7a299"
 dependencies = [
  "inline-python-macros",
  "pyo3",
@@ -173,9 +173,9 @@ dependencies = [
 
 [[package]]
 name = "inline-python-macros"
-version = "0.7.0"
+version = "0.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7156c4a14ca399598b2a2c5d26d8c421721661445a1c22e906d3aa77952610bc"
+checksum = "f772582b7328d339524184f3980438daf380bf75edb05543356790192a17fafc"
 dependencies = [
  "libc",
  "proc-macro2",
diff --git a/panda/plugins/syscalls2/generated/syscall_switch_enter_linux_arm.cpp b/panda/plugins/syscalls2/generated/syscall_switch_enter_linux_arm.cpp
index bd5c554b0d2..79073223a06 100644
--- a/panda/plugins/syscalls2/generated/syscall_switch_enter_linux_arm.cpp
+++ b/panda/plugins/syscalls2/generated/syscall_switch_enter_linux_arm.cpp
@@ -5376,7 +5376,11 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	if (!panda_noreturn) {
 		struct hook h;
 		h.addr = ctx.retaddr;
-		h.asid = ctx.asid;
+		if (ctx.double_return) {
+			h.asid = 0;
+		} else {
+			h.asid = ctx.asid;
+		}
 		//h.cb.start_block_exec = hook_syscall_return;
 		//h.type = PANDA_CB_START_BLOCK_EXEC;
 		h.cb.before_tcg_codegen = hook_syscall_return;
@@ -5385,9 +5389,9 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 		h.km = MODE_ANY; //you'd expect this to be user only
 		hooks_add_hook(&h);
 
-		running_syscalls[std::make_pair(ctx.retaddr, ctx.asid)] = ctx;
+		running_syscalls[std::make_pair(ctx.retaddr, h.asid)] = ctx;
 	}
 #endif
 }
 
-/* vim: set tabstop=4 softtabstop=4 noexpandtab ft=cpp: */
\ No newline at end of file
+/* vim: set tabstop=4 softtabstop=4 noexpandtab ft=cpp: */
diff --git a/panda/plugins/syscalls2/generated/syscall_switch_enter_linux_x64.cpp b/panda/plugins/syscalls2/generated/syscall_switch_enter_linux_x64.cpp
index 5ede06d2a4e..48ba3b352dd 100644
--- a/panda/plugins/syscalls2/generated/syscall_switch_enter_linux_x64.cpp
+++ b/panda/plugins/syscalls2/generated/syscall_switch_enter_linux_x64.cpp
@@ -4918,4 +4918,4 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 #endif
 }
 
-/* vim: set tabstop=4 softtabstop=4 noexpandtab ft=cpp: */
\ No newline at end of file
+/* vim: set tabstop=4 softtabstop=4 noexpandtab ft=cpp: */
diff --git a/panda/plugins/syscalls2/generated/syscall_switch_return_linux_arm.cpp b/panda/plugins/syscalls2/generated/syscall_switch_return_linux_arm.cpp
index 3a68fa3f9ac..6ebafcc2493 100644
--- a/panda/plugins/syscalls2/generated/syscall_switch_return_linux_arm.cpp
+++ b/panda/plugins/syscalls2/generated/syscall_switch_return_linux_arm.cpp
@@ -42,6 +42,7 @@ void syscall_return_switch_linux_arm(CPUState *cpu, target_ptr_t pc, const sysca
 		case 2: {
 			if (PPP_CHECK_CB(on_sys_fork_return) || PPP_CHECK_CB(on_all_sys_return2)) {
 			}
+			printf("fork return\n");
 			PPP_RUN_CB(on_sys_fork_return, cpu, pc) ;
 		}; break;
 		// 3 long sys_read ['unsigned int fd', 'char __user *buf', 'size_t count']
@@ -4032,4 +4033,4 @@ void syscall_return_switch_linux_arm(CPUState *cpu, target_ptr_t pc, const sysca
 #endif
 }
 
-/* vim: set tabstop=4 softtabstop=4 noexpandtab ft=cpp: */
\ No newline at end of file
+/* vim: set tabstop=4 softtabstop=4 noexpandtab ft=cpp: */
diff --git a/panda/plugins/tcp_passthrough/Cargo.lock b/panda/plugins/tcp_passthrough/Cargo.lock
new file mode 100644
index 00000000000..6f4968914ae
--- /dev/null
+++ b/panda/plugins/tcp_passthrough/Cargo.lock
@@ -0,0 +1,728 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 3
+
+[[package]]
+name = "ansi-parser"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bcb2392079bf27198570d6af79ecbd9ec7d8f16d3ec6b60933922fdb66287127"
+dependencies = [
+ "heapless",
+ "nom",
+]
+
+[[package]]
+name = "ansi-str"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "90cb0ceb8c444d026166795e474e9dfe54b443bdc07cc21bd6c5073f5e637482"
+dependencies = [
+ "ansi-parser",
+]
+
+[[package]]
+name = "array-init"
+version = "2.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6945cc5422176fc5e602e590c2878d2c2acd9a4fe20a4baa7c28022521698ec6"
+
+[[package]]
+name = "arrayvec"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "23b62fc65de8e4e7f52534fb52b0f3ed04746ae267519eef2a83941e8085068b"
+
+[[package]]
+name = "as-slice"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "45403b49e3954a4b8428a0ac21a4b7afadccf92bfd96273f1a58cd4812496ae0"
+dependencies = [
+ "generic-array 0.12.4",
+ "generic-array 0.13.3",
+ "generic-array 0.14.5",
+ "stable_deref_trait",
+]
+
+[[package]]
+name = "autocfg"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d468802bab17cbc0cc575e9b053f41e72aa36bfa6b7f55e3529ffa43161b97fa"
+
+[[package]]
+name = "bincode"
+version = "1.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b1f45e9417d87227c7a56d22e471c6206462cba514c7590c09aff4cf6d1ddcad"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "bitflags"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
+
+[[package]]
+name = "byteorder"
+version = "1.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "14c189c53d098945499cdfa7ecc63567cf3886b3332b312a5b4585d8d3a6a610"
+
+[[package]]
+name = "cfg-if"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
+
+[[package]]
+name = "ctor"
+version = "0.1.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ccc0a48a9b826acdf4028595adc9db92caea352f7af011a3034acd172a52a0aa"
+dependencies = [
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "darling"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0d706e75d87e35569db781a9b5e2416cff1236a47ed380831f959382ccd5f858"
+dependencies = [
+ "darling_core",
+ "darling_macro",
+]
+
+[[package]]
+name = "darling_core"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0c960ae2da4de88a91b2d920c2a7233b400bc33cb28453a2987822d8392519b"
+dependencies = [
+ "fnv",
+ "ident_case",
+ "proc-macro2",
+ "quote",
+ "strsim",
+ "syn",
+]
+
+[[package]]
+name = "darling_macro"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d9b5a2f4ac4969822c62224815d069952656cadc7084fdca9751e6d959189b72"
+dependencies = [
+ "darling_core",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "dashmap"
+version = "5.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "391b56fbd302e585b7a9494fb70e40949567b1cf9003a8e4a6041a1687c26573"
+dependencies = [
+ "cfg-if",
+ "hashbrown",
+ "lock_api",
+]
+
+[[package]]
+name = "dirs"
+version = "3.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "30baa043103c9d0c2a57cf537cc2f35623889dc0d405e6c3cccfadbc81c71309"
+dependencies = [
+ "dirs-sys",
+]
+
+[[package]]
+name = "dirs-sys"
+version = "0.3.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "03d86534ed367a67548dc68113a0f5db55432fdfbb6e6f9d77704397d95d5780"
+dependencies = [
+ "libc",
+ "redox_users",
+ "winapi",
+]
+
+[[package]]
+name = "doc-comment"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fea41bba32d969b513997752735605054bc0dfa92b4c56bf1189f2e174be7a10"
+
+[[package]]
+name = "fnv"
+version = "1.0.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
+
+[[package]]
+name = "generic-array"
+version = "0.12.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ffdf9f34f1447443d37393cc6c2b8313aebddcd96906caf34e54c68d8e57d7bd"
+dependencies = [
+ "typenum",
+]
+
+[[package]]
+name = "generic-array"
+version = "0.13.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f797e67af32588215eaaab8327027ee8e71b9dd0b2b26996aedf20c030fce309"
+dependencies = [
+ "typenum",
+]
+
+[[package]]
+name = "generic-array"
+version = "0.14.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fd48d33ec7f05fbfa152300fdad764757cbded343c1aa1cff2fbaf4134851803"
+dependencies = [
+ "typenum",
+ "version_check 0.9.4",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7fcd999463524c52659517fe2cea98493cfe485d10565e7b0fb07dbba7ad2753"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "wasi",
+]
+
+[[package]]
+name = "ghost"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1a5bcf1bbeab73aa4cf2fde60a846858dc036163c7c33bec309f8d17de785479"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "glib-sys"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c7e9b997a66e9a23d073f2b1abb4dbfc3925e0b8952f67efd8d9b6e168e4cdc1"
+dependencies = [
+ "libc",
+ "system-deps",
+]
+
+[[package]]
+name = "hash32"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d4041af86e63ac4298ce40e5cca669066e75b6f1aa3390fe2561ffa5e1d9f4cc"
+dependencies = [
+ "byteorder",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "db0d4cf898abf0081f964436dc980e96670a0f36863e4b83aaacdb65c9d7ccc3"
+
+[[package]]
+name = "heapless"
+version = "0.5.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "74911a68a1658cfcfb61bc0ccfbd536e3b6e906f8c2f7883ee50157e3e2184f1"
+dependencies = [
+ "as-slice",
+ "generic-array 0.13.3",
+ "hash32",
+ "stable_deref_trait",
+]
+
+[[package]]
+name = "heck"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6d621efb26863f0e9924c6ac577e8275e5e6b77455db64ffa6c65c904e9e132c"
+dependencies = [
+ "unicode-segmentation",
+]
+
+[[package]]
+name = "ident_case"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9e0384b61958566e926dc50660321d12159025e767c18e043daf26b70104c39"
+
+[[package]]
+name = "inventory"
+version = "0.1.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0eb5160c60ba1e809707918ee329adb99d222888155835c6feedba19f6c3fd4"
+dependencies = [
+ "ctor",
+ "ghost",
+ "inventory-impl",
+]
+
+[[package]]
+name = "inventory-impl"
+version = "0.1.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e41b53715c6f0c4be49510bb82dee2c1e51c8586d885abe65396e82ed518548"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "lazy_static"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
+
+[[package]]
+name = "libc"
+version = "0.2.112"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1b03d17f364a3a042d5e5d46b053bbbf82c92c9430c592dd4c064dc6ee997125"
+
+[[package]]
+name = "libloading"
+version = "0.6.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "351a32417a12d5f7e82c368a66781e307834dae04c6ce0cd4456d52989229883"
+dependencies = [
+ "cfg-if",
+ "winapi",
+]
+
+[[package]]
+name = "lock_api"
+version = "0.4.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "327fa5b6a6940e4699ec49a9beae1ea4845c6bab9314e4f84ac68742139d8c53"
+dependencies = [
+ "autocfg",
+ "scopeguard",
+]
+
+[[package]]
+name = "memchr"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2dffe52ecf27772e601905b7522cb4ef790d2cc203488bbd0e2fe85fcb74566d"
+
+[[package]]
+name = "nom"
+version = "4.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2ad2a91a8e869eeb30b9cb3119ae87773a8f4ae617f41b1eb9c154b2905f7bd6"
+dependencies = [
+ "memchr",
+ "version_check 0.1.5",
+]
+
+[[package]]
+name = "once_cell"
+version = "1.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da32515d9f6e6e489d7bc9d84c71b060db7247dc035bbe44eac88cf87486d8d5"
+
+[[package]]
+name = "owo-colors"
+version = "3.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "decf7381921fea4dcb2549c5667eda59b3ec297ab7e2b5fc33eac69d2e7da87b"
+
+[[package]]
+name = "panda-re"
+version = "0.34.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6848dfa0312ec610a889292351238c728a1e2622d9fbff94194475dc0eb29de0"
+dependencies = [
+ "array-init",
+ "dirs",
+ "glib-sys",
+ "inventory",
+ "lazy_static",
+ "libloading",
+ "once_cell",
+ "panda-re-macros",
+ "panda-re-sys",
+ "paste",
+ "strum 0.20.0",
+ "strum_macros 0.20.1",
+ "thiserror",
+]
+
+[[package]]
+name = "panda-re-macros"
+version = "0.21.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29772398be20723c90088ae4380d62e25cefe54c174d9082532b258985e41d04"
+dependencies = [
+ "darling",
+ "doc-comment",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "panda-re-sys"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e00ee000dc315bf4a0a55d78b6d97456a7540d6ed01768da5f5aa89fdb660783"
+
+[[package]]
+name = "papergrid"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "63709d10e2c2ec58f7bd91d8258d27ce80de090064b0ddf3a4bf38b907b61b8a"
+dependencies = [
+ "strip-ansi-escapes",
+ "unicode-width",
+]
+
+[[package]]
+name = "paste"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0744126afe1a6dd7f394cb50a716dbe086cb06e255e53d8d0185d82828358fb5"
+
+[[package]]
+name = "pkg-config"
+version = "0.3.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "58893f751c9b0412871a09abd62ecd2a00298c6c83befa223ef98c52aef40cbe"
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2f84e92c0f7c9d58328b85a78557813e4bd845130db68d7184635344399423b1"
+dependencies = [
+ "unicode-xid",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "38bc8cc6a5f2e3655e0899c1b848643b2562f853f114bfec7be120678e3ace05"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "redox_syscall"
+version = "0.2.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8383f39639269cde97d255a32bdb68c047337295414940c68bdd30c2e13203ff"
+dependencies = [
+ "bitflags",
+]
+
+[[package]]
+name = "redox_users"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "528532f3d801c87aec9def2add9ca802fe569e44a544afe633765267840abe64"
+dependencies = [
+ "getrandom",
+ "redox_syscall",
+]
+
+[[package]]
+name = "scopeguard"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d29ab0c6d3fc0ee92fe66e2d99f700eab17a8d57d1c1d3b748380fb20baa78cd"
+
+[[package]]
+name = "serde"
+version = "1.0.131"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4ad69dfbd3e45369132cc64e6748c2d65cdfb001a2b1c232d128b4ad60561c1"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.131"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b710a83c4e0dff6a3d511946b95274ad9ca9e5d3ae497b63fda866ac955358d2"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "stable_deref_trait"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a8f112729512f8e442d81f95a8a7ddf2b7c6b8a1a6f509a95864142b30cab2d3"
+
+[[package]]
+name = "strip-ansi-escapes"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "011cbb39cf7c1f62871aea3cc46e5817b0937b49e9447370c93cacbe93a766d8"
+dependencies = [
+ "vte",
+]
+
+[[package]]
+name = "strsim"
+version = "0.9.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6446ced80d6c486436db5c078dde11a9f73d42b57fb273121e160b84f63d894c"
+
+[[package]]
+name = "strum"
+version = "0.18.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "57bd81eb48f4c437cadc685403cad539345bf703d78e63707418431cecd4522b"
+
+[[package]]
+name = "strum"
+version = "0.20.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7318c509b5ba57f18533982607f24070a55d353e90d4cae30c467cdb2ad5ac5c"
+
+[[package]]
+name = "strum_macros"
+version = "0.18.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "87c85aa3f8ea653bfd3ddf25f7ee357ee4d204731f6aa9ad04002306f6e2774c"
+dependencies = [
+ "heck",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "strum_macros"
+version = "0.20.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee8bc6b87a5112aeeab1f4a9f7ab634fe6cbefc4850006df31267f4cfb9e3149"
+dependencies = [
+ "heck",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "syn"
+version = "1.0.82"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8daf5dd0bb60cbd4137b1b587d2fc0ae729bc07cf01cd70b36a1ed5ade3b9d59"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-xid",
+]
+
+[[package]]
+name = "system-deps"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0f3ecc17269a19353b3558b313bba738b25d82993e30d62a18406a24aba4649b"
+dependencies = [
+ "heck",
+ "pkg-config",
+ "strum 0.18.0",
+ "strum_macros 0.18.0",
+ "thiserror",
+ "toml",
+ "version-compare",
+]
+
+[[package]]
+name = "tabled"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d15827061abcf689257b1841c8e2732b1dfcc3ef825b24ce6c606e1e9e1a7bde"
+dependencies = [
+ "ansi-str",
+ "papergrid",
+ "tabled_derive",
+]
+
+[[package]]
+name = "tabled_derive"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "278ea3921cee8c5a69e0542998a089f7a14fa43c9c4e4f9951295da89bd0c943"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "tcp_passthrough"
+version = "0.1.0"
+dependencies = [
+ "bincode",
+ "dashmap",
+ "once_cell",
+ "owo-colors",
+ "panda-re",
+ "serde",
+ "tabled",
+ "tcp_shared_types",
+]
+
+[[package]]
+name = "tcp_shared_types"
+version = "0.1.0"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "thiserror"
+version = "1.0.30"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "854babe52e4df1653706b98fcfc05843010039b406875930a70e4d9644e5c417"
+dependencies = [
+ "thiserror-impl",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "1.0.30"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aa32fd3f627f367fe16f893e2597ae3c05020f8bba2666a4e6ea73d377e5714b"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "toml"
+version = "0.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a31142970826733df8241ef35dc040ef98c679ab14d7c3e54d827099b3acecaa"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "typenum"
+version = "1.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dcf81ac59edc17cc8697ff311e8f5ef2d99fcbd9817b34cec66f90b6c3dfd987"
+
+[[package]]
+name = "unicode-segmentation"
+version = "1.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8895849a949e7845e06bd6dc1aa51731a103c42707010a5b591c0038fb73385b"
+
+[[package]]
+name = "unicode-width"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3ed742d4ea2bd1176e236172c8429aaf54486e7ac098db29ffe6529e0ce50973"
+
+[[package]]
+name = "unicode-xid"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ccb82d61f80a663efe1f787a51b16b5a51e3314d6ac365b08639f52387b33f3"
+
+[[package]]
+name = "utf8parse"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "936e4b492acfd135421d8dca4b1aa80a7bfc26e702ef3af710e0752684df5372"
+
+[[package]]
+name = "version-compare"
+version = "0.0.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d63556a25bae6ea31b52e640d7c41d1ab27faba4ccb600013837a3d0b3994ca1"
+
+[[package]]
+name = "version_check"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "914b1a6776c4c929a602fafd8bc742e06365d4bcbe48c30f9cca5824f70dc9dd"
+
+[[package]]
+name = "version_check"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "49874b5167b65d7193b8aba1567f5c7d93d001cafc34600cee003eda787e483f"
+
+[[package]]
+name = "vte"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6cbce692ab4ca2f1f3047fcf732430249c0e971bfdd2b234cf2c47ad93af5983"
+dependencies = [
+ "arrayvec",
+ "utf8parse",
+ "vte_generate_state_changes",
+]
+
+[[package]]
+name = "vte_generate_state_changes"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d257817081c7dffcdbab24b9e62d2def62e2ff7d00b1c20062551e6cccc145ff"
+dependencies = [
+ "proc-macro2",
+ "quote",
+]
+
+[[package]]
+name = "wasi"
+version = "0.10.2+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fd6fbd9a79829dd1ad0cc20627bf1ed606756a7f77edff7b66b7064f9cb327c6"
+
+[[package]]
+name = "winapi"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
+dependencies = [
+ "winapi-i686-pc-windows-gnu",
+ "winapi-x86_64-pc-windows-gnu",
+]
+
+[[package]]
+name = "winapi-i686-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
+
+[[package]]
+name = "winapi-x86_64-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
diff --git a/panda/plugins/tcp_passthrough/Cargo.toml b/panda/plugins/tcp_passthrough/Cargo.toml
new file mode 100644
index 00000000000..41bff9ea788
--- /dev/null
+++ b/panda/plugins/tcp_passthrough/Cargo.toml
@@ -0,0 +1,31 @@
+[package]
+name = "tcp_passthrough"
+version = "0.1.0"
+authors = ["Jordan McLeod <Jordan.McLeod@ll.mit.edu>"]
+edition = "2018"
+
+[lib]
+crate-type = ["cdylib"]
+
+[dependencies]
+panda-re = { version = "0.34", default-features = false }
+bincode = "1"
+serde = { version = "1", features = ["derive"] }
+tabled = { version = "0.6", features = ["color"] }
+once_cell = "1"
+owo-colors = "3"
+dashmap = "5"
+
+tcp_shared_types = { path = "./tcp_shared_types" }
+
+[features]
+default = ["x86_64"]
+
+x86_64 = ["panda-re/x86_64"]
+i386 = ["panda-re/i386"]
+arm = ["panda-re/arm"]
+ppc = ["panda-re/ppc"]
+mips = ["panda-re/mips"]
+mipsel = ["panda-re/mipsel"]
+aarch64 = ["panda-re/aarch64"]
+mips64 = ["panda-re/mips64"]
diff --git a/panda/plugins/tcp_passthrough/Makefile b/panda/plugins/tcp_passthrough/Makefile
new file mode 100644
index 00000000000..2234476df57
--- /dev/null
+++ b/panda/plugins/tcp_passthrough/Makefile
@@ -0,0 +1,18 @@
+# Don't forget to add your plugin to config.panda!
+
+# Build rust plugins with make!
+
+# The main rule for your plugin. List all object-file dependencies.
+
+PANDA_PATH = $(realpath $(shell pwd)/..)
+PLUGIN_DIR = $(realpath $(join $(PANDA_PATH), /../panda/plugins/$(PLUGIN_NAME)/))
+RUST_SOURCE = $(wildcard $(PLUGIN_DIR)/src/*.rs)
+PLUGIN_ARTIFACTS_DIR = $(PLUGIN_TARGET_DIR)/$(PLUGIN_NAME)/target
+
+$(PLUGIN_TARGET_DIR)/panda_$(PLUGIN_NAME).so : $(RUST_SOURCE) $(PLUGIN_DIR)/Cargo.toml
+	@echo "  CARGO   $(PLUGIN_DIR)"
+	@CARGO_TERM_PROGRESS_WHEN=never cargo build --release \
+		--no-default-features --features=$(TARGET_NAME) \
+		--manifest-path=$(PLUGIN_DIR)/Cargo.toml \
+		--target-dir=$(PLUGIN_ARTIFACTS_DIR)
+	@cp -p $(PLUGIN_ARTIFACTS_DIR)/release/lib$(PLUGIN_NAME).so $@
diff --git a/panda/plugins/tcp_passthrough/README.md b/panda/plugins/tcp_passthrough/README.md
new file mode 100644
index 00000000000..4842c9a0a6c
--- /dev/null
+++ b/panda/plugins/tcp_passthrough/README.md
@@ -0,0 +1,5 @@
+# Guest Agent TCP Passthrough
+
+A plugin for using the PANDA guest agent in order to perform passthrough of TCP servers present in the guest.
+
+See `try_it.py` for example on how to forward an HTTP server running on port 8000 in the guest to port 4343 on the host, as well as print out a table of the sockets listening in the guest.
diff --git a/panda/plugins/tcp_passthrough/cbindgen.toml b/panda/plugins/tcp_passthrough/cbindgen.toml
new file mode 100644
index 00000000000..dfad82285b5
--- /dev/null
+++ b/panda/plugins/tcp_passthrough/cbindgen.toml
@@ -0,0 +1,7 @@
+language = "C"
+no_includes = true
+after_includes = """// BEGIN_PYPANDA_NEEDS_THIS -- do not delete this comment bc pypanda
+// api autogen needs it.  And don't put any compiler directives
+// between this and END_PYPANDA_NEEDS_THIS except includes of other
+// files in this directory that contain subsections like this one."""
+trailer = "// END_PYPANDA_NEEDS_THIS -- do not delete this comment!\n"
diff --git a/panda/plugins/tcp_passthrough/generate_header.sh b/panda/plugins/tcp_passthrough/generate_header.sh
new file mode 100755
index 00000000000..5c6cdb5d8cb
--- /dev/null
+++ b/panda/plugins/tcp_passthrough/generate_header.sh
@@ -0,0 +1,3 @@
+#!/bin/sh
+cbindgen -o tcp_passthrough.h
+echo "^^^ ignore those warnings thanks :)"
diff --git a/panda/plugins/tcp_passthrough/src/display.rs b/panda/plugins/tcp_passthrough/src/display.rs
new file mode 100644
index 00000000000..c7ee37c0e69
--- /dev/null
+++ b/panda/plugins/tcp_passthrough/src/display.rs
@@ -0,0 +1,70 @@
+use std::collections::HashMap;
+use std::net::Ipv4Addr;
+
+use once_cell::sync::Lazy;
+use owo_colors::OwoColorize;
+use tabled::{object::FirstRow, style::Style, Format, Modify, Table, Tabled};
+
+use tcp_shared_types::SocketInfo;
+
+#[derive(Tabled)]
+struct TableEntry {
+    #[tabled(rename = "Listening")]
+    listening: &'static str,
+
+    #[tabled(rename = "Local IP")]
+    ip: Ipv4Addr,
+
+    #[tabled(rename = "Port")]
+    port: u16,
+
+    #[tabled(rename = "PID")]
+    pid: String,
+
+    #[tabled(rename = "Description")]
+    description: &'static str,
+}
+
+static TCP_NAMES_CSV: &str = include_str!("tcp.csv");
+
+static PORT_TO_NAME: Lazy<HashMap<u16, &'static str>> = Lazy::new(|| {
+    TCP_NAMES_CSV
+        .trim()
+        .split('\n')
+        .filter(|line| !line.is_empty())
+        .filter_map(|line| line.split_once(','))
+        .filter_map(|(port, name)| port.parse().ok().map(move |port| (port, name)))
+        .collect()
+});
+
+const CHECK_MARK: &str = "\u{1f5f8}";
+
+pub(crate) fn print_table(sockets: Vec<SocketInfo>) {
+    let tcp_server_table = sockets
+        .into_iter()
+        .map(|socket| TableEntry {
+            listening: if socket.server { CHECK_MARK } else { " " },
+            ip: socket.ip.clone(),
+            port: socket.port,
+            pid: socket
+                .pid
+                .as_ref()
+                .map(ToString::to_string)
+                .unwrap_or_else(|| String::from("")),
+            description: PORT_TO_NAME.get(&socket.port).copied().unwrap_or(""),
+        })
+        .collect::<Vec<_>>();
+
+    println!(
+        "\n\n{}\n",
+        Table::new(tcp_server_table)
+            .with(Style::modern())
+            .with(Modify::new(FirstRow).with(Format::new(|text| text.bold().to_string())))
+            .with(tabled::Header("TCP Sockets"))
+            .with(
+                Modify::new(FirstRow)
+                    .with(tabled::Alignment::center())
+                    .with(Format::new(|text| text.bold().to_string()))
+            )
+    );
+}
diff --git a/panda/plugins/tcp_passthrough/src/forward_socket.rs b/panda/plugins/tcp_passthrough/src/forward_socket.rs
new file mode 100644
index 00000000000..ff024539d3f
--- /dev/null
+++ b/panda/plugins/tcp_passthrough/src/forward_socket.rs
@@ -0,0 +1,72 @@
+use dashmap::DashMap;
+use once_cell::sync::Lazy;
+use panda::plugins::guest_plugin_manager::*;
+use std::io::Write;
+use std::net::Ipv4Addr;
+use std::net::{TcpListener, TcpStream};
+use std::sync::Mutex;
+use std::thread;
+
+use tcp_shared_types::Request;
+
+static CONNECTIONS: Lazy<DashMap<u32, Mutex<TcpStream>>> = Lazy::new(DashMap::new);
+
+#[channel_recv]
+fn incoming_tcp(channel_id: u32, data: &[u8]) {
+    eprintln!("[{channel_id}] TCP data: len={}", data.len());
+    if let Some(channel) = CONNECTIONS.get(&channel_id) {
+        channel.lock().unwrap().write_all(data).unwrap();
+        eprintln!("[{channel_id}] TCP data written");
+    }
+}
+
+pub fn forward(ip: Ipv4Addr, guest_port: u16, host_port: u16, localhost_only: bool) {
+    thread::spawn(move || {
+        let listener = TcpListener::bind((
+            if localhost_only {
+                "localhost"
+            } else {
+                "0.0.0.0"
+            },
+            host_port,
+        ))
+        .expect("Could not bind to host port");
+        eprintln!("Listening on localhost:{}...", host_port);
+
+        for stream in listener.incoming() {
+            match stream {
+                Ok(mut outgoing_tcp_stream) => {
+                    println!(
+                        "Incoming connection for port {} (guest port {})",
+                        host_port, guest_port
+                    );
+                    let mut incoming_channel = Channel::new(incoming_tcp);
+
+                    CONNECTIONS.insert(
+                        incoming_channel.id(),
+                        Mutex::new(outgoing_tcp_stream.try_clone().unwrap()),
+                    );
+
+                    let channel_id = incoming_channel.id();
+
+                    thread::spawn(move || {
+                        if let Err(err) =
+                            std::io::copy(&mut outgoing_tcp_stream, &mut incoming_channel)
+                        {
+                            eprintln!("Connection Closed for host port {}: {:?}", host_port, err);
+                        }
+                    });
+
+                    crate::send_request(Request::ForwardConnection {
+                        ip,
+                        port: guest_port,
+                        channel_id,
+                    });
+                }
+                Err(_) => {
+                    eprintln!("Failed to accept connection to localhost:{}", host_port);
+                }
+            }
+        }
+    });
+}
diff --git a/panda/plugins/tcp_passthrough/src/lib.rs b/panda/plugins/tcp_passthrough/src/lib.rs
new file mode 100644
index 00000000000..53a5b8f91a4
--- /dev/null
+++ b/panda/plugins/tcp_passthrough/src/lib.rs
@@ -0,0 +1,138 @@
+use once_cell::sync::Lazy;
+use panda::{plugins::guest_plugin_manager::*, prelude::*};
+use std::ffi::CStr;
+use std::net::Ipv4Addr;
+use std::os::raw::c_char;
+use std::sync::Mutex;
+
+mod display;
+mod forward_socket;
+mod send_ext;
+mod socket_list;
+
+use send_ext::SendExt;
+
+use tcp_shared_types::Request;
+
+/// Request that a table of sockets be printed once guest execution resumes
+#[no_mangle]
+pub extern "C" fn print_socket_info() {
+    socket_list::on_get_socket_list(display::print_table);
+}
+
+fn forward_socket_internal(ip: Ipv4Addr, port: u16, host_port: u16) {
+    forward_socket::forward(ip, port, host_port, false);
+}
+
+/// Information about a given socket binding
+#[repr(C)]
+pub struct SocketInfo {
+    pub ip: [u8; 4],
+    pub pid: u64,
+    pub port: u16,
+    pub server: bool,
+}
+
+/// Provide a callback for receiving a socket list that will get called once the guest
+/// resumes execution
+#[no_mangle]
+pub extern "C" fn on_get_socket_list(callback: extern "C" fn(*const SocketInfo, usize)) {
+    socket_list::on_get_socket_list(move |socket_list| {
+        let socket_list: Vec<SocketInfo> = socket_list
+            .into_iter()
+            .map(
+                |tcp_shared_types::SocketInfo {
+                     ip,
+                     port,
+                     pid,
+                     server,
+                 }| {
+                    SocketInfo {
+                        ip: ip.octets(),
+                        port,
+                        pid: pid.unwrap_or(u64::MAX),
+                        server,
+                    }
+                },
+            )
+            .collect();
+
+        callback(socket_list.as_ptr(), socket_list.len());
+
+        drop(socket_list);
+    })
+}
+
+/// Forward a socket from the guest, returning true if no issue is hit. Returns `false` if
+/// the IP address fails to parse. A null IP address is treated as 0.0.0.0
+///
+/// Guest must resume execution for an unspecified amount of time before TCP traffic
+/// will actually be processed.
+#[no_mangle]
+pub unsafe extern "C" fn forward_socket(
+    ip: *const c_char,
+    guest_port: u16,
+    host_port: u16,
+) -> bool {
+    let ip = if ip.is_null() {
+        "0.0.0.0".parse().unwrap()
+    } else {
+        let ip = CStr::from_ptr(ip);
+
+        if let Ok(ip) = ip.to_str().unwrap().parse() {
+            ip
+        } else {
+            return false;
+        }
+    };
+
+    forward_socket_internal(ip, guest_port, host_port);
+
+    true
+}
+
+#[channel_recv]
+fn main_channel_cb(_: u32, _: &[u8]) {
+    // TODO: support for guest closing the socket
+}
+
+static MAIN_CHANNEL: Lazy<Mutex<Channel>> =
+    Lazy::new(|| Mutex::new(load_guest_plugin("tcp_servers", main_channel_cb)));
+
+fn send_request(req: Request) {
+    MAIN_CHANNEL.lock().unwrap().send(req)
+}
+
+#[derive(PandaArgs)]
+#[name = "tcp_passthrough"]
+struct Args {
+    print_sockets: bool,
+    forward_port: u32,
+    host_port: u32,
+}
+
+static ARGS: Lazy<Args> = Lazy::new(Args::from_panda_args);
+
+#[panda::init]
+fn init(_: &mut PluginHandle) {
+    // TODO: switch to pretty_env_logger
+
+    if ARGS.print_sockets {
+        print_socket_info();
+    }
+
+    let forward_port = ARGS.forward_port as u16;
+    let host_port = ARGS.host_port as u16;
+    if forward_port != 0 {
+        Lazy::force(&MAIN_CHANNEL);
+
+        forward_socket_internal(
+            "0.0.0.0".parse().unwrap(),
+            forward_port,
+            match host_port {
+                0 => forward_port,
+                port => port,
+            },
+        );
+    }
+}
diff --git a/panda/plugins/tcp_passthrough/src/send_ext.rs b/panda/plugins/tcp_passthrough/src/send_ext.rs
new file mode 100644
index 00000000000..dca58b0a02e
--- /dev/null
+++ b/panda/plugins/tcp_passthrough/src/send_ext.rs
@@ -0,0 +1,12 @@
+use panda::plugins::guest_plugin_manager::Channel;
+use serde::Serialize;
+
+pub(crate) trait SendExt {
+    fn send<T: Serialize>(&mut self, val: T);
+}
+
+impl SendExt for Channel {
+    fn send<T: Serialize>(&mut self, val: T) {
+        self.write_packet(&bincode::serialize(&val).unwrap());
+    }
+}
diff --git a/panda/plugins/tcp_passthrough/src/socket_list.rs b/panda/plugins/tcp_passthrough/src/socket_list.rs
new file mode 100644
index 00000000000..d45778c9200
--- /dev/null
+++ b/panda/plugins/tcp_passthrough/src/socket_list.rs
@@ -0,0 +1,51 @@
+use crate::send_request;
+use once_cell::sync::Lazy;
+use panda::plugins::guest_plugin_manager::*;
+use std::sync::Mutex;
+
+use tcp_shared_types::{Request, SocketInfo};
+
+type SocketListCb = Box<dyn FnOnce(Vec<SocketInfo>) + Send + 'static>;
+
+static SOCKET_LIST_CHANNEL: Lazy<Channel> = Lazy::new(|| Channel::new(recv_socket_info));
+
+static SOCKET_INFO_CALLBACK: Lazy<Mutex<Option<SocketListCb>>> = Lazy::new(|| Mutex::new(None));
+
+#[channel_recv]
+fn recv_socket_info(_: u32, data: &[u8]) {
+    if let Some(callback) = take_callback() {
+        callback(bincode::deserialize(data).unwrap());
+    }
+}
+
+fn take_callback() -> Option<SocketListCb> {
+    SOCKET_INFO_CALLBACK.lock().unwrap().take()
+}
+
+fn set_callback(cb: SocketListCb) {
+    SOCKET_INFO_CALLBACK.lock().unwrap().replace(cb);
+}
+
+pub(crate) fn on_get_socket_list<CallbackFn>(new_callback: CallbackFn)
+where
+    CallbackFn: FnOnce(Vec<SocketInfo>) + Send + 'static,
+{
+    let callback = if let Some(existing_callback) = take_callback() {
+        // pending callback, chain them
+        let replacement_callback = move |sockets: Vec<SocketInfo>| {
+            existing_callback(sockets.clone());
+            new_callback(sockets);
+        };
+
+        Box::new(replacement_callback) as SocketListCb
+    } else {
+        // no callback pending, queue a request for listing
+        send_request(Request::GetSocketList {
+            channel_id: SOCKET_LIST_CHANNEL.id(),
+        });
+
+        Box::new(new_callback) as SocketListCb
+    };
+
+    set_callback(callback);
+}
diff --git a/panda/plugins/tcp_passthrough/src/tcp.csv b/panda/plugins/tcp_passthrough/src/tcp.csv
new file mode 100644
index 00000000000..143907685e3
--- /dev/null
+++ b/panda/plugins/tcp_passthrough/src/tcp.csv
@@ -0,0 +1,3266 @@
+0,Reserved
+1,Port Service Multiplexer
+2,Management Utility
+3,Compression Process
+4,Unassigned
+5,Remote Job Entry
+6,Unassigned
+7,Echo
+8,Unassigned
+9,Discard
+10,Unassigned
+11,Active Users
+12,Unassigned
+13,Daytime (RFC 867)
+14,Unassigned
+15,Unassigned [was netstat]
+16,Unassigned
+17,Quote of the Day
+18,Message Send Protocol
+19,Character Generator
+20,File Transfer [Default Data]
+21,File Transfer [Control]
+22,SSH Remote Login Protocol
+23,Telnet
+24,any private mail system
+25,Simple Mail Transfer
+26,Unassigned
+27,NSW User System FE
+28,Unassigned
+29,MSG ICP
+30,Unassigned
+31,MSG Authentication
+32,Unassigned
+33,Display Support Protocol
+34,Unassigned
+35,any private printer server
+36,Unassigned
+37,Time / W32.Sober.I virus
+38,Route Access Protocol
+39,Resource Location Protocol
+40,Unassigned
+41,Graphics
+42,Host Name Server
+43,WhoIs
+44,MPM FLAGS Protocol
+45,Message Processing Module [recv]
+46,MPM [default send]
+47,NI FTP
+48,Digital Audit Daemon
+49,Login Host Protocol (TACACS)
+50,Remote Mail Checking Protocol
+51,IMP Logical Address Maintenance
+52,XNS Time Protocol
+53,Domain Name Server
+54,XNS Clearinghouse
+55,ISI Graphics Language
+56,XNS Authentication
+57,any private terminal access
+58,XNS Mail
+59,any private file service
+60,Unassigned
+61,NI MAIL
+62,ACA Services
+63,whois++
+64,Communications Integrator (CI)
+65,TACACS-Database Service
+66,Oracle SQL*NET
+67,Bootstrap Protocol Server
+68,Bootstrap Protocol Client
+69,Trivial File Transfer
+70,Gopher
+71,Remote Job Service
+72,Remote Job Service
+73,Remote Job Service
+74,Remote Job Service
+75,any private dial out service
+76,Distributed External Object Store
+77,any private RJE service
+78,vettcp
+79,Finger
+80,World Wide Web HTTP
+81,HOSTS2 Name Server / Bagle-AZ worm / Win32.Rbot worm
+82,XFER Utility
+83,MIT ML Device
+84,Common Trace Facility
+85,MIT ML Device
+86,Micro Focus Cobol
+87,any private terminal link
+88,Kerberos
+89,SU/MIT Telnet Gateway
+90,DNSIX Securit Attribute Token Map
+91,MIT Dover Spooler
+92,Network Printing Protocol
+93,Device Control Protocol
+94,Tivoli Object Dispatcher
+95,SUPDUP
+96,DIXIE Protocol Specification
+97,Swift Remote Virtural File Protocol
+98,Linuxconf / TAC News
+99,Metagram Relay
+100,[unauthorized use]
+101,NIC Host Name Server
+102,MSExchangeMTA X.400 / ISO-TSAP Class 0
+103,Genesis Point-to-Point Trans Net
+104,ACR-NEMA Digital Imag. & Comm. 300
+105,Mailbox Name Nameserver
+106,3COM-TSMUX
+107,Remote Telnet Service
+108,SNA Gateway Access Server
+109,Post Office Protocol - Version 2
+110,Post Office Protocol - Version 3
+111,SUN Remote Procedure Call
+112,McIDAS Data Transmission Protocol
+113,Authentication Service
+114,Audio News Multicast
+115,Simple File Transfer Protocol
+116,ANSA REX Notify
+117,UUCP Path Service
+118,SQL Services
+119,Network News Transfer Protocol
+120,CFDPTKT
+121,Encore Expedited Remote Pro.Call
+122,SMAKYNET
+123,Network Time Protocol
+124,ANSA REX Trader
+125,Locus PC-Interface Net Map Ser
+126,Unisys Unitary Login
+127,Locus PC-Interface Conn Server
+128,GSS X License Verification
+129,Password Generator Protocol
+130,cisco FNATIVE
+131,cisco TNATIVE
+132,cisco SYSMAINT
+133,Statistics Service
+134,INGRES-NET Service
+135,DCE endpoint resolution
+136,PROFILE Naming System
+137,NETBIOS Name Service
+138,NETBIOS Datagram Service
+139,NETBIOS Session Service
+140,EMFIS Data Service
+141,EMFIS Control Service
+142,Britton-Lee IDM
+143,Internet Message Access Protocol
+144,Universal Management Architecture
+145,UAAC Protocol
+146,ISO-IP0
+147,ISO-IP
+148,Jargon
+149,AED 512 Emulation Service
+150,SQL-NET
+151,HEMS
+152,Background File Transfer Program
+153,SGMP
+154,NETSC
+155,NETSC
+156,SQL Service
+157,KNET/VM Command/Message Protocol
+158,PCMail Server
+159,NSS-Routing
+160,SGMP-TRAPS
+161,SNMP
+162,SNMPTRAP
+163,CMIP/TCP Manager
+164,CMIP/TCP Agent
+165,Xerox
+166,Sirius Systems
+167,NAMP
+168,RSVD
+169,SEND
+170,Network PostScript
+171,Network Innovations Multiplex
+172,Network Innovations CL/1
+173,Xyplex
+174,MAILQ
+175,VMNET
+176,GENRAD-MUX
+177,X Display Manager Control Protocol
+178,NextStep Window Server
+179,Border Gateway Protocol
+180,Intergraph
+181,Unify
+182,Unisys Audit SITP
+183,OCBinder
+184,OCServer
+185,Remote-KIS
+186,KIS Protocol
+187,Application Communication Interface
+188,Plus Five's MUMPS
+189,Queued File Transport
+190,Gateway Access Control Protocol
+191,Prospero Directory Service
+192,OSU Network Monitoring System
+193,Spider Remote Monitoring Protocol
+194,Internet Relay Chat Protocol
+195,DNSIX Network Level Module Audit
+196,DNSIX Session Mgt Module Audit Redir
+197,Directory Location Service
+198,Directory Location Service Monitor
+199,SMUX
+200,IBM System Resource Controller
+201,AppleTalk Routing Maintenance
+202,AppleTalk Name Binding
+203,AppleTalk Unused
+204,AppleTalk Echo
+205,AppleTalk Unused
+206,AppleTalk Zone Information
+207,AppleTalk Unused
+208,AppleTalk Unused
+209,The Quick Mail Transfer Protocol
+210,ANSI Z39.50
+211,Texas Instruments 914C/G Terminal
+212,ATEXSSTR
+213,IPX
+214,VM PWSCS
+215,Insignia Solutions
+216,Computer Associates Int'l License Server
+217,dBASE Unix
+218,Netix Message Posting Protocol
+219,Unisys ARPs
+220,Interactive Mail Access Protocol v3
+221,Berkeley rlogind with SPX auth
+222,Berkeley rshd with SPX auth
+223,Certificate Distribution Center
+224,masqdialer
+242,Direct
+243,Survey Measurement
+244,inbusiness
+245,LINK
+246,Display Systems Protocol
+247,SUBNTBCST_TFTP
+248,bhfhs
+256,RAP/Checkpoint SNMP
+257,Check Point / Secure Electronic Transaction
+258,Check Point / Yak Winsock Personal Chat
+259,Check Point Firewall-1 telnet auth / Efficient Short Remote Operations
+260,Openport
+261,IIOP Name Service over TLS/SSL
+262,Arcisdms
+263,HDAP
+264,BGMP / Check Point
+265,X-Bone CTL
+266,SCSI on ST
+267,Tobit David Service Layer
+268,Tobit David Replica
+280,HTTP-mgmt
+281,Personal Link
+282,Cable Port A/X
+283,rescap
+284,corerjd
+286,FXP-1
+287,K-BLOCK
+308,Novastor Backup
+309,EntrustTime
+310,bhmds
+311,AppleShare IP WebAdmin
+312,VSLMP
+313,Magenta Logic
+314,Opalis Robot
+315,DPSI
+316,decAuth
+317,Zannet
+318,PKIX TimeStamp
+319,PTP Event
+320,PTP General
+321,PIP
+322,RTSPS
+333,Texar Security Port
+344,Prospero Data Access Protocol
+345,Perf Analysis Workbench
+346,Zebra server
+347,Fatmen Server
+348,Cabletron Management Protocol
+349,mftp
+350,MATIP Type A
+351,bhoetty (added 5/21/97)
+352,bhoedap4 (added 5/21/97)
+353,NDSAUTH
+354,bh611
+355,DATEX-ASN
+356,Cloanto Net 1
+357,bhevent
+358,Shrinkwrap
+359,Tenebris Network Trace Service
+360,scoi2odialog
+361,Semantix
+362,SRS Send
+363,RSVP Tunnel
+364,Aurora CMGR
+365,DTK
+366,ODMR
+367,MortgageWare
+368,QbikGDP
+369,rpc2portmap
+370,codaauth2
+371,Clearcase
+372,ListProcessor
+373,Legent Corporation
+374,Legent Corporation
+375,Hassle
+376,Amiga Envoy Network Inquiry Proto
+377,NEC Corporation
+378,NEC Corporation
+379,TIA/EIA/IS-99 modem client
+380,TIA/EIA/IS-99 modem server
+381,hp performance data collector
+382,hp performance data managed node
+383,hp performance data alarm manager
+384,A Remote Network Server System
+385,IBM Application
+386,ASA Message Router Object Def.
+387,Appletalk Update-Based Routing Pro.
+388,Unidata LDM
+389,Lightweight Directory Access Protocol / Internet Locator Service (ILS)
+390,UIS
+391,SynOptics SNMP Relay Port
+392,SynOptics Port Broker Port
+393,Data Interpretation System
+394,EMBL Nucleic Data Transfer
+395,NETscout Control Protocol
+396,Novell Netware over IP
+397,Multi Protocol Trans. Net.
+398,Kryptolan
+399,ISO Transport Class 2 Non-Control over TCP
+400,Workstation Solutions
+401,Uninterruptible Power Supply
+402,Genie Protocol
+403,decap
+404,nced
+405,ncld
+406,Interactive Mail Support Protocol
+407,Timbuktu
+408,Prospero Resource Manager Sys. Man.
+409,Prospero Resource Manager Node Man.
+410,DECLadebug Remote Debug Protocol
+411,Remote MT Protocol
+412,NeoModus Direct Connect (Windows file sharing program) / Trap Convention Port
+413,SMSP
+414,InfoSeek
+415,BNet
+416,Silverplatter
+417,Onmux
+418,Hyper-G
+419,Ariel
+420,SMPTE
+421,Ariel
+422,Ariel
+423,IBM Operations Planning and Control Start
+424,IBM Operations Planning and Control Track
+425,ICAD
+426,smartsdp
+427,Server Location
+428,OCS_CMU
+429,OCS_AMU
+430,UTMPSD
+431,UTMPCD
+432,IASD
+433,NNSP
+434,MobileIP-Agent
+435,MobilIP-MN
+436,DNA-CML
+437,comscm
+438,dsfgw
+439,dasp
+440,sgcp
+441,decvms-sysmgt
+442,cvc_hostd
+443,HTTP protocol over TLS/SSL
+444,Simple Network Paging Protocol
+445,Microsoft-DS
+446,DDM-RDB
+447,DDM-RFM
+448,DDM-SSL
+449,AS Server Mapper
+450,TServer
+451,Cray Network Semaphore server
+452,Cray SFS config server
+453,CreativeServer
+454,ContentServer
+455,CreativePartnr
+456,macon-tcp
+457,scohelp
+458,apple quick time
+459,ampr-rcmd
+460,skronk
+461,DataRampSrv
+462,DataRampSrvSec
+463,alpes
+464,kpasswd
+465,SMTPS
+466,digital-vrc
+467,mylex-mapd
+468,proturis
+469,Radio Control Protocol
+470,scx-proxy
+471,Mondex
+472,ljk-login
+473,hybrid-pop
+474,tn-tl-w1
+475,tcpnethaspsrv
+476,tn-tl-fd1
+477,ss7ns
+478,spsc
+479,iafserver
+480,iafdbase
+481,Ph service
+482,bgs-nsi
+483,ulpnet
+484,Integra Software Management Environment
+485,Air Soft Power Burst
+486,avian
+487,saft Simple Asynchronous File Transfer
+488,gss-HTTP
+489,nest-protocol
+490,micom-pfs
+491,go-login
+492,Transport Independent Convergence for FNA
+493,Transport Independent Convergence for FNA
+494,POV-Ray
+495,intecourier
+496,PIM-RP-DISC
+497,dantz
+498,siam
+499,ISO ILL Protocol
+500,ISAKMP
+501,STMF
+502,asa-appl-proto
+503,Intrinsa
+504,citadel
+505,mailbox-lm
+506,ohimsrv
+507,crs
+508,xvttp
+509,snare
+510,FirstClass Protocol
+511,PassGo
+512,Remote process execution
+513,Remote Login
+514,Remote Shell
+515,spooler
+516,videotex
+517,like tenex link but across
+518,talkd
+519,unixtime
+520,extended file name server
+521,ripng
+522,User Location Service / ULP
+523,IBM-DB2
+524,NCP
+525,timeserver
+526,newdate
+527,Stock IXChange
+528,Customer IXChange
+529,IRC-SERV
+530,rpc
+531,chat
+532,readnews
+533,for emergency broadcasts
+534,MegaMedia Admin
+535,iiop
+536,opalis-rdv
+537,Networked Media Streaming Protocol
+538,gdomap
+539,Apertus Technologies Load Determination
+540,uucpd
+541,uucp-rlogin
+542,commerce
+543,kerberos (v4/v5)
+544,krcmd
+545,appleqtcsrvr
+546,DHCPv6 Client
+547,DHCPv6 Server
+548,AppleShare AFP over TCP
+549,IDFP
+550,new-who
+551,cybercash
+552,deviceshare
+553,pirp
+554,Real Time Stream Control Protocol
+555,phAse Zero backdoor (Win 9x, NT) / dsf
+556,rfs server
+557,openvms-sysipc
+558,SDNSKMP
+559,TEEDTAP / Backdoor.Domwis Win32 trojan
+560,rmonitord
+561,monitor
+562,chcmd
+563,AOL IM / NNTP protocol over TLS/SSL
+564,plan 9 file service
+565,whoami
+566,streettalk
+567,banyan-rpc
+568,microsoft shuttle
+569,microsoft rome
+570,demon
+571,udemon
+572,sonar
+573,banyan-vip
+574,FTP Software Agent System
+575,VEMMI
+576,ipcd
+577,vnas
+578,ipdd
+579,decbsrv
+580,SNTP HEARTBEAT
+581,Bundle Discovery Protocol
+582,SCC Security
+583,Philips Video-Conferencing
+584,Key Server
+585,IMAP4+SSL
+586,Password Change
+587,Message Submission (Sendmail)
+588,CAL
+589,EyeLink
+590,TNS CML
+591,FileMaker Inc. - HTTP Alternate
+592,Eudora Set
+593,HTTP RPC Ep Map
+594,TPIP
+595,CAB Protocol
+596,SMSD
+597,PTC Name Service
+598,SCO Web Server Manager 3
+599,Aeolon Core Protocol
+600,Sun IPC server
+606,Cray Unified Resource Manager
+607,nqs
+608,Sender-Initiated/Unsolicited File Transfer
+609,npmp-trap
+610,Apple Admin Service / npmp-local
+611,npmp-gui
+612,HMMP Indication
+613,HMMP Operation
+614,SSLshell
+615,Internet Configuration Manager
+616,SCO System Administration Server
+617,SCO Desktop Administration Server
+618,DEI-ICDA
+619,Digital EVM
+620,SCO WebServer Manager
+621,ESCP
+622,Collaborator
+623,Aux Bus Shunt
+624,Crypto Admin
+625,DEC DLM
+626,ASIA
+627,PassGo Tivoli
+628,QMQP
+629,3Com AMP3
+630,RDA
+631,IPP (Internet Printing Protocol)
+632,bmpp
+633,Service Status update (Sterling Software)
+634,ginad
+635,RLZ DBase
+636,LDAP protocol over TLS/SSL
+637,lanserver
+638,mcns-sec
+639,MSDP
+640,entrust-sps
+641,repcmd
+642,ESRO-EMSDP V1.3
+643,SANity
+644,dwr
+645,PSSC
+646,LDP
+647,DHCP Failover
+648,Registry Registrar Protocol (RRP)
+649,Aminet
+650,OBEX
+651,IEEE MMS
+652,UDLR_DTCP
+653,RepCmd
+654,AODV
+655,TINC
+656,SPMP
+657,RMC
+658,TenFold
+659,URL Rendezvous
+660,MacOS Server Admin
+661,HAP
+662,PFTP
+663,PureNoise
+664,Secure Aux Bus
+665,Sun DR
+666,doom Id Software
+667,campaign contribution disclosures - SDR Technologies
+668,MeComm
+669,MeRegister
+670,VACDSM-SWS
+671,VACDSM-APP
+672,VPPS-QUA
+673,CIMPLEX
+674,ACAP
+675,DCTP
+676,VPPS Via
+677,Virtual Presence Protocol
+678,GNU Gereration Foundation NCP
+679,MRM
+680,entrust-aaas
+681,entrust-aams
+682,XFR
+683,CORBA IIOP
+684,CORBA IIOP SSL
+685,MDC Port Mapper
+686,Hardware Control Protocol Wismar
+687,asipregistry
+688,REALM-RUSD
+689,NMAP
+690,VATP
+691,MS Exchange Routing
+692,Hyperwave-ISP
+693,connendp
+694,ha-cluster
+695,IEEE-MMS-SSL
+696,RUSHD
+697,UUIDGEN
+698,OLSR
+704,errlog copy/server daemon
+705,AgentX
+706,SILC
+707,W32.Nachi Worm / Borland DSJ
+709,Entrust Key Management Service Handler
+710,Entrust Administration Service Handler
+711,Cisco TDP
+729,IBM NetView DM/6000 Server/Client
+730,IBM NetView DM/6000 send/tcp
+731,IBM NetView DM/6000 receive/tcp
+740,(old) NETscout Control Protocol (old)
+741,netGW
+742,Network based Rev. Cont. Sys.
+744,Flexible License Manager
+747,Fujitsu Device Control
+748,Russell Info Sci Calendar Manager
+749,kerberos administration
+750,rfile
+751,pump
+752,Kerberos password server
+753,Kerberos userreg server
+754,send
+758,nlogin
+759,con
+760,kreg, kerberos/4 registration
+761,kpwd, Kerberos/4 password
+762,quotad
+763,cycleserv
+764,omserv
+765,webster
+767,phone
+769,vid
+770,cadlock
+771,rtip
+772,cycleserv2
+773,submit
+774,rpasswd
+775,entomb
+776,wpages
+777,Multiling HTTP
+780,wpgs
+781,HP performance data collector
+782,node HP performance data managed node
+783,HP performance data alarm manager
+786,Concert
+787,QSC
+799,ControlIT / Remotely Possible
+800,mdbs_daemon / Remotely Possible
+801,device
+808,CCProxy
+810,FCP
+828,itm-mcell-s
+829,PKIX-3 CA/RA
+871,SUP server
+873,rsync
+886,ICL coNETion locate server
+887,ICL coNETion server info
+888,CD Database Protocol
+900,Check Point Firewall-1 HTTP administration / OMG Initial Refs
+901,Samba Web Administration Tool / Realsecure / SMPNAMERES/ NetDevil trojan
+902,VMware Authentication Daemon / IDEAFARM-CHAT
+903,IDEAFARM-CATCH / NetDevil trojan
+911,xact-backup
+912,VMware Authentication Daemon
+989,FTP protocol data over TLS/SSL
+990,FTP protocol control over TLS/SSL
+991,Netnews Administration System
+992,Telnet protocol over TLS/SSL
+993,IMAP4 protocol over TLS/SSL
+994,IRC protocol over TLS/SSL
+995,POP3 protocol over TLS/SSL
+996,vsinet
+997,maitrd
+998,busboy
+999,puprouter
+1000,cadlock
+1002,Microsoft Site Server Internet Locator Service (Netmeeting/ICF)
+1008,UFS-aware server
+1010,surf
+1011,Doly (Windows Trojan)
+1015,Doly (Windows Trojan)
+1023,Reserved
+1024,Reserved
+1025,MSTASK / network blackjack
+1026,MSTASK / Remote Login Network Terminal
+1030,BBN IAD
+1031,InetInfo / BBN IAD
+1032,BBN IAD
+1042,W32.Mydoom.L virus
+1047,Sun's NEO Object Request Broker
+1048,Sun's NEO Object Request Broker
+1049,Tobit David Postman VPMN
+1050,CORBA Management Agent
+1051,Optima VNET
+1052,Dynamic DNS Tools
+1053,Remote Assistant (RA)
+1054,BRVREAD
+1055,ANSYS - License Manager
+1056,VFO
+1057,STARTRON
+1058,nim
+1059,nimreg
+1060,POLESTAR
+1061,KIOSK
+1062,Veracity
+1063,KyoceraNetDev
+1064,JSTEL
+1065,SYSCOMLAN
+1066,FPO-FNS
+1067,Installation Bootstrap Proto. Serv.
+1068,Installation Bootstrap Proto. Cli.
+1069,COGNEX-INSIGHT
+1070,GMRUpdateSERV
+1071,BSQUARE-VOIP
+1072,CARDAX
+1073,BridgeControl
+1074,FASTechnologies License Manager
+1075,RDRMSHC
+1076,DAB STI-C
+1077,IMGames
+1078,eManageCstp
+1079,ASPROVATalk
+1080,Socks / W32.Beagle.AB trojan
+1081,PVUNIWIEN
+1082,AMT-ESD-PROT
+1083,Anasoft License Manager
+1084,Anasoft License Manager
+1085,Web Objects
+1086,CPL Scrambler Logging
+1087,CPL Scrambler Internal
+1088,CPL Scrambler Alarm Log
+1089,FF Annunciation
+1090,FF Fieldbus Message Specification
+1091,FF System Management
+1092,OBRPD
+1093,PROOFD
+1094,ROOTD
+1095,NICELink
+1096,Common Name Resolution Protocol
+1097,Sun Cluster Manager
+1098,RMI Activation
+1099,RMI Registry
+1100,MCTP
+1101,PT2-DISCOVER
+1102,ADOBE SERVER 1
+1103,ADOBE SERVER 2
+1104,XRL
+1105,FTRANHC
+1106,ISOIPSIGPORT-1
+1107,ISOIPSIGPORT-2
+1108,ratio-adp
+1109,Pop with Kerberos
+1110,Cluster status info
+1111,LM Social Server
+1112,Intelligent Communication Protocol
+1114,Mini SQL
+1115,ARDUS Transfer
+1116,ARDUS Control
+1117,ARDUS Multicast Transfer
+1123,Murray
+1127,SUP debugging
+1155,Network File Access
+1161,Health Polling
+1162,Health Trap
+1169,TRIPWIRE
+1178,SKK (kanji input)
+1180,Millicent Client Proxy
+1188,HP Web Admin
+1200,SCOL
+1201,Nucleus Sand
+1202,caiccipc
+1203,License Validation
+1204,Log Request Listener
+1205,Accord-MGC
+1206,Anthony Data
+1207,MetaSage
+1208,SEAGULL AIS
+1209,IPCD3
+1210,EOSS
+1211,Groove DPP
+1212,lupa
+1213,MPC LIFENET
+1214,KAZAA (Morpheus)
+1215,scanSTAT 1.0
+1216,ETEBAC 5
+1217,HPSS-NDAPI
+1218,AeroFlight-ADs
+1219,AeroFlight-Ret
+1220,QT SERVER ADMIN
+1221,SweetWARE Apps
+1222,SNI R&D network
+1223,TGP
+1224,VPNz
+1225,SLINKYSEARCH
+1226,STGXFWS
+1227,DNS2Go
+1228,FLORENCE
+1229,Novell ZFS
+1234,W32.Beagle.Y trojan / Infoseek Search Agent
+1239,NMSD
+1241,Nessus Daemon / remote message service
+1243,SubSeven (Windows Trojan)
+1245,Subseven backdoor remote access tool
+1248,hermes
+1270,Microsoft Operations Manager MOM-Encrypted
+1300,H323 Host Call Secure
+1310,Husky
+1311,RxMon
+1312,STI Envision
+1313,BMC_PATROLDB
+1314,Photoscript Distributed Printing System
+1319,Panja-ICSP
+1320,Panja-AXBNET
+1321,PIP
+1335,Digital Notary Protocol
+1345,VPJP
+1346,Alta Analytics License Manager
+1347,multi media conferencing
+1348,multi media conferencing
+1349,Registration Network Protocol
+1350,Registration Network Protocol
+1351,Digital Tool Works (MIT)
+1352,Lotus Notes
+1353,Relief Consulting
+1354,RightBrain Software
+1355,Intuitive Edge
+1356,CuillaMartin Company
+1357,Electronic PegBoard
+1358,CONNLCLI
+1359,FTSRV
+1360,MIMER
+1361,LinX
+1362,TimeFlies
+1363,Network DataMover Requester
+1364,Network DataMover Server
+1365,Network Software Associates
+1366,Novell NetWare Comm Service Platform
+1367,DCS
+1368,ScreenCast
+1369,GlobalView to Unix Shell
+1370,Unix Shell to GlobalView
+1371,Fujitsu Config Protocol
+1372,Fujitsu Config Protocol
+1373,Chromagrafx
+1374,EPI Software Systems
+1375,Bytex
+1376,IBM Person to Person Software
+1377,Cichlid License Manager
+1378,Elan License Manager
+1379,Integrity Solutions
+1380,Telesis Network License Manager
+1381,Apple Network License Manager
+1382,udt_os
+1383,GW Hannaway Network License Manager
+1384,Objective Solutions License Manager
+1385,Atex Publishing License Manager
+1386,CheckSum License Manager
+1387,Computer Aided Design Software Inc LM
+1388,Objective Solutions DataBase Cache
+1389,Document Manager
+1390,Storage Controller
+1391,Storage Access Server
+1392,Print Manager
+1393,Network Log Server
+1394,Network Log Client
+1395,PC Workstation Manager software
+1396,DVL Active Mail
+1397,Audio Active Mail
+1398,Video Active Mail
+1399,Cadkey License Manager
+1400,Cadkey Tablet Daemon
+1401,Goldleaf License Manager
+1402,Prospero Resource Manager
+1403,Prospero Resource Manager
+1404,Infinite Graphics License Manager
+1405,IBM Remote Execution Starter
+1406,NetLabs License Manager
+1407,DBSA License Manager
+1408,Sophia License Manager
+1409,Here License Manager
+1410,HiQ License Manager
+1411,AudioFile
+1412,InnoSys
+1413,Innosys-ACL
+1414,IBM MQSeries
+1415,DBStar
+1416,Novell LU6.2
+1417,Timbuktu Service 1 Port
+1418,Timbuktu Service 2 Port
+1419,Timbuktu Service 3 Port
+1420,Timbuktu Service 4 Port
+1421,Gandalf License Manager
+1422,Autodesk License Manager
+1423,Essbase Arbor Software
+1424,Hybrid Encryption Protocol
+1425,Zion Software License Manager
+1426,Satellite-data Acquisition System 1
+1427,mloadd monitoring tool
+1428,Informatik License Manager
+1429,Hypercom NMS
+1430,Hypercom TPDU
+1431,Reverse Gossip Transport
+1432,Blueberry Software License Manager
+1433,Microsoft-SQL-Server
+1434,Microsoft-SQL-Monitor
+1435,IBM CICS
+1436,Satellite-data Acquisition System 2
+1437,Tabula
+1438,Eicon Security Agent/Server
+1439,Eicon X25/SNA Gateway
+1440,Eicon Service Location Protocol
+1441,Cadis License Management
+1442,Cadis License Management
+1443,Integrated Engineering Software
+1444,Marcam License Management
+1445,Proxima License Manager
+1446,Optical Research Associates License Manager
+1447,Applied Parallel Research LM
+1448,OpenConnect License Manager
+1449,PEport
+1450,Tandem Distributed Workbench Facility
+1451,IBM Information Management
+1452,GTE Government Systems License Man
+1453,Genie License Manager
+1454,interHDL License Manager
+1455,ESL License Manager
+1456,DCA
+1457,Valisys License Manager
+1458,Nichols Research Corp.
+1459,Proshare Notebook Application
+1460,Proshare Notebook Application
+1461,IBM Wireless LAN
+1462,World License Manager
+1463,Nucleus
+1464,MSL License Manager
+1465,Pipes Platform
+1466,Ocean Software License Manager
+1467,CSDMBASE
+1468,CSDM
+1469,Active Analysis Limited License Manager
+1470,Universal Analytics
+1471,csdmbase
+1472,csdm
+1473,OpenMath
+1474,Telefinder
+1475,Taligent License Manager
+1476,clvm-cfg
+1477,ms-sna-server
+1478,ms-sna-base
+1479,dberegister
+1480,PacerForum
+1481,AIRS
+1482,Miteksys License Manager
+1483,AFS License Manager
+1484,Confluent License Manager
+1485,LANSource
+1486,nms_topo_serv
+1487,LocalInfoSrvr
+1488,DocStor
+1489,dmdocbroker
+1490,insitu-conf
+1491,anynetgateway
+1492,stone-design-1
+1493,netmap_lm
+1494,Citrix/ica
+1495,cvc
+1496,liberty-lm
+1497,rfx-lm
+1498,Sybase SQL Any
+1499,Federico Heinz Consultora
+1500,VLSI License Manager
+1501,Satellite-data Acquisition System 3
+1502,Shiva
+1503,MS Netmeeting / T.120 / Databeam
+1504,EVB Software Engineering License Manager
+1505,Funk Software Inc.
+1506,Universal Time daemon (utcd)
+1507,symplex
+1508,diagmond
+1509,Robcad Ltd. License Manager
+1510,Midland Valley Exploration Ltd. Lic. Man.
+1511,3l-l1
+1512,Microsoft's Windows Internet Name Service
+1513,Fujitsu Systems Business of America Inc
+1514,Fujitsu Systems Business of America Inc
+1515,ifor-protocol
+1516,Virtual Places Audio data
+1517,Virtual Places Audio control
+1518,Virtual Places Video data
+1519,Virtual Places Video control
+1520,atm zip office
+1521,Oracle8i Listener / nCube License Manager
+1522,Ricardo North America License Manager
+1523,cichild
+1524,dtspcd / ingres
+1525,Oracle / Prospero Directory Service non-priv
+1526,Prospero Data Access Prot non-priv
+1527,oracle
+1528,micautoreg
+1529,oracle
+1530,Oracle ExtProc (PLSExtProc) / rap-service
+1531,rap-listen
+1532,miroconnect
+1533,Virtual Places Software
+1534,micromuse-lm
+1535,ampr-info
+1536,ampr-inter
+1537,isi-lm
+1538,3ds-lm
+1539,Intellistor License Manager
+1540,rds
+1541,rds2
+1542,gridgen-elmd
+1543,simba-cs
+1544,aspeclmd
+1545,vistium-share
+1546,abbaccuray
+1547,laplink
+1548,Axon License Manager
+1549,Shiva Hose
+1550,Image Storage license manager 3M Company
+1551,HECMTL-DB
+1552,pciarray
+1553,sna-cs
+1554,CACI Products Company License Manager
+1555,livelan
+1556,AshWin CI Tecnologies
+1557,ArborText License Manager
+1558,xingmpeg
+1559,web2host
+1560,asci-val
+1561,facilityview
+1562,pconnectmgr
+1563,Cadabra License Manager
+1564,Pay-Per-View
+1565,WinDD
+1566,CORELVIDEO
+1567,jlicelmd
+1568,tsspmap
+1569,ets
+1570,orbixd
+1571,Oracle Remote Data Base
+1572,Chipcom License Manager
+1573,itscomm-ns
+1574,mvel-lm
+1575,oraclenames
+1576,moldflow-lm
+1577,hypercube-lm
+1578,Jacobus License Manager
+1579,ioc-sea-lm
+1580,tn-tl-r1
+1581,MIL-2045-47001
+1582,MSIMS
+1583,simbaexpress
+1584,tn-tl-fd2
+1585,intv
+1586,ibm-abtact
+1587,pra_elmd
+1588,triquest-lm
+1589,VQP
+1590,gemini-lm
+1591,ncpm-pm
+1592,commonspace
+1593,mainsoft-lm
+1594,sixtrak
+1595,radio
+1596,radio-sm
+1597,orbplus-iiop
+1598,picknfs
+1599,simbaservices
+1600,Bofra-A worm / issd
+1601,aas
+1602,inspect
+1603,pickodbc
+1604,icabrowser
+1605,Salutation Manager (Salutation Protocol)
+1606,Salutation Manager (SLM-API)
+1607,stt
+1608,Smart Corp. License Manager
+1609,isysg-lm
+1610,taurus-wh
+1611,Inter Library Loan
+1612,NetBill Transaction Server
+1613,NetBill Key Repository
+1614,NetBill Credential Server
+1615,NetBill Authorization Server
+1616,NetBill Product Server
+1617,Nimrod Inter-Agent Communication
+1618,skytelnet
+1619,xs-openstorage
+1620,faxportwinport
+1621,softdataphone
+1622,ontime
+1623,jaleosnd
+1624,udp-sr-port
+1625,svs-omagent
+1626,Shockwave
+1627,T.128 Gateway
+1628,LonTalk normal
+1629,LonTalk urgent
+1630,Oracle Net8 Cman
+1631,Visit view
+1632,PAMMRATC
+1633,PAMMRPC
+1634,Log On America Probe
+1635,EDB Server 1
+1636,CableNet Control Protocol
+1637,CableNet Admin Protocol
+1638,Bofra-A worm / CableNet Info Protocol
+1639,cert-initiator
+1640,cert-responder
+1641,InVision
+1642,isis-am
+1643,isis-ambc
+1644,Satellite-data Acquisition System 4
+1645,datametrics
+1646,sa-msg-port
+1647,rsap
+1648,concurrent-lm
+1649,kermit
+1650,nkd
+1651,shiva_confsrvr
+1652,xnmp
+1653,alphatech-lm
+1654,stargatealerts
+1655,dec-mbadmin
+1656,dec-mbadmin-h
+1657,fujitsu-mmpdc
+1658,sixnetudr
+1659,Silicon Grail License Manager
+1660,skip-mc-gikreq
+1661,netview-aix-1
+1662,netview-aix-2
+1663,netview-aix-3
+1664,netview-aix-4
+1665,netview-aix-5
+1666,netview-aix-6
+1667,netview-aix-7
+1668,netview-aix-8
+1669,netview-aix-9
+1670,netview-aix-10
+1671,netview-aix-11
+1672,netview-aix-12
+1673,Intel Proshare Multicast
+1674,Intel Proshare Multicast
+1675,Pacific Data Products
+1676,netcomm1
+1677,groupwise
+1678,prolink
+1679,darcorp-lm
+1680,microcom-sbp
+1681,sd-elmd
+1682,lanyon-lantern
+1683,ncpm-hip
+1684,SnareSecure
+1685,n2nremote
+1686,cvmon
+1687,nsjtp-ctrl
+1688,nsjtp-data
+1689,firefox
+1690,ng-umds
+1691,empire-empuma
+1692,sstsys-lm
+1693,rrirtr
+1694,rrimwm
+1695,rrilwm
+1696,rrifmm
+1697,rrisat
+1698,RSVP-ENCAPSULATION-1
+1699,RSVP-ENCAPSULATION-2
+1700,mps-raft
+1701,l2tp / AOL
+1702,deskshare
+1703,hb-engine
+1704,bcs-broker
+1705,slingshot
+1706,jetform
+1707,vdmplay
+1708,gat-lmd
+1709,centra
+1710,impera
+1711,pptconference
+1712,resource monitoring service
+1713,ConferenceTalk
+1714,sesi-lm
+1715,houdini-lm
+1716,xmsg
+1717,fj-hdnet
+1718,h323gatedisc
+1719,h323gatestat
+1720,h323hostcall
+1721,caicci
+1722,HKS License Manager
+1723,pptp
+1724,csbphonemaster
+1725,iden-ralp
+1726,IBERIAGAMES
+1727,winddx
+1728,TELINDUS
+1729,CityNL License Management
+1730,roketz
+1731,MS Netmeeting / Audio call control / MSICCP
+1732,proxim
+1733,SIMS - SIIPAT Protocol for Alarm Transmission
+1734,Camber Corporation License Management
+1735,PrivateChat
+1736,street-stream
+1737,ultimad
+1738,GameGen1
+1739,webaccess
+1740,encore
+1741,cisco-net-mgmt
+1742,3Com-nsd
+1743,Cinema Graphics License Manager
+1744,ncpm-ft
+1745,ISA Server proxy autoconfig / Remote Winsock
+1746,ftrapid-1
+1747,ftrapid-2
+1748,oracle-em1
+1749,aspen-services
+1750,Simple Socket Library's PortMaster
+1751,SwiftNet
+1752,Leap of Faith Research License Manager
+1753,Translogic License Manager
+1754,oracle-em2
+1755,Microsoft Streaming Server
+1756,capfast-lmd
+1757,cnhrp
+1758,tftp-mcast
+1759,SPSS License Manager
+1760,www-ldap-gw
+1761,cft-0
+1762,cft-1
+1763,cft-2
+1764,cft-3
+1765,cft-4
+1766,cft-5
+1767,cft-6
+1768,cft-7
+1769,bmc-net-adm
+1770,bmc-net-svc
+1771,vaultbase
+1772,EssWeb Gateway
+1773,KMSControl
+1774,global-dtserv
+1776,Federal Emergency Management Information System
+1777,powerguardian
+1778,prodigy-internet
+1779,pharmasoft
+1780,dpkeyserv
+1781,answersoft-lm
+1782,HP JetSend
+1783,Port 04/14/00 fujitsu.co.jp
+1784,Finle License Manager
+1785,Wind River Systems License Manager
+1786,funk-logger
+1787,funk-license
+1788,psmond
+1789,hello
+1790,Narrative Media Streaming Protocol
+1791,EA1
+1792,ibm-dt-2
+1793,rsc-robot
+1794,cera-bcm
+1795,dpi-proxy
+1796,Vocaltec Server Administration
+1797,UMA
+1798,Event Transfer Protocol
+1799,NETRISK
+1800,ANSYS-License manager
+1801,Microsoft Message Queuing
+1802,ConComp1
+1803,HP-HCIP-GWY
+1804,ENL
+1805,ENL-Name
+1806,Musiconline
+1807,Fujitsu Hot Standby Protocol
+1808,Oracle-VP2
+1809,Oracle-VP1
+1810,Jerand License Manager
+1811,Scientia-SDB
+1812,RADIUS
+1813,RADIUS Accounting / HackTool.SkSocket
+1814,TDP Suite
+1815,MMPFT
+1816,HARP
+1817,RKB-OSCS
+1818,Enhanced Trivial File Transfer Protocol
+1819,Plato License Manager
+1820,mcagent
+1821,donnyworld
+1822,es-elmd
+1823,Unisys Natural Language License Manager
+1824,metrics-pas
+1825,DirecPC Video
+1826,ARDT
+1827,ASI
+1828,itm-mcell-u
+1829,Optika eMedia
+1830,Oracle Net8 CMan Admin
+1831,Myrtle
+1832,ThoughtTreasure
+1833,udpradio
+1834,ARDUS Unicast
+1835,ARDUS Multicast
+1836,ste-smsc
+1837,csoft1
+1838,TALNET
+1839,netopia-vo1
+1840,netopia-vo2
+1841,netopia-vo3
+1842,netopia-vo4
+1843,netopia-vo5
+1844,DirecPC-DLL
+1850,GSI
+1851,ctcd
+1860,SunSCALAR Services
+1861,LeCroy VICP
+1862,techra-server
+1863,MSN Messenger
+1864,Paradym 31 Port
+1865,ENTP
+1870,SunSCALAR DNS Service
+1871,Cano Central 0
+1872,Cano Central 1
+1873,Fjmpjps
+1874,Fjswapsnp
+1881,IBM MQSeries
+1895,Vista 4GL
+1899,MC2Studios
+1900,SSDP
+1901,Fujitsu ICL Terminal Emulator Program A
+1902,Fujitsu ICL Terminal Emulator Program B
+1903,Local Link Name Resolution
+1904,Fujitsu ICL Terminal Emulator Program C
+1905,Secure UP.Link Gateway Protocol
+1906,TPortMapperReq
+1907,IntraSTAR
+1908,Dawn
+1909,Global World Link
+1910,ultrabac
+1911,Starlight Networks Multimedia Transport Protocol
+1912,rhp-iibp
+1913,armadp
+1914,Elm-Momentum
+1915,FACELINK
+1916,Persoft Persona
+1917,nOAgent
+1918,Candle Directory Service - NDS
+1919,Candle Directory Service - DCH
+1920,Candle Directory Service - FERRET
+1921,NoAdmin
+1922,Tapestry
+1923,SPICE
+1924,XIIP
+1930,Drive AppServer
+1931,AMD SCHED
+1944,close-combat
+1945,dialogic-elmd
+1946,tekpls
+1947,hlserver
+1948,eye2eye
+1949,ISMA Easdaq Live
+1950,ISMA Easdaq Test
+1951,bcs-lmserver
+1952,mpnjsc
+1953,Rapid Base
+1961,BTS APPSERVER
+1962,BIAP-MP
+1963,WebMachine
+1964,SOLID E ENGINE
+1965,Tivoli NPM
+1966,Slush
+1967,SNS Quote
+1972,Cache
+1973,Data Link Switching Remote Access Protocol
+1974,DRP
+1975,TCO Flash Agent
+1976,TCO Reg Agent
+1977,TCO Address Book
+1978,UniSQL
+1979,UniSQL Java
+1984,BB
+1985,Hot Standby Router Protocol
+1986,cisco license management
+1987,cisco RSRB Priority 1 port
+1988,cisco RSRB Priority 2 port
+1989,MHSnet system
+1990,cisco STUN Priority 1 port
+1991,cisco STUN Priority 2 port
+1992,IPsendmsg
+1993,cisco SNMP TCP port
+1994,cisco serial tunnel port
+1995,cisco perf port
+1996,cisco Remote SRB port
+1997,cisco Gateway Discovery Protocol
+1998,cisco X.25 service (XOT)
+1999,cisco identification port / SubSeven (Windows Trojan) / Backdoor (Windows Trojan)
+2000,Remotely Anywhere / VIA NET.WORKS PostOffice Plus
+2001,Cisco mgmt / Remotely Anywhere
+2002,globe
+2003,GNU finger
+2004,mailbox
+2005,encrypted symmetric telnet/login
+2006,invokator
+2007,dectalk
+2008,conf
+2009,news
+2010,search
+2011,raid
+2012,ttyinfo
+2013,raid-am
+2014,troff
+2015,cypress
+2016,bootserver
+2017,cypress-stat
+2018,terminaldb
+2019,whosockami
+2020,xinupageserver
+2021,servexec
+2022,down
+2023,xinuexpansion3
+2024,xinuexpansion4
+2025,ellpack
+2026,scrabble
+2027,shadowserver
+2028,submitserver
+2030,device2
+2032,blackboard
+2033,glogger
+2034,scoremgr
+2035,imsldoc
+2038,objectmanager
+2040,lam
+2041,W32.Korgo Worm / interbase
+2042,isis
+2043,isis-bcast
+2044,rimsl
+2045,cdfunc
+2046,sdfunc
+2047,dls
+2048,dls-monitor
+2049,Network File System - Sun Microsystems
+2053,Kerberos de-multiplexer
+2054,distrib-net
+2065,Data Link Switch Read Port Number
+2067,Data Link Switch Write Port Number
+2080,Wingate
+2090,Load Report Protocol
+2091,PRP
+2092,Descent 3
+2093,NBX CC
+2094,NBX AU
+2095,NBX SER
+2096,NBX DIR
+2097,Jet Form Preview
+2098,Dialog Port
+2099,H.225.0 Annex G
+2100,amiganetfs
+2101,Microsoft Message Queuing / rtcm-sc104
+2102,Zephyr server
+2103,Microsoft Message Queuing RPC / Zephyr serv-hm connection
+2104,Zephyr hostmanager
+2105,Microsoft Message Queuing RPC / MiniPay
+2106,MZAP
+2107,Microsoft Message Queuing Management / BinTec Admin
+2108,Comcam
+2109,Ergolight
+2110,UMSP
+2111,DSATP
+2112,Idonix MetaNet
+2113,HSL StoRM
+2114,NEWHEIGHTS
+2115,KDM / Bugs (Windows Trojan)
+2116,CCOWCMR
+2117,MENTACLIENT
+2118,MENTASERVER
+2119,GSIGATEKEEPER
+2120,Quick Eagle Networks CP
+2121,CCProxy FTP / SCIENTIA-SSDB
+2122,CauPC Remote Control
+2123,GTP-Control Plane (3GPP)
+2124,ELATELINK
+2125,LOCKSTEP
+2126,PktCable-COPS
+2127,INDEX-PC-WB
+2128,Net Steward Control
+2129,cs-live.com
+2130,SWC-XDS
+2131,Avantageb2b
+2132,AVAIL-EPMAP
+2133,ZYMED-ZPP
+2134,AVENUE
+2135,Grid Resource Information Server
+2136,APPWORXSRV
+2137,CONNECT
+2138,UNBIND-CLUSTER
+2139,IAS-AUTH
+2140,IAS-REG
+2141,IAS-ADMIND
+2142,TDM-OVER-IP
+2143,Live Vault Job Control
+2144,Live Vault Fast Object Transfer
+2145,Live Vault Remote Diagnostic Console Support
+2146,Live Vault Admin Event Notification
+2147,Live Vault Authentication
+2148,VERITAS UNIVERSAL COMMUNICATION LAYER
+2149,ACPTSYS
+2150,DYNAMIC3D
+2151,DOCENT
+2152,GTP-User Plane (3GPP)
+2165,X-Bone API
+2166,IWSERVER
+2180,Millicent Vendor Gateway Server
+2181,eforward
+2190,TiVoConnect Beacon
+2191,TvBus Messaging
+2200,ICI
+2201,Advanced Training System Program
+2202,Int. Multimedia Teleconferencing Cosortium
+2213,Kali
+2220,Ganymede
+2221,Rockwell CSP1
+2222,Rockwell CSP2
+2223,Rockwell CSP3
+2232,IVS Video default
+2233,INFOCRYPT
+2234,DirectPlay
+2235,Sercomm-WLink
+2236,Nani
+2237,Optech Port1 License Manager
+2238,AVIVA SNA SERVER
+2239,Image Query
+2240,RECIPe
+2241,IVS Daemon
+2242,Folio Remote Server
+2243,Magicom Protocol
+2244,NMS Server
+2245,HaO
+2279,xmquery
+2280,LNVPOLLER
+2281,LNVCONSOLE
+2282,LNVALARM
+2283,Dumaru.Y (Windows trojan) / LNVSTATUS
+2284,LNVMAPS
+2285,LNVMAILMON
+2286,NAS-Metering
+2287,DNA
+2288,NETML
+2294,Konshus License Manager (FLEX)
+2295,Advant License Manager
+2296,Theta License Manager (Rainbow)
+2297,D2K DataMover 1
+2298,D2K DataMover 2
+2299,PC Telecommute
+2300,CVMMON
+2301,Compaq HTTP
+2302,Bindery Support
+2303,Proxy Gateway
+2304,Attachmate UTS
+2305,MT ScaleServer
+2306,TAPPI BoxNet
+2307,pehelp
+2308,sdhelp
+2309,SD Server
+2310,SD Client
+2311,Message Service
+2313,IAPP (Inter Access Point Protocol)
+2314,CR WebSystems
+2315,Precise Sft.
+2316,SENT License Manager
+2317,Attachmate G32
+2318,Cadence Control
+2319,InfoLibria
+2320,Siebel NS
+2321,RDLAP over UDP
+2322,ofsd
+2323,3d-nfsd
+2324,Cosmocall
+2325,Design Space License Management
+2326,IDCP
+2327,xingcsm
+2328,Netrix SFTM
+2329,NVD
+2330,TSCCHAT
+2331,AGENTVIEW
+2332,RCC Host
+2333,SNAPP
+2334,ACE Client Auth
+2335,ACE Proxy
+2336,Apple UG Control
+2337,ideesrv
+2338,Norton Lambert
+2339,3Com WebView
+2340,WRS Registry
+2341,XIO Status
+2342,Seagate Manage Exec
+2343,nati logos
+2344,fcmsys
+2345,dbm
+2346,Game Connection Port
+2347,Game Announcement and Location
+2348,Information to query for game status
+2349,Diagnostics Port
+2350,psbserver
+2351,psrserver
+2352,pslserver
+2353,pspserver
+2354,psprserver
+2355,psdbserver
+2356,GXT License Managemant
+2357,UniHub Server
+2358,Futrix
+2359,FlukeServer
+2360,NexstorIndLtd
+2361,TL1
+2362,digiman
+2363,Media Central NFSD
+2364,OI-2000
+2365,dbref
+2366,qip-login
+2367,Service Control
+2368,OpenTable
+2369,ACS2000 DSP
+2370,L3-HBMon
+2381,Compaq HTTPS
+2382,Microsoft OLAP
+2383,Microsoft OLAP
+2384,SD-REQUEST
+2389,OpenView Session Mgr
+2390,RSMTP
+2391,3COM Net Management
+2392,Tactical Auth
+2393,MS OLAP 1
+2394,MS OLAP 2
+2395,LAN900 Remote
+2396,Wusage
+2397,NCL
+2398,Orbiter
+2399,FileMaker Inc. - Data Access Layer
+2400,OpEquus Server
+2401,cvspserver
+2402,TaskMaster 2000 Server
+2403,TaskMaster 2000 Web
+2404,IEC870-5-104
+2405,TRC Netpoll
+2406,JediServer
+2407,Orion
+2408,OptimaNet
+2409,SNS Protocol
+2410,VRTS Registry
+2411,Netwave AP Management
+2412,CDN
+2413,orion-rmi-reg
+2414,Interlingua
+2415,COMTEST
+2416,RMT Server
+2417,Composit Server
+2418,cas
+2419,Attachmate S2S
+2420,DSL Remote Management
+2421,G-Talk
+2422,CRMSBITS
+2423,RNRP
+2424,KOFAX-SVR
+2425,Fujitsu App Manager
+2426,Appliant TCP
+2427,Media Gateway Control Protocol Gateway
+2428,One Way Trip Time
+2429,FT-ROLE
+2430,venus
+2431,venus-se
+2432,codasrv
+2433,codasrv-se
+2434,pxc-epmap
+2435,OptiLogic
+2436,TOP/X
+2437,UniControl
+2438,MSP
+2439,SybaseDBSynch
+2440,Spearway Lockers
+2441,pvsw-inet
+2442,Netangel
+2443,PowerClient Central Storage Facility
+2444,BT PP2 Sectrans
+2445,DTN1
+2446,bues_service
+2447,OpenView NNM daemon
+2448,hpppsvr
+2449,RATL
+2450,netadmin
+2451,netchat
+2452,SnifferClient
+2453,madge-om
+2454,IndX-DDS
+2455,WAGO-IO-SYSTEM
+2456,altav-remmgt
+2457,Rapido_IP
+2458,griffin
+2459,Community
+2460,ms-theater
+2461,qadmifoper
+2462,qadmifevent
+2463,Symbios Raid
+2464,DirecPC SI
+2465,Load Balance Management
+2466,Load Balance Forwarding
+2467,High Criteria
+2468,qip_msgd
+2469,MTI-TCS-COMM
+2470,taskman port
+2471,SeaODBC
+2472,C3
+2473,Aker-cdp
+2474,Vital Analysis
+2475,ACE Server
+2476,ACE Server Propagation
+2477,SecurSight Certificate Valifation Service
+2478,SecurSight Authentication Server (SLL)
+2479,SecurSight Event Logging Server (SSL)
+2480,Lingwood's Detail
+2481,Oracle GIOP
+2482,Oracle GIOP SSL
+2483,Oracle TTC
+2484,Oracle TTC SSL
+2485,Net Objects1
+2486,Net Objects2
+2487,Policy Notice Service
+2488,Moy Corporation
+2489,TSILB
+2490,qip_qdhcp
+2491,Conclave CPP
+2492,GROOVE
+2493,Talarian MQS
+2494,BMC AR
+2495,Fast Remote Services
+2496,DIRGIS
+2497,Quad DB
+2498,ODN-CasTraq
+2499,UniControl
+2500,Resource Tracking system server
+2501,Resource Tracking system client
+2502,Kentrox Protocol
+2503,NMS-DPNSS
+2504,WLBS
+2505,torque-traffic
+2506,jbroker
+2507,spock
+2508,JDataStore
+2509,fjmpss
+2510,fjappmgrbulk
+2511,Metastorm
+2512,Citrix IMA
+2513,Citrix ADMIN
+2514,Facsys NTP
+2515,Facsys Router
+2516,Main Control
+2517,H.323 Annex E call signaling transport
+2518,Willy
+2519,globmsgsvc
+2520,pvsw
+2521,Adaptec Manager
+2522,WinDb
+2523,Qke LLC V.3
+2524,Optiwave License Management
+2525,MS V-Worlds
+2526,EMA License Manager
+2527,IQ Server
+2528,NCR CCL
+2529,UTS FTP
+2530,VR Commerce
+2531,ITO-E GUI
+2532,OVTOPMD
+2533,SnifferServer
+2534,Combox Web Access
+2535,W32.Beagle trojan / MADCAP
+2536,btpp2audctr1
+2537,Upgrade Protocol
+2538,vnwk-prapi
+2539,VSI Admin
+2540,LonWorks
+2541,LonWorks2
+2542,daVinci
+2543,REFTEK
+2544,Novell ZEN
+2545,sis-emt
+2546,vytalvaultbrtp
+2547,vytalvaultvsmp
+2548,vytalvaultpipe
+2549,IPASS
+2550,ADS
+2551,ISG UDA Server
+2552,Call Logging
+2553,efidiningport
+2554,VCnet-Link v10
+2555,Compaq WCP
+2556,W32.Beagle.N trojan / MADCAP / nicetec-nmsvc
+2557,nicetec-mgmt
+2558,PCLE Multi Media
+2559,LSTP
+2560,labrat
+2561,MosaixCC
+2562,Delibo
+2563,CTI Redwood
+2564,HP 3000 NS/VT block mode telnet
+2565,Coordinator Server
+2566,pcs-pcw
+2567,Cisco Line Protocol
+2568,SPAM TRAP
+2569,Sonus Call Signal
+2570,HS Port
+2571,CECSVC
+2572,IBP
+2573,Trust Establish
+2574,Blockade BPSP
+2575,HL7
+2576,TCL Pro Debugger
+2577,Scriptics Lsrvr
+2578,RVS ISDN DCP
+2579,mpfoncl
+2580,Tributary
+2581,ARGIS TE
+2582,ARGIS DS
+2583,MON / Wincrash2
+2584,cyaserv
+2585,NETX Server
+2586,NETX Agent
+2587,MASC
+2588,Privilege
+2589,quartus tcl
+2590,idotdist
+2591,Maytag Shuffle
+2592,netrek
+2593,MNS Mail Notice Service
+2594,Data Base Server
+2595,World Fusion 1
+2596,World Fusion 2
+2597,Homestead Glory
+2598,Citrix MA Client
+2599,Meridian Data
+2600,HPSTGMGR
+2601,discp client
+2602,discp server
+2603,Service Meter
+2604,NSC CCS
+2605,NSC POSA
+2606,Dell Netmon
+2607,Dell Connection
+2608,Wag Service
+2609,System Monitor
+2610,VersaTek
+2611,LIONHEAD
+2612,Qpasa Agent
+2613,SMNTUBootstrap
+2614,Never Offline
+2615,firepower
+2616,appswitch-emp
+2617,Clinical Context Managers
+2618,Priority E-Com
+2619,bruce
+2620,LPSRecommender
+2621,Miles Apart Jukebox Server
+2622,MetricaDBC
+2623,LMDP
+2624,Aria
+2625,Blwnkl Port
+2626,gbjd816
+2627,Moshe Beeri
+2628,DICT
+2629,Sitara Server
+2630,Sitara Management
+2631,Sitara Dir
+2632,IRdg Post
+2633,InterIntelli
+2634,PK Electronics
+2635,Back Burner
+2636,Solve
+2637,Import Document Service
+2638,Sybase Anywhere
+2639,AMInet
+2640,Sabbagh Associates Licence Manager
+2641,HDL Server
+2642,Tragic
+2643,GTE-SAMP
+2644,Travsoft IPX Tunnel
+2645,Novell IPX CMD
+2646,AND Licence Manager
+2647,SyncServer
+2648,Upsnotifyprot
+2649,VPSIPPORT
+2650,eristwoguns
+2651,EBInSite
+2652,InterPathPanel
+2653,Sonus
+2654,Corel VNC Admin
+2655,UNIX Nt Glue
+2656,Kana
+2657,SNS Dispatcher
+2658,SNS Admin
+2659,SNS Query
+2660,GC Monitor
+2661,OLHOST
+2662,BinTec-CAPI
+2663,BinTec-TAPI
+2664,Command MQ GM
+2665,Command MQ PM
+2666,extensis
+2667,Alarm Clock Server
+2668,Alarm Clock Client
+2669,TOAD
+2670,TVE Announce
+2671,newlixreg
+2672,nhserver
+2673,First Call 42
+2674,ewnn
+2675,TTC ETAP
+2676,SIMSLink
+2677,Gadget Gate 1 Way
+2678,Gadget Gate 2 Way
+2679,Sync Server SSL
+2680,pxc-sapxom
+2681,mpnjsomb
+2682,SRSP
+2683,NCDLoadBalance
+2684,mpnjsosv
+2685,mpnjsocl
+2686,mpnjsomg
+2687,pq-lic-mgmt
+2688,md-cf-HTTP
+2689,FastLynx
+2690,HP NNM Embedded Database
+2691,IT Internet
+2692,Admins LMS
+2693,belarc-HTTP
+2694,pwrsevent
+2695,VSPREAD
+2696,Unify Admin
+2697,Oce SNMP Trap Port
+2698,MCK-IVPIP
+2699,Csoft Plus Client
+2700,tqdata
+2701,SMS Remote Control (control)
+2702,SMS Remote Control (data)
+2703,SMS Remote Control (chat)
+2704,SMS Remote File Transfer
+2705,SDS Admin
+2706,NCD Mirroring
+2707,EMCSYMAPIPORT
+2708,Banyan-Net
+2709,Supermon
+2710,SSO Service
+2711,SSO Control
+2712,Axapta Object Communication Protocol
+2713,Raven1
+2714,Raven2
+2715,HPSTGMGR2
+2716,Inova IP Disco
+2717,PN REQUESTER
+2718,PN REQUESTER 2
+2719,Scan & Change
+2720,wkars
+2721,Smart Diagnose
+2722,Proactive Server
+2723,WatchDog NT
+2724,qotps
+2725,SQL Analysis Services / MSOLAP PTP2
+2726,TAMS
+2727,Media Gateway Control Protocol Call Agent
+2728,SQDR
+2729,TCIM Control
+2730,NEC RaidPlus
+2731,NetDragon Messanger
+2732,G5M
+2733,Signet CTF
+2734,CCS Software
+2735,Monitor Console
+2736,RADWIZ NMS SRV
+2737,SRP Feedback
+2738,NDL TCP-OSI Gateway
+2739,TN Timing
+2740,Alarm
+2741,TSB
+2742,TSB2
+2743,murx
+2744,honyaku
+2745,W32.Beagle.C trojan) / URBISNET
+2746,CPUDPENCAP
+2747,yk.fujitsu.co.jp
+2748,yk.fujitsu.co.jp
+2749,yk.fujitsu.co.jp
+2750,yk.fujitsu.co.jp
+2751,yk.fujitsu.co.jp
+2752,RSISYS ACCESS
+2753,de-spot
+2754,APOLLO CC
+2755,Express Pay
+2756,simplement-tie
+2757,CNRP
+2758,APOLLO Status
+2759,APOLLO GMS
+2760,Saba MS
+2761,DICOM ISCL
+2762,DICOM TLS
+2763,Desktop DNA
+2764,Data Insurance
+2765,qip-audup
+2766,Compaq SCP
+2767,UADTC
+2768,UACS
+2769,Single Point MVS
+2770,Veronica
+2771,Vergence CM
+2772,auris
+2773,PC Backup
+2774,PC Backup
+2775,SMMP
+2776,Ridgeway Systems & Software
+2777,Ridgeway Systems & Software
+2778,Gwen-Sonya
+2779,LBC Sync
+2780,LBC Control
+2781,whosells
+2782,everydayrc
+2783,AISES
+2784,world wide web - development
+2785,aic-np
+2786,aic-oncrpc - Destiny MCD database
+2787,piccolo - Cornerstone Software
+2788,NetWare Loadable Module - Seagate Software
+2789,Media Agent
+2790,PLG Proxy
+2791,MT Port Registrator
+2792,f5-globalsite
+2793,initlsmsad
+2794,aaftp
+2795,LiveStats
+2796,ac-tech
+2797,esp-encap
+2798,TMESIS-UPShot
+2799,ICON Discover
+2800,ACC RAID
+2801,IGCP
+2802,Veritas TCP1
+2803,btprjctrl
+2804,Telexis VTU
+2805,WTA WSP-S
+2806,cspuni
+2807,cspmulti
+2808,J-LAN-P
+2809,CORBA LOC
+2810,Active Net Steward
+2811,GSI FTP
+2812,atmtcp
+2813,llm-pass
+2814,llm-csv
+2815,LBC Measurement
+2816,LBC Watchdog
+2817,NMSig Port
+2818,rmlnk
+2819,FC Fault Notification
+2820,UniVision
+2821,vml_dms
+2822,ka0wuc
+2823,CQG Net/LAN
+2826,slc systemlog
+2827,slc ctrlrloops
+2828,ITM License Manager
+2829,silkp1
+2830,silkp2
+2831,silkp3
+2832,silkp4
+2833,glishd
+2834,EVTP
+2835,EVTP-DATA
+2836,catalyst
+2837,Repliweb
+2838,Starbot
+2839,NMSigPort
+2840,l3-exprt
+2841,l3-ranger
+2842,l3-hawk
+2843,PDnet
+2844,BPCP POLL
+2845,BPCP TRAP
+2846,AIMPP Hello
+2847,AIMPP Port Req
+2848,AMT-BLC-PORT
+2849,FXP
+2850,MetaConsole
+2851,webemshttp
+2852,bears-01
+2853,ISPipes
+2854,InfoMover
+2856,cesdinv
+2857,SimCtIP
+2858,ECNP
+2859,Active Memory
+2860,Dialpad Voice 1
+2861,Dialpad Voice 2
+2862,TTG Protocol
+2863,Sonar Data
+2864,main 5001 cmd
+2865,pit-vpn
+2866,lwlistener
+2867,esps-portal
+2868,NPEP Messaging
+2869,SSDP event notification / ICSLAP
+2870,daishi
+2871,MSI Select Play
+2872,CONTRACT
+2873,PASPAR2 ZoomIn
+2874,dxmessagebase1
+2875,dxmessagebase2
+2876,SPS Tunnel
+2877,BLUELANCE
+2878,AAP
+2879,ucentric-ds
+2880,synapse
+2881,NDSP
+2882,NDTP
+2883,NDNP
+2884,Flash Msg
+2885,TopFlow
+2886,RESPONSELOGIC
+2887,aironet
+2888,SPCSDLOBBY
+2889,RSOM
+2890,CSPCLMULTI
+2891,CINEGRFX-ELMD License Manager
+2892,SNIFFERDATA
+2893,VSECONNECTOR
+2894,ABACUS-REMOTE
+2895,NATUS LINK
+2896,ECOVISIONG6-1
+2897,Citrix RTMP
+2898,APPLIANCE-CFG
+2899,case.nm.fujitsu.co.jp
+2900,magisoft.com
+2901,ALLSTORCNS
+2902,NET ASPI
+2903,SUITCASE
+2904,M2UA
+2905,M3UA
+2906,CALLER9
+2907,WEBMETHODS B2B
+2908,mao
+2909,Funk Dialout
+2910,TDAccess
+2911,Blockade
+2912,Epicon
+2913,Booster Ware
+2914,Game Lobby
+2915,TK Socket
+2916,Elvin Server
+2917,Elvin Client
+2918,Kasten Chase Pad
+2919,ROBOER
+2920,ROBOEDA
+2921,CESD Contents Delivery Management
+2922,CESD Contents Delivery Data Transfer
+2923,WTA-WSP-WTP-S
+2924,PRECISE-VIP
+2925,Firewall Redundancy Protocol
+2926,MOBILE-FILE-DL
+2927,UNIMOBILECTRL
+2928,REDSTONE-CPSS
+2929,PANJA-WEBADMIN
+2930,PANJA-WEBLINX
+2931,Circle-X
+2932,INCP
+2933,4-TIER OPM GW
+2934,4-TIER OPM CLI
+2935,QTP
+2936,OTPatch
+2937,PNACONSULT-LM
+2938,SM-PAS-1
+2939,SM-PAS-2
+2940,SM-PAS-3
+2941,SM-PAS-4
+2942,SM-PAS-5
+2943,TTNRepository
+2944,Megaco H-248
+2945,H248 Binary
+2946,FJSVmpor
+2947,GPSD
+2948,WAP PUSH
+2949,WAP PUSH SECURE
+2950,ESIP
+2951,OTTP
+2952,MPFWSAS
+2953,OVALARMSRV
+2954,OVALARMSRV-CMD
+2955,CSNOTIFY
+2956,OVRIMOSDBMAN
+2957,JAMCT5
+2958,JAMCT6
+2959,RMOPAGT
+2960,DFOXSERVER
+2961,BOLDSOFT-LM
+2962,IPH-POLICY-CLI
+2963,IPH-POLICY-ADM
+2964,BULLANT SRAP
+2965,BULLANT RAP
+2966,IDP-INFOTRIEVE
+2967,SSC-AGENT
+2968,ENPP
+2969,UPnP / ESSP
+2970,INDEX-NET
+2971,Net Clip
+2972,PMSM Webrctl
+2973,SV Networks
+2974,Signal
+2975,Fujitsu Configuration Management Service
+2976,CNS Server Port
+2977,TTCs Enterprise Test Access Protocol - NS
+2978,TTCs Enterprise Test Access Protocol - DS
+2979,H.263 Video Streaming
+2980,Instant Messaging Service
+2981,MYLXAMPORT
+2982,IWB-WHITEBOARD
+2983,NETPLAN
+2984,HPIDSADMIN
+2985,HPIDSAGENT
+2986,STONEFALLS
+2987,IDENTIFY
+2988,CLASSIFY
+2989,ZARKOV
+2990,BOSCAP
+2991,WKSTN-MON
+2992,ITB301
+2993,VERITAS VIS1
+2994,VERITAS VIS2
+2995,IDRS
+2996,vsixml
+2997,REBOL
+2998,Real Secure
+2999,RemoteWare Unassigned
+3000,RemoteWare Client
+3001,Phatbot Worm / Redwood Broker
+3002,RemoteWare Server
+3003,CGMS
+3004,Csoft Agent
+3005,Genius License Manager
+3006,Instant Internet Admin
+3007,Lotus Mail Tracking Agent Protocol
+3008,Midnight Technologies
+3009,PXC-NTFY
+3010,Telerate Workstation
+3011,Trusted Web
+3012,Trusted Web Client
+3013,Gilat Sky Surfer
+3014,Broker Service
+3015,NATI DSTP
+3016,Notify Server
+3017,Event Listener
+3018,Service Registry
+3019,Resource Manager
+3020,CIFS
+3021,AGRI Server
+3022,CSREGAGENT
+3023,magicnotes
+3024,NDS_SSO
+3025,Arepa Raft
+3026,AGRI Gateway
+3027,LiebDevMgmt_C
+3028,LiebDevMgmt_DM
+3029,LiebDevMgmt_A
+3030,Arepa Cas
+3031,AgentVU
+3032,Redwood Chat
+3033,PDB
+3034,Osmosis AEEA
+3035,FJSV gssagt
+3036,Hagel DUMP
+3037,HP SAN Mgmt
+3038,Santak UPS
+3039,Cogitate Inc.
+3040,Tomato Springs
+3041,di-traceware
+3042,journee
+3043,BRP
+3045,ResponseNet
+3046,di-ase
+3047,Fast Security HL Server
+3048,Sierra Net PC Trader
+3049,NSWS
+3050,gds_db
+3051,Galaxy Server
+3052,APCPCNS
+3053,dsom-server
+3054,AMT CNF PROT
+3055,Policy Server
+3056,CDL Server
+3057,GoAhead FldUp
+3058,videobeans
+3059,qsoft
+3060,interserver
+3061,cautcpd
+3062,ncacn-ip-tcp
+3063,ncadg-ip-udp
+3065,slinterbase
+3066,NETATTACHSDMP
+3067,W32.Korgo Worm / FJHPJP
+3068,ls3 Broadcast
+3069,ls3
+3070,MGXSWITCH
+3075,Orbix 2000 Locator
+3076,Orbix 2000 Config
+3077,Orbix 2000 Locator SSL
+3078,Orbix 2000 Locator SSL
+3079,LV Front Panel
+3080,stm_pproc
+3081,TL1-LV
+3082,TL1-RAW
+3083,TL1-TELNET
+3084,ITM-MCCS
+3085,PCIHReq
+3086,JDL-DBKitchen
+3105,Cardbox
+3106,Cardbox HTTP
+3127,W32.Mydoom.A virus
+3128,Squid HTTP Proxy / W32.Mydoom.B virus
+3129,Master's Paradise (Windows Trojan)
+3130,ICPv2
+3131,Net Book Mark
+3141,VMODEM
+3142,RDC WH EOS
+3143,Sea View
+3144,Tarantella
+3145,CSI-LFAP
+3147,RFIO
+3148,NetMike Game Administrator
+3149,NetMike Game Server
+3150,NetMike Assessor Administrator
+3151,NetMike Assessor
+3180,Millicent Broker Server
+3181,BMC Patrol Agent
+3182,BMC Patrol Rendezvous
+3262,NECP
+3264,cc:mail/lotus
+3265,Altav Tunnel
+3266,NS CFG Server
+3267,IBM Dial Out
+3268,Microsoft Global Catalog
+3269,Microsoft Global Catalog with LDAP/SSL
+3270,Verismart
+3271,CSoft Prev Port
+3272,Fujitsu User Manager
+3273,Simple Extensible Multiplexed Protocol
+3274,Ordinox Server
+3275,SAMD
+3276,Maxim ASICs
+3277,AWG Proxy
+3278,LKCM Server
+3279,admind
+3280,VS Server
+3281,SYSOPT
+3282,Datusorb
+3283,Net Assistant
+3284,4Talk
+3285,Plato
+3286,E-Net
+3287,DIRECTVDATA
+3288,COPS
+3289,ENPC
+3290,CAPS LOGISTICS TOOLKIT - LM
+3291,S A Holditch & Associates - LM
+3292,Cart O Rama
+3293,fg-fps
+3294,fg-gip
+3295,Dynamic IP Lookup
+3296,Rib License Manager
+3297,Cytel License Manager
+3298,Transview
+3299,pdrncs
+3300,bmc-patrol-agent
+3301,Unathorised use by SAP R/3
+3302,MCS Fastmail
+3303,OP Session Client
+3304,OP Session Server
+3305,ODETTE-FTP
+3306,MySQL
+3307,OP Session Proxy
+3308,TNS Server
+3309,TNS ADV
+3310,Dyna Access
+3311,MCNS Tel Ret
+3312,Application Management Server
+3313,Unify Object Broker
+3314,Unify Object Host
+3315,CDID
+3316,AICC/CMI
+3317,VSAI PORT
+3318,Swith to Swith Routing Information Protocol
+3319,SDT License Manager
+3320,Office Link 2000
+3321,VNSSTR
+3325,isi.edu
+3326,SFTU
+3327,BBARS
+3328,Eaglepoint License Manager
+3329,HP Device Disc
+3330,MCS Calypso ICF
+3331,MCS Messaging
+3332,MCS Mail Server
+3333,DEC Notes
+3334,Direct TV Webcasting
+3335,Direct TV Software Updates
+3336,Direct TV Tickers
+3337,Direct TV Data Catalog
+3338,OMF data b
+3339,OMF data l
+3340,OMF data m
+3341,OMF data h
+3342,WebTIE
+3343,MS Cluster Net
+3344,BNT Manager
+3345,Influence
+3346,Trnsprnt Proxy
+3347,Phoenix RPC
+3348,Pangolin Laser
+3349,Chevin Services
+3350,FINDVIATV
+3351,BTRIEVE
+3352,SSQL
+3353,FATPIPE
+3354,SUITJD
+3355,Hogle (proxy backdoor) / Ordinox Dbase
+3356,UPNOTIFYPS
+3357,Adtech Test IP
+3358,Mp Sys Rmsvr
+3359,WG NetForce
+3360,KV Server
+3361,KV Agent
+3362,DJ ILM
+3363,NATI Vi Server
+3364,Creative Server
+3365,Content Server
+3366,Creative Partner
+3371,ccm.jf.intel.com
+3372,Microsoft Distributed Transaction Coordinator (MSDTC) / TIP 2
+3373,Lavenir License Manager
+3374,Cluster Disc
+3375,VSNM Agent
+3376,CD Broker
+3377,Cogsys Network License Manager
+3378,WSICOPY
+3379,SOCORFS
+3380,SNS Channels
+3381,Geneous
+3382,Fujitsu Network Enhanced Antitheft function
+3383,Enterprise Software Products License Manager
+3384,Cluster Management Services
+3385,qnxnetman
+3386,GPRS Data
+3387,Back Room Net
+3388,CB Server
+3389,MS Terminal Server
+3390,Distributed Service Coordinator
+3391,SAVANT
+3392,EFI License Management
+3393,D2K Tapestry Client to Server
+3394,D2K Tapestry Server to Server
+3395,Dyna License Manager (Elam)
+3396,Printer Agent
+3397,Cloanto License Manager
+3398,Mercantile
+3399,CSMS
+3400,CSMS2
+3401,filecast
+3410,Backdoor.OptixPro.13
+3421,Bull Apprise portmapper
+3454,Apple Remote Access Protocol
+3455,RSVP Port
+3456,VAT default data
+3457,VAT default control
+3458,D3WinOsfi
+3459,TIP Integral
+3460,EDM Manger
+3461,EDM Stager
+3462,EDM STD Notify
+3463,EDM ADM Notify
+3464,EDM MGR Sync
+3465,EDM MGR Cntrl
+3466,WORKFLOW
+3467,RCST
+3468,TTCM Remote Controll
+3469,Pluribus
+3470,jt400
+3471,jt400-ssl
+3535,MS-LA
+3563,Watcom Debug
+3572,harlequin.co.uk
+3672,harlequinorb
+3689,Apple Digital Audio Access Protocol
+3802,VHD
+3845,V-ONE Single Port Proxy
+3862,GIGA-POCKET
+3875,PNBSCADA
+3900,Unidata UDT OS
+3984,MAPPER network node manager
+3985,MAPPER TCP/IP server
+3986,MAPPER workstation server
+3987,Centerline
+4000,Terabase
+4001,Cisco mgmt / NewOak
+4002,pxc-spvr-ft
+4003,pxc-splr-ft
+4004,pxc-roid
+4005,pxc-pin
+4006,pxc-spvr
+4007,pxc-splr
+4008,NetCheque accounting
+4009,Chimera HWM
+4010,Samsung Unidex
+4011,Alternate Service Boot
+4012,PDA Gate
+4013,ACL Manager
+4014,TAICLOCK
+4015,Talarian Mcast
+4016,Talarian Mcast
+4017,Talarian Mcast
+4018,Talarian Mcast
+4019,Talarian Mcast
+4045,nfs-lockd
+4096,BRE (Bridge Relay Element)
+4097,Patrol View
+4098,drmsfsd
+4099,DPCP
+4132,NUTS Daemon
+4133,NUTS Bootp Server
+4134,NIFTY-Serve HMI protocol
+4141,Workflow Server
+4142,Document Server
+4143,Document Replication
+4144,Compuserve pc windows
+4160,Jini Discovery
+4199,EIMS ADMIN
+4299,earth.path.net
+4300,Corel CCam
+4321,Remote Who Is
+4333,mini-sql server
+4343,UNICALL
+4344,VinaInstall
+4345,Macro 4 Network AS
+4346,ELAN LM
+4347,LAN Surveyor
+4348,ITOSE
+4349,File System Port Map
+4350,Net Device
+4351,PLCY Net Services
+4353,F5 iQuery
+4397,Phatbot Worm
+4442,Saris
+4443,Pharos
+4444,AdSubtract / NV Video default
+4445,UPNOTIFYP
+4446,N1-FWP
+4447,N1-RMGMT
+4448,ASC Licence Manager
+4449,PrivateWire
+4450,Camp
+4451,CTI System Msg
+4452,CTI Program Load
+4453,NSS Alert Manager
+4454,NSS Agent Manager
+4455,PR Chat User
+4456,PR Chat Server
+4457,PR Register
+4500,sae-urn
+4501,urn-x-cdchoice
+4545,WorldScores
+4546,SF License Manager (Sentinel)
+4547,Lanner License Manager
+4557,FAX transmission service
+4559,HylaFAX client-service protocol
+4567,TRAM
+4568,BMC Reporting
+4600,Piranha1
+4601,Piranha2
+4661,eDonkey2k
+4662,eDonkey2k
+4663,eDonkey
+4665,eDonkey2k
+4672,remote file access server
+4675,eMule
+4711,eMule
+4751,W32.Beagle.V trojan
+4772,eMule
+4800,Icona Instant Messenging System
+4801,Icona Web Embedded Chat
+4802,Icona License System Server
+4820,Backdoor.Tuxter
+4827,HTCP
+4837,Varadero-0
+4838,Varadero-1
+4868,Photon Relay
+4869,Photon Relay Debug
+4885,ABBS
+4899,RAdmin Win32 remote control
+4983,AT&T Intercom
+5000,UPnP / filmaker.com / Socket de Troie (Windows Trojan)
+5001,filmaker.com / Socket de Troie (Windows Trojan)
+5002,radio free ethernet
+5003,FileMaker Inc. - Proprietary transport
+5004,avt-profile-1
+5005,avt-profile-2
+5006,wsm server
+5007,wsm server ssl
+5010,TelepathStart
+5011,TelepathAttack
+5020,zenginkyo-1
+5021,zenginkyo-2
+5042,asnaacceler8db
+5050,Yahoo Messenger / multimedia conference control tool
+5051,ITA Agent
+5052,ITA Manager
+5055,UNOT
+5060,SIP
+5069,I/Net 2000-NPR
+5071,PowerSchool
+5093,Sentinel LM
+5099,SentLM Srv2Srv
+5101,Yahoo! Messenger
+5145,RMONITOR SECURE
+5150,Ascend Tunnel Management Protocol
+5151,ESRI SDE Instance
+5152,ESRI SDE Instance Discovery
+5165,ife_1corp
+5190,America-Online
+5191,AmericaOnline1
+5192,AmericaOnline2
+5193,AmericaOnline3
+5200,Targus AIB 1
+5201,Targus AIB 2
+5202,Targus TNTS 1
+5203,Targus TNTS 2
+5222,Jabber Server
+5232,SGI Distribution Graphics
+5236,padl2sim
+5272,PK
+5300,HA cluster heartbeat
+5301,HA cluster general services
+5302,HA cluster configuration
+5303,HA cluster probing
+5304,HA Cluster Commands
+5305,HA Cluster Test
+5306,Sun MC Group
+5307,SCO AIP
+5308,CFengine
+5309,J Printer
+5310,Outlaws
+5311,TM Login
+5373,W32.Gluber.B@mm
+5400,Excerpt Search / Blade Runner (Windows Trojan)
+5401,Excerpt Search Secure / Blade Runner (Windows Trojan)
+5402,MFTP / Blade Runner (Windows Trojan)
+5403,HPOMS-CI-LSTN
+5404,HPOMS-DPS-LSTN
+5405,NetSupport
+5406,Systemics Sox
+5407,Foresyte-Clear
+5408,Foresyte-Sec
+5409,Salient Data Server
+5410,Salient User Manager
+5411,ActNet
+5412,Continuus
+5413,WWIOTALK
+5414,StatusD
+5415,NS Server
+5416,SNS Gateway
+5417,SNS Agent
+5418,MCNTP
+5419,DJ-ICE
+5420,Cylink-C
+5421,Net Support 2
+5422,Salient MUX
+5423,VIRTUALUSER
+5426,DEVBASIC
+5427,SCO-PEER-TTA
+5428,TELACONSOLE
+5429,Billing and Accounting System Exchange
+5430,RADEC CORP
+5431,PARK AGENT
+5432,postgres database server
+5435,Data Tunneling Transceiver Linking (DTTL)
+5454,apc-tcp-udp-4
+5455,apc-tcp-udp-5
+5456,apc-tcp-udp-6
+5461,SILKMETER
+5462,TTL Publisher
+5465,NETOPS-BROKER
+5490,Squid HTTP Proxy
+5500,fcp-addr-srvr1
+5501,fcp-addr-srvr2
+5502,fcp-srvr-inst1
+5503,fcp-srvr-inst2
+5504,fcp-cics-gw1
+5510,ACE/Server Services
+5520,ACE/Server Services
+5530,ACE/Server Services
+5540,ACE/Server Services
+5550,ACE/Server Services / Xtcp 2.0x
+5554,Sasser Worm FTP backdoor / SGI ESP HTTP
+5555,Personal Agent / W32.Mimail.P@mm
+5556,Mtbd (mtb backup)
+5559,Enterprise Security Remote Install axent.com
+5599,Enterprise Security Remote Install
+5600,Enterprise Security Manager
+5601,Enterprise Security Agent
+5602,A1-MSC
+5603,A1-BS
+5604,A3-SDUNode
+5605,A4-SDUNode
+5631,pcANYWHEREdata
+5632,pcANYWHEREstat
+5678,LinkSys EtherFast Router Remote Administration / Remote Replication Agent Connection
+5679,Direct Cable Connect Manager
+5680,Canna (Japanese Input)
+5713,proshare conf audio
+5714,proshare conf video
+5715,proshare conf data
+5716,proshare conf request
+5717,proshare conf notify
+5729,Openmail User Agent Layer
+5741,IDA Discover Port 1
+5742,IDA Discover Port 2 / Wincrash (Windows Trojan)
+5745,fcopy-server
+5746,fcopys-server
+5755,OpenMail Desk Gateway server
+5757,OpenMail X.500 Directory Server
+5766,OpenMail NewMail Server
+5767,OpenMail Suer Agent Layer (Secure)
+5768,OpenMail CMTS Server
+5771,NetAgent
+5800,VNC Virtual Network Computing
+5801,VNC Virtual Network Computing
+5813,ICMPD
+5859,WHEREHOO
+5882,Y3k
+5900,VNC Virtual Network Computing
+5901,VNC Virtual Network Computing
+5968,mppolicy-v5
+5969,mppolicy-mgr
+5977,NCD preferences TCP port
+5978,NCD diagnostic TCP port
+5979,NCD configuration TCP port
+5980,VNC Virtual Network Computing
+5981,VNC Virtual Network Computing
+5987,Solaris Web Enterprise Management RMI
+5997,NCD preferences telnet port
+5998,NCD diagnostic telnet port
+5999,CVSup
+6000,X-Windows / W32.LoveGate.ak virus
+6001,Cisco mgmt
+6003,Half-Life WON server
+6063,X Windows System mit.edu
+6064,NDL-AHP-SVC
+6065,WinPharaoh
+6066,EWCTSP
+6067,SRB
+6068,GSMP
+6069,TRIP
+6070,Messageasap
+6071,SSDTP
+6072,DIAGNOSE-PROC
+6073,DirectPlay8
+6100,SynchroNet-db
+6101,SynchroNet-rtc
+6102,SynchroNet-upd
+6103,RETS
+6104,DBDB
+6105,Prima Server
+6106,MPS Server
+6107,ETC Control
+6108,Sercomm-SCAdmin
+6109,GLOBECAST-ID
+6110,HP SoftBench CM
+6111,HP SoftBench Sub-Process Control
+6112,dtspcd / Blizzard Battlenet
+6123,Backup Express
+6129,DameWare
+6141,Meta Corporation License Manager
+6142,Aspen Technology License Manager
+6143,Watershed License Manager
+6144,StatSci License Manager - 1
+6145,StatSci License Manager - 2
+6146,Lone Wolf Systems License Manager
+6147,Montage License Manager
+6148,Ricardo North America License Manager
+6149,tal-pod
+6253,CRIP
+6321,Empress Software Connectivity Server 1
+6322,Empress Software Connectivity Server 2
+6346,Gnutella/Bearshare file sharing Application
+6348,Limewire P2P
+6389,clariion-evr01
+6400,saegatesoftware.com
+6401,saegatesoftware.com
+6402,saegatesoftware.com
+6403,saegatesoftware.com
+6404,saegatesoftware.com
+6405,saegatesoftware.com
+6406,saegatesoftware.com
+6407,saegatesoftware.com
+6408,saegatesoftware.com
+6409,saegatesoftware.com
+6410,saegatesoftware.com
+6455,SKIP Certificate Receive
+6456,SKIP Certificate Send
+6471,LVision License Manager
+6500,BoKS Master
+6501,BoKS Servc
+6502,BoKS Servm
+6503,BoKS Clntd
+6505,BoKS Admin Private Port
+6506,BoKS Admin Public Port
+6507,BoKS Dir Server Private Port
+6508,BoKS Dir Server Public Port
+6547,apc-tcp-udp-1
+6548,apc-tcp-udp-2
+6549,apc-tcp-udp-3
+6550,fg-sysupdate
+6558,xdsxdm
+6588,AnalogX Web Proxy
+6665,Internet Relay Chat
+6666,IRC / Windows Media Unicast Service
+6667,IRC
+6668,IRC
+6669,IRC
+6670,Vocaltec Global Online Directory / Deep Throat 2 (Windows Trojan)
+6672,vision_server
+6673,vision_elmd
+6699,Napster
+6700,Napster / Carracho (server)
+6701,KTI/ICAD Nameserver
+6701,Napster / Carracho (server)
+6711,SubSeven (Windows Trojan)
+6723,DDOS communication TCP
+6767,BMC PERFORM AGENT
+6768,BMC PERFORM MGRD
+6776,SubSeven/BackDoor-G (Windows Trojan)
+6777,W32.Beagle.A trojan
+6789,IBM DB2
+6790,HNMP / IBM DB2
+6831,ambit-lm
+6841,Netmo Default
+6842,Netmo HTTP
+6850,ICCRUSHMORE
+6881,BitTorrent Network
+6888,MUSE
+6891,MS Messenger file transfer
+6901,MS Messenger voice calls
+6961,JMACT3
+6962,jmevt2
+6963,swismgr1
+6964,swismgr2
+6965,swistrap
+6966,swispol
+6969,acmsoda
+6998,IATP-highPri
+6999,IATP-normalPri
+7000,IRC / file server itself
+7001,WebLogic Server / Callbacks to cache managers
+7002,WebLogic Server (SSL) / Half-Life Auth Server / Users & groups database
+7003,volume location database
+7004,AFS/Kerberos authentication service
+7005,volume managment server
+7006,error interpretation service
+7007,Windows Media Services / basic overseer process
+7008,server-to-server updater
+7009,remote cache manager service
+7010,onlinet uninterruptable power supplies
+7011,Talon Discovery Port
+7012,Talon Engine
+7013,Microtalon Discovery
+7014,Microtalon Communications
+7015,Talon Webserver
+7020,DP Serve
+7021,DP Serve Admin
+7070,ARCP
+7099,lazy-ptop
+7100,X Font Service
+7121,Virtual Prototypes License Manager
+7141,vnet.ibm.com
+7161,Catalyst
+7174,Clutild
+7200,FODMS FLIP
+7201,DLIP
+7323,3.11 Remote Administration
+7326,Internet Citizen's Band
+7390,The Swiss Exchange swx.ch
+7395,winqedit
+7426,OpenView DM Postmaster Manager
+7427,OpenView DM Event Agent Manager
+7428,OpenView DM Log Agent Manager
+7429,OpenView DM rqt communication
+7430,OpenView DM xmpv7 api pipe
+7431,OpenView DM ovc/xmpv3 api pipe
+7437,Faximum
+7491,telops-lmd
+7511,pafec-lm
+7544,FlowAnalyzer DisplayServer
+7545,FlowAnalyzer UtilityServer
+7566,VSI Omega
+7570,Aries Kfinder
+7588,Sun License Manager
+7597,TROJAN WORM
+7633,PMDF Management
+7640,CUSeeMe
+7777,Oracle App server / cbt
+7778,Windows Media Services / Interwise
+7781,accu-lmgr
+7786,MINIVEND
+7932,Tier 2 Data Resource Manager
+7933,Tier 2 Business Rules Manager
+7967,Supercell
+7979,Micromuse-ncps
+7980,Quest Vista
+7999,iRDMI2
+8000,HTTP/iRDMI
+8001,HTTP/VCOM Tunnel
+8002,HTTP/Teradata ORDBMS
+8007,Apache JServ Protocol
+8008,HTTP Alternate
+8009,Apache JServ Protocol
+8010,Wingate HTTP Proxy
+8032,ProEd
+8033,MindPrint
+8080,HTTP / HTTP Proxy
+8081,HTTP / HTTP Proxy
+8082,BlackICE Capture
+8129,Snapstream PVS Server
+8130,INDIGO-VRMI
+8131,INDIGO-VBCP
+8160,Patrol
+8161,Patrol SNMP
+8181,IPSwitch IMail / Monitor
+8200,TRIVNET
+8201,TRIVNET
+8204,LM Perfworks
+8205,LM Instmgr
+8206,LM Dta
+8207,LM SServer
+8208,LM Webwatcher
+8351,Server Find
+8376,Cruise ENUM
+8377,Cruise SWROUTE
+8378,Cruise CONFIG
+8379,Cruise DIAGS
+8380,Cruise UPDATE
+8383,Web Email
+8400,cvd
+8401,sabarsd
+8402,abarsd
+8403,admind
+8431,Micro PC-Cilin
+8450,npmp
+8473,Virtual Point to Point
+8484,Ipswitch IMail
+8554,RTSP Alternate (see port 554)
+8733,iBus
+8763,MC-APPSERVER
+8764,OPENQUEUE
+8765,Ultraseek HTTP
+8804,truecm
+8866,W32.Beagle.B trojan
+8880,CDDBP
+8888,NewsEDGE server TCP / AnswerBook2
+8889,Desktop Data TCP 1
+8890,Desktop Data TCP 2
+8891,Desktop Data TCP 3: NESS application
+8892,Desktop Data TCP 4: FARM product
+8893,Desktop Data TCP 5: NewsEDGE/Web application
+8894,Desktop Data TCP 6: COAL application
+8900,JMB-CDS 1
+8901,JMB-CDS 2
+8967,Win32/Dabber (Windows worm)
+8999,Firewall
+9000,CSlistener
+9001,cisco-xremote
+9090,WebSM
+9100,HP JetDirect
+9160,NetLOCK1
+9161,NetLOCK2
+9162,NetLOCK3
+9163,NetLOCK4
+9164,NetLOCK5
+9200,WAP connectionless session service
+9201,WAP session service
+9202,WAP secure connectionless session service
+9203,WAP secure session service
+9204,WAP vCard
+9205,WAP vCal
+9206,WAP vCard Secure
+9207,WAP vCal Secure
+9273,BackGate (Windows rootkit)
+9274,BackGate (Windows rootkit)
+9275,BackGate (Windows rootkit)
+9276,BackGate (Windows rootkit)
+9277,BackGate (Windows rootkit)
+9278,BackGate (Windows rootkit)
+9280,HP JetDirect Embedded Web Server
+9290,HP JetDirect
+9291,HP JetDirect
+9292,HP JetDirect
+9321,guibase
+9343,MpIdcMgr
+9344,Mphlpdmc
+9374,fjdmimgr
+9396,fjinvmgr
+9397,MpIdcAgt
+9400,InCommand
+9500,ismserver
+9535,Remote man server
+9537,Remote man server, testing
+9594,Message System
+9595,Ping Discovery Service
+9600,MICROMUSE-NCPW
+9753,rasadv
+9876,Session Director
+9888,CYBORG Systems
+9898,MonkeyCom / Win32/Dabber (Windows worm)
+9899,SCTP TUNNELING
+9900,IUA
+9909,domaintime
+9950,APCPCPLUSWIN1
+9951,APCPCPLUSWIN2
+9952,APCPCPLUSWIN3
+9992,Palace
+9993,Palace
+9994,Palace
+9995,Palace
+9996,Sasser Worm shell / Palace
+9997,Palace
+9998,Distinct32
+9999,distinct / Win32/Dabber (Windows worm)
+10000,Webmin / Network Data Management Protocol/ Dumaru.Y (Windows trojan)
+10001,queue
+10002,poker
+10003,gateway
+10004,remp
+10005,Secure telnet
+10007,MVS Capacity
+10012,qmaster
+10080,Amanda / MyDoom.B (Windows trojan)
+10082,Amanda Indexing
+10083,Amanda Tape Indexing
+10113,NetIQ Endpoint
+10114,NetIQ Qcheck
+10115,Ganymede Endpoint
+10128,BMC-PERFORM-SERVICE DAEMON
+10202,Computer Associate License Manager
+10203,Computer Associate License Manager
+10204,Computer Associate License Manager
+10288,Blocks
+10520,Acid Shivers (Windows Trojan)
+11000,IRISA
+11001,Metasys
+11111,Viral Computing Environment (VCE)
+11117,W32.Beagle.L trojan / URBISNET
+11367,ATM UHAS
+11523,AOL / AdSubtract AOL Proxy
+11720,h323 Call Signal Alternate
+11722,RK Test
+12000,IBM Enterprise Extender SNA XID Exchange
+12001,IBM Enterprise Extender SNA COS Network Priority
+12002,IBM Enterprise Extender SNA COS High Priority
+12003,IBM Enterprise Extender SNA COS Medium Priority
+12004,IBM Enterprise Extender SNA COS Low Priority
+12172,HiveP
+12345,Netbus (Windows Trojan)
+12346,NetBus (Windows Trojan)
+12348,BioNet (Windows Trojan)
+12349,BioNet (Windows Trojan)
+12361,Whack-a-mole (Windows Trojan)
+12362,Whack-a-mole (Windows Trojan)
+12753,tsaf port
+12754,DDOS communication TCP
+13160,I-ZIPQD
+13223,PowWow Client
+13224,PowWow Server
+13326,game
+13720,BPRD Protocol (VERITAS NetBackup)
+13721,BPBRM Protocol (VERITAS NetBackup)
+13722,BP Java MSVC Protocol
+13782,VERITAS NetBackup
+13783,VOPIED Protnocol
+13818,DSMCC Config
+13819,DSMCC Session Messages
+13820,DSMCC Pass-Thru Messages
+13821,DSMCC Download Protocol
+13822,DSMCC Channel Change Protocol
+14001,ITU SCCP (SS7)
+14237,Palm Network Hotsync
+14247,Mitglieder.H trojan
+15104,DDOS communication TCP
+16360,netserialext1
+16361,netserialext2
+16367,netserialext3
+16368,netserialext4
+16660,Stacheldraht distributed attack tool client
+16959,Subseven DEFCON8 2.1 backdoor remote access tool
+16991,INTEL-RCI-MP
+17007,isode-dua
+17219,Chipper
+17300,Kuang2 (Windows trojan)
+17569,Infector
+17990,Worldspan gateway
+18000,Beckman Instruments Inc.
+18181,OPSEC CVP
+18182,OPSEC UFP
+18183,OPSEC SAM
+18184,OPSEC LEA
+18185,OPSEC OMI
+18187,OPSEC ELA
+18463,AC Cluster
+18753,Shaft distributed attack tool handler agent
+18888,APCNECMP
+19216,BackGate (Windows rootkit)
+19283,Key Server for SASSAFRAS
+19315,Key Shadow for SASSAFRAS
+19410,hp-sco
+19411,hp-sca
+19412,HP-SESSMON
+19541,JCP Client
+20000,DNP
+20005,xcept4 (German Telekom's CEPT videotext service)
+20031,BakBone NetVault
+20034,NetBus 2 Pro (Windows Trojan)
+20432,Shaft distributed attack client
+20670,Track
+20742,Mitglieder.E trojan
+20999,At Hand MMP
+21554,Girlfriend (Windows Trojan)
+21590,VoFR Gateway
+21845,webphone
+21846,NetSpeak Corp. Directory Services
+21847,NetSpeak Corp. Connection Services
+21848,NetSpeak Corp. Automatic Call Distribution
+21849,NetSpeak Corp. Credit Processing System
+22000,SNAPenetIO
+22001,OptoControl
+22156,Phatbot Worm
+22273,wnn6
+22289,Wnn6 (Chinese Input)
+22305,Wnn6 (Korean Input)
+22321,Wnn6 (Taiwanese Input)
+22555,Vocaltec Web Conference
+22800,Telerate Information Platform LAN
+22951,Telerate Information Platform WAN
+23005,W32.HLLW.Nettrash
+23006,W32.HLLW.Nettrash
+23432,Asylum
+23476,Donald Dick
+23477,Donald Dick
+23485,Shareasa file sharing
+24000,med-ltp
+24001,med-fsp-rx
+24002,med-fsp-tx
+24003,med-supp
+24004,med-ovw
+24005,med-ci
+24006,med-net-svc
+24386,Intel RCI
+24554,BINKP
+25000,icl-twobase1
+25001,icl-twobase2
+25002,icl-twobase3
+25003,icl-twobase4
+25004,icl-twobase5
+25005,icl-twobase6
+25006,icl-twobase7
+25007,icl-twobase8
+25008,icl-twobase9
+25009,icl-twobase10
+25555,Mitglieder.D trojan
+25793,Vocaltec Address Server
+25867,WebCam32 Admin
+26000,quake
+26208,wnn6-ds
+26274,Delta Source (Windows Trojan)
+27347,SubSeven / Linux.Ramen.Worm (RedHat Linux)
+27374,SubSeven / Linux.Ramen.Worm (RedHat Linux)
+27665,Trinoo distributed attack tool Master server control port
+27999,TW Authentication/Key Distribution and
+30100,Netsphere (Windows Trojan)
+30101,Netsphere (Windows Trojan)
+30102,Netsphere (Windows Trojan)
+30999,Kuang
+31337,BO2K
+31785,Hack-A-Tack (Windows Trojan)
+31787,Hack-A-Tack (Windows Trojan)
+31788,Hack-A-Tack (Windows Trojan)
+31789,Hack-A-Tack (Windows Trojan)
+31791,Hack-A-Tack (Windows Trojan)
+32000,XtraMail v1.11
+32768,Filenet TMS
+32769,Filenet RPC
+32770,Filenet NCH
+32771,Solaris RPC
+32772,Solaris RPC
+32773,Solaris RPC
+32774,Solaris RPC
+32775,Solaris RPC
+32776,Solaris RPC
+32777,Solaris RPC
+32780,RPC
+33434,traceroute use
+34324,Big Gluck (Windows Trojan)
+36865,KastenX Pipe
+40421,Master's Paradise (Windows Trojan)
+40422,Master's Paradise (Windows Trojan)
+40423,Master's Paradise (Windows Trojan)
+40426,Master's Paradise (Windows Trojan)
+40841,CSCP
+42424,ASP.NET Session State
+43118,Reachout
+43188,Reachout
+44333,Kerio WinRoute Firewall Administration
+44334,Kerio Personal Firewall Administration
+44337,Kerio MailServer Administration
+44444,Prosiak
+44818,Rockwell Encapsulation
+45092,BackGate (Windows rootkit)
+45678,EBA PRISE
+45966,SSRServerMgr
+47262,Delta Source (Windows Trojan)
+47557,Databeam Corporation
+47624,Direct Play Server
+47806,ALC Protocol
+47808,Building Automation and Control Networks
+48000,Nimbus Controller
+48001,Nimbus Spooler
+48002,Nimbus Hub
+48003,Nimbus Gateway
+49400,Compaq Insight Manager
+49401,Compaq Insight Manager
+50300,O&O Defrag
+51515,Microsoft Operations Manager MOM-Clear
+52673,Stickies
+54283,SubSeven
+54320,Orifice 2000 (TCP)
+54321,Orifice 2000 (TCP)
+60000,DeepThroat
+65000,distributed attack tool / Devil (Windows Trojan)
+65301,pcAnywhere-def
+65506,PhatBot, Agobot, Gaobot (Windows trojans)
diff --git a/panda/plugins/tcp_passthrough/tcp_passthrough.h b/panda/plugins/tcp_passthrough/tcp_passthrough.h
new file mode 100644
index 00000000000..3af6dc322cc
--- /dev/null
+++ b/panda/plugins/tcp_passthrough/tcp_passthrough.h
@@ -0,0 +1,36 @@
+// BEGIN_PYPANDA_NEEDS_THIS -- do not delete this comment bc pypanda
+// api autogen needs it.  And don't put any compiler directives
+// between this and END_PYPANDA_NEEDS_THIS except includes of other
+// files in this directory that contain subsections like this one.
+
+/**
+ * Information about a given socket binding
+ */
+typedef struct SocketInfo {
+  uint8_t ip[4];
+  uint64_t pid;
+  uint16_t port;
+  bool server;
+} SocketInfo;
+
+/**
+ * Request that a table of sockets be printed once guest execution resumes
+ */
+void print_socket_info(void);
+
+/**
+ * Provide a callback for receiving a socket list that will get called once the guest
+ * resumes execution
+ */
+void on_get_socket_list(void (*callback)(const struct SocketInfo*, uintptr_t));
+
+/**
+ * Forward a socket from the guest, returning true if no issue is hit. Returns `false` if
+ * the IP address fails to parse. A null IP address is treated as 0.0.0.0
+ *
+ * Guest must resume execution for an unspecified amount of time before TCP traffic
+ * will actually be processed.
+ */
+bool forward_socket(const char *ip, uint16_t guest_port, uint16_t host_port);
+
+// END_PYPANDA_NEEDS_THIS -- do not delete this comment!
diff --git a/panda/plugins/tcp_passthrough/tcp_shared_types/Cargo.lock b/panda/plugins/tcp_passthrough/tcp_shared_types/Cargo.lock
new file mode 100644
index 00000000000..80f047aed59
--- /dev/null
+++ b/panda/plugins/tcp_passthrough/tcp_shared_types/Cargo.lock
@@ -0,0 +1,65 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 3
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.37"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec757218438d5fda206afc041538b2f6d889286160d649a86a24d37e1235afd1"
+dependencies = [
+ "unicode-xid",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a1feb54ed693b93a84e14094943b84b7c4eae204c512b7ccb95ab0c66d278ad1"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "serde"
+version = "1.0.137"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "61ea8d54c77f8315140a05f4c7237403bf38b72704d031543aa1d16abbf517d1"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.137"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1f26faba0c3959972377d3b2d306ee9f71faee9714294e41bb777f83f88578be"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "syn"
+version = "1.0.92"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7ff7c592601f11445996a06f8ad0c27f094a58857c2f89e97974ab9235b92c52"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-xid",
+]
+
+[[package]]
+name = "tcp_shared_types"
+version = "0.1.0"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "unicode-xid"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "957e51f3646910546462e67d5f7599b9e4fb8acdd304b087a6494730f9eebf04"
diff --git a/panda/plugins/tcp_passthrough/tcp_shared_types/Cargo.toml b/panda/plugins/tcp_passthrough/tcp_shared_types/Cargo.toml
new file mode 100644
index 00000000000..124d2ac4406
--- /dev/null
+++ b/panda/plugins/tcp_passthrough/tcp_shared_types/Cargo.toml
@@ -0,0 +1,7 @@
+[package]
+name = "tcp_shared_types"
+version = "0.1.0"
+edition = "2021"
+
+[dependencies]
+serde = { version = "1", features = ["derive"] }
diff --git a/panda/plugins/tcp_passthrough/tcp_shared_types/src/lib.rs b/panda/plugins/tcp_passthrough/tcp_shared_types/src/lib.rs
new file mode 100644
index 00000000000..6f5d221b79d
--- /dev/null
+++ b/panda/plugins/tcp_passthrough/tcp_shared_types/src/lib.rs
@@ -0,0 +1,29 @@
+use serde::{Deserialize, Serialize};
+use std::net::Ipv4Addr;
+
+pub type Pid = u64;
+
+#[derive(Serialize, Deserialize, Clone, Debug)]
+pub struct SocketInfo {
+    pub ip: Ipv4Addr,
+    pub port: u16,
+    pub pid: Option<Pid>,
+    pub server: bool,
+}
+
+#[derive(Serialize, Deserialize, Clone, Debug)]
+pub enum Request {
+    /// Request a Vec<SocketInfo> be sent to a given channel
+    GetSocketList { channel_id: u32 },
+
+    /// Connect to the given TCP port at the provided IP and forward the connection
+    /// over the given channel
+    ForwardConnection {
+        ip: Ipv4Addr,
+        port: u16,
+        channel_id: u32,
+    },
+
+    /// Closes a socket so the TCP server knows the connection ended
+    CloseSocket { channel_id: u32 },
+}
diff --git a/panda/plugins/tcp_passthrough/try_it.py b/panda/plugins/tcp_passthrough/try_it.py
new file mode 100644
index 00000000000..deb08c83362
--- /dev/null
+++ b/panda/plugins/tcp_passthrough/try_it.py
@@ -0,0 +1,34 @@
+from pandare import Panda
+
+panda = Panda(generic="x86_64")
+
+@panda.queue_blocking
+def run_cmd():
+    panda.revert_sync("root")
+
+    # Start up an HTTP server as a background job
+    panda.run_serial_cmd("python3 -m http.server &")
+
+    # Give the HTTP server time to start up before pulling socket info
+    panda.run_serial_cmd("sleep 2")
+
+    # Print a table of the TCP servers in the guest
+    panda.tcp.print_socket_info()
+
+    # Forward a socket from localhost:8000 in the guest to localhost:4343 on the host
+    panda.tcp.forward_socket(8000, 4343)
+
+    # print out the socket list ourselves too
+    @panda.tcp.on_get_socket_list
+    def callback(socket_info: list):
+        print(" Ip Address\tPID\tIs Server?")
+        print("====================================")
+        for socket in socket_info:
+            print(f" {socket.ip}:{socket.port}\t{socket.pid}\t{socket.is_server}")
+
+    # Injecting into a cat command, but this could be anything
+    panda.run_serial_cmd("cat", no_timeout=True)
+
+    panda.end_analysis()
+
+panda.run()
diff --git a/panda/python/core/create_panda_datatypes.py b/panda/python/core/create_panda_datatypes.py
index 1a23272b022..fc5a5e8df27 100755
--- a/panda/python/core/create_panda_datatypes.py
+++ b/panda/python/core/create_panda_datatypes.py
@@ -307,6 +307,8 @@ def expand_ppp_def(line):
     define_clean_header(ffi, include_dir + "/proc_start_linux_ppp.h")
     define_clean_header(ffi, include_dir + "/forcedexec_ppp.h")
     define_clean_header(ffi, include_dir + "/stringsearch_ppp.h")
+    define_clean_header(ffi, include_dir + "/guest_plugin_manager_ppp.h")
+    define_clean_header(ffi, include_dir + "/linjector_ppp.h")
     # END PPP headers
 
     define_clean_header(ffi, include_dir + "/breakpoints.h")
@@ -382,10 +384,13 @@ def main(install=False,recompile=True):
     # TODO: programtically copy anything that ends with _ppp.h
     copy_ppp_header("%s/%s" % (PLUGINS_DIR+"/forcedexec",   "forcedexec_ppp.h"))
     copy_ppp_header("%s/%s" % (PLUGINS_DIR+"/stringsearch", "stringsearch_ppp.h"))
+    copy_ppp_header("%s/%s" % (PLUGINS_DIR+"/guest_plugin_manager", "guest_plugin_manager_ppp.h"))
+    copy_ppp_header("%s/%s" % (PLUGINS_DIR+"/linjector", "linjector_ppp.h"))
     create_pypanda_header("%s/%s" % (PLUGINS_DIR+"/hooks2", "hooks2.h"))
-    
+
     copy_ppp_header("%s/%s" % (PLUGINS_DIR+"/proc_start_linux", "proc_start_linux_ppp.h"))
     create_pypanda_header("%s/%s" % (PLUGINS_DIR+"/proc_start_linux", "proc_start_linux.h"))
+    create_pypanda_header("%s/%s" % (PLUGINS_DIR+"/tcp_passthrough", "tcp_passthrough.h"))
     copy_ppp_header("%s/taint2/taint2.h" % PLUGINS_DIR)
 
     with open(os.path.join(OUTPUT_DIR, "panda_datatypes.py"), "w") as pdty:
diff --git a/panda/python/core/pandare/panda.py b/panda/python/core/pandare/panda.py
index 53602fc61f3..fa44ce7fb94 100755
--- a/panda/python/core/pandare/panda.py
+++ b/panda/python/core/pandare/panda.py
@@ -39,6 +39,7 @@
 from .qcows_internal import Qcows
 from .qemu_logging import QEMU_Log_Manager
 from .arch import ArmArch, Aarch64Arch, MipsArch, Mips64Arch, X86Arch, X86_64Arch
+from .tcp_passthrough import TcpPassthrough, SocketInfo
 
 # Might be worth importing and auto-initilizing a PLogReader
 # object within Panda for the current architecture?
@@ -91,6 +92,7 @@ def __init__(self, arch="i386", mem="128M",
         self.os_type = os
         self.qcow = qcow
         self.plugins = plugin_list(self)
+        self.tcp = TcpPassthrough(self)
         self.expect_prompt = expect_prompt
         self.lambda_cnt = 0
         self.__sighandler = None
@@ -649,6 +651,8 @@ def load_plugin(self, name, args={}):
         argstrs_ffi = []
         if isinstance(args, dict):
             for k,v in args.items():
+                if type(v) is bool:
+                    v = "true" if v else "false"
                 this_arg_s = "{}={}".format(k,v)
                 this_arg = self.ffi.new("char[]", bytes(this_arg_s, "utf-8"))
                 argstrs_ffi.append(this_arg)
diff --git a/panda/python/core/pandare/tcp_passthrough.py b/panda/python/core/pandare/tcp_passthrough.py
new file mode 100644
index 00000000000..1ebcdf2c986
--- /dev/null
+++ b/panda/python/core/pandare/tcp_passthrough.py
@@ -0,0 +1,88 @@
+from dataclasses import dataclass
+from ipaddress import IPv4Address
+from typing import Callable
+
+@dataclass
+class SocketInfo:
+    '''
+    Information about a socket running in the guest.
+
+    Fields:
+        * `ip`: `IPv4Address` - the IP address within the guest being bound to
+        * `pid`: `int` - the Process ID of the process which is bound to the socket
+        * `port`: `int` - the TCP port (0-65565) within the guest being used
+        * `is_server`: `bool` - Whether the socket within the guest is a listener or an outgoing connection
+    '''
+
+    ip: IPv4Address
+    pid: int
+    port: int
+    is_server: bool
+
+    def from_ffi(raw):
+        '''
+        Takes a C FFI instances of SocketInfo and converts it to a python-native type
+        '''
+
+        ip = IPv4Address(bytes([raw.ip[i] for i in range(4)]))
+        pid = raw.pid
+        port = raw.port
+        is_server = raw.server
+
+        return SocketInfo(ip, pid, port, is_server)
+
+class TcpPassthrough:
+    '''
+    Object to interact with the `tcp_passthrough` PANDA plugin. An instance can be found
+    at `panda.tcp`, where `panda` is a `Panda` object.
+    '''
+
+    def __init__(self, panda):
+        self.panda = panda
+
+    def forward_socket(self, guest_port: int, host_port: int):
+        '''
+        Forward TCP connections performed on a host port to a TCP server running in the
+        guest. This could, for example, be used to allow access to a guest HTTP server.
+
+        ```
+        # Allow connecting to the guest localhost:80 via the host localhost:8500
+        panda.tcp.forward_socket(80, 8500)
+        ```
+        '''
+        self.panda.plugins["tcp_passthrough"].forward_socket(
+            self.panda.ffi.cast("const char*", self.panda.ffi.NULL),
+            self.panda.ffi.cast("uint16_t", guest_port),
+            self.panda.ffi.cast("uint16_t", host_port)
+        )
+
+    def on_get_socket_list(self, callback: Callable[[list], None]):
+        '''
+        Request a list of sockets from the guest, running a provided callback when they
+        are available. The callback is given a `list` of `SocketInfo`s.
+
+        ```
+        @panda.tcp.on_get_socket_list
+        def with_sockets(sockets):
+            for socket in sockets:
+                print(f"Socket bound on guest port {socket.port}")
+        ```
+        '''
+        @self.panda.ffi.callback("void(*)(const struct SocketInfo*, uintptr_t)")
+        def cb(ptr, length):
+            callback([SocketInfo.from_ffi(ptr[i]) for i in range(length)])
+
+        self.socket_list = (self.__dict__.get("socket_list") or []) + [cb]
+
+        self.panda.plugins["tcp_passthrough"].on_get_socket_list(cb)
+
+    def print_socket_info(self):
+        '''
+        Request that a list of sockets in the guest is printed as a table to stdout,
+        including information about what the given port is typically reserved for.
+
+        ```
+        panda.tcp.print_socket_info()
+        ```
+        '''
+        self.panda.plugins["tcp_passthrough"].print_socket_info()
diff --git a/panda/python/core/setup.py b/panda/python/core/setup.py
index a4cecede530..8650db0d628 100644
--- a/panda/python/core/setup.py
+++ b/panda/python/core/setup.py
@@ -62,6 +62,7 @@ def copy_objs():
         softmmu = arch+"-softmmu"
         path      = os.path.join(*[build_root, softmmu, libname])
         plugindir = os.path.join(*[build_root, softmmu, "panda", "plugins"])
+        guestplugindir = os.path.join(*[build_root, softmmu, "panda", "guest_plugins"])
         llvm1     = os.path.join(*[build_root, softmmu, "llvm-helpers.bc1"])
         llvm2     = os.path.join(*[build_root, softmmu, f"llvm-helpers-{arch}.bc"])
 
@@ -82,6 +83,12 @@ def copy_objs():
 
         shutil.copytree(plugindir,  new_plugindir, ignore=shutil.ignore_patterns('*.o', '*.d'))
 
+        new_guestplugindir = os.path.join(lib_dir, softmmu, "panda/guest_plugins")
+        print("\n\n")
+        print(guestplugindir, new_guestplugindir)
+        if os.path.exists(guestplugindir):
+            shutil.copytree(guestplugindir,  new_guestplugindir, ignore=shutil.ignore_patterns('*.o', '*.d'))
+
     # Strip libpandas and plugins to save space (Need <100mb for pypi)
     if pypi_build:
         check_output(f"find {lib_dir} -type f -executable -exec strip {{}} \;", shell=True)
@@ -163,6 +170,8 @@ def run(self):
           'data/*-softmmu/llvm-helpers*.bc*', # Llvm-helpers
           'data/*-softmmu/panda/plugins/*',   # All plugins
           'data/*-softmmu/panda/plugins/**/*',# All plugin files
+          'data/*-softmmu/panda/guest_plugins/*',   # All plugins
+          'data/*-softmmu/panda/guest_plugins/**/*',# All plugin files
           'data/pypanda/include/*.h',         # Includes files
           'data/pc-bios/*',                   # BIOSes
           'data/pc-bios/**/*',                # Keymaps
diff --git a/panda/python/examples/guest_shell.py b/panda/python/examples/guest_shell.py
new file mode 100644
index 00000000000..8963b47e35b
--- /dev/null
+++ b/panda/python/examples/guest_shell.py
@@ -0,0 +1,26 @@
+# See panda/plugins/guest_shell/guest_shell_pty.sh for actually interacting with the shell
+from pandare import Panda
+import os
+
+if os.path.exists("/tmp/guest_shell.sock"):
+    os.remove("/tmp/guest_shell.sock")
+
+panda = Panda(generic="x86_64")
+
+@panda.queue_blocking
+def run_cmd():
+    panda.revert_sync("root")
+    panda.load_plugin("guest_shell")
+
+    # if it's worth running it's worth running twice
+    # (don't ask, and definitely don't remove either line)
+    panda.load_plugin("linjector", {
+        "guest_binary": "guest_daemon",
+        "proc_name": "cat"
+    })
+    panda.run_serial_cmd("cat", no_timeout=True)
+    panda.run_serial_cmd("cat", no_timeout=True)
+
+    panda.end_analysis()
+
+panda.run()
diff --git a/panda/python/examples/hyperfuse.py b/panda/python/examples/hyperfuse.py
new file mode 100644
index 00000000000..9ec21609eea
--- /dev/null
+++ b/panda/python/examples/hyperfuse.py
@@ -0,0 +1,22 @@
+from pandare import Panda
+import os
+
+panda = Panda(generic="x86_64")
+panda.load_plugin("hyperfuse", {})
+
+@panda.queue_blocking
+def run_cmd():
+    panda.revert_sync("root")
+
+    # if it's worth running it's worth running twice
+    # (don't ask, and definitely don't remove either line)
+    panda.load_plugin("linjector", {
+        "guest_binary": "guest_daemon",
+        "proc_name": "cat"
+    })
+    panda.run_serial_cmd("cat", no_timeout=True)
+    panda.run_serial_cmd("cat", no_timeout=True)
+
+    panda.end_analysis()
+
+panda.run()
diff --git a/panda/python/examples/linject.py b/panda/python/examples/linject.py
new file mode 100644
index 00000000000..50987c3b367
--- /dev/null
+++ b/panda/python/examples/linject.py
@@ -0,0 +1,31 @@
+from pandare import Panda
+from termcolor import colored
+import os
+
+# Please don't do it this way normally
+code = """#include <stdio.h>
+#include <unistd.h>
+
+int main() {
+    printf("Hello World!\\n");
+    sleep(3);
+
+    return 0;
+}
+"""
+os.system(f'printf {repr(code)} | gcc -x c - -o hello_world_x86_64')
+
+panda = Panda(generic="x86_64")
+panda.load_plugin("linjector", {
+    "require_root": False,
+    "guest_binary": "hello_world_x86_64",
+    "proc_name": "cat"
+})
+
+@panda.queue_blocking
+def run_cmd():
+    panda.revert_sync("root")
+    print(colored(panda.run_serial_cmd("cat /proc/cpuinfo"), "white", attrs=['bold']))
+    panda.end_analysis()
+
+panda.run()
diff --git a/panda/python/examples/tcp_passthrough.py b/panda/python/examples/tcp_passthrough.py
new file mode 100644
index 00000000000..98aedcaed51
--- /dev/null
+++ b/panda/python/examples/tcp_passthrough.py
@@ -0,0 +1,51 @@
+from pandare import Panda
+
+panda = Panda(generic="x86_64")
+
+page = "<html><body><h1>Guest Web Server</h1><p>CPU Info:</p><iframe src=\"/cpuinfo.html\" style=\"width: 70%; height: 70%\"></iframe></body></html>"
+
+@panda.queue_blocking
+def run_cmd():
+    panda.revert_sync("root")
+
+    panda.run_serial_cmd("echo '<html><body><pre>' > cpuinfo.html")
+    panda.run_serial_cmd("cat /proc/cpuinfo >> cpuinfo.html")
+    panda.run_serial_cmd("echo '</pre></body></html>' >> cpuinfo.html")
+    panda.run_serial_cmd(f"echo '{page}' > index.html")
+
+    #print(panda.run_serial_cmd("mknod -m 777 fifo p"))
+    #print(panda.run_serial_cmd("head -c10000 fifo | netcat -l -k localhost 1234 > fifo"))
+
+    # Start up an HTTP server as a background job
+    panda.run_serial_cmd("python3 -m http.server &")
+
+    # Give the HTTP server time to start up before pulling socket info
+    panda.run_serial_cmd("sleep 2")
+
+    # Print a table of the TCP servers in the guest
+    panda.tcp.print_socket_info()
+
+    # Forward a socket from localhost:8000 in the guest to localhost:8000 on the host
+    panda.tcp.forward_socket(8000, 8000)
+
+    # Forward a socket from localhost:1234 in the guest to localhost:1234 on the host
+    panda.tcp.forward_socket(1234, 1234)
+
+    # print out the socket list ourselves too
+    @panda.tcp.on_get_socket_list
+    def callback(socket_info: list):
+        print(" Ip Address\tPID\tIs Server?")
+        print("====================================")
+        for socket in socket_info:
+            print(f" {socket.ip}:{socket.port}\t{socket.pid}\t{socket.is_server}")
+
+    # Injecting into a cat command, but this could be anything
+    panda.load_plugin("linjector", {
+        "guest_binary": "guest_daemon",
+        "proc_name": "cat"
+    })
+    panda.run_serial_cmd("cat", no_timeout=True)
+
+    panda.end_analysis()
+
+panda.run()
diff --git a/panda/scripts/musl_toolchains.sh b/panda/scripts/musl_toolchains.sh
new file mode 100755
index 00000000000..e23ad58494f
--- /dev/null
+++ b/panda/scripts/musl_toolchains.sh
@@ -0,0 +1,337 @@
+#!/bin/bash
+
+TARGETS=(i486-linux-musl-cross mips-linux-musl-cross mipsel-linux-musl-cross mips64-linux-musl-cross arm-linux-musleabi-cross aarch64-linux-musl-cross)
+
+bold=$(tput bold)
+red=$(tput setaf 1)
+cyan=$(tput setaf 6)
+normal=$(tput sgr0)
+
+CMD_NAME="./musl_toolchains.sh"
+
+function error {
+    >&2 echo "${bold}${red}error${normal}: $@"
+}
+
+function suggest {
+    >&2 echo "  ${bold}${cyan}help${normal}: $@"
+}
+
+function help {
+    >&2 echo "${bold}Usage:${normal}"
+    >&2 echo "    ${CMD_NAME} [subcommand]"
+    >&2 echo ""
+    >&2 echo "${bold}Subcommands:${normal}"
+    >&2 echo "    install               Install all needed musl toolchains to the current directory"
+    >&2 echo "    uninstall             Remove all installed musl toolchains from the current directory"
+    >&2 echo "    list                  List the musl toolchains supported or installed by this script"
+    >&2 echo "    check-installed       Checks if a target or set of targets are installed"
+    >&2 echo "    help                  Print this help text"
+}
+
+function install_help {
+    >&2 echo "${bold}Usage:${normal}"
+    >&2 echo "    ${CMD_NAME} install [args]"
+    >&2 echo ""
+    >&2 echo "Install all the toolchains supported by this script"
+    >&2 echo ""
+    >&2 echo "${bold}Arguments:${normal}"
+    >&2 echo "    --help                Print this help text"
+    >&2 echo "    --to <dir>            Install the toolchains inside of the <dir> directory (default: cwd)"
+}
+
+function uninstall_help {
+    >&2 echo "${bold}Usage:${normal}"
+    >&2 echo "    ${CMD_NAME} uninstall [args]"
+    >&2 echo ""
+    >&2 echo "Uninstall all the toolchains supported by this script"
+    >&2 echo ""
+    >&2 echo "${bold}Arguments:${normal}"
+    >&2 echo "    --help                Print this help text"
+    >&2 echo "    --from <dir>          Uninstall any toolchains inside of the <dir> directory (default: cwd)"
+}
+
+function list_targets_help {
+    >&2 echo "${bold}Usage:${normal}"
+    >&2 echo "    ${CMD_NAME} list [args]"
+    >&2 echo ""
+    >&2 echo "List the target triples supported or installed by this script"
+    >&2 echo ""
+    >&2 echo "${bold}Arguments:${normal}"
+    >&2 echo "    --help                Print this help text"
+    >&2 echo "    --installed           Show only installed targets"
+    >&2 echo "    --in <dir>            When checking for installed toolchains, look inside of the <dir> directory (default: cwd)"
+}
+
+function check_installed_help {
+    >&2 echo "${bold}Usage:${normal}"
+    >&2 echo "    ${CMD_NAME} check-installed [args]"
+    >&2 echo ""
+    >&2 echo "Checks if a set of targets are installed"
+    >&2 echo ""
+    >&2 echo "${bold}Arguments:${normal}"
+    >&2 echo "    --help                Print this help text"
+    >&2 echo "    --all                 Check that all available targets are selected"
+    >&2 echo "    --in <dir>            When checking for installed toolchains, look inside of the <dir> directory (default: cwd)"
+    >&2 echo "    <TARGETS...>          A list of targets to check are installed"
+}
+
+function install {
+    cwd=`pwd`
+    args=("$@")
+
+    while [[  ${#args[@]} -ne 0 ]]
+    do
+        case ${args[0]} in
+            "--help" | "-h")
+                install_help
+                exit 0
+                ;;
+            "--to")
+                cwd="${args[1]}"
+                args=("${args[@]:2}")
+                ;;
+            *)
+                error "Found '${args[0]}'"
+                install_help
+                exit 1
+                ;;
+        esac
+    done
+
+    if [[ $cwd == "" ]]
+    then
+        error "empty directory to install to"
+        exit 1
+    fi
+
+    if ! [[ -d $cwd ]]
+    then
+        >&2 echo "Directory '$cwd' does not exist, creating for you..."
+        mkdir -p $cwd
+    fi
+
+    path_prefix=""
+
+    for target in ${TARGETS[@]}
+    do
+        full_path="$cwd/$target/bin"
+        if [ -d $full_path ]
+        then
+            echo "$target is already installed"
+        else
+            echo "${bold}Downloading $target...${normal}"
+            curl -o "$cwd/$target.tgz" https://musl.cc/$target.tgz && tar -xzf "$cwd/$target.tgz"
+            rm "$cwd/$target.tgz"
+        fi
+
+        path_prefix="$full_path:$path_prefix"
+    done
+
+    QUOTE='"'
+    DOLLAR='$'
+
+    >&2 echo ""
+    >&2 echo "${bold}Add to PATH using:${normal}"
+    echo "    export PATH=${QUOTE}${path_prefix}${DOLLAR}PATH${QUOTE}"
+}
+
+function uninstall {
+    cwd=`pwd`
+    args=("$@")
+
+    while [[  ${#args[@]} -ne 0 ]]
+    do
+        case ${args[0]} in
+            "--help" | "-h")
+                uninstall_help
+                exit 0
+                ;;
+            "--from")
+                cwd="${args[1]}"
+                args=("${args[@]:2}")
+                ;;
+            *)
+                error "Found '${args[0]}'"
+                uninstall_help
+                exit 1
+                ;;
+        esac
+    done
+
+    if [[ $cwd == "" ]]
+    then
+        error "empty directory to uninstall from"
+        exit 1
+    fi
+
+    for target in ${TARGETS[@]}
+    do
+        full_path="$cwd/$target/bin"
+        if [ -d $full_path ]
+        then
+            rm -rf "$cwd/$target" && echo "Removed $target"
+            >/dev/null 2>/dev/null rm $target.tgz || true
+        else
+            >/dev/null 2>/dev/null rm $target.tgz || true
+        fi
+    done
+
+    echo ""
+    echo "All targets uninstalled"
+}
+
+function list_targets {
+    check_installed=false
+    cwd_set=false
+
+    cwd=`pwd`
+    args=("$@")
+
+    while [[  ${#args[@]} -ne 0 ]]
+    do
+        case ${args[0]} in
+            "--help" | "-h")
+                list_targets_help
+                exit 0
+                ;;
+            "--installed")
+                check_installed=true
+                args=("${args[@]:1}")
+                ;;
+            "--in")
+                cwd_set=true
+                cwd="${args[1]}"
+                args=("${args[@]:2}")
+                ;;
+            *)
+                error "Found '${args[0]}', unexpected for 'list' subcommand"
+                list_targets_help
+                exit 1
+                ;;
+        esac
+    done
+
+    if [[ $cwd_set = true && $check_installed = false ]]
+    then
+        error "'--in' was passed, requires '--installed' to be passed as well"
+        exit 1
+    fi
+
+    at_least_one_installed=false
+
+    for target in ${TARGETS[@]}
+    do
+        full_path="$cwd/$target/bin"
+
+        if [[ $check_installed = false || -d $full_path ]]
+        then
+            echo $target
+            at_least_one_installed=true
+        fi
+    done
+
+    if [[ $check_installed = true && $at_least_one_installed = false ]]
+    then
+        >&2 echo "${bold}No targets installed${normal}"
+    fi
+}
+
+containsElement () {
+    local e match="$1"
+    shift
+
+    for e; do [[ "$e" == "$match"  ]] && return 0; done
+
+    return 1
+}
+
+function check_installed {
+    check_installed=false
+    cwd_set=false
+
+    cwd=`pwd`
+    args=("$@")
+
+    selected_targets=()
+
+    while [[  ${#args[@]} -ne 0 ]]
+    do
+        case ${args[0]} in
+            "--help" | "-h")
+                check_installed_help
+                exit 0
+                ;;
+            "--all")
+                check_all=true
+                args=("${args[@]:1}")
+                ;;
+            "--in")
+                cwd="${args[1]}"
+                args=("${args[@]:2}")
+                ;;
+            *)
+                if containsElement "${args[0]}" "${TARGETS[@]}"; then
+                    selected_targets+=("${args[0]}")
+                    args=("${args[@]:1}")
+                else
+                    error "Found '${args[0]}', unexpected for 'check-installed' subcommand, not a valid flag or target name"
+                    suggest "use '${CMD_NAME} list' to see a list of valid targets"
+                    >&2 echo ""
+                    check_installed_help
+                    exit 1
+                fi
+                ;;
+        esac
+    done
+
+    if [[ $check_all = true ]]; then
+        selected_targets=("${TARGETS[@]}")
+    fi
+
+    if [[ ${#selected_targets[@]} -eq 0 ]]; then
+        error "No targets specified"
+        suggest "pass '--all' or a space-separated list of toolchain names"
+        exit 1
+    fi
+
+    for target in ${selected_targets[@]}
+    do
+        full_path="$cwd/$target/bin"
+
+        if ! [[ -d $full_path ]]
+        then
+            error "Toolchain '$target' is not installed in '$cwd'"
+            exit 1
+        fi
+    done
+
+    >&2 echo "All toolchains are installed."
+}
+
+if [[ $# -lt 1 ]]
+then
+    help
+    exit 1
+fi
+
+case $1 in
+    help | "-h" | "--help")
+        help
+        ;;
+    list)
+        list_targets ${@:2}
+        ;;
+    install)
+        install ${@:2}
+        ;;
+    uninstall | remove | delete)
+        uninstall ${@:2}
+        ;;
+    "check-installed")
+        check_installed ${@:2}
+        ;;
+    *)
+        >&2 echo "Invalid usage"
+        help
+esac
diff --git a/panda/src/callbacks.c b/panda/src/callbacks.c
index 58bdaa8f84c..5d90a353035 100644
--- a/panda/src/callbacks.c
+++ b/panda/src/callbacks.c
@@ -264,6 +264,30 @@ bool _panda_load_plugin(const char *filename, const char *plugin_name, bool libr
 
 extern const char *qemu_file;
 
+char *panda_guest_plugin_path(const char *plugin_name) {
+    gchar* plugin_path;
+    // Note qemu_file is set in the first call to main_aux
+    // so if this is called (likely via load_plugin) qemu_file must be set directly
+    assert(qemu_file != NULL);
+
+    // try relative to PANDA binary as it would be in the build or install directory
+    char *dir = g_path_get_dirname(qemu_file);
+    plugin_path = g_strdup_printf("%s/panda/guest_plugins/bin/%s", dir,
+                                  plugin_name);
+
+    g_free(dir);
+    if (TRUE == g_file_test(plugin_path, G_FILE_TEST_EXISTS)) {
+        char* path = strdup(plugin_path);
+        g_free(plugin_path);
+        return path;
+    }
+    printf("Failed to find guest plugin '%s' at '%s'", plugin_name, plugin_path);
+    g_free(plugin_path);
+
+    // Return null if plugin resolution failed.
+    return NULL;
+}
+
 // Resolve a file in the plugin directory to a path. If the file doesn't
 // exist in any of the search paths, then NULL is returned. The search order 
 // for files is as follows:

From 169239f73008754f9b1a39ba8b8ec427eaea1934 Mon Sep 17 00:00:00 2001
From: Luke Craig <lacraig3@gmail.com>
Date: Tue, 25 Oct 2022 13:01:29 -0400
Subject: [PATCH 117/140] Revert "guest plugins (#1145)" (#1240)

This reverts commit aee5f52bb20e402a30d69a26a6ca8cdfc6866e47.
---
 panda/Makefile.panda.target                   |   91 +-
 panda/dependencies/ubuntu:18.04_build.txt     |    3 -
 panda/dependencies/ubuntu:20.04_build.txt     |    3 -
 panda/dependencies/ubuntu:22.04_build.txt     |    3 -
 panda/docs/guest_plugins.md                   |  306 --
 panda/guest_plugins/config.panda              |    3 -
 panda/guest_plugins/guest_daemon/Cargo.lock   |  257 --
 panda/guest_plugins/guest_daemon/Cargo.toml   |   11 -
 panda/guest_plugins/guest_daemon/Makefile     |   20 -
 .../guest_plugins/guest_daemon/src/loader.rs  |   44 -
 panda/guest_plugins/guest_daemon/src/main.rs  |   65 -
 panda/guest_plugins/panda.mak                 |   53 -
 panda/guest_plugins/rust_example/Cargo.lock   |  130 -
 panda/guest_plugins/rust_example/Cargo.toml   |    7 -
 panda/guest_plugins/rust_example/Makefile     |   20 -
 panda/guest_plugins/rust_example/src/main.rs  |   23 -
 panda/guest_plugins/tcp_servers/Cargo.lock    |  217 --
 panda/guest_plugins/tcp_servers/Cargo.toml    |   12 -
 panda/guest_plugins/tcp_servers/Makefile      |   20 -
 .../tcp_servers/src/allow_cancel.rs           |  110 -
 panda/guest_plugins/tcp_servers/src/main.rs   |   99 -
 panda/include/panda/plugin.h                  |    2 -
 panda/plugins/config.panda                    |    7 -
 panda/plugins/frida/Cargo.lock                |  608 ---
 panda/plugins/frida/Cargo.toml                |   26 -
 panda/plugins/frida/Makefile                  |   18 -
 panda/plugins/frida/README.md                 |    6 -
 panda/plugins/frida/src/lib.rs                |   33 -
 panda/plugins/guest_plugin_example/Cargo.lock |  489 ---
 panda/plugins/guest_plugin_example/Cargo.toml |   24 -
 panda/plugins/guest_plugin_example/Makefile   |   18 -
 panda/plugins/guest_plugin_example/README.md  |    6 -
 panda/plugins/guest_plugin_example/src/lib.rs |   18 -
 panda/plugins/guest_plugin_example/try_it.py  |   13 -
 panda/plugins/guest_plugin_manager/Cargo.lock |  511 ---
 panda/plugins/guest_plugin_manager/Cargo.toml |   28 -
 panda/plugins/guest_plugin_manager/Makefile   |   18 -
 panda/plugins/guest_plugin_manager/README.md  |   94 -
 .../guest_plugin_manager_ppp.h                |   11 -
 .../plugins/guest_plugin_manager/rustfmt.toml |    1 -
 .../src/guest_plugin_manager.rs               |  148 -
 .../guest_plugin_manager/src/hyp_regs.rs      |   54 -
 .../guest_plugin_manager/src/interface/api.rs |   80 -
 .../src/interface/channels.rs                 |  103 -
 .../src/interface/daemon_manager.rs           |   54 -
 .../guest_plugin_manager/src/interface/hci.rs |  105 -
 .../guest_plugin_manager/src/interface/mod.rs |    5 -
 .../src/interface/plugin_manager.rs           |   61 -
 panda/plugins/guest_shell/Cargo.lock          |  489 ---
 panda/plugins/guest_shell/Cargo.toml          |   24 -
 panda/plugins/guest_shell/Makefile            |   18 -
 panda/plugins/guest_shell/README.md           |   95 -
 panda/plugins/guest_shell/guest_shell_pty.sh  |    1 -
 .../guest_shell/rusty_shell/Cargo.toml        |    4 -
 .../guest_shell/rusty_shell/src/hypercall.rs  |  113 -
 .../guest_shell/rusty_shell/src/main.rs       |   52 -
 panda/plugins/guest_shell/src/lib.rs          |   42 -
 panda/plugins/hyperfuse/Cargo.lock            |  749 ----
 panda/plugins/hyperfuse/Cargo.toml            |   33 -
 panda/plugins/hyperfuse/Makefile              |   18 -
 panda/plugins/hyperfuse/README.md             |   95 -
 panda/plugins/hyperfuse/src/lib.rs            |  308 --
 panda/plugins/hyperfuse/src/types.rs          |  104 -
 panda/plugins/linjector/.gitignore            |    3 -
 panda/plugins/linjector/Cargo.lock            |  705 ----
 panda/plugins/linjector/Cargo.toml            |   28 -
 panda/plugins/linjector/Makefile              |   18 -
 panda/plugins/linjector/README.md             |   15 -
 panda/plugins/linjector/linjector_ppp.h       |   11 -
 panda/plugins/linjector/rustfmt.toml          |    1 -
 panda/plugins/linjector/src/args.rs           |   55 -
 .../linjector/src/injectables/Makefile        |   31 -
 .../src/injectables/include/hypercall.h       |   66 -
 .../injectables/include/hypercall_constants.h |   15 -
 .../src/injectables/include/syscall_x86.h     |  103 -
 .../linjector/src/injectables/injector.c      |   54 -
 .../linjector/src/injectables/tiny_mmap.c     |   11 -
 panda/plugins/linjector/src/lib.rs            |  274 --
 panda/plugins/linjector/src/regs.rs           |   16 -
 panda/plugins/linjector/src/syscalls.rs       |  107 -
 .../plugins/linjector/src/syscalls/aarch64.rs |   17 -
 panda/plugins/linjector/src/syscalls/arm.rs   |   17 -
 panda/plugins/linjector/src/syscalls/i386.rs  |   19 -
 panda/plugins/linjector/src/syscalls/mips.rs  |   17 -
 .../plugins/linjector/src/syscalls/mips64.rs  |   17 -
 .../plugins/linjector/src/syscalls/x86_64.rs  |   17 -
 panda/plugins/rust_skeleton/Cargo.lock        |   27 +-
 panda/plugins/rust_skeleton/Cargo.toml        |    2 +-
 panda/plugins/rust_skeleton/src/lib.rs        |   14 +-
 panda/plugins/snake_hook/Cargo.lock           |    8 +-
 .../syscall_switch_enter_linux_arm.cpp        |   10 +-
 .../syscall_switch_enter_linux_x64.cpp        |    2 +-
 .../syscall_switch_return_linux_arm.cpp       |    3 +-
 panda/plugins/tcp_passthrough/Cargo.lock      |  728 ----
 panda/plugins/tcp_passthrough/Cargo.toml      |   31 -
 panda/plugins/tcp_passthrough/Makefile        |   18 -
 panda/plugins/tcp_passthrough/README.md       |    5 -
 panda/plugins/tcp_passthrough/cbindgen.toml   |    7 -
 .../tcp_passthrough/generate_header.sh        |    3 -
 panda/plugins/tcp_passthrough/src/display.rs  |   70 -
 .../tcp_passthrough/src/forward_socket.rs     |   72 -
 panda/plugins/tcp_passthrough/src/lib.rs      |  138 -
 panda/plugins/tcp_passthrough/src/send_ext.rs |   12 -
 .../tcp_passthrough/src/socket_list.rs        |   51 -
 panda/plugins/tcp_passthrough/src/tcp.csv     | 3266 -----------------
 .../plugins/tcp_passthrough/tcp_passthrough.h |   36 -
 .../tcp_shared_types/Cargo.lock               |   65 -
 .../tcp_shared_types/Cargo.toml               |    7 -
 .../tcp_shared_types/src/lib.rs               |   29 -
 panda/plugins/tcp_passthrough/try_it.py       |   34 -
 panda/python/core/create_panda_datatypes.py   |    7 +-
 panda/python/core/pandare/panda.py            |    4 -
 panda/python/core/pandare/tcp_passthrough.py  |   88 -
 panda/python/core/setup.py                    |    9 -
 panda/python/examples/guest_shell.py          |   26 -
 panda/python/examples/hyperfuse.py            |   22 -
 panda/python/examples/linject.py              |   31 -
 panda/python/examples/tcp_passthrough.py      |   51 -
 panda/scripts/musl_toolchains.sh              |  337 --
 panda/src/callbacks.c                         |   24 -
 120 files changed, 28 insertions(+), 13009 deletions(-)
 delete mode 100644 panda/docs/guest_plugins.md
 delete mode 100644 panda/guest_plugins/config.panda
 delete mode 100644 panda/guest_plugins/guest_daemon/Cargo.lock
 delete mode 100644 panda/guest_plugins/guest_daemon/Cargo.toml
 delete mode 100644 panda/guest_plugins/guest_daemon/Makefile
 delete mode 100644 panda/guest_plugins/guest_daemon/src/loader.rs
 delete mode 100644 panda/guest_plugins/guest_daemon/src/main.rs
 delete mode 100644 panda/guest_plugins/panda.mak
 delete mode 100644 panda/guest_plugins/rust_example/Cargo.lock
 delete mode 100644 panda/guest_plugins/rust_example/Cargo.toml
 delete mode 100644 panda/guest_plugins/rust_example/Makefile
 delete mode 100644 panda/guest_plugins/rust_example/src/main.rs
 delete mode 100644 panda/guest_plugins/tcp_servers/Cargo.lock
 delete mode 100644 panda/guest_plugins/tcp_servers/Cargo.toml
 delete mode 100644 panda/guest_plugins/tcp_servers/Makefile
 delete mode 100644 panda/guest_plugins/tcp_servers/src/allow_cancel.rs
 delete mode 100644 panda/guest_plugins/tcp_servers/src/main.rs
 delete mode 100644 panda/plugins/frida/Cargo.lock
 delete mode 100644 panda/plugins/frida/Cargo.toml
 delete mode 100644 panda/plugins/frida/Makefile
 delete mode 100644 panda/plugins/frida/README.md
 delete mode 100644 panda/plugins/frida/src/lib.rs
 delete mode 100644 panda/plugins/guest_plugin_example/Cargo.lock
 delete mode 100644 panda/plugins/guest_plugin_example/Cargo.toml
 delete mode 100644 panda/plugins/guest_plugin_example/Makefile
 delete mode 100644 panda/plugins/guest_plugin_example/README.md
 delete mode 100644 panda/plugins/guest_plugin_example/src/lib.rs
 delete mode 100644 panda/plugins/guest_plugin_example/try_it.py
 delete mode 100644 panda/plugins/guest_plugin_manager/Cargo.lock
 delete mode 100644 panda/plugins/guest_plugin_manager/Cargo.toml
 delete mode 100644 panda/plugins/guest_plugin_manager/Makefile
 delete mode 100644 panda/plugins/guest_plugin_manager/README.md
 delete mode 100644 panda/plugins/guest_plugin_manager/guest_plugin_manager_ppp.h
 delete mode 100644 panda/plugins/guest_plugin_manager/rustfmt.toml
 delete mode 100644 panda/plugins/guest_plugin_manager/src/guest_plugin_manager.rs
 delete mode 100644 panda/plugins/guest_plugin_manager/src/hyp_regs.rs
 delete mode 100644 panda/plugins/guest_plugin_manager/src/interface/api.rs
 delete mode 100644 panda/plugins/guest_plugin_manager/src/interface/channels.rs
 delete mode 100644 panda/plugins/guest_plugin_manager/src/interface/daemon_manager.rs
 delete mode 100644 panda/plugins/guest_plugin_manager/src/interface/hci.rs
 delete mode 100644 panda/plugins/guest_plugin_manager/src/interface/mod.rs
 delete mode 100644 panda/plugins/guest_plugin_manager/src/interface/plugin_manager.rs
 delete mode 100644 panda/plugins/guest_shell/Cargo.lock
 delete mode 100644 panda/plugins/guest_shell/Cargo.toml
 delete mode 100644 panda/plugins/guest_shell/Makefile
 delete mode 100644 panda/plugins/guest_shell/README.md
 delete mode 100755 panda/plugins/guest_shell/guest_shell_pty.sh
 delete mode 100644 panda/plugins/guest_shell/rusty_shell/Cargo.toml
 delete mode 100644 panda/plugins/guest_shell/rusty_shell/src/hypercall.rs
 delete mode 100644 panda/plugins/guest_shell/rusty_shell/src/main.rs
 delete mode 100644 panda/plugins/guest_shell/src/lib.rs
 delete mode 100644 panda/plugins/hyperfuse/Cargo.lock
 delete mode 100644 panda/plugins/hyperfuse/Cargo.toml
 delete mode 100644 panda/plugins/hyperfuse/Makefile
 delete mode 100644 panda/plugins/hyperfuse/README.md
 delete mode 100644 panda/plugins/hyperfuse/src/lib.rs
 delete mode 100644 panda/plugins/hyperfuse/src/types.rs
 delete mode 100644 panda/plugins/linjector/.gitignore
 delete mode 100644 panda/plugins/linjector/Cargo.lock
 delete mode 100644 panda/plugins/linjector/Cargo.toml
 delete mode 100644 panda/plugins/linjector/Makefile
 delete mode 100644 panda/plugins/linjector/README.md
 delete mode 100644 panda/plugins/linjector/linjector_ppp.h
 delete mode 100644 panda/plugins/linjector/rustfmt.toml
 delete mode 100644 panda/plugins/linjector/src/args.rs
 delete mode 100644 panda/plugins/linjector/src/injectables/Makefile
 delete mode 100644 panda/plugins/linjector/src/injectables/include/hypercall.h
 delete mode 100644 panda/plugins/linjector/src/injectables/include/hypercall_constants.h
 delete mode 100644 panda/plugins/linjector/src/injectables/include/syscall_x86.h
 delete mode 100644 panda/plugins/linjector/src/injectables/injector.c
 delete mode 100644 panda/plugins/linjector/src/injectables/tiny_mmap.c
 delete mode 100644 panda/plugins/linjector/src/lib.rs
 delete mode 100644 panda/plugins/linjector/src/regs.rs
 delete mode 100644 panda/plugins/linjector/src/syscalls.rs
 delete mode 100644 panda/plugins/linjector/src/syscalls/aarch64.rs
 delete mode 100644 panda/plugins/linjector/src/syscalls/arm.rs
 delete mode 100644 panda/plugins/linjector/src/syscalls/i386.rs
 delete mode 100644 panda/plugins/linjector/src/syscalls/mips.rs
 delete mode 100644 panda/plugins/linjector/src/syscalls/mips64.rs
 delete mode 100644 panda/plugins/linjector/src/syscalls/x86_64.rs
 delete mode 100644 panda/plugins/tcp_passthrough/Cargo.lock
 delete mode 100644 panda/plugins/tcp_passthrough/Cargo.toml
 delete mode 100644 panda/plugins/tcp_passthrough/Makefile
 delete mode 100644 panda/plugins/tcp_passthrough/README.md
 delete mode 100644 panda/plugins/tcp_passthrough/cbindgen.toml
 delete mode 100755 panda/plugins/tcp_passthrough/generate_header.sh
 delete mode 100644 panda/plugins/tcp_passthrough/src/display.rs
 delete mode 100644 panda/plugins/tcp_passthrough/src/forward_socket.rs
 delete mode 100644 panda/plugins/tcp_passthrough/src/lib.rs
 delete mode 100644 panda/plugins/tcp_passthrough/src/send_ext.rs
 delete mode 100644 panda/plugins/tcp_passthrough/src/socket_list.rs
 delete mode 100644 panda/plugins/tcp_passthrough/src/tcp.csv
 delete mode 100644 panda/plugins/tcp_passthrough/tcp_passthrough.h
 delete mode 100644 panda/plugins/tcp_passthrough/tcp_shared_types/Cargo.lock
 delete mode 100644 panda/plugins/tcp_passthrough/tcp_shared_types/Cargo.toml
 delete mode 100644 panda/plugins/tcp_passthrough/tcp_shared_types/src/lib.rs
 delete mode 100644 panda/plugins/tcp_passthrough/try_it.py
 delete mode 100644 panda/python/core/pandare/tcp_passthrough.py
 delete mode 100644 panda/python/examples/guest_shell.py
 delete mode 100644 panda/python/examples/hyperfuse.py
 delete mode 100644 panda/python/examples/linject.py
 delete mode 100644 panda/python/examples/tcp_passthrough.py
 delete mode 100755 panda/scripts/musl_toolchains.sh

diff --git a/panda/Makefile.panda.target b/panda/Makefile.panda.target
index f036bc068c7..34a71ce5a8e 100644
--- a/panda/Makefile.panda.target
+++ b/panda/Makefile.panda.target
@@ -56,7 +56,7 @@ extra-plugin-%: plog.pb-c.h plog.pb.h $(PANDA_API_EXT)
 		PLUGIN_SRC_ROOT="$(EXTRA_PLUGINS_PATH)/panda/plugins" \
 		V="$(V)" PLUGIN_NAME="$*" all,)
 
-all: $(PLUGIN_SUBDIR_RULES) $(EXTRA_PLUGIN_SUBDIR_RULES) build_guest_plugins
+all: $(PLUGIN_SUBDIR_RULES) $(EXTRA_PLUGIN_SUBDIR_RULES)
 
 PROTO_FILES=$(wildcard $(addsuffix /*.proto,$(ALL_PLUGIN_SUBDIRS)))
 
@@ -147,95 +147,6 @@ clean-panda:
 		rm -f panda/panda_*.so;\
 	fi
 
-#########################################################
-# Guest Plugins
-
-# determine list of guest plugins
-# remove spaces from lines. skip lines starting with a #. concatenate the rest into 
-# a space-delimited list
-PANDA_GUEST_PLUGINS=$(shell tr -d "[:blank:]" < $(SRC_PATH)/panda/guest_plugins/config.panda | grep -v "^\#" | xargs)
-GUEST_PLUGIN_SUBDIR_RULES=$(patsubst %,guest-plugin-%, $(PANDA_GUEST_PLUGINS))
-GUEST_PLUGIN_SUBDIR_MAKEFLAGS=$(if $(V),,--no-print-directory) BUILD_DIR=$(BUILD_DIR)
-
-ALL_GUEST_PLUGIN_RULES=$(GUEST_PLUGIN_SUBDIR_RULES)
-
-ifdef EXTRA_GUEST_PLUGINS_PATH
-	EXTRA_GUEST_PLUGINS=$(shell tr -d "[:blank:]" < $(EXTRA_GUEST_PLUGINS_PATH)/config.panda | grep -v "^\#" | xargs)
-	EXTRA_GUEST_PLUGIN_SUBDIR_RULES=$(patsubst %,extra-guest-plugin-%, $(EXTRA_GUEST_PLUGINS))
-	ALL_GUEST_PLUGIN_RULES+=$(EXTRA_GUEST_PLUGIN_SUBDIR_RULES)
-endif
-
-ifeq ($(TARGET_NAME),i386)
-	GUEST_CC=i486-linux-musl-gcc
-	GUEST_RUST_TARGET=i686-unknown-linux-musl
-else ifeq ($(TARGET_NAME),x86_64)
-	GUEST_RUST_TARGET=x86_64-unknown-linux-musl
-else ifeq ($(TARGET_NAME),mips)
-	GUEST_CC=mips-linux-musl-gcc
-	GUEST_RUST_TARGET=mips-unknown-linux-musl
-else ifeq ($(TARGET_NAME),mipsel)
-	GUEST_CC=mipsel-linux-musl-gcc
-	GUEST_RUST_TARGET=mipsel-unknown-linux-musl
-else ifeq ($(TARGET_NAME),mips64)
-	GUEST_CC=mips64-linux-musl-gcc
-	GUEST_RUST_TARGET=mips64-unknown-linux-muslabi64
-else ifeq ($(TARGET_NAME),arm)
-	GUEST_CC=arm-linux-musleabi-gcc
-	GUEST_RUST_TARGET=armv5te-unknown-linux-musleabi
-else ifeq ($(TARGET_NAME),aarch64)
-	GUEST_CC=aarch64-linux-musl-gcc
-	GUEST_RUST_TARGET=aarch64-unknown-linux-musl
-endif
-
-HAS_GUEST_TOOLCHAIN="no"
-ifeq ($(TARGET_NAME),x86_64)
-    ifeq (, $(shell rustup target list --installed | grep $(GUEST_RUST_TARGET)))
-    	GUEST_PLUGIN_DISABLE_REASON="rust target ${GUEST_RUST_TARGET} not installed"
-    	HAS_GUEST_TOOLCHAIN="no"
-    else
-    	HAS_GUEST_TOOLCHAIN="yes"
-    endif
-else ifeq ($(TARGET_NAME),ppc)
-	HAS_GUEST_TOOLCHAIN="no"
-	GUEST_PLUGIN_DISABLE_REASON="unsupported on ppc"
-else ifneq (, $(shell which $(GUEST_CC)))
-    ifeq (, $(shell rustup target list --installed | grep $(GUEST_RUST_TARGET)))
-    	GUEST_PLUGIN_DISABLE_REASON="rust target ${GUEST_RUST_TARGET} not installed"
-    	HAS_GUEST_TOOLCHAIN="no"
-    else
-    	HAS_GUEST_TOOLCHAIN="yes"
-    endif
-else
-	GUEST_PLUGIN_DISABLE_REASON="musl toolchain not in PATH"
-endif
-
-ifeq ($(HAS_GUEST_TOOLCHAIN),"yes")
-build_guest_plugins: $(ALL_GUEST_PLUGIN_RULES)
-	@echo "GUEST_PLUGINS: ${PANDA_GUEST_PLUGINS} ${EXTRA_GUEST_PLUGINS}"
-else
-build_guest_plugins:
-	@echo "GUEST_PLUGINS: disabled on arch ${TARGET_NAME}, ${GUEST_PLUGIN_DISABLE_REASON}"
-endif
-
-
-guest-plugin-%:
-	$(call quiet-command,mkdir -p ../panda/guest_plugins/$*,)
-	$(call quiet-command,mkdir -p panda/guest_plugins/$*,)
-	$(call quiet-command,$(MAKE) $(GUEST_PLUGIN_SUBDIR_MAKEFLAGS) \
-		-f "$(SRC_PATH)/panda/guest_plugins/panda.mak" \
-		-f "$(SRC_PATH)/panda/guest_plugins/$*/Makefile" \
-		PLUGIN_SRC_ROOT="$(SRC_PATH)/panda/guest_plugins" \
-		V="$(V)" PLUGIN_NAME="$*" all,)
-
-extra-guest-plugin-%:
-	$(call quiet-command,mkdir -p ../panda/guest_plugins/$*,)
-	$(call quiet-command,mkdir -p panda/guest_plugins/$*,)
-	$(call quiet-command,$(MAKE) $(GUEST_PLUGIN_SUBDIR_MAKEFLAGS) \
-		-f "$(SRC_PATH)/panda/guest_plugins/panda.mak" \
-		-f "$(EXTRA_GUEST_PLUGINS_PATH)/$*/Makefile" \
-		PLUGIN_SRC_ROOT="$(EXTRA_GUEST_PLUGINS_PATH)" \
-		V="$(V)" PLUGIN_NAME="$*" all,)
-
 ifdef CONFIG_LLVM
 #########################################################
 # LLVM library
diff --git a/panda/dependencies/ubuntu:18.04_build.txt b/panda/dependencies/ubuntu:18.04_build.txt
index f6b7aedbc90..b0695e00e85 100644
--- a/panda/dependencies/ubuntu:18.04_build.txt
+++ b/panda/dependencies/ubuntu:18.04_build.txt
@@ -25,9 +25,6 @@ protobuf-compiler
 python3-dev
 zip
 
-# hyperfuse build deps
-libfuse-dev
-
 # pypanda dependencies
 python3-setuptools
 python3-wheel
diff --git a/panda/dependencies/ubuntu:20.04_build.txt b/panda/dependencies/ubuntu:20.04_build.txt
index 453514816a1..57a682f20da 100644
--- a/panda/dependencies/ubuntu:20.04_build.txt
+++ b/panda/dependencies/ubuntu:20.04_build.txt
@@ -21,9 +21,6 @@ python3-dev
 libpixman-1-dev
 zip
 
-# hyperfuse build deps
-libfuse-dev
-
 # pypanda dependencies
 python3-setuptools
 python3-wheel
diff --git a/panda/dependencies/ubuntu:22.04_build.txt b/panda/dependencies/ubuntu:22.04_build.txt
index 453514816a1..57a682f20da 100644
--- a/panda/dependencies/ubuntu:22.04_build.txt
+++ b/panda/dependencies/ubuntu:22.04_build.txt
@@ -21,9 +21,6 @@ python3-dev
 libpixman-1-dev
 zip
 
-# hyperfuse build deps
-libfuse-dev
-
 # pypanda dependencies
 python3-setuptools
 python3-wheel
diff --git a/panda/docs/guest_plugins.md b/panda/docs/guest_plugins.md
deleted file mode 100644
index 74cd40bfa32..00000000000
--- a/panda/docs/guest_plugins.md
+++ /dev/null
@@ -1,306 +0,0 @@
-# PANDA Guest Plugins
-
-### Overview
-
-PANDA guest plugins are a feature of PANDA that allows you to run non-cooperative guest agents. This means without any control of the guest, you can run programs that can communicate with code running on the host system. This gives the ability to gain a semantic understanding of the guest through stable interfaces, with the drawback of not being usable in replays.
-
-Some quick links to resources regarding guest plugins:
-
-* [`rust_example`](/panda/guest_plugins/rust_example) - An example guest plugin written in Rust
-* [`guest_plugin_example`](/panda/plugins/guest_plugin_example) - The PANDA (host) plugin that loads and interacts with the guest plugin example
-* [`guest_plugin_manager` Rust Documentation](https://docs.rs/panda-re/latest/panda/plugins/guest_plugin_manager/index.html)
-* [`guest_plugin_manager`](/panda/plugins/guest_plugin_manager) - Source for the guest plugin manager (the PANDA host plugin which handles loading/unloading guest plugins)
-
-### Structure of Typical Usage
-
-PANDA guest plugins are a bit more involved than normal PANDA plugins, due to needing to facilitate communication across the hypervisor:
-
-* Host-side plugin 
-    * A standard PANDA plugin (a shared object built from `panda/plugins`). 
-    * Responsible for loading the code into the guest using the `guest_plugin_manager` plugin
-    * Handles communication with the guest plugin 
-        * Sending - queuing up messages for the guest 
-        * Recieving - Provides a callback for messages sent by the guest
-* Guest-side plugin 
-    * A standard statically-linked executable cross-compiled for the guest (built from `panda/guest_plugins`)
-    * Additional guest plugins will be built from `$EXTRA_GUEST_PLUGINS_PATH`
-        * Requires a `$EXTRA_GUEST_PLUGINS_PATH/config.panda` file containing newline-separated plugin names. Each plugin is built from `$EXTRA_GUEST_PLUGINS_PATH/$plugin_name/`.
-    * Communicates to the host using hypervisor calls via the [`panda-channels`](https://github.com/panda-re/panda-channels) library.
-
-### Getting Started
-
-For starters let's try developing an out-of-tree guest plugin. This process won't be any different than in-tree, so if down the road you wish to upstream your plugin it'll only require a bit of copy/pasting.
-
-#### Creating a New Plugin
-
-First up, create a folder to use as your "out-of-tree" plugins folder and set `EXTRA_GUEST_PLUGINS_PATH` accordingly:
-
-```bash
-mkdir guest_plugins
-export EXTRA_GUEST_PLUGINS_PATH=`realpath guest_plugins`
-```
-
-Now let's create a guest plugin using the example plugin as a template:
-
-1. Copy `panda/guest_plugins/guest_plugins/rust_example` to `$EXTRA_GUEST_PLUGINS_PATH/your_plugin_name`
-2. Edit the `Cargo.toml` to change the name to match your folder name:
-
-```toml
-[package]
-name = "your_plugin_name"
-```
-
-3. Create a `config.panda` file in your out-of-tree `guest_plugins` folder. The only thing this needs to contain is your plugin's name:
-
-```
-your_plugin_name
-```
-
-Later, if you make more plugins you can add each one on a new line:
-
-```
-your_plugin_name
-your_other_plugin
-```
-
-#### Adding Some Guest Logic
-
-For our example, we'll make a guest plugin which informs the host of how many files/directories are in `/etc`.
-
-First up some imports we'll need:
-
-```rust
-use panda_channels::Channel;
-use std::io::Write;
-use std::fs;
-
-fn main() {
-}
-```
-
-We'll need `Channel` and `Write` for communicating with the host, and we'll need `fs` for actually interacting with the filesystem.
-
-Then in our `main` function we'll read `/etc` using [`read_dir`](https://doc.rust-lang.org/std/fs/fn.read_dir.html) and use [`Iterator::count`](https://doc.rust-lang.org/std/iter/trait.Iterator.html#method.count):
-
-```rust
-let file_count = fs::read_dir("/etc").unwrap().count();
-```
-
-Now let's create a channel to send this information to the host:
-
-```rust
-let mut channel = Channel::main("your_plugin_name").unwrap();
-```
-
-We pass the name of our plugin to `Channel::main` to get the main channel for our plugin. This channel is automatically allocated by the `guest_plugin_manager` when we load our plugin and for most usecases it's all we'll need.
-
-We've marked it as mutable so we can write to it. `Channel` implements Rust's [`Write`](https://doc.rust-lang.org/std/io/trait.Write.html) trait, so all we need to do is serialize our file count to bytes and use [`write_all`](https://doc.rust-lang.org/std/io/trait.Write.html#method.write_all) to send the bytes to the host:
-
-```rust
-channel.write_all(&(file_count as u32).to_le_bytes()).unwrap();
-```
-
-We convert `file_count` from `usize` (arch-width integer) to a 32-bit integer to serialize to a fixed number of bytes (that way our host code doesn't need to care about whether our guest is 32 or 64 bit) and then use `to_le_bytes` to convert to little endian bytes for us to write.
-
-Putting that all together we get our complete guest plugin:
-
-```rust
-use panda_channels::Channel;
-use std::io::Write;
-use std::fs;
-
-fn main() {
-    let file_count = fs::read_dir("/etc").unwrap().count();
-    let mut channel = Channel::main("your_plugin_name").unwrap();
-    channel.write_all(&(file_count as u32).to_le_bytes()).unwrap();
-}
-```
-
-If we want to check if it built properly, we can run:
-
-```
-cargo check
-```
-
-This will print out any errors that need to be resolved, if there's no issues we'll get:
-
-```
-   Finished dev [unoptimized + debuginfo] target(s) in 0.11s
-```
-
-This doesn't actually build or link our executable, so it saves a lot of time over doing a full PANDA build any time we want to check for compiler errors. Some other options are [`clippy`](https://github.com/rust-lang/rust-clippy) (A full Rust linter to help write idiomatic Rust) and [`bacon`](https://github.com/Canop/bacon) (Watches your project for changes and keeps a live-updating set of errors/warnings). Also helpful while developing is [`rust-analyzer`](https://rust-analyzer.github.io/), a Language Server implementation for VS Code, Emacs, Vim, etc.
-
-#### Writing a Host Plugin
-
-In order for our guest plugin to do anything, we'll need a host PANDA plugin in order to facilitate loading/message passing.
-
-First up, let's create a new Rust plugin. Similarly to with our guest plugin, we can use an example plugin as a template and just find/replace the names.
-
-I'd recommend using `panda/plugins/guest_plugin_example` as a base. Change the name in `Cargo.toml` to match the folder name, add the folder name to `panda/plugins/config.panda`, and you should be good to go.
-
-If you use another plugin as your base, make sure you have a somewhat recent version of `panda-re`, as you'll need at least `0.26` for this:
-
-```toml
-[dependencies]
-panda-re = { version = "0.26", default-features = false }
-```
-
-| Tip |
-|:----|
-| Install [`cargo-edit`](https://github.com/killercup/cargo-edit) and you can add the latest version of a dependency with `cargo add dep-name` |
-
-Now onto actually writing the host plugin. First off we'll want to pull the guest plugin management utilities we'll need into scope:
-
-```rust
-use panda::plugins::guest_plugin_manager::{load_guest_plugin, channel_recv};
-use panda::prelude::*;
-```
-
-We'll need a callback function for handling incoming messages from the guest. The `panda-re` package provides an (`#[channel_recv]`) attribute for this to do most of the work for us, so for the most part we just need to define a function which takes a `u32` (an ID representing the channel we're recieving messages from) and either bytes (`&[u8]`) or a string (`&str`). In this case, since we're dealing with binary data, let's go with a byte slice:
-
-```rust
-#[channel_recv]
-fn message_recv(_: u32, data: &[u8]) {
-}
-```
-
-And inside of that, let's just include a bit of code for converting back to an integer and printing it out to our terminal:
-
-```rust
-// convert &[u8] to [u8; 4]
-let count_bytes: [u8; 4] = data[..4].try_into().unwrap();
-
-// convert [u8; 4] to u32
-let file_count = u32::from_le_bytes(count_bytes);
-
-// print the file count to the terminal
-println!("Guest `/etc` file count: {}", file_count);
-```
-
-Next up, let's define our `init` function. Since all we need to do when our plugin is load the guest plugin:
-
-```rust
-#[panda::init]
-fn init(_: &mut PluginHandle) {
-    let mut channel = load_guest_plugin("your_guest_plugin_name", message_recv);
-
-    // if we needed to write to the channel at all we could do so here using
-    // std::io::Write, just like the guest plugin.
-}
-```
-
-Now we have everything we need for a fully-functional host plugin:
-
-```rust
-use panda::plugins::guest_plugin_manager::{load_guest_plugin, channel_recv};
-use panda::prelude::*;
-
-#[channel_recv]
-fn message_recv(_: u32, data: &[u8]) {
-    // convert &[u8] to [u8; 4]
-    let count_bytes: [u8; 4] = data[..4].try_into().unwrap();
-
-    // convert [u8; 4] to u32
-    let file_count = u32::from_le_bytes(count_bytes);
-
-    // print the file count to the terminal
-    println!("Guest `/etc` file count: {}", file_count);
-}
-
-#[panda::init]
-fn init(_: &mut PluginHandle) {
-    load_guest_plugin("your_guest_plugin_name", message_recv);
-}
-```
-
-If your plugin uses Rust 2018 edition then you'll also need to import `std::convert::TryInto`. If you forget this, no worries though, as rustc will remind you and tell you how to fix it:
-
-```
-help: the following trait is implemented but not in scope; perhaps add a `use` for it:
-    |
-1   | use std::convert::TryInto;
-    |
-```
-
-#### Building
-
-To build, we go through the standard PANDA build process:
-
-1. Create a `build` folder in the root of your clone of PANDA if you haven't already
-2. From within the build folder run `../build.sh`. In our case, we are only going to be testing on x86_64 while developing, so we can save ourselves some build time by only building a single architecture: `../build.sh x86_64-softmmu`
-
-#### Testing Our Guest Plugin
-
-The easiest way to test our plugin will be with a pypanda script. An example script can be found in [`panda/plugins/guest_plugin_example/try_it.py`](/panda/plugins/guest_plugin_example/try_it.py).
-
-```python
-from pandare import Panda
-
-panda = Panda(generic="x86_64")
-panda.load_plugin("guest_plugin_example")
-
-@panda.queue_blocking
-def run_cmd():
-    panda.revert_sync("root")
-    panda.run_serial_cmd("cat", no_timeout=True)
-    panda.run_serial_cmd("cat", no_timeout=True)
-
-    panda.end_analysis()
-
-panda.run()
-```
-
-Just replace `"guest_plugin_example"` with the name of your host PANDA plugin, then run the script. You should see roughly the following output:
-
-```
-$ python3 try_it.py
-
-[...]
-Guest `/etc` file count: 170
-```
-
-If you're getting this message, congrats! You've made your first PANDA guest plugin. If you're having trouble, a list of potential problems and solutions has been included below.
-
-### Troubleshooting
-
-If you issue is not listed here, ask for help in the PANDA/MIT Rehosting Slack, and we'll try to add it here.
-
-##### "No guest plugin path was provided but plugin could not be found"
-
-```
-thread '<unnamed>' panicked at 'No guest plugin path was provided but plugin "your_guest_plugin_name" could not be found, ensure "your_guest_plugin_name" has been built.', src/interface/api.rs:23:21
-note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
-fatal runtime error: failed to initiate panic, error 5
-Aborted (core dumped)
-```
-
-Fix steps:
-
-1. Ensure your guest plugin is listed in guest_plugins/config.panda
-2. Make sure you properly updated the guest plugin name in $host_plugin/src/lib.rs
-3. Double check for typos
-
-#### "Fatal error: could not find path for plugin"
-
-```
-PANDA[core]:Fatal error: could not find path for plugin your_plugin_name
-python3: {...}/panda/src/callbacks.c:166: _panda_load_plugin: Assertion `file name != NULL' failed.
-Aborted (core dumped)`
-```
-
-Fix steps:
-
-1. Ensure your host plugin is listed in panda/plugins/config.panda
-2. Ensure you didn't miss any build errors happening when building your host plugin
-
-
-#### "Failed to find channel number"
-
-```
-failed to find channel number
-```
-
-Fix steps:
-
-1. Ensure the name you include in $guest_plugin/src/main.rs is correct when you call `Channel::main`
-2. Ensure the name of the guest plugin itself is correct and contains no typos
diff --git a/panda/guest_plugins/config.panda b/panda/guest_plugins/config.panda
deleted file mode 100644
index af2bf46fe04..00000000000
--- a/panda/guest_plugins/config.panda
+++ /dev/null
@@ -1,3 +0,0 @@
-#rust_example
-tcp_servers
-guest_daemon
diff --git a/panda/guest_plugins/guest_daemon/Cargo.lock b/panda/guest_plugins/guest_daemon/Cargo.lock
deleted file mode 100644
index eadba358711..00000000000
--- a/panda/guest_plugins/guest_daemon/Cargo.lock
+++ /dev/null
@@ -1,257 +0,0 @@
-# This file is automatically @generated by Cargo.
-# It is not intended for manual editing.
-version = 3
-
-[[package]]
-name = "bitflags"
-version = "1.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
-
-[[package]]
-name = "cc"
-version = "1.0.73"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2fff2a6927b3bb87f9595d67196a70493f627687a71d87a0d692242c33f58c11"
-
-[[package]]
-name = "cfg-if"
-version = "0.1.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4785bdd1c96b2a846b2bd7cc02e86b6b3dbf14e7e53446c4f54c92a361040822"
-
-[[package]]
-name = "cfg-if"
-version = "1.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
-
-[[package]]
-name = "daemonize-me"
-version = "1.0.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "583332de51377006c0faf944fedde7edbfb857d6f79034925eab804cc97470ec"
-dependencies = [
- "libc",
- "nix",
- "snafu",
-]
-
-[[package]]
-name = "doc-comment"
-version = "0.3.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fea41bba32d969b513997752735605054bc0dfa92b4c56bf1189f2e174be7a10"
-
-[[package]]
-name = "guest_daemon"
-version = "0.1.0"
-dependencies = [
- "daemonize-me",
- "libc",
- "libloading",
- "memfd",
- "panda-channels",
-]
-
-[[package]]
-name = "instant"
-version = "0.1.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bee0328b1209d157ef001c94dd85b4f8f64139adb0eac2659f4b08382b2f474d"
-dependencies = [
- "cfg-if 1.0.0",
-]
-
-[[package]]
-name = "lazy_static"
-version = "1.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
-
-[[package]]
-name = "libc"
-version = "0.2.131"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "04c3b4822ccebfa39c02fc03d1534441b22ead323fa0f48bb7ddd8e6ba076a40"
-
-[[package]]
-name = "libloading"
-version = "0.7.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6f84d96438c15fcd6c3f244c8fce01d1e2b9c6b5623e9c711dc9286d8fc92d6a"
-dependencies = [
- "cfg-if 1.0.0",
- "winapi",
-]
-
-[[package]]
-name = "lock_api"
-version = "0.4.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "712a4d093c9976e24e7dbca41db895dabcbac38eb5f4045393d17a95bdfb1109"
-dependencies = [
- "scopeguard",
-]
-
-[[package]]
-name = "memfd"
-version = "0.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f6627dc657574b49d6ad27105ed671822be56e0d2547d413bfbf3e8d8fa92e7a"
-dependencies = [
- "libc",
-]
-
-[[package]]
-name = "nix"
-version = "0.17.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "50e4785f2c3b7589a0d0c1dd60285e1188adac4006e8abd6dd578e1567027363"
-dependencies = [
- "bitflags",
- "cc",
- "cfg-if 0.1.10",
- "libc",
- "void",
-]
-
-[[package]]
-name = "panda-channels"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "529d17650397380d80c95c6027ffcb48eaf4095a0c513eb7e827f0c3c0e52e9c"
-dependencies = [
- "lazy_static",
- "parking_lot",
-]
-
-[[package]]
-name = "parking_lot"
-version = "0.11.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7d17b78036a60663b797adeaee46f5c9dfebb86948d1255007a1d6be0271ff99"
-dependencies = [
- "instant",
- "lock_api",
- "parking_lot_core",
-]
-
-[[package]]
-name = "parking_lot_core"
-version = "0.8.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d76e8e1493bcac0d2766c42737f34458f1c8c50c0d23bcb24ea953affb273216"
-dependencies = [
- "cfg-if 1.0.0",
- "instant",
- "libc",
- "redox_syscall",
- "smallvec",
- "winapi",
-]
-
-[[package]]
-name = "proc-macro2"
-version = "1.0.43"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0a2ca2c61bc9f3d74d2886294ab7b9853abd9c1ad903a3ac7815c58989bb7bab"
-dependencies = [
- "unicode-ident",
-]
-
-[[package]]
-name = "quote"
-version = "1.0.21"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bbe448f377a7d6961e30f5955f9b8d106c3f5e449d493ee1b125c1d43c2b5179"
-dependencies = [
- "proc-macro2",
-]
-
-[[package]]
-name = "redox_syscall"
-version = "0.2.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8383f39639269cde97d255a32bdb68c047337295414940c68bdd30c2e13203ff"
-dependencies = [
- "bitflags",
-]
-
-[[package]]
-name = "scopeguard"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d29ab0c6d3fc0ee92fe66e2d99f700eab17a8d57d1c1d3b748380fb20baa78cd"
-
-[[package]]
-name = "smallvec"
-version = "1.6.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fe0f37c9e8f3c5a4a66ad655a93c74daac4ad00c441533bf5c6e7990bb42604e"
-
-[[package]]
-name = "snafu"
-version = "0.6.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eab12d3c261b2308b0d80c26fffb58d17eba81a4be97890101f416b478c79ca7"
-dependencies = [
- "doc-comment",
- "snafu-derive",
-]
-
-[[package]]
-name = "snafu-derive"
-version = "0.6.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1508efa03c362e23817f96cde18abed596a25219a8b2c66e8db33c03543d315b"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "syn"
-version = "1.0.99"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "58dbef6ec655055e20b86b15a8cc6d439cca19b667537ac6a1369572d151ab13"
-dependencies = [
- "proc-macro2",
- "quote",
- "unicode-ident",
-]
-
-[[package]]
-name = "unicode-ident"
-version = "1.0.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c4f5b37a154999a8f3f98cc23a628d850e154479cd94decf3414696e12e31aaf"
-
-[[package]]
-name = "void"
-version = "1.0.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6a02e4885ed3bc0f2de90ea6dd45ebcbb66dacffe03547fadbb0eeae2770887d"
-
-[[package]]
-name = "winapi"
-version = "0.3.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
-dependencies = [
- "winapi-i686-pc-windows-gnu",
- "winapi-x86_64-pc-windows-gnu",
-]
-
-[[package]]
-name = "winapi-i686-pc-windows-gnu"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
-
-[[package]]
-name = "winapi-x86_64-pc-windows-gnu"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
diff --git a/panda/guest_plugins/guest_daemon/Cargo.toml b/panda/guest_plugins/guest_daemon/Cargo.toml
deleted file mode 100644
index d262ac88a6a..00000000000
--- a/panda/guest_plugins/guest_daemon/Cargo.toml
+++ /dev/null
@@ -1,11 +0,0 @@
-[package]
-name = "guest_daemon"
-version = "0.1.0"
-edition = "2018"
-
-[dependencies]
-panda-channels = "0.3"
-memfd = "0.4.0"
-libloading = "0.7"
-daemonize-me = "1"
-libc = "0.2"
diff --git a/panda/guest_plugins/guest_daemon/Makefile b/panda/guest_plugins/guest_daemon/Makefile
deleted file mode 100644
index 1458392b517..00000000000
--- a/panda/guest_plugins/guest_daemon/Makefile
+++ /dev/null
@@ -1,20 +0,0 @@
-# Remember to:
-# * Add your plugin name to config.panda
-# * Keep your plugin name the same as the folder name and Cargo.toml package name
-
-# Output build artifacts to the build directory
-PLUGIN_ARTIFACTS_DIR = $(PLUGIN_TARGET_DIR)/$(PLUGIN_NAME)/target
-
-# recompile if any of the src/*.rs files changed, or Cargo.toml
-RUST_SOURCE = $(wildcard $(PLUGIN_DIR)/src/*.rs)
-PLUGIN_DEPS=$(RUST_SOURCE) $(PLUGIN_DIR)/Cargo.toml
-
-$(PLUGIN_OUT_PATH): BUILD_RESULT="$(PLUGIN_ARTIFACTS_DIR)/$(TARGET_TRIPLE)/release/$(PLUGIN_NAME)"
-$(PLUGIN_OUT_PATH): $(PLUGIN_DEPS)
-	@echo "  CARGO   $(PLUGIN_NAME) (${TARGET_TRIPLE})"
-	@CARGO_TERM_PROGRESS_WHEN=never cargo build --release \
-		--target=$(TARGET_TRIPLE) \
-		--manifest-path=$(PLUGIN_DIR)/Cargo.toml \
-		--target-dir=$(PLUGIN_ARTIFACTS_DIR)
-	@mkdir -p $(PLUGIN_BIN_DIR)
-	@cp -p $(BUILD_RESULT) $@
diff --git a/panda/guest_plugins/guest_daemon/src/loader.rs b/panda/guest_plugins/guest_daemon/src/loader.rs
deleted file mode 100644
index 5b38c926dfd..00000000000
--- a/panda/guest_plugins/guest_daemon/src/loader.rs
+++ /dev/null
@@ -1,44 +0,0 @@
-use memfd::MemfdOptions;
-use std::{
-    fs,
-    io::Write,
-    os::unix::{fs::OpenOptionsExt, prelude::AsRawFd},
-    process::Command,
-};
-
-pub(crate) fn load_plugin(payload: Vec<u8>) {
-    let (path, mut file) = if let Ok(plugin_file) = MemfdOptions::new().create("pluginfd") {
-        let fd = plugin_file.as_raw_fd();
-
-        (format!("/proc/self/fd/{}", fd), plugin_file.into_file())
-    } else {
-        match fs::OpenOptions::new()
-            .create(true)
-            .write(true)
-            .mode(0o777)
-            .custom_flags(libc::O_CLOEXEC)
-            .open("/tmp/plugin_file")
-        {
-            Ok(file) => (String::from("/tmp/plugin_file"), file),
-            Err(err) => {
-                eprintln!("Failed to write to /tmp");
-                panic!("{:?}", err);
-            }
-        }
-    };
-
-    file.write_all(&payload).unwrap();
-    let _ = file.flush();
-    let _ = file.sync_all();
-
-    let mut file = Some(file);
-
-    if path.starts_with("/tmp") {
-        drop(file.take());
-    }
-
-    eprintln!("Running guest plugin...");
-    Command::new(path)
-        .spawn()
-        .expect("Failed to run guest plugin");
-}
diff --git a/panda/guest_plugins/guest_daemon/src/main.rs b/panda/guest_plugins/guest_daemon/src/main.rs
deleted file mode 100644
index c527819d346..00000000000
--- a/panda/guest_plugins/guest_daemon/src/main.rs
+++ /dev/null
@@ -1,65 +0,0 @@
-use panda_channels::{get_main_raw_channel, hypercall, RawChannel};
-use std::{io::Write, thread, time::Duration};
-
-mod loader;
-
-enum PacketKind {
-    LoadPlugin = 0,
-}
-
-struct Packet {
-    kind: PacketKind,
-    payload: Vec<u8>,
-}
-
-fn read_packet(reader: &mut RawChannel) -> Option<Packet> {
-    let mut temp_buf = vec![0u8; 4096 as _];
-    temp_buf.fill(1);
-
-    let mut payload = vec![];
-    loop {
-        match reader.read_packet(&mut temp_buf) {
-            0 => break,
-            _ => {
-                payload.write_all(&temp_buf).unwrap();
-            }
-        }
-    }
-
-    if payload.is_empty() {
-        return None;
-    }
-
-    Some(Packet {
-        kind: PacketKind::LoadPlugin,
-        payload,
-    })
-}
-
-fn main() {
-    eprintln!("at main.rs in guest_daemon");
-
-    eprintln!("Daemonizing...");
-    daemonize_me::Daemon::new()
-        .start()
-        .expect("Failed to daemonize");
-    eprintln!("Finished daemonizing");
-
-    while !hypercall::start() {
-        thread::yield_now();
-    }
-
-    let mut channel = get_main_raw_channel("guest_daemon").unwrap();
-
-    loop {
-        match read_packet(&mut channel) {
-            Some(Packet {
-                kind: PacketKind::LoadPlugin,
-                payload,
-            }) => loader::load_plugin(payload),
-            None => {
-                thread::sleep(Duration::from_millis(10));
-            }
-        }
-    }
-}
diff --git a/panda/guest_plugins/panda.mak b/panda/guest_plugins/panda.mak
deleted file mode 100644
index c84fb4c1014..00000000000
--- a/panda/guest_plugins/panda.mak
+++ /dev/null
@@ -1,53 +0,0 @@
-include config-target.mak
-
-ifndef PLUGIN_SRC_ROOT
-$(error PLUGIN_SRC_ROOT is not set)
-endif
-ifndef PLUGIN_NAME
-$(error PLUGIN_NAME is not set)
-endif
-
-PLUGIN_DIR = $(realpath $(join $(PLUGIN_SRC_ROOT), /$(PLUGIN_NAME)/))
-PLUGIN_TARGET_DIR=panda/guest_plugins
-PLUGIN_BIN_DIR=$(PLUGIN_TARGET_DIR)/bin
-PLUGIN_OUT_PATH=$(PLUGIN_BIN_DIR)/$(PLUGIN_NAME)
-
-export CARGO_TARGET_ARMV5TE_UNKNOWN_LINUX_MUSLEABI_LINKER ?= arm-linux-musleabi-cc
-export CARGO_TARGET_ARMV5TE_UNKNOWN_LINUX_MUSLEABI_RUSTFLAGS = -C target-cpu=arm926ej-s
-
-export CARGO_TARGET_MIPS_UNKNOWN_LINUX_MUSL_LINKER ?= mips-linux-musl-cc
-#export CARGO_TARGET_MIPS_UNKNOWN_LINUX_MUSL_RUSTFLAGS = "-C linker=mips-linux-musl-cc"
-
-export CARGO_TARGET_MIPSEL_UNKNOWN_LINUX_MUSL_LINKER ?= mipsel-linux-musl-cc
-
-export CARGO_TARGET_AARCH64_UNKNOWN_LINUX_MUSL_LINKER ?= aarch64-linux-musl-cc
-
-export CARGO_TARGET_MIPS64_UNKNOWN_LINUX_MUSLABI64_LINKER ?= mips64-linux-musl-cc
-
-BUILD_TARGET=$(addprefix build-,$(TARGET_NAME))
-
-all: $(BUILD_TARGET)
-
-build-x86_64: TARGET_TRIPLE=x86_64-unknown-linux-musl
-build-x86_64: $(PLUGIN_OUT_PATH)
-
-build-i386: TARGET_TRIPLE=i686-unknown-linux-musl
-build-i386: $(PLUGIN_OUT_PATH)
-
-build-arm: TARGET_TRIPLE=armv5te-unknown-linux-musleabi
-build-arm: $(PLUGIN_OUT_PATH)
-
-build-aarch64: TARGET_TRIPLE=aarch64-unknown-linux-musl
-build-aarch64: $(PLUGIN_OUT_PATH)
-
-build-mips: TARGET_TRIPLE=mips-unknown-linux-musl
-build-mips: $(PLUGIN_OUT_PATH)
-
-build-mipsel: TARGET_TRIPLE=mipsel-unknown-linux-musl
-build-mipsel: $(PLUGIN_OUT_PATH)
-
-build-mips64: TARGET_TRIPLE=mips64-unknown-linux-muslabi64
-build-mips64: $(PLUGIN_OUT_PATH)
-
-# Do not build for PowerPC
-build-ppc: ;
diff --git a/panda/guest_plugins/rust_example/Cargo.lock b/panda/guest_plugins/rust_example/Cargo.lock
deleted file mode 100644
index 568faf6b7d8..00000000000
--- a/panda/guest_plugins/rust_example/Cargo.lock
+++ /dev/null
@@ -1,130 +0,0 @@
-# This file is automatically @generated by Cargo.
-# It is not intended for manual editing.
-version = 3
-
-[[package]]
-name = "bitflags"
-version = "1.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
-
-[[package]]
-name = "cfg-if"
-version = "1.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
-
-[[package]]
-name = "instant"
-version = "0.1.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7a5bbe824c507c5da5956355e86a746d82e0e1464f65d862cc5e71da70e94b2c"
-dependencies = [
- "cfg-if",
-]
-
-[[package]]
-name = "lazy_static"
-version = "1.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
-
-[[package]]
-name = "libc"
-version = "0.2.109"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f98a04dce437184842841303488f70d0188c5f51437d2a834dc097eafa909a01"
-
-[[package]]
-name = "lock_api"
-version = "0.4.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "712a4d093c9976e24e7dbca41db895dabcbac38eb5f4045393d17a95bdfb1109"
-dependencies = [
- "scopeguard",
-]
-
-[[package]]
-name = "panda-channels"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a94b07d8bcc852032a8deb91be9d2bbd59421d776a9edb42fc74b40816e7d940"
-dependencies = [
- "lazy_static",
- "parking_lot",
-]
-
-[[package]]
-name = "parking_lot"
-version = "0.11.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7d17b78036a60663b797adeaee46f5c9dfebb86948d1255007a1d6be0271ff99"
-dependencies = [
- "instant",
- "lock_api",
- "parking_lot_core",
-]
-
-[[package]]
-name = "parking_lot_core"
-version = "0.8.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d76e8e1493bcac0d2766c42737f34458f1c8c50c0d23bcb24ea953affb273216"
-dependencies = [
- "cfg-if",
- "instant",
- "libc",
- "redox_syscall",
- "smallvec",
- "winapi",
-]
-
-[[package]]
-name = "redox_syscall"
-version = "0.2.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8383f39639269cde97d255a32bdb68c047337295414940c68bdd30c2e13203ff"
-dependencies = [
- "bitflags",
-]
-
-[[package]]
-name = "rust_example"
-version = "0.1.0"
-dependencies = [
- "panda-channels",
-]
-
-[[package]]
-name = "scopeguard"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d29ab0c6d3fc0ee92fe66e2d99f700eab17a8d57d1c1d3b748380fb20baa78cd"
-
-[[package]]
-name = "smallvec"
-version = "1.7.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ecab6c735a6bb4139c0caafd0cc3635748bbb3acf4550e8138122099251f309"
-
-[[package]]
-name = "winapi"
-version = "0.3.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
-dependencies = [
- "winapi-i686-pc-windows-gnu",
- "winapi-x86_64-pc-windows-gnu",
-]
-
-[[package]]
-name = "winapi-i686-pc-windows-gnu"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
-
-[[package]]
-name = "winapi-x86_64-pc-windows-gnu"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
diff --git a/panda/guest_plugins/rust_example/Cargo.toml b/panda/guest_plugins/rust_example/Cargo.toml
deleted file mode 100644
index 193c1885fe7..00000000000
--- a/panda/guest_plugins/rust_example/Cargo.toml
+++ /dev/null
@@ -1,7 +0,0 @@
-[package]
-name = "rust_example"
-version = "0.1.0"
-edition = "2021"
-
-[dependencies]
-panda-channels = "0.3"
diff --git a/panda/guest_plugins/rust_example/Makefile b/panda/guest_plugins/rust_example/Makefile
deleted file mode 100644
index 1458392b517..00000000000
--- a/panda/guest_plugins/rust_example/Makefile
+++ /dev/null
@@ -1,20 +0,0 @@
-# Remember to:
-# * Add your plugin name to config.panda
-# * Keep your plugin name the same as the folder name and Cargo.toml package name
-
-# Output build artifacts to the build directory
-PLUGIN_ARTIFACTS_DIR = $(PLUGIN_TARGET_DIR)/$(PLUGIN_NAME)/target
-
-# recompile if any of the src/*.rs files changed, or Cargo.toml
-RUST_SOURCE = $(wildcard $(PLUGIN_DIR)/src/*.rs)
-PLUGIN_DEPS=$(RUST_SOURCE) $(PLUGIN_DIR)/Cargo.toml
-
-$(PLUGIN_OUT_PATH): BUILD_RESULT="$(PLUGIN_ARTIFACTS_DIR)/$(TARGET_TRIPLE)/release/$(PLUGIN_NAME)"
-$(PLUGIN_OUT_PATH): $(PLUGIN_DEPS)
-	@echo "  CARGO   $(PLUGIN_NAME) (${TARGET_TRIPLE})"
-	@CARGO_TERM_PROGRESS_WHEN=never cargo build --release \
-		--target=$(TARGET_TRIPLE) \
-		--manifest-path=$(PLUGIN_DIR)/Cargo.toml \
-		--target-dir=$(PLUGIN_ARTIFACTS_DIR)
-	@mkdir -p $(PLUGIN_BIN_DIR)
-	@cp -p $(BUILD_RESULT) $@
diff --git a/panda/guest_plugins/rust_example/src/main.rs b/panda/guest_plugins/rust_example/src/main.rs
deleted file mode 100644
index e77424c9ff7..00000000000
--- a/panda/guest_plugins/rust_example/src/main.rs
+++ /dev/null
@@ -1,23 +0,0 @@
-use panda_channels::Channel;
-use std::io::{Read, Write};
-
-fn main() {
-    // This print won't be visible outside of the serial log
-    println!("Hello, world!");
-
-    // Get the main channel for our plugin by name
-    let mut channel = Channel::main("rust_example").unwrap();
-
-    // Write some text to the channel using the standard std::io::Write interface
-    channel.write_all(b"Hello rust_example channel").unwrap();
-
-    // Or use formatting utilties to do so
-    writeln!(&mut channel, "today's lucky number is: {}", 3).unwrap();
-
-    // The channel can also be read from
-    let mut buf = [0; 4];
-    channel.read_exact(&mut buf).unwrap();
-
-    let num = u32::from_le_bytes(buf);
-    writeln!(&mut channel, "the number you sent the guest was: {}", num).unwrap();
-}
diff --git a/panda/guest_plugins/tcp_servers/Cargo.lock b/panda/guest_plugins/tcp_servers/Cargo.lock
deleted file mode 100644
index cc542916090..00000000000
--- a/panda/guest_plugins/tcp_servers/Cargo.lock
+++ /dev/null
@@ -1,217 +0,0 @@
-# This file is automatically @generated by Cargo.
-# It is not intended for manual editing.
-version = 3
-
-[[package]]
-name = "autocfg"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d468802bab17cbc0cc575e9b053f41e72aa36bfa6b7f55e3529ffa43161b97fa"
-
-[[package]]
-name = "bincode"
-version = "1.3.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b1f45e9417d87227c7a56d22e471c6206462cba514c7590c09aff4cf6d1ddcad"
-dependencies = [
- "serde",
-]
-
-[[package]]
-name = "bitflags"
-version = "1.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
-
-[[package]]
-name = "cfg-if"
-version = "1.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
-
-[[package]]
-name = "instant"
-version = "0.1.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7a5bbe824c507c5da5956355e86a746d82e0e1464f65d862cc5e71da70e94b2c"
-dependencies = [
- "cfg-if",
-]
-
-[[package]]
-name = "lazy_static"
-version = "1.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
-
-[[package]]
-name = "libc"
-version = "0.2.126"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "349d5a591cd28b49e1d1037471617a32ddcda5731b99419008085f72d5a53836"
-
-[[package]]
-name = "lock_api"
-version = "0.4.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "327fa5b6a6940e4699ec49a9beae1ea4845c6bab9314e4f84ac68742139d8c53"
-dependencies = [
- "autocfg",
- "scopeguard",
-]
-
-[[package]]
-name = "panda-channels"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "529d17650397380d80c95c6027ffcb48eaf4095a0c513eb7e827f0c3c0e52e9c"
-dependencies = [
- "lazy_static",
- "parking_lot",
-]
-
-[[package]]
-name = "parking_lot"
-version = "0.11.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7d17b78036a60663b797adeaee46f5c9dfebb86948d1255007a1d6be0271ff99"
-dependencies = [
- "instant",
- "lock_api",
- "parking_lot_core",
-]
-
-[[package]]
-name = "parking_lot_core"
-version = "0.8.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d76e8e1493bcac0d2766c42737f34458f1c8c50c0d23bcb24ea953affb273216"
-dependencies = [
- "cfg-if",
- "instant",
- "libc",
- "redox_syscall",
- "smallvec",
- "winapi",
-]
-
-[[package]]
-name = "proc-macro2"
-version = "1.0.39"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c54b25569025b7fc9651de43004ae593a75ad88543b17178aa5e1b9c4f15f56f"
-dependencies = [
- "unicode-ident",
-]
-
-[[package]]
-name = "proc-net-tcp"
-version = "1.0.0"
-source = "git+https://github.com/panda-re/proc-net-tcp#87de3e9ce7adeda56d75c13dc0b510136ee675b2"
-
-[[package]]
-name = "quote"
-version = "1.0.18"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a1feb54ed693b93a84e14094943b84b7c4eae204c512b7ccb95ab0c66d278ad1"
-dependencies = [
- "proc-macro2",
-]
-
-[[package]]
-name = "redox_syscall"
-version = "0.2.13"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "62f25bc4c7e55e0b0b7a1d43fb893f4fa1361d0abe38b9ce4f323c2adfe6ef42"
-dependencies = [
- "bitflags",
-]
-
-[[package]]
-name = "scopeguard"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d29ab0c6d3fc0ee92fe66e2d99f700eab17a8d57d1c1d3b748380fb20baa78cd"
-
-[[package]]
-name = "serde"
-version = "1.0.137"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "61ea8d54c77f8315140a05f4c7237403bf38b72704d031543aa1d16abbf517d1"
-dependencies = [
- "serde_derive",
-]
-
-[[package]]
-name = "serde_derive"
-version = "1.0.137"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1f26faba0c3959972377d3b2d306ee9f71faee9714294e41bb777f83f88578be"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "smallvec"
-version = "1.8.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2dd574626839106c320a323308629dcb1acfc96e32a8cba364ddc61ac23ee83"
-
-[[package]]
-name = "syn"
-version = "1.0.96"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0748dd251e24453cb8717f0354206b91557e4ec8703673a4b30208f2abaf1ebf"
-dependencies = [
- "proc-macro2",
- "quote",
- "unicode-ident",
-]
-
-[[package]]
-name = "tcp_servers"
-version = "0.1.0"
-dependencies = [
- "bincode",
- "panda-channels",
- "proc-net-tcp",
- "serde",
- "tcp_shared_types",
-]
-
-[[package]]
-name = "tcp_shared_types"
-version = "0.1.0"
-dependencies = [
- "serde",
-]
-
-[[package]]
-name = "unicode-ident"
-version = "1.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5bd2fe26506023ed7b5e1e315add59d6f584c621d037f9368fea9cfb988f368c"
-
-[[package]]
-name = "winapi"
-version = "0.3.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
-dependencies = [
- "winapi-i686-pc-windows-gnu",
- "winapi-x86_64-pc-windows-gnu",
-]
-
-[[package]]
-name = "winapi-i686-pc-windows-gnu"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
-
-[[package]]
-name = "winapi-x86_64-pc-windows-gnu"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
diff --git a/panda/guest_plugins/tcp_servers/Cargo.toml b/panda/guest_plugins/tcp_servers/Cargo.toml
deleted file mode 100644
index 6ec634079ae..00000000000
--- a/panda/guest_plugins/tcp_servers/Cargo.toml
+++ /dev/null
@@ -1,12 +0,0 @@
-[package]
-name = "tcp_servers"
-version = "0.1.0"
-edition = "2021"
-
-[dependencies]
-panda-channels = "0.3"
-bincode = "1"
-serde = { version = "1", features = ["derive"] }
-
-proc-net-tcp = { git = "https://github.com/panda-re/proc-net-tcp" }
-tcp_shared_types = { path = "../../plugins/tcp_passthrough/tcp_shared_types" }
diff --git a/panda/guest_plugins/tcp_servers/Makefile b/panda/guest_plugins/tcp_servers/Makefile
deleted file mode 100644
index 1458392b517..00000000000
--- a/panda/guest_plugins/tcp_servers/Makefile
+++ /dev/null
@@ -1,20 +0,0 @@
-# Remember to:
-# * Add your plugin name to config.panda
-# * Keep your plugin name the same as the folder name and Cargo.toml package name
-
-# Output build artifacts to the build directory
-PLUGIN_ARTIFACTS_DIR = $(PLUGIN_TARGET_DIR)/$(PLUGIN_NAME)/target
-
-# recompile if any of the src/*.rs files changed, or Cargo.toml
-RUST_SOURCE = $(wildcard $(PLUGIN_DIR)/src/*.rs)
-PLUGIN_DEPS=$(RUST_SOURCE) $(PLUGIN_DIR)/Cargo.toml
-
-$(PLUGIN_OUT_PATH): BUILD_RESULT="$(PLUGIN_ARTIFACTS_DIR)/$(TARGET_TRIPLE)/release/$(PLUGIN_NAME)"
-$(PLUGIN_OUT_PATH): $(PLUGIN_DEPS)
-	@echo "  CARGO   $(PLUGIN_NAME) (${TARGET_TRIPLE})"
-	@CARGO_TERM_PROGRESS_WHEN=never cargo build --release \
-		--target=$(TARGET_TRIPLE) \
-		--manifest-path=$(PLUGIN_DIR)/Cargo.toml \
-		--target-dir=$(PLUGIN_ARTIFACTS_DIR)
-	@mkdir -p $(PLUGIN_BIN_DIR)
-	@cp -p $(BUILD_RESULT) $@
diff --git a/panda/guest_plugins/tcp_servers/src/allow_cancel.rs b/panda/guest_plugins/tcp_servers/src/allow_cancel.rs
deleted file mode 100644
index 83da71f9661..00000000000
--- a/panda/guest_plugins/tcp_servers/src/allow_cancel.rs
+++ /dev/null
@@ -1,110 +0,0 @@
-use std::io::{self, Read, Seek, SeekFrom, Write};
-use std::sync::{
-    atomic::{AtomicBool, Ordering},
-    Arc,
-};
-
-pub struct AllowCancel<T>(T, Arc<AtomicBool>);
-
-#[derive(Clone)]
-pub struct CancelSignal(Arc<AtomicBool>);
-
-impl CancelSignal {
-    pub fn cancel(&self) {
-        self.0.store(true, Ordering::SeqCst)
-    }
-}
-
-impl Clone for AllowCancel<panda_channels::Channel> {
-    fn clone(&self) -> Self {
-        Self(self.0.clone(), Arc::clone(&self.1))
-    }
-}
-
-impl<T> AllowCancel<T> {
-    pub fn new(io: T) -> Self {
-        Self(io, Arc::new(AtomicBool::new(false)))
-    }
-
-    pub fn cancel_signal(&self) -> CancelSignal {
-        CancelSignal(Arc::clone(&self.1))
-    }
-
-    pub fn with_signal(self, cancel_signal: CancelSignal) -> Self {
-        Self(self.0, cancel_signal.0)
-    }
-}
-
-macro_rules! dbg {
-    ($expr:expr) => {
-        //panda_channels::Channel::main(&format!(
-        //    "[{}:{}] {} = {:?}",
-        //    file!(),
-        //    line!(),
-        //    stringify!($expr),
-        //    $expr,
-        //))
-    };
-}
-
-impl<T: Write> Write for AllowCancel<T> {
-    fn write(&mut self, buf: &[u8]) -> std::io::Result<usize> {
-        if !self.1.load(Ordering::SeqCst) {
-            dbg!(buf.len());
-
-            self.0.write(buf)
-        } else {
-            Err(io::Error::new(
-                io::ErrorKind::ConnectionAborted,
-                "Connection ended",
-            ))
-        }
-    }
-
-    fn flush(&mut self) -> io::Result<()> {
-        if !self.1.load(Ordering::SeqCst) {
-            dbg!("flushing");
-
-            self.0.flush()
-        } else {
-            Err(io::Error::new(
-                io::ErrorKind::ConnectionAborted,
-                "Connection ended",
-            ))
-        }
-    }
-}
-
-impl<T: Read> Read for AllowCancel<T> {
-    fn read(&mut self, buf: &mut [u8]) -> io::Result<usize> {
-        if !self.1.load(Ordering::SeqCst) {
-            //dbg!(buf.len());
-
-            self.0.read(buf).map(|len| {
-                if len != 0 {
-                    dbg!(len);
-                }
-
-                len
-            })
-        } else {
-            Err(io::Error::new(
-                io::ErrorKind::ConnectionAborted,
-                "Connection ended",
-            ))
-        }
-    }
-}
-
-impl<T: Seek> Seek for AllowCancel<T> {
-    fn seek(&mut self, pos: SeekFrom) -> io::Result<u64> {
-        if !self.1.load(Ordering::SeqCst) {
-            self.0.seek(pos)
-        } else {
-            Err(io::Error::new(
-                io::ErrorKind::ConnectionAborted,
-                "Connection ended",
-            ))
-        }
-    }
-}
diff --git a/panda/guest_plugins/tcp_servers/src/main.rs b/panda/guest_plugins/tcp_servers/src/main.rs
deleted file mode 100644
index 4b2c4927410..00000000000
--- a/panda/guest_plugins/tcp_servers/src/main.rs
+++ /dev/null
@@ -1,99 +0,0 @@
-use panda_channels::{Channel, RawChannel};
-use proc_net_tcp::socket_info;
-
-use std::collections::HashMap;
-use std::mem::transmute;
-use std::net::{Ipv4Addr, TcpStream};
-
-use tcp_shared_types::{Request, SocketInfo};
-
-mod allow_cancel;
-use allow_cancel::{AllowCancel, CancelSignal};
-
-fn recv_request(mut channel: &mut Channel) -> Request {
-    loop {
-        if let Ok(request) = bincode::deserialize_from(&mut channel) {
-            break request;
-        }
-
-        std::thread::sleep(std::time::Duration::from_millis(10));
-    }
-}
-
-fn build_socket_list_packet() -> Vec<u8> {
-    let sockets = socket_info()
-        .into_iter()
-        .filter_map(|socket| {
-            socket.ok().map(|socket| SocketInfo {
-                ip: *socket.local_address.ip(),
-                port: socket.local_address.port(),
-                pid: socket.owning_pid,
-                server: socket.is_listening(),
-            })
-        })
-        .collect::<Vec<_>>();
-
-    bincode::serialize(&sockets).unwrap()
-}
-
-fn forward_connection(ip: Ipv4Addr, port: u16, channel_id: u32) -> CancelSignal {
-    let raw = unsafe { transmute(channel_id) };
-
-    let mut write_channel = AllowCancel::new(Channel::from_raw(raw));
-    let mut read_channel = write_channel.clone();
-
-    let cancel_signal = write_channel.cancel_signal();
-
-    let write_socket = TcpStream::connect((ip, port)).unwrap();
-    let read_socket = write_socket.try_clone().unwrap();
-
-    let mut read_socket = AllowCancel::new(read_socket).with_signal(cancel_signal.clone());
-    let mut write_socket = AllowCancel::new(write_socket).with_signal(cancel_signal.clone());
-
-    std::thread::spawn(move || {
-        let _ = std::io::copy(&mut read_channel, &mut write_socket);
-    });
-
-    std::thread::spawn(move || {
-        let _ = std::io::copy(&mut read_socket, &mut write_channel);
-    });
-
-    cancel_signal
-}
-
-fn main() {
-    let mut channel = Channel::main("tcp_servers").unwrap();
-    let mut active_sockets = HashMap::new();
-
-    loop {
-        let request = recv_request(&mut channel);
-
-        // debug??
-        //let _ = Channel::main(&format!("Request: {:?}", request));
-        //panda_channels::debug_output(&);
-        match request {
-            Request::GetSocketList { channel_id } => {
-                eprintln!("Getting socket list...");
-                let socket_list_channel: RawChannel = unsafe { transmute(channel_id) };
-
-                socket_list_channel.write_packet(&build_socket_list_packet());
-            }
-
-            Request::ForwardConnection {
-                ip,
-                port,
-                channel_id,
-            } => {
-                let cancel_signal = forward_connection(ip, port, channel_id);
-
-                active_sockets.insert(channel_id, cancel_signal);
-            }
-
-            Request::CloseSocket { channel_id } => {
-                if let Some(socket) = active_sockets.remove(&channel_id) {
-                    socket.cancel();
-                }
-            }
-        }
-    }
-}
diff --git a/panda/include/panda/plugin.h b/panda/include/panda/plugin.h
index 39edeecc3b1..e3b79f895a9 100644
--- a/panda/include/panda/plugin.h
+++ b/panda/include/panda/plugin.h
@@ -159,8 +159,6 @@ char** str_split(char *a_str, const char a_delim);
 extern gchar *panda_argv[MAX_PANDA_PLUGIN_ARGS];
 extern int panda_argc;
 
-
-char *panda_guest_plugin_path(const char *name);
 char* resolve_file_from_plugin_directory(const char* file_name_fmt, const char* name);
 char *panda_plugin_path(const char *name);
 char* panda_shared_library_path(const char* name);
diff --git a/panda/plugins/config.panda b/panda/plugins/config.panda
index 92f7580ca38..60b8166f4af 100644
--- a/panda/plugins/config.panda
+++ b/panda/plugins/config.panda
@@ -12,18 +12,12 @@ dynamic_symbols
 edge_coverage
 filereadmon
 forcedexec
-frida
 gdb
-guest_plugin_example
-guest_plugin_manager
-guest_shell
 hooks
 hooks2
-hyperfuse
 hw_proc_id
 libfi
 lighthouse_coverage
-linjector
 loaded
 loaded_libs
 mem_hooks
@@ -38,7 +32,6 @@ osi_test
 pri
 pri_dwarf
 pri_simple
-tcp_passthrough
 proc_start_linux
 proc_trace
 recctrl
diff --git a/panda/plugins/frida/Cargo.lock b/panda/plugins/frida/Cargo.lock
deleted file mode 100644
index 5bb3343b3ba..00000000000
--- a/panda/plugins/frida/Cargo.lock
+++ /dev/null
@@ -1,608 +0,0 @@
-# This file is automatically @generated by Cargo.
-# It is not intended for manual editing.
-version = 3
-
-[[package]]
-name = "aho-corasick"
-version = "0.7.18"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e37cfd5e7657ada45f742d6e99ca5788580b5c529dc78faf11ece6dc702656f"
-dependencies = [
- "memchr",
-]
-
-[[package]]
-name = "atty"
-version = "0.2.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d9b39be18770d11421cdb1b9947a45dd3f37e93092cbf377614828a319d5fee8"
-dependencies = [
- "hermit-abi",
- "libc",
- "winapi",
-]
-
-[[package]]
-name = "bitflags"
-version = "1.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
-
-[[package]]
-name = "cfg-if"
-version = "1.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
-
-[[package]]
-name = "ctor"
-version = "0.1.21"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ccc0a48a9b826acdf4028595adc9db92caea352f7af011a3034acd172a52a0aa"
-dependencies = [
- "quote",
- "syn",
-]
-
-[[package]]
-name = "darling"
-version = "0.10.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0d706e75d87e35569db781a9b5e2416cff1236a47ed380831f959382ccd5f858"
-dependencies = [
- "darling_core",
- "darling_macro",
-]
-
-[[package]]
-name = "darling_core"
-version = "0.10.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f0c960ae2da4de88a91b2d920c2a7233b400bc33cb28453a2987822d8392519b"
-dependencies = [
- "fnv",
- "ident_case",
- "proc-macro2",
- "quote",
- "strsim",
- "syn",
-]
-
-[[package]]
-name = "darling_macro"
-version = "0.10.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d9b5a2f4ac4969822c62224815d069952656cadc7084fdca9751e6d959189b72"
-dependencies = [
- "darling_core",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "dirs"
-version = "3.0.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "30baa043103c9d0c2a57cf537cc2f35623889dc0d405e6c3cccfadbc81c71309"
-dependencies = [
- "dirs-sys",
-]
-
-[[package]]
-name = "dirs-sys"
-version = "0.3.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "03d86534ed367a67548dc68113a0f5db55432fdfbb6e6f9d77704397d95d5780"
-dependencies = [
- "libc",
- "redox_users",
- "winapi",
-]
-
-[[package]]
-name = "doc-comment"
-version = "0.3.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fea41bba32d969b513997752735605054bc0dfa92b4c56bf1189f2e174be7a10"
-
-[[package]]
-name = "env_logger"
-version = "0.7.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "44533bbbb3bb3c1fa17d9f2e4e38bbbaf8396ba82193c4cb1b6445d711445d36"
-dependencies = [
- "atty",
- "humantime",
- "log",
- "regex",
- "termcolor",
-]
-
-[[package]]
-name = "fnv"
-version = "1.0.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
-
-[[package]]
-name = "frida"
-version = "0.1.0"
-dependencies = [
- "log",
- "panda-re",
- "parking_lot",
- "pretty_env_logger",
-]
-
-[[package]]
-name = "getrandom"
-version = "0.2.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7fcd999463524c52659517fe2cea98493cfe485d10565e7b0fb07dbba7ad2753"
-dependencies = [
- "cfg-if",
- "libc",
- "wasi",
-]
-
-[[package]]
-name = "ghost"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1a5bcf1bbeab73aa4cf2fde60a846858dc036163c7c33bec309f8d17de785479"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "glib-sys"
-version = "0.10.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c7e9b997a66e9a23d073f2b1abb4dbfc3925e0b8952f67efd8d9b6e168e4cdc1"
-dependencies = [
- "libc",
- "system-deps",
-]
-
-[[package]]
-name = "heck"
-version = "0.3.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6d621efb26863f0e9924c6ac577e8275e5e6b77455db64ffa6c65c904e9e132c"
-dependencies = [
- "unicode-segmentation",
-]
-
-[[package]]
-name = "hermit-abi"
-version = "0.1.19"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "62b467343b94ba476dcb2500d242dadbb39557df889310ac77c5d99100aaac33"
-dependencies = [
- "libc",
-]
-
-[[package]]
-name = "humantime"
-version = "1.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "df004cfca50ef23c36850aaaa59ad52cc70d0e90243c3c7737a4dd32dc7a3c4f"
-dependencies = [
- "quick-error",
-]
-
-[[package]]
-name = "ident_case"
-version = "1.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b9e0384b61958566e926dc50660321d12159025e767c18e043daf26b70104c39"
-
-[[package]]
-name = "instant"
-version = "0.1.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7a5bbe824c507c5da5956355e86a746d82e0e1464f65d862cc5e71da70e94b2c"
-dependencies = [
- "cfg-if",
-]
-
-[[package]]
-name = "inventory"
-version = "0.1.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f0eb5160c60ba1e809707918ee329adb99d222888155835c6feedba19f6c3fd4"
-dependencies = [
- "ctor",
- "ghost",
- "inventory-impl",
-]
-
-[[package]]
-name = "inventory-impl"
-version = "0.1.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7e41b53715c6f0c4be49510bb82dee2c1e51c8586d885abe65396e82ed518548"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "lazy_static"
-version = "1.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
-
-[[package]]
-name = "libc"
-version = "0.2.112"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1b03d17f364a3a042d5e5d46b053bbbf82c92c9430c592dd4c064dc6ee997125"
-
-[[package]]
-name = "libloading"
-version = "0.6.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "351a32417a12d5f7e82c368a66781e307834dae04c6ce0cd4456d52989229883"
-dependencies = [
- "cfg-if",
- "winapi",
-]
-
-[[package]]
-name = "lock_api"
-version = "0.4.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "712a4d093c9976e24e7dbca41db895dabcbac38eb5f4045393d17a95bdfb1109"
-dependencies = [
- "scopeguard",
-]
-
-[[package]]
-name = "log"
-version = "0.4.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "51b9bbe6c47d51fc3e1a9b945965946b4c44142ab8792c50835a980d362c2710"
-dependencies = [
- "cfg-if",
-]
-
-[[package]]
-name = "memchr"
-version = "2.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "308cc39be01b73d0d18f82a0e7b2a3df85245f84af96fdddc5d202d27e47b86a"
-
-[[package]]
-name = "once_cell"
-version = "1.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "da32515d9f6e6e489d7bc9d84c71b060db7247dc035bbe44eac88cf87486d8d5"
-
-[[package]]
-name = "panda-re"
-version = "0.26.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2dfc5b9d238b9f1d4785346b7d611dcc4236f615334e0719afbf3033f8c26e0e"
-dependencies = [
- "dirs",
- "glib-sys",
- "inventory",
- "lazy_static",
- "libloading",
- "once_cell",
- "panda-re-macros",
- "panda-re-sys",
- "paste",
- "strum 0.20.0",
- "strum_macros 0.20.1",
- "thiserror",
-]
-
-[[package]]
-name = "panda-re-macros"
-version = "0.16.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5be1d7a86fc7fc5c32ca9d7b430e5f12f76b664f381c4213c7071d14e88fc588"
-dependencies = [
- "darling",
- "doc-comment",
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "panda-re-sys"
-version = "0.7.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e00ee000dc315bf4a0a55d78b6d97456a7540d6ed01768da5f5aa89fdb660783"
-
-[[package]]
-name = "parking_lot"
-version = "0.11.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7d17b78036a60663b797adeaee46f5c9dfebb86948d1255007a1d6be0271ff99"
-dependencies = [
- "instant",
- "lock_api",
- "parking_lot_core",
-]
-
-[[package]]
-name = "parking_lot_core"
-version = "0.8.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d76e8e1493bcac0d2766c42737f34458f1c8c50c0d23bcb24ea953affb273216"
-dependencies = [
- "cfg-if",
- "instant",
- "libc",
- "redox_syscall",
- "smallvec",
- "winapi",
-]
-
-[[package]]
-name = "paste"
-version = "1.0.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0744126afe1a6dd7f394cb50a716dbe086cb06e255e53d8d0185d82828358fb5"
-
-[[package]]
-name = "pkg-config"
-version = "0.3.24"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "58893f751c9b0412871a09abd62ecd2a00298c6c83befa223ef98c52aef40cbe"
-
-[[package]]
-name = "pretty_env_logger"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "926d36b9553851b8b0005f1275891b392ee4d2d833852c417ed025477350fb9d"
-dependencies = [
- "env_logger",
- "log",
-]
-
-[[package]]
-name = "proc-macro2"
-version = "1.0.34"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2f84e92c0f7c9d58328b85a78557813e4bd845130db68d7184635344399423b1"
-dependencies = [
- "unicode-xid",
-]
-
-[[package]]
-name = "quick-error"
-version = "1.2.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a1d01941d82fa2ab50be1e79e6714289dd7cde78eba4c074bc5a4374f650dfe0"
-
-[[package]]
-name = "quote"
-version = "1.0.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "38bc8cc6a5f2e3655e0899c1b848643b2562f853f114bfec7be120678e3ace05"
-dependencies = [
- "proc-macro2",
-]
-
-[[package]]
-name = "redox_syscall"
-version = "0.2.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8383f39639269cde97d255a32bdb68c047337295414940c68bdd30c2e13203ff"
-dependencies = [
- "bitflags",
-]
-
-[[package]]
-name = "redox_users"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "528532f3d801c87aec9def2add9ca802fe569e44a544afe633765267840abe64"
-dependencies = [
- "getrandom",
- "redox_syscall",
-]
-
-[[package]]
-name = "regex"
-version = "1.5.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d07a8629359eb56f1e2fb1652bb04212c072a87ba68546a04065d525673ac461"
-dependencies = [
- "aho-corasick",
- "memchr",
- "regex-syntax",
-]
-
-[[package]]
-name = "regex-syntax"
-version = "0.6.25"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f497285884f3fcff424ffc933e56d7cbca511def0c9831a7f9b5f6153e3cc89b"
-
-[[package]]
-name = "scopeguard"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d29ab0c6d3fc0ee92fe66e2d99f700eab17a8d57d1c1d3b748380fb20baa78cd"
-
-[[package]]
-name = "serde"
-version = "1.0.131"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b4ad69dfbd3e45369132cc64e6748c2d65cdfb001a2b1c232d128b4ad60561c1"
-
-[[package]]
-name = "smallvec"
-version = "1.7.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ecab6c735a6bb4139c0caafd0cc3635748bbb3acf4550e8138122099251f309"
-
-[[package]]
-name = "strsim"
-version = "0.9.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6446ced80d6c486436db5c078dde11a9f73d42b57fb273121e160b84f63d894c"
-
-[[package]]
-name = "strum"
-version = "0.18.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "57bd81eb48f4c437cadc685403cad539345bf703d78e63707418431cecd4522b"
-
-[[package]]
-name = "strum"
-version = "0.20.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7318c509b5ba57f18533982607f24070a55d353e90d4cae30c467cdb2ad5ac5c"
-
-[[package]]
-name = "strum_macros"
-version = "0.18.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "87c85aa3f8ea653bfd3ddf25f7ee357ee4d204731f6aa9ad04002306f6e2774c"
-dependencies = [
- "heck",
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "strum_macros"
-version = "0.20.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ee8bc6b87a5112aeeab1f4a9f7ab634fe6cbefc4850006df31267f4cfb9e3149"
-dependencies = [
- "heck",
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "syn"
-version = "1.0.82"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8daf5dd0bb60cbd4137b1b587d2fc0ae729bc07cf01cd70b36a1ed5ade3b9d59"
-dependencies = [
- "proc-macro2",
- "quote",
- "unicode-xid",
-]
-
-[[package]]
-name = "system-deps"
-version = "1.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0f3ecc17269a19353b3558b313bba738b25d82993e30d62a18406a24aba4649b"
-dependencies = [
- "heck",
- "pkg-config",
- "strum 0.18.0",
- "strum_macros 0.18.0",
- "thiserror",
- "toml",
- "version-compare",
-]
-
-[[package]]
-name = "termcolor"
-version = "1.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2dfed899f0eb03f32ee8c6a0aabdb8a7949659e3466561fc0adf54e26d88c5f4"
-dependencies = [
- "winapi-util",
-]
-
-[[package]]
-name = "thiserror"
-version = "1.0.30"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "854babe52e4df1653706b98fcfc05843010039b406875930a70e4d9644e5c417"
-dependencies = [
- "thiserror-impl",
-]
-
-[[package]]
-name = "thiserror-impl"
-version = "1.0.30"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aa32fd3f627f367fe16f893e2597ae3c05020f8bba2666a4e6ea73d377e5714b"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "toml"
-version = "0.5.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a31142970826733df8241ef35dc040ef98c679ab14d7c3e54d827099b3acecaa"
-dependencies = [
- "serde",
-]
-
-[[package]]
-name = "unicode-segmentation"
-version = "1.8.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8895849a949e7845e06bd6dc1aa51731a103c42707010a5b591c0038fb73385b"
-
-[[package]]
-name = "unicode-xid"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8ccb82d61f80a663efe1f787a51b16b5a51e3314d6ac365b08639f52387b33f3"
-
-[[package]]
-name = "version-compare"
-version = "0.0.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d63556a25bae6ea31b52e640d7c41d1ab27faba4ccb600013837a3d0b3994ca1"
-
-[[package]]
-name = "wasi"
-version = "0.10.2+wasi-snapshot-preview1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fd6fbd9a79829dd1ad0cc20627bf1ed606756a7f77edff7b66b7064f9cb327c6"
-
-[[package]]
-name = "winapi"
-version = "0.3.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
-dependencies = [
- "winapi-i686-pc-windows-gnu",
- "winapi-x86_64-pc-windows-gnu",
-]
-
-[[package]]
-name = "winapi-i686-pc-windows-gnu"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
-
-[[package]]
-name = "winapi-util"
-version = "0.1.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "70ec6ce85bb158151cae5e5c87f95a8e97d2c0c4b001223f33a334e3ce5de178"
-dependencies = [
- "winapi",
-]
-
-[[package]]
-name = "winapi-x86_64-pc-windows-gnu"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
diff --git a/panda/plugins/frida/Cargo.toml b/panda/plugins/frida/Cargo.toml
deleted file mode 100644
index a7c8a783ec0..00000000000
--- a/panda/plugins/frida/Cargo.toml
+++ /dev/null
@@ -1,26 +0,0 @@
-[package]
-name = "frida"
-version = "0.1.0"
-authors = ["Jordan McLeod <Jordan.McLeod@ll.mit.edu>"]
-edition = "2018"
-
-[lib]
-crate-type = ["cdylib"]
-
-[dependencies]
-panda-re = { version = "0.26", default-features = false }
-parking_lot = "0.11"
-log = "0.4"
-pretty_env_logger = "0.4"
-
-[features]
-default = ["x86_64"]
-
-x86_64 = ["panda-re/x86_64"]
-i386 = ["panda-re/i386"]
-arm = ["panda-re/arm"]
-ppc = ["panda-re/ppc"]
-mips = ["panda-re/mips"]
-mipsel = ["panda-re/mipsel"]
-aarch64 = ["panda-re/aarch64"]
-mips64 = ["panda-re/mips64"]
diff --git a/panda/plugins/frida/Makefile b/panda/plugins/frida/Makefile
deleted file mode 100644
index 2234476df57..00000000000
--- a/panda/plugins/frida/Makefile
+++ /dev/null
@@ -1,18 +0,0 @@
-# Don't forget to add your plugin to config.panda!
-
-# Build rust plugins with make!
-
-# The main rule for your plugin. List all object-file dependencies.
-
-PANDA_PATH = $(realpath $(shell pwd)/..)
-PLUGIN_DIR = $(realpath $(join $(PANDA_PATH), /../panda/plugins/$(PLUGIN_NAME)/))
-RUST_SOURCE = $(wildcard $(PLUGIN_DIR)/src/*.rs)
-PLUGIN_ARTIFACTS_DIR = $(PLUGIN_TARGET_DIR)/$(PLUGIN_NAME)/target
-
-$(PLUGIN_TARGET_DIR)/panda_$(PLUGIN_NAME).so : $(RUST_SOURCE) $(PLUGIN_DIR)/Cargo.toml
-	@echo "  CARGO   $(PLUGIN_DIR)"
-	@CARGO_TERM_PROGRESS_WHEN=never cargo build --release \
-		--no-default-features --features=$(TARGET_NAME) \
-		--manifest-path=$(PLUGIN_DIR)/Cargo.toml \
-		--target-dir=$(PLUGIN_ARTIFACTS_DIR)
-	@cp -p $(PLUGIN_ARTIFACTS_DIR)/release/lib$(PLUGIN_NAME).so $@
diff --git a/panda/plugins/frida/README.md b/panda/plugins/frida/README.md
deleted file mode 100644
index cbd6557ee87..00000000000
--- a/panda/plugins/frida/README.md
+++ /dev/null
@@ -1,6 +0,0 @@
-# Guest Plugin Example
-
-This is a basic example of how to build a PANDA plugin for communicating with a guest
-plugin using Rust.
-
-See [`guest_plugins/rust_example`](/panda/guest_plugins/rust_example) for the corresponding guest plugin.
diff --git a/panda/plugins/frida/src/lib.rs b/panda/plugins/frida/src/lib.rs
deleted file mode 100644
index a721f07e8ec..00000000000
--- a/panda/plugins/frida/src/lib.rs
+++ /dev/null
@@ -1,33 +0,0 @@
-use panda::{plugins::guest_plugin_manager::*, prelude::*};
-use parking_lot::{const_mutex, Mutex};
-use std::io::Write;
-use std::net::{TcpListener, TcpStream};
-
-#[channel_recv]
-fn message_recv(_: u32, data: &[u8]) {
-    if let Some(socket) = SOCKET.lock().as_mut() {
-        socket.write_all(data).unwrap();
-    }
-}
-
-static SOCKET: Mutex<Option<TcpStream>> = const_mutex(None);
-
-#[panda::init]
-fn init(_: &mut PluginHandle) {
-    pretty_env_logger::init_custom_env("FRIDA_LOG");
-    let mut channel = load_guest_plugin("frida_server", message_recv);
-
-    std::thread::spawn(move || {
-        let server = TcpListener::bind("localhost:27042").unwrap();
-
-        for socket in server.incoming() {
-            let mut socket = socket.unwrap();
-            log::debug!("Socket connected");
-            SOCKET.lock().replace(socket.try_clone().unwrap());
-            log::debug!("Forwarding socket...");
-            std::io::copy(&mut socket, &mut channel).unwrap();
-            log::debug!("Socket disconnected");
-            SOCKET.lock().take();
-        }
-    });
-}
diff --git a/panda/plugins/guest_plugin_example/Cargo.lock b/panda/plugins/guest_plugin_example/Cargo.lock
deleted file mode 100644
index 6631ad52b15..00000000000
--- a/panda/plugins/guest_plugin_example/Cargo.lock
+++ /dev/null
@@ -1,489 +0,0 @@
-# This file is automatically @generated by Cargo.
-# It is not intended for manual editing.
-version = 3
-
-[[package]]
-name = "bitflags"
-version = "1.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
-
-[[package]]
-name = "cfg-if"
-version = "1.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
-
-[[package]]
-name = "ctor"
-version = "0.1.21"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ccc0a48a9b826acdf4028595adc9db92caea352f7af011a3034acd172a52a0aa"
-dependencies = [
- "quote",
- "syn",
-]
-
-[[package]]
-name = "darling"
-version = "0.10.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0d706e75d87e35569db781a9b5e2416cff1236a47ed380831f959382ccd5f858"
-dependencies = [
- "darling_core",
- "darling_macro",
-]
-
-[[package]]
-name = "darling_core"
-version = "0.10.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f0c960ae2da4de88a91b2d920c2a7233b400bc33cb28453a2987822d8392519b"
-dependencies = [
- "fnv",
- "ident_case",
- "proc-macro2",
- "quote",
- "strsim",
- "syn",
-]
-
-[[package]]
-name = "darling_macro"
-version = "0.10.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d9b5a2f4ac4969822c62224815d069952656cadc7084fdca9751e6d959189b72"
-dependencies = [
- "darling_core",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "dirs"
-version = "3.0.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "30baa043103c9d0c2a57cf537cc2f35623889dc0d405e6c3cccfadbc81c71309"
-dependencies = [
- "dirs-sys",
-]
-
-[[package]]
-name = "dirs-sys"
-version = "0.3.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "03d86534ed367a67548dc68113a0f5db55432fdfbb6e6f9d77704397d95d5780"
-dependencies = [
- "libc",
- "redox_users",
- "winapi",
-]
-
-[[package]]
-name = "doc-comment"
-version = "0.3.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fea41bba32d969b513997752735605054bc0dfa92b4c56bf1189f2e174be7a10"
-
-[[package]]
-name = "fnv"
-version = "1.0.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
-
-[[package]]
-name = "getrandom"
-version = "0.2.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7fcd999463524c52659517fe2cea98493cfe485d10565e7b0fb07dbba7ad2753"
-dependencies = [
- "cfg-if",
- "libc",
- "wasi",
-]
-
-[[package]]
-name = "ghost"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1a5bcf1bbeab73aa4cf2fde60a846858dc036163c7c33bec309f8d17de785479"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "glib-sys"
-version = "0.10.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c7e9b997a66e9a23d073f2b1abb4dbfc3925e0b8952f67efd8d9b6e168e4cdc1"
-dependencies = [
- "libc",
- "system-deps",
-]
-
-[[package]]
-name = "guest_plugin_example"
-version = "0.1.0"
-dependencies = [
- "panda-re",
- "parking_lot",
-]
-
-[[package]]
-name = "heck"
-version = "0.3.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6d621efb26863f0e9924c6ac577e8275e5e6b77455db64ffa6c65c904e9e132c"
-dependencies = [
- "unicode-segmentation",
-]
-
-[[package]]
-name = "ident_case"
-version = "1.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b9e0384b61958566e926dc50660321d12159025e767c18e043daf26b70104c39"
-
-[[package]]
-name = "instant"
-version = "0.1.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7a5bbe824c507c5da5956355e86a746d82e0e1464f65d862cc5e71da70e94b2c"
-dependencies = [
- "cfg-if",
-]
-
-[[package]]
-name = "inventory"
-version = "0.1.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f0eb5160c60ba1e809707918ee329adb99d222888155835c6feedba19f6c3fd4"
-dependencies = [
- "ctor",
- "ghost",
- "inventory-impl",
-]
-
-[[package]]
-name = "inventory-impl"
-version = "0.1.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7e41b53715c6f0c4be49510bb82dee2c1e51c8586d885abe65396e82ed518548"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "lazy_static"
-version = "1.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
-
-[[package]]
-name = "libc"
-version = "0.2.112"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1b03d17f364a3a042d5e5d46b053bbbf82c92c9430c592dd4c064dc6ee997125"
-
-[[package]]
-name = "libloading"
-version = "0.6.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "351a32417a12d5f7e82c368a66781e307834dae04c6ce0cd4456d52989229883"
-dependencies = [
- "cfg-if",
- "winapi",
-]
-
-[[package]]
-name = "lock_api"
-version = "0.4.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "712a4d093c9976e24e7dbca41db895dabcbac38eb5f4045393d17a95bdfb1109"
-dependencies = [
- "scopeguard",
-]
-
-[[package]]
-name = "once_cell"
-version = "1.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "da32515d9f6e6e489d7bc9d84c71b060db7247dc035bbe44eac88cf87486d8d5"
-
-[[package]]
-name = "panda-re"
-version = "0.26.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2dfc5b9d238b9f1d4785346b7d611dcc4236f615334e0719afbf3033f8c26e0e"
-dependencies = [
- "dirs",
- "glib-sys",
- "inventory",
- "lazy_static",
- "libloading",
- "once_cell",
- "panda-re-macros",
- "panda-re-sys",
- "paste",
- "strum 0.20.0",
- "strum_macros 0.20.1",
- "thiserror",
-]
-
-[[package]]
-name = "panda-re-macros"
-version = "0.16.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5be1d7a86fc7fc5c32ca9d7b430e5f12f76b664f381c4213c7071d14e88fc588"
-dependencies = [
- "darling",
- "doc-comment",
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "panda-re-sys"
-version = "0.7.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e00ee000dc315bf4a0a55d78b6d97456a7540d6ed01768da5f5aa89fdb660783"
-
-[[package]]
-name = "parking_lot"
-version = "0.11.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7d17b78036a60663b797adeaee46f5c9dfebb86948d1255007a1d6be0271ff99"
-dependencies = [
- "instant",
- "lock_api",
- "parking_lot_core",
-]
-
-[[package]]
-name = "parking_lot_core"
-version = "0.8.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d76e8e1493bcac0d2766c42737f34458f1c8c50c0d23bcb24ea953affb273216"
-dependencies = [
- "cfg-if",
- "instant",
- "libc",
- "redox_syscall",
- "smallvec",
- "winapi",
-]
-
-[[package]]
-name = "paste"
-version = "1.0.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0744126afe1a6dd7f394cb50a716dbe086cb06e255e53d8d0185d82828358fb5"
-
-[[package]]
-name = "pkg-config"
-version = "0.3.24"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "58893f751c9b0412871a09abd62ecd2a00298c6c83befa223ef98c52aef40cbe"
-
-[[package]]
-name = "proc-macro2"
-version = "1.0.34"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2f84e92c0f7c9d58328b85a78557813e4bd845130db68d7184635344399423b1"
-dependencies = [
- "unicode-xid",
-]
-
-[[package]]
-name = "quote"
-version = "1.0.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "38bc8cc6a5f2e3655e0899c1b848643b2562f853f114bfec7be120678e3ace05"
-dependencies = [
- "proc-macro2",
-]
-
-[[package]]
-name = "redox_syscall"
-version = "0.2.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8383f39639269cde97d255a32bdb68c047337295414940c68bdd30c2e13203ff"
-dependencies = [
- "bitflags",
-]
-
-[[package]]
-name = "redox_users"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "528532f3d801c87aec9def2add9ca802fe569e44a544afe633765267840abe64"
-dependencies = [
- "getrandom",
- "redox_syscall",
-]
-
-[[package]]
-name = "scopeguard"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d29ab0c6d3fc0ee92fe66e2d99f700eab17a8d57d1c1d3b748380fb20baa78cd"
-
-[[package]]
-name = "serde"
-version = "1.0.131"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b4ad69dfbd3e45369132cc64e6748c2d65cdfb001a2b1c232d128b4ad60561c1"
-
-[[package]]
-name = "smallvec"
-version = "1.7.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ecab6c735a6bb4139c0caafd0cc3635748bbb3acf4550e8138122099251f309"
-
-[[package]]
-name = "strsim"
-version = "0.9.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6446ced80d6c486436db5c078dde11a9f73d42b57fb273121e160b84f63d894c"
-
-[[package]]
-name = "strum"
-version = "0.18.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "57bd81eb48f4c437cadc685403cad539345bf703d78e63707418431cecd4522b"
-
-[[package]]
-name = "strum"
-version = "0.20.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7318c509b5ba57f18533982607f24070a55d353e90d4cae30c467cdb2ad5ac5c"
-
-[[package]]
-name = "strum_macros"
-version = "0.18.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "87c85aa3f8ea653bfd3ddf25f7ee357ee4d204731f6aa9ad04002306f6e2774c"
-dependencies = [
- "heck",
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "strum_macros"
-version = "0.20.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ee8bc6b87a5112aeeab1f4a9f7ab634fe6cbefc4850006df31267f4cfb9e3149"
-dependencies = [
- "heck",
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "syn"
-version = "1.0.82"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8daf5dd0bb60cbd4137b1b587d2fc0ae729bc07cf01cd70b36a1ed5ade3b9d59"
-dependencies = [
- "proc-macro2",
- "quote",
- "unicode-xid",
-]
-
-[[package]]
-name = "system-deps"
-version = "1.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0f3ecc17269a19353b3558b313bba738b25d82993e30d62a18406a24aba4649b"
-dependencies = [
- "heck",
- "pkg-config",
- "strum 0.18.0",
- "strum_macros 0.18.0",
- "thiserror",
- "toml",
- "version-compare",
-]
-
-[[package]]
-name = "thiserror"
-version = "1.0.30"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "854babe52e4df1653706b98fcfc05843010039b406875930a70e4d9644e5c417"
-dependencies = [
- "thiserror-impl",
-]
-
-[[package]]
-name = "thiserror-impl"
-version = "1.0.30"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aa32fd3f627f367fe16f893e2597ae3c05020f8bba2666a4e6ea73d377e5714b"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "toml"
-version = "0.5.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a31142970826733df8241ef35dc040ef98c679ab14d7c3e54d827099b3acecaa"
-dependencies = [
- "serde",
-]
-
-[[package]]
-name = "unicode-segmentation"
-version = "1.8.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8895849a949e7845e06bd6dc1aa51731a103c42707010a5b591c0038fb73385b"
-
-[[package]]
-name = "unicode-xid"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8ccb82d61f80a663efe1f787a51b16b5a51e3314d6ac365b08639f52387b33f3"
-
-[[package]]
-name = "version-compare"
-version = "0.0.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d63556a25bae6ea31b52e640d7c41d1ab27faba4ccb600013837a3d0b3994ca1"
-
-[[package]]
-name = "wasi"
-version = "0.10.2+wasi-snapshot-preview1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fd6fbd9a79829dd1ad0cc20627bf1ed606756a7f77edff7b66b7064f9cb327c6"
-
-[[package]]
-name = "winapi"
-version = "0.3.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
-dependencies = [
- "winapi-i686-pc-windows-gnu",
- "winapi-x86_64-pc-windows-gnu",
-]
-
-[[package]]
-name = "winapi-i686-pc-windows-gnu"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
-
-[[package]]
-name = "winapi-x86_64-pc-windows-gnu"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
diff --git a/panda/plugins/guest_plugin_example/Cargo.toml b/panda/plugins/guest_plugin_example/Cargo.toml
deleted file mode 100644
index c9147ac88eb..00000000000
--- a/panda/plugins/guest_plugin_example/Cargo.toml
+++ /dev/null
@@ -1,24 +0,0 @@
-[package]
-name = "guest_plugin_example"
-version = "0.1.0"
-authors = ["Jordan McLeod <Jordan.McLeod@ll.mit.edu>"]
-edition = "2018"
-
-[lib]
-crate-type = ["cdylib"]
-
-[dependencies]
-panda-re = { version = "0.26", default-features = false }
-parking_lot = "0.11"
-
-[features]
-default = ["x86_64"]
-
-x86_64 = ["panda-re/x86_64"]
-i386 = ["panda-re/i386"]
-arm = ["panda-re/arm"]
-ppc = ["panda-re/ppc"]
-mips = ["panda-re/mips"]
-mipsel = ["panda-re/mipsel"]
-aarch64 = ["panda-re/aarch64"]
-mips64 = ["panda-re/mips64"]
diff --git a/panda/plugins/guest_plugin_example/Makefile b/panda/plugins/guest_plugin_example/Makefile
deleted file mode 100644
index 2234476df57..00000000000
--- a/panda/plugins/guest_plugin_example/Makefile
+++ /dev/null
@@ -1,18 +0,0 @@
-# Don't forget to add your plugin to config.panda!
-
-# Build rust plugins with make!
-
-# The main rule for your plugin. List all object-file dependencies.
-
-PANDA_PATH = $(realpath $(shell pwd)/..)
-PLUGIN_DIR = $(realpath $(join $(PANDA_PATH), /../panda/plugins/$(PLUGIN_NAME)/))
-RUST_SOURCE = $(wildcard $(PLUGIN_DIR)/src/*.rs)
-PLUGIN_ARTIFACTS_DIR = $(PLUGIN_TARGET_DIR)/$(PLUGIN_NAME)/target
-
-$(PLUGIN_TARGET_DIR)/panda_$(PLUGIN_NAME).so : $(RUST_SOURCE) $(PLUGIN_DIR)/Cargo.toml
-	@echo "  CARGO   $(PLUGIN_DIR)"
-	@CARGO_TERM_PROGRESS_WHEN=never cargo build --release \
-		--no-default-features --features=$(TARGET_NAME) \
-		--manifest-path=$(PLUGIN_DIR)/Cargo.toml \
-		--target-dir=$(PLUGIN_ARTIFACTS_DIR)
-	@cp -p $(PLUGIN_ARTIFACTS_DIR)/release/lib$(PLUGIN_NAME).so $@
diff --git a/panda/plugins/guest_plugin_example/README.md b/panda/plugins/guest_plugin_example/README.md
deleted file mode 100644
index cbd6557ee87..00000000000
--- a/panda/plugins/guest_plugin_example/README.md
+++ /dev/null
@@ -1,6 +0,0 @@
-# Guest Plugin Example
-
-This is a basic example of how to build a PANDA plugin for communicating with a guest
-plugin using Rust.
-
-See [`guest_plugins/rust_example`](/panda/guest_plugins/rust_example) for the corresponding guest plugin.
diff --git a/panda/plugins/guest_plugin_example/src/lib.rs b/panda/plugins/guest_plugin_example/src/lib.rs
deleted file mode 100644
index 5ea9fd93a08..00000000000
--- a/panda/plugins/guest_plugin_example/src/lib.rs
+++ /dev/null
@@ -1,18 +0,0 @@
-use panda::{plugins::guest_plugin_manager::*, prelude::*};
-use std::io::Write;
-
-// Print out all the messages sent from the guest
-#[channel_recv]
-fn message_recv(_: u32, data: &str) {
-    println!("[rust_example] {}", data);
-}
-
-#[panda::init]
-fn init(_: &mut PluginHandle) {
-    let mut channel = load_guest_plugin("rust_example", message_recv);
-
-    // the `rust_example` plugin expects to be sent a u32 which it will log
-    // so let's sent it one.
-    let num: u32 = 1234;
-    channel.write_all(&num.to_le_bytes()).unwrap();
-}
diff --git a/panda/plugins/guest_plugin_example/try_it.py b/panda/plugins/guest_plugin_example/try_it.py
deleted file mode 100644
index 8df6c35a626..00000000000
--- a/panda/plugins/guest_plugin_example/try_it.py
+++ /dev/null
@@ -1,13 +0,0 @@
-from pandare import Panda
-
-panda = Panda(generic="x86_64")
-panda.load_plugin("guest_plugin_example")
-
-@panda.queue_blocking
-def run_cmd():
-    panda.revert_sync("root")
-    panda.run_serial_cmd("cat", no_timeout=True)
-    panda.run_serial_cmd("cat", no_timeout=True)
-    panda.end_analysis()
-
-panda.run()
diff --git a/panda/plugins/guest_plugin_manager/Cargo.lock b/panda/plugins/guest_plugin_manager/Cargo.lock
deleted file mode 100644
index 738462e6c85..00000000000
--- a/panda/plugins/guest_plugin_manager/Cargo.lock
+++ /dev/null
@@ -1,511 +0,0 @@
-# This file is automatically @generated by Cargo.
-# It is not intended for manual editing.
-version = 3
-
-[[package]]
-name = "bitflags"
-version = "1.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf1de2fe8c75bc145a2f577add951f8134889b4795d47466a54a5c846d691693"
-
-[[package]]
-name = "cfg-if"
-version = "1.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
-
-[[package]]
-name = "crossbeam-queue"
-version = "0.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b10ddc024425c88c2ad148c1b0fd53f4c6d38db9697c9f1588381212fa657c9"
-dependencies = [
- "cfg-if",
- "crossbeam-utils",
-]
-
-[[package]]
-name = "crossbeam-utils"
-version = "0.8.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d82cfc11ce7f2c3faef78d8a684447b40d503d9681acebed6cb728d45940c4db"
-dependencies = [
- "cfg-if",
- "lazy_static",
-]
-
-[[package]]
-name = "ctor"
-version = "0.1.20"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5e98e2ad1a782e33928b96fc3948e7c355e5af34ba4de7670fe8bac2a3b2006d"
-dependencies = [
- "quote",
- "syn",
-]
-
-[[package]]
-name = "darling"
-version = "0.10.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0d706e75d87e35569db781a9b5e2416cff1236a47ed380831f959382ccd5f858"
-dependencies = [
- "darling_core",
- "darling_macro",
-]
-
-[[package]]
-name = "darling_core"
-version = "0.10.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f0c960ae2da4de88a91b2d920c2a7233b400bc33cb28453a2987822d8392519b"
-dependencies = [
- "fnv",
- "ident_case",
- "proc-macro2",
- "quote",
- "strsim",
- "syn",
-]
-
-[[package]]
-name = "darling_macro"
-version = "0.10.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d9b5a2f4ac4969822c62224815d069952656cadc7084fdca9751e6d959189b72"
-dependencies = [
- "darling_core",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "dirs"
-version = "3.0.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "30baa043103c9d0c2a57cf537cc2f35623889dc0d405e6c3cccfadbc81c71309"
-dependencies = [
- "dirs-sys",
-]
-
-[[package]]
-name = "dirs-sys"
-version = "0.3.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "03d86534ed367a67548dc68113a0f5db55432fdfbb6e6f9d77704397d95d5780"
-dependencies = [
- "libc",
- "redox_users",
- "winapi",
-]
-
-[[package]]
-name = "doc-comment"
-version = "0.3.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fea41bba32d969b513997752735605054bc0dfa92b4c56bf1189f2e174be7a10"
-
-[[package]]
-name = "fnv"
-version = "1.0.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
-
-[[package]]
-name = "getrandom"
-version = "0.2.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7fcd999463524c52659517fe2cea98493cfe485d10565e7b0fb07dbba7ad2753"
-dependencies = [
- "cfg-if",
- "libc",
- "wasi",
-]
-
-[[package]]
-name = "ghost"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1a5bcf1bbeab73aa4cf2fde60a846858dc036163c7c33bec309f8d17de785479"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "glib-sys"
-version = "0.10.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c7e9b997a66e9a23d073f2b1abb4dbfc3925e0b8952f67efd8d9b6e168e4cdc1"
-dependencies = [
- "libc",
- "system-deps",
-]
-
-[[package]]
-name = "guest_plugin_manager"
-version = "0.1.0"
-dependencies = [
- "crossbeam-queue",
- "lazy_static",
- "once_cell",
- "panda-re",
- "parking_lot",
-]
-
-[[package]]
-name = "heck"
-version = "0.3.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6d621efb26863f0e9924c6ac577e8275e5e6b77455db64ffa6c65c904e9e132c"
-dependencies = [
- "unicode-segmentation",
-]
-
-[[package]]
-name = "ident_case"
-version = "1.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b9e0384b61958566e926dc50660321d12159025e767c18e043daf26b70104c39"
-
-[[package]]
-name = "instant"
-version = "0.1.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "716d3d89f35ac6a34fd0eed635395f4c3b76fa889338a4632e5231a8684216bd"
-dependencies = [
- "cfg-if",
-]
-
-[[package]]
-name = "inventory"
-version = "0.1.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0f0f7efb804ec95e33db9ad49e4252f049e37e8b0a4652e3cd61f7999f2eff7f"
-dependencies = [
- "ctor",
- "ghost",
- "inventory-impl",
-]
-
-[[package]]
-name = "inventory-impl"
-version = "0.1.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "75c094e94816723ab936484666968f5b58060492e880f3c8d00489a1e244fa51"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "lazy_static"
-version = "1.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
-
-[[package]]
-name = "libc"
-version = "0.2.98"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "320cfe77175da3a483efed4bc0adc1968ca050b098ce4f2f1c13a56626128790"
-
-[[package]]
-name = "libloading"
-version = "0.6.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "351a32417a12d5f7e82c368a66781e307834dae04c6ce0cd4456d52989229883"
-dependencies = [
- "cfg-if",
- "winapi",
-]
-
-[[package]]
-name = "lock_api"
-version = "0.4.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "712a4d093c9976e24e7dbca41db895dabcbac38eb5f4045393d17a95bdfb1109"
-dependencies = [
- "scopeguard",
-]
-
-[[package]]
-name = "once_cell"
-version = "1.8.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "692fcb63b64b1758029e0a96ee63e049ce8c5948587f2f7208df04625e5f6b56"
-
-[[package]]
-name = "panda-re"
-version = "0.25.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bfd819f91df8381e0b6255a47f749a1dd52589c34a0b007bbee41f27630ff7ee"
-dependencies = [
- "dirs",
- "glib-sys",
- "inventory",
- "lazy_static",
- "libloading",
- "once_cell",
- "panda-re-macros",
- "panda-re-sys",
- "paste",
- "strum 0.20.0",
- "strum_macros 0.20.1",
- "thiserror",
-]
-
-[[package]]
-name = "panda-re-macros"
-version = "0.15.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9d807aa10d149e5ddde4e9cd386df1791efda6d6716077349da9f78cb6d32460"
-dependencies = [
- "darling",
- "doc-comment",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "panda-re-sys"
-version = "0.7.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e00ee000dc315bf4a0a55d78b6d97456a7540d6ed01768da5f5aa89fdb660783"
-
-[[package]]
-name = "parking_lot"
-version = "0.11.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7d17b78036a60663b797adeaee46f5c9dfebb86948d1255007a1d6be0271ff99"
-dependencies = [
- "instant",
- "lock_api",
- "parking_lot_core",
-]
-
-[[package]]
-name = "parking_lot_core"
-version = "0.8.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d76e8e1493bcac0d2766c42737f34458f1c8c50c0d23bcb24ea953affb273216"
-dependencies = [
- "cfg-if",
- "instant",
- "libc",
- "redox_syscall",
- "smallvec",
- "winapi",
-]
-
-[[package]]
-name = "paste"
-version = "1.0.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "acbf547ad0c65e31259204bd90935776d1c693cec2f4ff7abb7a1bbbd40dfe58"
-
-[[package]]
-name = "pkg-config"
-version = "0.3.19"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3831453b3449ceb48b6d9c7ad7c96d5ea673e9b470a1dc578c2ce6521230884c"
-
-[[package]]
-name = "proc-macro2"
-version = "1.0.27"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f0d8caf72986c1a598726adc988bb5984792ef84f5ee5aa50209145ee8077038"
-dependencies = [
- "unicode-xid",
-]
-
-[[package]]
-name = "quote"
-version = "1.0.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c3d0b9745dc2debf507c8422de05d7226cc1f0644216dfdfead988f9b1ab32a7"
-dependencies = [
- "proc-macro2",
-]
-
-[[package]]
-name = "redox_syscall"
-version = "0.2.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5ab49abadf3f9e1c4bc499e8845e152ad87d2ad2d30371841171169e9d75feee"
-dependencies = [
- "bitflags",
-]
-
-[[package]]
-name = "redox_users"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "528532f3d801c87aec9def2add9ca802fe569e44a544afe633765267840abe64"
-dependencies = [
- "getrandom",
- "redox_syscall",
-]
-
-[[package]]
-name = "scopeguard"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d29ab0c6d3fc0ee92fe66e2d99f700eab17a8d57d1c1d3b748380fb20baa78cd"
-
-[[package]]
-name = "serde"
-version = "1.0.126"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ec7505abeacaec74ae4778d9d9328fe5a5d04253220a85c4ee022239fc996d03"
-
-[[package]]
-name = "smallvec"
-version = "1.7.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ecab6c735a6bb4139c0caafd0cc3635748bbb3acf4550e8138122099251f309"
-
-[[package]]
-name = "strsim"
-version = "0.9.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6446ced80d6c486436db5c078dde11a9f73d42b57fb273121e160b84f63d894c"
-
-[[package]]
-name = "strum"
-version = "0.18.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "57bd81eb48f4c437cadc685403cad539345bf703d78e63707418431cecd4522b"
-
-[[package]]
-name = "strum"
-version = "0.20.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7318c509b5ba57f18533982607f24070a55d353e90d4cae30c467cdb2ad5ac5c"
-
-[[package]]
-name = "strum_macros"
-version = "0.18.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "87c85aa3f8ea653bfd3ddf25f7ee357ee4d204731f6aa9ad04002306f6e2774c"
-dependencies = [
- "heck",
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "strum_macros"
-version = "0.20.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ee8bc6b87a5112aeeab1f4a9f7ab634fe6cbefc4850006df31267f4cfb9e3149"
-dependencies = [
- "heck",
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "syn"
-version = "1.0.74"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1873d832550d4588c3dbc20f01361ab00bfe741048f71e3fecf145a7cc18b29c"
-dependencies = [
- "proc-macro2",
- "quote",
- "unicode-xid",
-]
-
-[[package]]
-name = "system-deps"
-version = "1.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0f3ecc17269a19353b3558b313bba738b25d82993e30d62a18406a24aba4649b"
-dependencies = [
- "heck",
- "pkg-config",
- "strum 0.18.0",
- "strum_macros 0.18.0",
- "thiserror",
- "toml",
- "version-compare",
-]
-
-[[package]]
-name = "thiserror"
-version = "1.0.26"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "93119e4feac1cbe6c798c34d3a53ea0026b0b1de6a120deef895137c0529bfe2"
-dependencies = [
- "thiserror-impl",
-]
-
-[[package]]
-name = "thiserror-impl"
-version = "1.0.26"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "060d69a0afe7796bf42e9e2ff91f5ee691fb15c53d38b4b62a9a53eb23164745"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "toml"
-version = "0.5.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a31142970826733df8241ef35dc040ef98c679ab14d7c3e54d827099b3acecaa"
-dependencies = [
- "serde",
-]
-
-[[package]]
-name = "unicode-segmentation"
-version = "1.8.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8895849a949e7845e06bd6dc1aa51731a103c42707010a5b591c0038fb73385b"
-
-[[package]]
-name = "unicode-xid"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8ccb82d61f80a663efe1f787a51b16b5a51e3314d6ac365b08639f52387b33f3"
-
-[[package]]
-name = "version-compare"
-version = "0.0.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d63556a25bae6ea31b52e640d7c41d1ab27faba4ccb600013837a3d0b3994ca1"
-
-[[package]]
-name = "wasi"
-version = "0.10.2+wasi-snapshot-preview1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fd6fbd9a79829dd1ad0cc20627bf1ed606756a7f77edff7b66b7064f9cb327c6"
-
-[[package]]
-name = "winapi"
-version = "0.3.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
-dependencies = [
- "winapi-i686-pc-windows-gnu",
- "winapi-x86_64-pc-windows-gnu",
-]
-
-[[package]]
-name = "winapi-i686-pc-windows-gnu"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
-
-[[package]]
-name = "winapi-x86_64-pc-windows-gnu"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
diff --git a/panda/plugins/guest_plugin_manager/Cargo.toml b/panda/plugins/guest_plugin_manager/Cargo.toml
deleted file mode 100644
index 04de54370a2..00000000000
--- a/panda/plugins/guest_plugin_manager/Cargo.toml
+++ /dev/null
@@ -1,28 +0,0 @@
-[package]
-name = "guest_plugin_manager"
-version = "0.1.0"
-authors = ["Luke Craig <Luke.Craig@ll.mit.edu>", "Jordan McLeod <Jordan.McLeod@ll.mit.edu>"]
-edition = "2018"
-
-[lib]
-crate-type = ["cdylib"]
-path = "./src/guest_plugin_manager.rs"
-
-[dependencies]
-panda-re = { version = "0.25", default-features = false }
-crossbeam-queue = "0.3.2"
-parking_lot = "0.11.2"
-lazy_static = "1.4.0"
-once_cell = "1.8.0"
-
-[features]
-default = ["x86_64"]
-
-x86_64 = ["panda-re/x86_64"]
-i386 = ["panda-re/i386"]
-arm = ["panda-re/arm"]
-ppc = ["panda-re/ppc"]
-mips = ["panda-re/mips"]
-mipsel = ["panda-re/mipsel"]
-aarch64 = ["panda-re/aarch64"]
-mips64 = ["panda-re/mips64"]
diff --git a/panda/plugins/guest_plugin_manager/Makefile b/panda/plugins/guest_plugin_manager/Makefile
deleted file mode 100644
index d34fc42957c..00000000000
--- a/panda/plugins/guest_plugin_manager/Makefile
+++ /dev/null
@@ -1,18 +0,0 @@
-# Don't forget to add your plugin to config.panda!
-
-# Build rust plugins with make!
-
-# The main rule for your plugin. List all object-file dependencies.
-
-PANDA_PATH = $(realpath $(shell pwd)/..)
-PLUGIN_DIR = $(realpath $(join $(PANDA_PATH), /../panda/plugins/$(PLUGIN_NAME)/))
-RUST_SOURCE = $(shell find $(PLUGIN_DIR)/src/ -name "*.rs")
-PLUGIN_ARTIFACTS_DIR = $(PLUGIN_TARGET_DIR)/$(PLUGIN_NAME)/target
-
-$(PLUGIN_TARGET_DIR)/panda_$(PLUGIN_NAME).so : $(RUST_SOURCE) $(PLUGIN_DIR)/Cargo.toml
-	@echo "  CARGO   $(PLUGIN_DIR)"
-	@CARGO_TERM_PROGRESS_WHEN=never cargo build --release \
-		--no-default-features --features=$(TARGET_NAME) \
-		--manifest-path=$(PLUGIN_DIR)/Cargo.toml \
-		--target-dir=$(PLUGIN_ARTIFACTS_DIR)
-	@cp -p $(PLUGIN_ARTIFACTS_DIR)/release/lib$(PLUGIN_NAME).so $@
diff --git a/panda/plugins/guest_plugin_manager/README.md b/panda/plugins/guest_plugin_manager/README.md
deleted file mode 100644
index 5a6e48a76c6..00000000000
--- a/panda/plugins/guest_plugin_manager/README.md
+++ /dev/null
@@ -1,94 +0,0 @@
-# Guest Plugin Manager
-
-The guest plugin manager is a PANDA plugin which handles loading guest agent plugins 
-into the guest, managing communication channels between the guest and the host. 
-Typical usage involves writing a host PANDA plugin which calls the plugin manager in
-order to load the executable, then loading that PANDA plugin as normal (from either the
-PANDA command line or from pypanda).
-
-Currently the guest plugin manager only supports Linux guests via the `linjector` plugin
-however support for other guest OS' would be possible in the presence of other backends.
-The responsibility of `linjector` is, as the name would imply, inject a single binary
-into the guest as a new process. The guest plugin manager uses this capability in order
-to load the "Guest Daemon", an executable running the guest responsible for handling
-the spawning of future guest processes and is responsible for communicating with the
-guest_plugin_manager directly.
-
-**Note:** injection of `guest_daemon` plugin must be done before guest plugin manager takes effect.
-
-## APIs and Callbacks
-
----
-
-Name: **add_guest_plugin**
-
-Signature:
-
-```c
-typedef ChannelId (*add_guest_plugin)(GuestPlugin);
-```
-
-Description: Adds a guest plugin to be loaded, returns a channel ID representing the
-main channel of the to-be-loaded plugin. Writes to this channel ID before plugin
-load will be queued and will thus be available when the plugin begins reading.
-
----
-
-Name: **channel_write**
-
-Signature:
-
-```c
-typedef void (*channel_write)(ChannelId, const u8*, size_t);
-```
-
-Description: Writes bytes from a buffer to the given channel ID, queuing them up for 
-the next guest plugin read. The buffer is copied into a new allocation before being 
-added to the queue, so the act of writing has no strict lifetime requirements.
-
----
-
-Name: **get_channel_from_name**
-
-Signature:
-
-```c
-typedef ChannelId (*get_channel_from_name)(const char*);
-```
-
-Description:
-
-Given the name of a plugin or channel, return the associated channel, panicking
-if a channel of the given name cannot be found. Channel name should be passed
-as a null-terminated string.
-
-The provided string has no lifetime requirements, but must be a non-null pointer
-to a valid C string.
-
----
-
-## Types
-
-```c
-// A globally unique identifier for a given channel
-typedef uint32_t ChannelId;
-
-// ChannelId - the unique identifier for the channel the message came from
-// const unsigned char* - a pointer to the data being sent from the guest
-// size_t - the length of the data buffer in bytes
-typedef void (*ChannelCB)(ChannelId, const unsigned char*, size_t);
-
-// A plugin to be passed to guest_plugin_manager to be registered
-typedef struct guest_plugin {
-    // A unique name for the given plugin, provided as a non-null C string
-    const char* plugin_name;
-
-    // An optional path to load the guest agent binary. If null, a lookup will be
-    // performed to find the binary from the given name. If non-null must be a valid
-    // C string.
-    const char* guest_binary_path;
-
-    // A callback for when this guest plugin sends a message to the host
-    ChannelCB msg_recieve_cb;
-} GuestPlugin;
-```
diff --git a/panda/plugins/guest_plugin_manager/guest_plugin_manager_ppp.h b/panda/plugins/guest_plugin_manager/guest_plugin_manager_ppp.h
deleted file mode 100644
index 7f4db0ae3e1..00000000000
--- a/panda/plugins/guest_plugin_manager/guest_plugin_manager_ppp.h
+++ /dev/null
@@ -1,11 +0,0 @@
-#ifndef __GUEST_PLUGIN_MANAGER_PPP_H
-#define __GUEST_PLUGIN_MANAGER_PPP_H
-// BEGIN_PYPANDA_NEEDS_THIS -- do not delete this comment bc pypanda
-// api autogen needs it.  And don't put any compiler directives
-// between this and END_PYPANDA_NEEDS_THIS except includes of other
-// files in this directory that contain subsections like this one.
-
-PPP_CB_TYPEDEF(void,on_guest_agent_load,CPUState *);
-
-// END_PYPANDA_NEEDS_THIS -- do not delete this comment!
-#endif
diff --git a/panda/plugins/guest_plugin_manager/rustfmt.toml b/panda/plugins/guest_plugin_manager/rustfmt.toml
deleted file mode 100644
index 5c8d9318b3b..00000000000
--- a/panda/plugins/guest_plugin_manager/rustfmt.toml
+++ /dev/null
@@ -1 +0,0 @@
-max_width = 80
\ No newline at end of file
diff --git a/panda/plugins/guest_plugin_manager/src/guest_plugin_manager.rs b/panda/plugins/guest_plugin_manager/src/guest_plugin_manager.rs
deleted file mode 100644
index 41868b1fc43..00000000000
--- a/panda/plugins/guest_plugin_manager/src/guest_plugin_manager.rs
+++ /dev/null
@@ -1,148 +0,0 @@
-use panda::plugins::guest_plugin_manager::guest_plugin_path;
-use panda::prelude::*;
-use panda::PppCallback;
-
-use std::convert::TryFrom;
-use std::sync::atomic::{AtomicBool, Ordering};
-
-mod hyp_regs;
-use hyp_regs::{get_hyp_reg, set_hyp_ret_reg};
-
-mod interface;
-use interface::hci::{
-    hyp_error, hyp_get_channel_by_name, hyp_get_manager, hyp_read, hyp_start,
-    hyp_stop, hyp_write,
-};
-
-const MAGIC: usize = 0x1337c0d3;
-
-#[derive(Copy, Clone)]
-pub enum HcCmd {
-    Start = 1,        /* start new action */
-    Stop,             /* stop action */
-    Read,             /* read buffer from hypervisor */
-    Write,            /* write buffer TO hypervisor*/
-    Error,            /* report error to hypervisor*/
-    GetManager,       /* returns unique chanenl ID to manager from plugin */
-    GetChannelByName, /* returns existing channel mapped to unique name */
-}
-
-impl TryFrom<usize> for HcCmd {
-    type Error = ();
-
-    fn try_from(value: usize) -> Result<Self, ()> {
-        match value {
-            1 => Ok(HcCmd::Start),
-            2 => Ok(HcCmd::Stop),
-            3 => Ok(HcCmd::Read),
-            4 => Ok(HcCmd::Write),
-            5 => Ok(HcCmd::Error),
-            6 => Ok(HcCmd::GetManager),
-            7 => Ok(HcCmd::GetChannelByName),
-            _ => Err(()),
-        }
-    }
-}
-
-#[panda::guest_hypercall]
-fn hypercall_handler(cpu: &mut CPUState) -> bool {
-    let magicval = get_hyp_reg(cpu, 0);
-    if magicval == MAGIC {
-        let action = get_hyp_reg(cpu, 1);
-        // dbg!(action);
-        let chan_id = get_hyp_reg(cpu, 2) as u32;
-        let arg1 = get_hyp_reg(cpu, 3);
-        let arg2 = get_hyp_reg(cpu, 4);
-
-        let retval = match HcCmd::try_from(action) {
-            Ok(HcCmd::Start) => hyp_start(cpu, chan_id, arg1, arg2),
-            Ok(HcCmd::Write) => hyp_write(cpu, chan_id, arg1, arg2),
-            Ok(HcCmd::Read) => hyp_read(cpu, chan_id, arg1, arg2),
-            Ok(HcCmd::Stop) => hyp_stop(cpu, chan_id, arg1, arg2),
-            Ok(HcCmd::Error) => hyp_error(cpu, chan_id, arg1, arg2),
-            Ok(HcCmd::GetManager) => hyp_get_manager(cpu, chan_id, arg1, arg2),
-            Ok(HcCmd::GetChannelByName) => {
-                hyp_get_channel_by_name(cpu, chan_id, arg1, arg2)
-            }
-            _ => None,
-        };
-
-        if let Some(retval) = retval {
-            set_hyp_ret_reg(cpu, retval);
-        }
-
-        true
-    } else {
-        false
-    }
-}
-
-#[derive(PandaArgs)]
-#[name = "linjector"]
-struct Linjector {
-    guest_binary: String,
-    proc_name: String,
-}
-
-#[derive(PandaArgs)]
-#[name = "guest_plugin_manager"]
-struct Args {
-    #[arg(default = "cat")]
-    proc_name: String,
-}
-
-panda::plugin_import! {
-    static LINJECTOR: LinjectorApi = extern "linjector" {
-        callbacks {
-            fn before_guest_inject(cpu: &mut CPUState);
-        }
-    };
-}
-
-panda::export_ppp_callback! {
-    pub(crate) fn on_guest_agent_load(cpu: &mut CPUState);
-}
-
-lazy_static::lazy_static! {
-    static ref ARGS: Args = Args::from_panda_args();
-}
-
-static LOADED: AtomicBool = AtomicBool::new(false);
-
-#[panda::init]
-fn init(_: &mut PluginHandle) -> bool {
-    if LOADED.swap(true, Ordering::SeqCst) {
-        return true;
-    }
-
-    lazy_static::initialize(&ARGS);
-    interface::daemon_manager::init();
-
-    //let guest_binary = guest_plugin_path("guest_daemon")
-    //    .expect("Failed to retrieve guest_daemon guest plugin path")
-    //    .to_string_lossy()
-    //    .into_owned();
-
-    //assert!(
-    //    panda::os::family().is_linux(),
-    //    "Guest plugin manager currently only supports Linux"
-    //);
-
-    //std::thread::spawn(|| {
-    //    // TODO: automatically decide which process to inject into
-    //    panda::require_plugin(&Linjector {
-    //        guest_binary,
-    //        proc_name: ARGS.proc_name.clone(),
-    //    });
-
-    //    PppCallback::new()
-    //        .before_guest_inject(|cpu| on_guest_agent_load::trigger(cpu));
-    //});
-
-    true
-}
-
-#[panda::uninit]
-fn exit(_: &mut PluginHandle) {
-    println!("Exiting");
-}
diff --git a/panda/plugins/guest_plugin_manager/src/hyp_regs.rs b/panda/plugins/guest_plugin_manager/src/hyp_regs.rs
deleted file mode 100644
index 2a19e082f50..00000000000
--- a/panda/plugins/guest_plugin_manager/src/hyp_regs.rs
+++ /dev/null
@@ -1,54 +0,0 @@
-use panda::{
-    prelude::*,
-    regs::{
-        get_reg, set_reg,
-        Reg::{self, *},
-    },
-};
-
-// =================== Register Order ===================
-#[cfg(feature = "i386")]
-pub const REG_ORDER: [Reg; 5] = [EAX, EBX, ECX, EDX, EDI];
-
-#[cfg(feature = "x86_64")]
-pub const REG_ORDER: [Reg; 5] = [RAX, RBX, RCX, RDX, RDI];
-
-#[cfg(feature = "arm")]
-pub const REG_ORDER: [Reg; 5] = [R0, R1, R2, R3, R4];
-
-#[cfg(any(feature = "mips", feature = "mipsel", feature = "mips64"))]
-pub const REG_ORDER: [Reg; 5] = [V0, A0, A1, A2, A3];
-
-#[cfg(feature = "aarch64")]
-pub const REG_ORDER: [Reg; 5] = [X0, X1, X2, X3, X4];
-
-#[cfg(feature = "ppc")]
-pub const REG_ORDER: [Reg; 5] = [R3, R4, R5, R6, R7];
-
-// =================== Return Value ===================
-#[cfg(feature = "i386")]
-pub const RET_REG: Reg = EAX;
-
-#[cfg(feature = "x86_64")]
-pub const RET_REG: Reg = RAX;
-
-#[cfg(feature = "arm")]
-pub const RET_REG: Reg = R0;
-
-#[cfg(any(feature = "mips", feature = "mipsel", feature = "mips64"))]
-pub const RET_REG: Reg = V0;
-
-#[cfg(feature = "aarch64")]
-pub const RET_REG: Reg = X0;
-
-#[cfg(feature = "ppc")]
-pub const RET_REG: Reg = R3;
-
-pub fn get_hyp_reg(cpu: &mut CPUState, num: usize) -> usize {
-    let reg_to_read = REG_ORDER[num];
-    get_reg(cpu, reg_to_read) as usize
-}
-
-pub fn set_hyp_ret_reg(cpu: &mut CPUState, value: usize) {
-    set_reg(cpu, RET_REG, value as target_ulong)
-}
diff --git a/panda/plugins/guest_plugin_manager/src/interface/api.rs b/panda/plugins/guest_plugin_manager/src/interface/api.rs
deleted file mode 100644
index 69988ec855e..00000000000
--- a/panda/plugins/guest_plugin_manager/src/interface/api.rs
+++ /dev/null
@@ -1,80 +0,0 @@
-use super::channels::add_channel;
-use super::daemon_manager::load_binary;
-use std::ffi::CStr;
-use std::os::raw::c_char;
-use std::slice::from_raw_parts;
-
-use super::channels::{publish_message_to_guest, ChannelCB, ChannelId};
-
-#[repr(C)]
-pub struct GuestPlugin {
-    /// A unique name for the given plugin, provided as a non-null C string
-    pub plugin_name: *const c_char,
-
-    /// An optional path to load the guest agent binary. If null, a lookup will be
-    /// performed to find the binary from the given name. If non-null must be a valid
-    /// C string.
-    pub guest_binary_path: *const c_char,
-
-    /// A callback for when this guest plugin sends a message to the host
-    pub msg_receive_cb: ChannelCB,
-}
-
-/// Adds a guest plugin to be loaded, returns a channel ID representing the
-/// main channel of the to-be-loaded plugin. Writes to this channel ID before plugin
-/// load will be queued and will thus be available when the plugin begins reading.
-#[no_mangle]
-pub extern "C" fn add_guest_plugin(plugin: GuestPlugin) -> ChannelId {
-    let path_temp;
-    let name = unsafe { CStr::from_ptr(plugin.plugin_name).to_string_lossy() };
-    let binary_path = if plugin.guest_binary_path.is_null() {
-        match crate::guest_plugin_path(&name) {
-            Some(path) => {
-                path_temp = path;
-                path_temp.to_string_lossy()
-            }
-            None => panic!(
-                "No guest plugin path was provided but plugin {0:?} \
-                    could not be found, ensure {0:?} has been built.",
-                name
-            ),
-        }
-    } else {
-        unsafe { CStr::from_ptr(plugin.guest_binary_path).to_string_lossy() }
-    };
-    load_binary(&binary_path);
-    add_channel(Some(&name), plugin.msg_receive_cb)
-}
-
-/// Create a new anonymous channel provided a callback for writes performed by the guest,
-/// returning the channel ID.
-#[no_mangle]
-pub unsafe extern "C" fn allocate_channel(callback: ChannelCB) -> ChannelId {
-    add_channel(None, callback)
-}
-
-/// Writes bytes from a buffer to the given channel ID, queuing them up for the next
-/// guest plugin read. The buffer is copied into a new allocation before being added
-/// to the queue, so the act of writing has no strict lifetime requirements.
-#[no_mangle]
-pub unsafe extern "C" fn channel_write(
-    channel: ChannelId,
-    buf: *const u8,
-    buf_len: usize,
-) {
-    publish_message_to_guest(channel, from_raw_parts(buf, buf_len).to_vec())
-}
-
-/// Given the name of a plugin or channel, return the associated channel, panicking
-/// if a channel of the given name cannot be found. Channel name should be passed
-/// as a null-terminated string.
-///
-/// The provided string has no lifetime requirements, but must be a non-null pointer
-/// to a valid C string.
-#[no_mangle]
-pub extern "C" fn get_channel_from_name(
-    channel_name: *const c_char,
-) -> ChannelId {
-    let name = unsafe { CStr::from_ptr(channel_name).to_string_lossy() };
-    super::channels::get_channel_from_name(&name).unwrap()
-}
diff --git a/panda/plugins/guest_plugin_manager/src/interface/channels.rs b/panda/plugins/guest_plugin_manager/src/interface/channels.rs
deleted file mode 100644
index 8182a6ad902..00000000000
--- a/panda/plugins/guest_plugin_manager/src/interface/channels.rs
+++ /dev/null
@@ -1,103 +0,0 @@
-use crossbeam_queue::SegQueue;
-use lazy_static::lazy_static;
-use parking_lot::RwLock;
-use std::collections::HashMap;
-use std::sync::atomic::{AtomicU32, Ordering};
-
-pub type ChannelId = u32;
-pub type ChannelCB = extern "C" fn(ChannelId, *const u8, usize);
-
-static NEXT_CHANNEL_NUMBER: AtomicU32 = AtomicU32::new(0);
-
-lazy_static! {
-    static ref CHANNELS: RwLock<HashMap<ChannelId, Channel>> =
-        RwLock::new(HashMap::new());
-}
-
-struct Channel {
-    name: Option<String>,
-    msg_receive_cb: ChannelCB,
-    message_queue: SegQueue<Vec<u8>>,
-}
-
-pub fn add_channel(p_name: Option<&str>, cb: ChannelCB) -> ChannelId {
-    let mut plugins = CHANNELS.write();
-    let channel_id = NEXT_CHANNEL_NUMBER.fetch_add(1, Ordering::SeqCst);
-    if plugins
-        .insert(
-            channel_id,
-            Channel {
-                name: p_name.map(ToString::to_string),
-                msg_receive_cb: cb,
-                message_queue: SegQueue::new(),
-            },
-        )
-        .is_some()
-    {
-        panic!("We've somehow added a duplicate ID");
-    }
-    println!("Added channel {} FD: {}", p_name.unwrap_or("?"), channel_id);
-    channel_id
-}
-
-pub fn poll_plugin_message(channel_id: ChannelId) -> Option<Vec<u8>> {
-    let pm = CHANNELS.read();
-    if let Some(plugin) = pm.get(&channel_id) {
-        plugin.message_queue.pop()
-    } else {
-        panic!("poll_plugin_message for plugin with incorrect ID");
-    }
-}
-
-pub fn requeue_plugin_message(channel_id: ChannelId, message: Vec<u8>) {
-    let pm = CHANNELS.read();
-    let plugin = pm.get(&channel_id).unwrap();
-    let len = plugin.message_queue.len();
-
-    plugin.message_queue.push(message);
-
-    // len won't be greater than single digit, this is fine
-    for _ in 0..len {
-        plugin
-            .message_queue
-            .push(plugin.message_queue.pop().unwrap());
-    }
-}
-
-pub fn publish_message_from_guest(channel_id: ChannelId, msg: Vec<u8>) {
-    let pm = CHANNELS.read();
-    if let Some(plugin) = pm.get(&channel_id) {
-        let buf_ptr = msg.as_ptr();
-        (plugin.msg_receive_cb)(channel_id, buf_ptr, msg.len())
-    } else {
-        println!("failed publish message to FD {}", channel_id);
-    }
-}
-
-pub fn publish_message_to_guest(channel_id: ChannelId, msg: Vec<u8>) {
-    let pm = CHANNELS.read();
-    if let Some(plugin) = pm.get(&channel_id) {
-        // println!("message pushed");
-        plugin.message_queue.push(msg)
-    } else {
-        println!("failed to publish message");
-    }
-}
-
-pub fn get_channel_from_name(p_name: &str) -> Option<ChannelId> {
-    // let unnamed = "unnamed".to_owned();
-    println!("channel_from_name");
-    for ch in CHANNELS.read().iter() {
-        println!(
-            "channel name: {} FD: {}",
-            &ch.1.name.as_ref().unwrap_or(&"unnamed".to_string()),
-            ch.0
-        );
-    }
-
-    CHANNELS
-        .read()
-        .iter()
-        .find(|(_, v)| v.name.as_deref() == Some(p_name))
-        .map(|x| *x.0)
-}
diff --git a/panda/plugins/guest_plugin_manager/src/interface/daemon_manager.rs b/panda/plugins/guest_plugin_manager/src/interface/daemon_manager.rs
deleted file mode 100644
index cdd0bf279f5..00000000000
--- a/panda/plugins/guest_plugin_manager/src/interface/daemon_manager.rs
+++ /dev/null
@@ -1,54 +0,0 @@
-use super::channels::{add_channel, publish_message_to_guest, ChannelId};
-use once_cell::sync::OnceCell;
-use std::path::Path;
-
-const CHANNEL_NAME: &str = "guest_daemon";
-static CHANNEL_DESC: OnceCell<ChannelId> = OnceCell::new();
-
-enum PacketKind {
-    LoadPlugin = 0,
-}
-
-#[allow(dead_code)]
-struct Packet {
-    kind: PacketKind,
-    payload: Vec<u8>,
-}
-
-#[allow(dead_code)]
-impl PacketKind {
-    fn from(kind: u32) -> Option<Self> {
-        match kind {
-            0 => Some(Self::LoadPlugin),
-            _ => None,
-        }
-    }
-}
-
-extern "C" fn read_callback(
-    _channel_id: ChannelId,
-    _ptr: *const u8,
-    _len: usize,
-) {
-}
-
-pub fn load_binary(binary_path: &str) {
-    if Path::new(binary_path).is_file() {
-        if let Ok(binary) = std::fs::read(binary_path) {
-            for chunk in binary.chunks(4096) {
-                let cd = CHANNEL_DESC.get().unwrap();
-                publish_message_to_guest(*cd, chunk.to_owned());
-            }
-        } else {
-            panic!("Failed to read binary at {}", binary_path);
-        }
-    } else {
-        panic!("failed to check for file {}", binary_path);
-    }
-}
-
-pub fn init() {
-    CHANNEL_DESC
-        .set(add_channel(Some(CHANNEL_NAME), read_callback))
-        .unwrap();
-}
diff --git a/panda/plugins/guest_plugin_manager/src/interface/hci.rs b/panda/plugins/guest_plugin_manager/src/interface/hci.rs
deleted file mode 100644
index bcd394cffff..00000000000
--- a/panda/plugins/guest_plugin_manager/src/interface/hci.rs
+++ /dev/null
@@ -1,105 +0,0 @@
-use super::channels::{
-    get_channel_from_name, poll_plugin_message, publish_message_from_guest,
-    requeue_plugin_message, ChannelId,
-};
-use super::plugin_manager::new_manager_channel;
-use crate::MAGIC;
-use panda::mem::{virtual_memory_read, virtual_memory_write};
-use panda::prelude::*;
-
-pub fn hyp_start(
-    _cpu: &mut CPUState,
-    _channel_id: ChannelId,
-    _arg1: usize,
-    _arg2: usize,
-) -> Option<usize> {
-    println!("start");
-    Some(!MAGIC)
-}
-pub fn hyp_stop(
-    _cpu: &mut CPUState,
-    _channel_id: ChannelId,
-    _arg1: usize,
-    _arg2: usize,
-) -> Option<usize> {
-    println!("stop");
-    None
-}
-pub fn hyp_read(
-    cpu: &mut CPUState,
-    channel_id: ChannelId,
-    addr: usize,
-    max_size: usize,
-) -> Option<usize> {
-    if let Some(mut msg) = poll_plugin_message(channel_id) {
-        if msg.len() > max_size {
-            requeue_plugin_message(channel_id, msg[max_size..].to_owned());
-            msg.truncate(max_size);
-        }
-        // could check max len more
-        virtual_memory_write(cpu, addr as target_ulong, &msg);
-        Some(msg.len())
-    } else {
-        Some(0)
-    }
-}
-pub fn hyp_write(
-    cpu: &mut CPUState,
-    channel_id: ChannelId,
-    buf_ptr: usize,
-    buf_size: usize,
-) -> Option<usize> {
-    if let Ok(buf_out) =
-        virtual_memory_read(cpu, buf_ptr as target_ulong, buf_size)
-    {
-        let bytes_read = buf_out.len();
-        publish_message_from_guest(channel_id, buf_out);
-
-        Some(bytes_read)
-    } else {
-        println!("Failed to read virtual memory in hyp_write");
-        None
-    }
-}
-pub fn hyp_error(
-    _cpu: &mut CPUState,
-    _channel_id: ChannelId,
-    _arg1: usize,
-    _arg2: usize,
-) -> Option<usize> {
-    println!("error");
-    None
-}
-
-pub fn hyp_get_manager(
-    _cpu: &mut CPUState,
-    _channel_id: ChannelId,
-    _arg1: usize,
-    _arg2: usize,
-) -> Option<usize> {
-    dbg!(Some(new_manager_channel() as usize))
-}
-
-pub fn hyp_get_channel_by_name(
-    cpu: &mut CPUState,
-    _channel_id: ChannelId,
-    buf_ptr: usize,
-    buf_size: usize,
-) -> Option<usize> {
-    println!("channel_by_name");
-    if let Ok(buf_out) =
-        virtual_memory_read(cpu, buf_ptr as target_ulong, buf_size)
-    {
-        if let Some(cd) =
-            get_channel_from_name(dbg!(&String::from_utf8_lossy(&buf_out)))
-        {
-            println!("found channel number {}", cd);
-            Some(cd as usize)
-        } else {
-            println!("failed to find channel number");
-            Some(-1_isize as usize)
-        }
-    } else {
-        panic!("Failed to read virtual memory in hyp_write");
-    }
-}
diff --git a/panda/plugins/guest_plugin_manager/src/interface/mod.rs b/panda/plugins/guest_plugin_manager/src/interface/mod.rs
deleted file mode 100644
index b732c698581..00000000000
--- a/panda/plugins/guest_plugin_manager/src/interface/mod.rs
+++ /dev/null
@@ -1,5 +0,0 @@
-pub mod api;
-pub mod plugin_manager;
-pub mod hci;
-pub mod channels;
-pub mod daemon_manager;
\ No newline at end of file
diff --git a/panda/plugins/guest_plugin_manager/src/interface/plugin_manager.rs b/panda/plugins/guest_plugin_manager/src/interface/plugin_manager.rs
deleted file mode 100644
index 228e67db58a..00000000000
--- a/panda/plugins/guest_plugin_manager/src/interface/plugin_manager.rs
+++ /dev/null
@@ -1,61 +0,0 @@
-use super::channels::{add_channel, publish_message_to_guest, ChannelId};
-use std::convert::TryFrom;
-use std::mem::size_of;
-use std::slice::from_raw_parts;
-
-type OperationID = u32;
-
-enum ManagerOp {
-    GetChannelFromName = 0,
-    DebugOutput = 2,
-}
-
-impl TryFrom<usize> for ManagerOp {
-    type Error = ();
-
-    fn try_from(value: usize) -> Result<Self, ()> {
-        match value {
-            0 => Ok(ManagerOp::GetChannelFromName),
-            2 => Ok(ManagerOp::DebugOutput),
-            _ => Err(()),
-        }
-    }
-}
-
-fn get_channel_from_name(origin_channel: ChannelId, buffer: Vec<u8>) {
-    let plugin_name = String::from_utf8_lossy(&buffer).into_owned();
-    if let Some(channel_id) =
-        super::channels::get_channel_from_name(&plugin_name)
-    {
-        println!(
-            "success got channel from name {} FD is {}",
-            plugin_name, channel_id
-        );
-        let buf = u32::to_le_bytes(channel_id);
-
-        publish_message_to_guest(origin_channel, buf.to_vec());
-    } else {
-        println!("Failed to get channel from name");
-    }
-}
-
-extern "C" fn read_callback(channel_id: ChannelId, ptr: *const u8, len: usize) {
-    let mut buf = unsafe { from_raw_parts(ptr, len).to_vec() };
-    const OPSIZE: usize = size_of::<OperationID>();
-    let mut operation: [u8; OPSIZE] = [0; 4];
-    operation.copy_from_slice(&buf[..OPSIZE]);
-    let op_num = OperationID::from_le_bytes(operation);
-    buf.drain(0..OPSIZE);
-    match ManagerOp::try_from(op_num as usize) {
-        Ok(ManagerOp::GetChannelFromName) => {
-            get_channel_from_name(channel_id, buf)
-        }
-        Ok(ManagerOp::DebugOutput) => {}
-        _ => {}
-    }
-}
-
-pub fn new_manager_channel() -> ChannelId {
-    dbg!(add_channel(None, read_callback))
-}
-
diff --git a/panda/plugins/guest_shell/Cargo.lock b/panda/plugins/guest_shell/Cargo.lock
deleted file mode 100644
index 2127edfa02b..00000000000
--- a/panda/plugins/guest_shell/Cargo.lock
+++ /dev/null
@@ -1,489 +0,0 @@
-# This file is automatically @generated by Cargo.
-# It is not intended for manual editing.
-version = 3
-
-[[package]]
-name = "bitflags"
-version = "1.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
-
-[[package]]
-name = "cfg-if"
-version = "1.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
-
-[[package]]
-name = "ctor"
-version = "0.1.21"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ccc0a48a9b826acdf4028595adc9db92caea352f7af011a3034acd172a52a0aa"
-dependencies = [
- "quote",
- "syn",
-]
-
-[[package]]
-name = "darling"
-version = "0.10.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0d706e75d87e35569db781a9b5e2416cff1236a47ed380831f959382ccd5f858"
-dependencies = [
- "darling_core",
- "darling_macro",
-]
-
-[[package]]
-name = "darling_core"
-version = "0.10.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f0c960ae2da4de88a91b2d920c2a7233b400bc33cb28453a2987822d8392519b"
-dependencies = [
- "fnv",
- "ident_case",
- "proc-macro2",
- "quote",
- "strsim",
- "syn",
-]
-
-[[package]]
-name = "darling_macro"
-version = "0.10.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d9b5a2f4ac4969822c62224815d069952656cadc7084fdca9751e6d959189b72"
-dependencies = [
- "darling_core",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "dirs"
-version = "3.0.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "30baa043103c9d0c2a57cf537cc2f35623889dc0d405e6c3cccfadbc81c71309"
-dependencies = [
- "dirs-sys",
-]
-
-[[package]]
-name = "dirs-sys"
-version = "0.3.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "03d86534ed367a67548dc68113a0f5db55432fdfbb6e6f9d77704397d95d5780"
-dependencies = [
- "libc",
- "redox_users",
- "winapi",
-]
-
-[[package]]
-name = "doc-comment"
-version = "0.3.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fea41bba32d969b513997752735605054bc0dfa92b4c56bf1189f2e174be7a10"
-
-[[package]]
-name = "fnv"
-version = "1.0.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
-
-[[package]]
-name = "getrandom"
-version = "0.2.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7fcd999463524c52659517fe2cea98493cfe485d10565e7b0fb07dbba7ad2753"
-dependencies = [
- "cfg-if",
- "libc",
- "wasi",
-]
-
-[[package]]
-name = "ghost"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1a5bcf1bbeab73aa4cf2fde60a846858dc036163c7c33bec309f8d17de785479"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "glib-sys"
-version = "0.10.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c7e9b997a66e9a23d073f2b1abb4dbfc3925e0b8952f67efd8d9b6e168e4cdc1"
-dependencies = [
- "libc",
- "system-deps",
-]
-
-[[package]]
-name = "guest_shell"
-version = "0.1.0"
-dependencies = [
- "panda-re",
- "parking_lot",
-]
-
-[[package]]
-name = "heck"
-version = "0.3.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6d621efb26863f0e9924c6ac577e8275e5e6b77455db64ffa6c65c904e9e132c"
-dependencies = [
- "unicode-segmentation",
-]
-
-[[package]]
-name = "ident_case"
-version = "1.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b9e0384b61958566e926dc50660321d12159025e767c18e043daf26b70104c39"
-
-[[package]]
-name = "instant"
-version = "0.1.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7a5bbe824c507c5da5956355e86a746d82e0e1464f65d862cc5e71da70e94b2c"
-dependencies = [
- "cfg-if",
-]
-
-[[package]]
-name = "inventory"
-version = "0.1.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f0eb5160c60ba1e809707918ee329adb99d222888155835c6feedba19f6c3fd4"
-dependencies = [
- "ctor",
- "ghost",
- "inventory-impl",
-]
-
-[[package]]
-name = "inventory-impl"
-version = "0.1.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7e41b53715c6f0c4be49510bb82dee2c1e51c8586d885abe65396e82ed518548"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "lazy_static"
-version = "1.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
-
-[[package]]
-name = "libc"
-version = "0.2.109"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f98a04dce437184842841303488f70d0188c5f51437d2a834dc097eafa909a01"
-
-[[package]]
-name = "libloading"
-version = "0.6.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "351a32417a12d5f7e82c368a66781e307834dae04c6ce0cd4456d52989229883"
-dependencies = [
- "cfg-if",
- "winapi",
-]
-
-[[package]]
-name = "lock_api"
-version = "0.4.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "712a4d093c9976e24e7dbca41db895dabcbac38eb5f4045393d17a95bdfb1109"
-dependencies = [
- "scopeguard",
-]
-
-[[package]]
-name = "once_cell"
-version = "1.8.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "692fcb63b64b1758029e0a96ee63e049ce8c5948587f2f7208df04625e5f6b56"
-
-[[package]]
-name = "panda-re"
-version = "0.26.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2dfc5b9d238b9f1d4785346b7d611dcc4236f615334e0719afbf3033f8c26e0e"
-dependencies = [
- "dirs",
- "glib-sys",
- "inventory",
- "lazy_static",
- "libloading",
- "once_cell",
- "panda-re-macros",
- "panda-re-sys",
- "paste",
- "strum 0.20.0",
- "strum_macros 0.20.1",
- "thiserror",
-]
-
-[[package]]
-name = "panda-re-macros"
-version = "0.16.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5be1d7a86fc7fc5c32ca9d7b430e5f12f76b664f381c4213c7071d14e88fc588"
-dependencies = [
- "darling",
- "doc-comment",
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "panda-re-sys"
-version = "0.7.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e00ee000dc315bf4a0a55d78b6d97456a7540d6ed01768da5f5aa89fdb660783"
-
-[[package]]
-name = "parking_lot"
-version = "0.11.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7d17b78036a60663b797adeaee46f5c9dfebb86948d1255007a1d6be0271ff99"
-dependencies = [
- "instant",
- "lock_api",
- "parking_lot_core",
-]
-
-[[package]]
-name = "parking_lot_core"
-version = "0.8.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d76e8e1493bcac0d2766c42737f34458f1c8c50c0d23bcb24ea953affb273216"
-dependencies = [
- "cfg-if",
- "instant",
- "libc",
- "redox_syscall",
- "smallvec",
- "winapi",
-]
-
-[[package]]
-name = "paste"
-version = "1.0.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0744126afe1a6dd7f394cb50a716dbe086cb06e255e53d8d0185d82828358fb5"
-
-[[package]]
-name = "pkg-config"
-version = "0.3.23"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d1a3ea4f0dd7f1f3e512cf97bf100819aa547f36a6eccac8dbaae839eb92363e"
-
-[[package]]
-name = "proc-macro2"
-version = "1.0.33"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fb37d2df5df740e582f28f8560cf425f52bb267d872fe58358eadb554909f07a"
-dependencies = [
- "unicode-xid",
-]
-
-[[package]]
-name = "quote"
-version = "1.0.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "38bc8cc6a5f2e3655e0899c1b848643b2562f853f114bfec7be120678e3ace05"
-dependencies = [
- "proc-macro2",
-]
-
-[[package]]
-name = "redox_syscall"
-version = "0.2.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8383f39639269cde97d255a32bdb68c047337295414940c68bdd30c2e13203ff"
-dependencies = [
- "bitflags",
-]
-
-[[package]]
-name = "redox_users"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "528532f3d801c87aec9def2add9ca802fe569e44a544afe633765267840abe64"
-dependencies = [
- "getrandom",
- "redox_syscall",
-]
-
-[[package]]
-name = "scopeguard"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d29ab0c6d3fc0ee92fe66e2d99f700eab17a8d57d1c1d3b748380fb20baa78cd"
-
-[[package]]
-name = "serde"
-version = "1.0.130"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f12d06de37cf59146fbdecab66aa99f9fe4f78722e3607577a5375d66bd0c913"
-
-[[package]]
-name = "smallvec"
-version = "1.7.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ecab6c735a6bb4139c0caafd0cc3635748bbb3acf4550e8138122099251f309"
-
-[[package]]
-name = "strsim"
-version = "0.9.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6446ced80d6c486436db5c078dde11a9f73d42b57fb273121e160b84f63d894c"
-
-[[package]]
-name = "strum"
-version = "0.18.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "57bd81eb48f4c437cadc685403cad539345bf703d78e63707418431cecd4522b"
-
-[[package]]
-name = "strum"
-version = "0.20.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7318c509b5ba57f18533982607f24070a55d353e90d4cae30c467cdb2ad5ac5c"
-
-[[package]]
-name = "strum_macros"
-version = "0.18.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "87c85aa3f8ea653bfd3ddf25f7ee357ee4d204731f6aa9ad04002306f6e2774c"
-dependencies = [
- "heck",
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "strum_macros"
-version = "0.20.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ee8bc6b87a5112aeeab1f4a9f7ab634fe6cbefc4850006df31267f4cfb9e3149"
-dependencies = [
- "heck",
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "syn"
-version = "1.0.82"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8daf5dd0bb60cbd4137b1b587d2fc0ae729bc07cf01cd70b36a1ed5ade3b9d59"
-dependencies = [
- "proc-macro2",
- "quote",
- "unicode-xid",
-]
-
-[[package]]
-name = "system-deps"
-version = "1.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0f3ecc17269a19353b3558b313bba738b25d82993e30d62a18406a24aba4649b"
-dependencies = [
- "heck",
- "pkg-config",
- "strum 0.18.0",
- "strum_macros 0.18.0",
- "thiserror",
- "toml",
- "version-compare",
-]
-
-[[package]]
-name = "thiserror"
-version = "1.0.30"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "854babe52e4df1653706b98fcfc05843010039b406875930a70e4d9644e5c417"
-dependencies = [
- "thiserror-impl",
-]
-
-[[package]]
-name = "thiserror-impl"
-version = "1.0.30"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aa32fd3f627f367fe16f893e2597ae3c05020f8bba2666a4e6ea73d377e5714b"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "toml"
-version = "0.5.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a31142970826733df8241ef35dc040ef98c679ab14d7c3e54d827099b3acecaa"
-dependencies = [
- "serde",
-]
-
-[[package]]
-name = "unicode-segmentation"
-version = "1.8.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8895849a949e7845e06bd6dc1aa51731a103c42707010a5b591c0038fb73385b"
-
-[[package]]
-name = "unicode-xid"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8ccb82d61f80a663efe1f787a51b16b5a51e3314d6ac365b08639f52387b33f3"
-
-[[package]]
-name = "version-compare"
-version = "0.0.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d63556a25bae6ea31b52e640d7c41d1ab27faba4ccb600013837a3d0b3994ca1"
-
-[[package]]
-name = "wasi"
-version = "0.10.2+wasi-snapshot-preview1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fd6fbd9a79829dd1ad0cc20627bf1ed606756a7f77edff7b66b7064f9cb327c6"
-
-[[package]]
-name = "winapi"
-version = "0.3.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
-dependencies = [
- "winapi-i686-pc-windows-gnu",
- "winapi-x86_64-pc-windows-gnu",
-]
-
-[[package]]
-name = "winapi-i686-pc-windows-gnu"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
-
-[[package]]
-name = "winapi-x86_64-pc-windows-gnu"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
diff --git a/panda/plugins/guest_shell/Cargo.toml b/panda/plugins/guest_shell/Cargo.toml
deleted file mode 100644
index f11c725961c..00000000000
--- a/panda/plugins/guest_shell/Cargo.toml
+++ /dev/null
@@ -1,24 +0,0 @@
-[package]
-name = "guest_shell"
-version = "0.1.0"
-authors = ["Luke Craig <Luke.Craig@ll.mit.edu>", "Jordan McLeod <Jordan.McLeod@ll.mit.edu>"]
-edition = "2018"
-
-[lib]
-crate-type = ["cdylib"]
-
-[dependencies]
-panda-re = { version = "0.26", default-features = false }
-parking_lot = "0.11"
-
-[features]
-default = ["x86_64"]
-
-x86_64 = ["panda-re/x86_64"]
-i386 = ["panda-re/i386"]
-arm = ["panda-re/arm"]
-ppc = ["panda-re/ppc"]
-mips = ["panda-re/mips"]
-mipsel = ["panda-re/mipsel"]
-aarch64 = ["panda-re/aarch64"]
-mips64 = ["panda-re/mips64"]
diff --git a/panda/plugins/guest_shell/Makefile b/panda/plugins/guest_shell/Makefile
deleted file mode 100644
index 2234476df57..00000000000
--- a/panda/plugins/guest_shell/Makefile
+++ /dev/null
@@ -1,18 +0,0 @@
-# Don't forget to add your plugin to config.panda!
-
-# Build rust plugins with make!
-
-# The main rule for your plugin. List all object-file dependencies.
-
-PANDA_PATH = $(realpath $(shell pwd)/..)
-PLUGIN_DIR = $(realpath $(join $(PANDA_PATH), /../panda/plugins/$(PLUGIN_NAME)/))
-RUST_SOURCE = $(wildcard $(PLUGIN_DIR)/src/*.rs)
-PLUGIN_ARTIFACTS_DIR = $(PLUGIN_TARGET_DIR)/$(PLUGIN_NAME)/target
-
-$(PLUGIN_TARGET_DIR)/panda_$(PLUGIN_NAME).so : $(RUST_SOURCE) $(PLUGIN_DIR)/Cargo.toml
-	@echo "  CARGO   $(PLUGIN_DIR)"
-	@CARGO_TERM_PROGRESS_WHEN=never cargo build --release \
-		--no-default-features --features=$(TARGET_NAME) \
-		--manifest-path=$(PLUGIN_DIR)/Cargo.toml \
-		--target-dir=$(PLUGIN_ARTIFACTS_DIR)
-	@cp -p $(PLUGIN_ARTIFACTS_DIR)/release/lib$(PLUGIN_NAME).so $@
diff --git a/panda/plugins/guest_shell/README.md b/panda/plugins/guest_shell/README.md
deleted file mode 100644
index 81a52bc976b..00000000000
--- a/panda/plugins/guest_shell/README.md
+++ /dev/null
@@ -1,95 +0,0 @@
-# Rust Skeleton
-
-This is a basic example of how to build a PANDA plugin with Rust.
-
-## Building
-
-To check if the plugin will build:
-
-```
-cargo check
-```
-
-To actually build the plugin:
-
-```
-cargo build --release
-```
-
-(remove `--release` if you want to build in debug mode)
-
-The resulting plugin will be located in `target/release/librust_skeleton.so`.
-
-## Structure
-
-```
-├── Cargo.toml
-├── Makefile
-├── README.md
-└── src
-   └── lib.rs
-```
-
-* Cargo.toml - The core plugin info. This informs `cargo` how to actually go about building the plugin. It includes the name, dependencies, and features of plugins.
-* Makefile - Instructions for how the PANDA build system will build the plugin.
-* lib.rs - The main source file of your plugin. Additional source files can be referenced from here.
-
-## Cargo.toml
-
-The dependencies section:
-
-```toml
-[dependencies]
-panda-re = { version = "0.5", default-features = false }
-```
-
-To add a new dependency, add a new line in the form `name = "version"`.
-
-For example to add [`libc`](https://docs.rs/libc), simply add the following line:
-
-```toml
-libc = "0.2"
-```
-
-## Targetting Multiple Architectures
-
-In PANDA, a plugin is recompiled once per target architecture (that is to say, the architecture of the guest). To enable this behavior in Rust plugins, we use ["features"](https://doc.rust-lang.org/cargo/reference/features.html) in order to specify which architecture we are building for.
-
-This is controlled by this section of Cargo.toml:
-
-```toml
-[features]
-default = ["x86_64"]
-
-x86_64 = ["panda-re/x86_64"]
-i386 = ["panda-re/i386"]
-arm = ["panda-re/arm"]
-ppc = ["panda-re/ppc"]
-mips = ["panda-re/mips"]
-mipsel = ["panda-re/mipsel"]
-```
-
-by default `x86_64` is the only feature enabled (which is why we don't need to specify any features to build), this is primarily so that IDE support (rust-analyzer for VSCode/vim/etc, IntelliJ/CLion integration) works out of the box, as IDEs typically do type checking with the default feature set.
-
-To build for, say, `arm` you can use the following command:
-
-```
-cargo build --release --no-default-features --features=arm
-```
-
-And if you wish to prevent certain code from compiling on certain platforms you can use the following:
-
-```rust
-#[cfg(not(feature = "arm"))]
-fn breaks_arm() {
-    // ...
-}
-```
-
-## Other Resources
-
-* [panda-rs documentation](https://docs.rs/panda-re) 
-* [panda-rs announcement blog post](https://panda.re/blog/panda-rs)
-* [panda-sys documentation](https://docs.rs/panda-re-sys)
-* [The Rust Programming Language](https://doc.rust-lang.org/book/)
-* [Some example Rust plugins](https://github.com/panda-re/panda-rs-plugins/)
diff --git a/panda/plugins/guest_shell/guest_shell_pty.sh b/panda/plugins/guest_shell/guest_shell_pty.sh
deleted file mode 100755
index 8532b6fbda2..00000000000
--- a/panda/plugins/guest_shell/guest_shell_pty.sh
+++ /dev/null
@@ -1 +0,0 @@
-socat UNIX-CONNECT:/tmp/guest_shell.sock PTY,link=/tmp/guest_shell_pty & screen /tmp/guest_shell_pty
diff --git a/panda/plugins/guest_shell/rusty_shell/Cargo.toml b/panda/plugins/guest_shell/rusty_shell/Cargo.toml
deleted file mode 100644
index 230c5c70459..00000000000
--- a/panda/plugins/guest_shell/rusty_shell/Cargo.toml
+++ /dev/null
@@ -1,4 +0,0 @@
-[package]
-name = "rusty_shell"
-version = "0.1.0"
-edition = "2018"
diff --git a/panda/plugins/guest_shell/rusty_shell/src/hypercall.rs b/panda/plugins/guest_shell/rusty_shell/src/hypercall.rs
deleted file mode 100644
index abf8e6ad513..00000000000
--- a/panda/plugins/guest_shell/rusty_shell/src/hypercall.rs
+++ /dev/null
@@ -1,113 +0,0 @@
-use std::{io::Write, marker::PhantomData};
-
-const HC_MAGIC: usize = 0x666;
-
-#[allow(dead_code)]
-#[derive(Copy, Clone)]
-pub enum HcCmd {
-    Noop = 0,
-    Start,             /* start new action */
-    Stop,              /* stop action */
-    Read,              /* read buffer from hypervisor */
-    Write,             /* write buffer TO hypervisor*/
-    Error,             /* report error to hypervisor*/
-    ConditionalOp,     /* ask the hypervisor if op should be completed*/
-    NextStateMachine,  /* ask the hypervisor manager to move to the next
-                            state machine*/
-}
-
-pub struct HyperCall<'a> {
-    cmd : HcCmd,
-    args: Vec<usize>,
-    lifetime: PhantomData<&'a ()>,
-}
-
-impl HyperCall<'static> {
-    pub fn new(cmd: HcCmd) -> Self {
-        Self {
-            cmd,
-            args: vec![0; 2],
-            lifetime: PhantomData,
-        }
-    }
-}
-
-#[allow(dead_code)]
-impl<'a> HyperCall<'a> {
-    pub fn arg(&mut self, arg: usize) -> &mut Self {
-        self.args.push(arg);
-        self
-    }
-
-    pub fn from_string(command: HcCmd, s: &'a str) -> HyperCall<'a> {
-        Self {
-            cmd: command,
-            args: vec![
-                s.as_ptr() as usize,
-                s.len(),
-            ],
-            lifetime: PhantomData,
-        }
-    }
-
-    pub fn from_buf(command: HcCmd, buf: &'a [u8]) -> HyperCall<'a> {
-        Self {
-            cmd: command,
-            args: vec![
-                buf.as_ptr() as usize,
-                buf.len(),
-            ],
-            lifetime: PhantomData,
-        }
-    }
-
-    pub fn from_mut_buf(command: HcCmd, buf: &'a mut [u8]) -> HyperCall<'a> {
-        Self {
-            cmd: command,
-            args: vec![
-                buf.as_ptr() as usize,
-                buf.len(),
-            ],
-            lifetime: PhantomData,
-        }
-    }
-
-    #[cfg(any(target_arch = "x86", target_arch = "x86_64"))]
-    pub fn call(&mut self) -> usize {
-        let ret_val;
-
-        while self.args.len() < 2 {
-            self.args.push(0);
-        }
-
-        unsafe {
-            asm!(
-                "mov eax, {hc_magic}",
-                "mov ebx, {command:e}",
-                "cpuid",
-                hc_magic = const HC_MAGIC,
-                command = in(reg) self.cmd as u32,
-                in("ecx") self.args[0],
-                in("edx") self.args[1],
-                out("eax") ret_val,
-            );
-        }
-
-        ret_val
-    }
-}
-
-struct HyperWriter;
-
-impl Write for HyperWriter {
-    fn write(&mut self, buf: &[u8]) -> std::io::Result<usize> {
-        HyperCall::from_buf(HcCmd::Write, buf).call();
-
-        Ok(buf.len())
-    }
-
-    #[inline]
-    fn flush(&mut self) -> std::io::Result<()> {
-        Ok(())
-    }
-}
diff --git a/panda/plugins/guest_shell/rusty_shell/src/main.rs b/panda/plugins/guest_shell/rusty_shell/src/main.rs
deleted file mode 100644
index 7d1308954f8..00000000000
--- a/panda/plugins/guest_shell/rusty_shell/src/main.rs
+++ /dev/null
@@ -1,52 +0,0 @@
-#![feature(asm)]
-
-mod hypercall;
-use std::process::Command;
-
-use hypercall::{HyperCall, HcCmd};
-
-/// Read a line of input from the hypervisor
-fn read_line() -> String {
-    let mut buf = vec![0u8; 1024];
-
-    let len = loop {
-        let ret = HyperCall::from_mut_buf(HcCmd::Read, &mut buf).call() as isize;
-
-        if ret > 0 {
-            break ret
-        } else {
-            std::thread::yield_now();
-        }
-    };
-
-    buf.truncate(len as usize);
-
-    String::from_utf8(buf).unwrap()
-}
-
-/// Write a buffer or string across the hypervisor
-fn write(output: impl AsRef<[u8]>) {
-    HyperCall::from_buf(HcCmd::Write, output.as_ref()).call();
-}
-
-fn main() {
-    HyperCall::new(HcCmd::Start).call();
-
-    loop {
-        let input = read_line();
-
-        let args: Vec<&str> = input.trim().split_whitespace().collect();
-
-        if let [program, args @ ..] = &args[..] {
-            match Command::new(program).args(args).output() {
-                Ok(output) => {
-                    write(&output.stdout);
-                    write("[CMD_FINISHED]");
-                }
-                Err(_) => break,
-            }
-        }
-    }
-
-    HyperCall::new(HcCmd::Stop).call();
-}
diff --git a/panda/plugins/guest_shell/src/lib.rs b/panda/plugins/guest_shell/src/lib.rs
deleted file mode 100644
index d0ecfde8f15..00000000000
--- a/panda/plugins/guest_shell/src/lib.rs
+++ /dev/null
@@ -1,42 +0,0 @@
-use panda::{plugins::guest_plugin_manager::*, prelude::*};
-use parking_lot::{const_mutex, Mutex};
-use std::{
-    io::{self, Write},
-    os::unix::net::{UnixListener, UnixStream},
-};
-
-static STDOUT: Mutex<Option<UnixStream>> = const_mutex(None);
-
-// Copy all messages from the guest to the unix socket
-#[channel_recv]
-fn message_recv(_: u32, data: &[u8]) {
-    STDOUT.lock().as_mut().unwrap().write_all(data).ok();
-}
-
-#[derive(PandaArgs)]
-#[name = "guest_shell"]
-struct Args {
-    #[arg(default = "/tmp/guest_shell.sock")]
-    socket_path: String,
-}
-
-fn get_split_socket(path: &str) -> io::Result<(UnixStream, UnixStream)> {
-    let (socket, _) = UnixListener::bind(path)?.accept()?;
-    Ok((socket.try_clone()?, socket))
-}
-
-#[panda::init]
-fn init(_: &mut PluginHandle) -> bool {
-    let args = Args::from_panda_args();
-    let mut guest_channel = load_guest_plugin("guest_shell", message_recv);
-
-    let (stdout, mut stdin) = get_split_socket(&args.socket_path).unwrap();
-    STDOUT.lock().replace(stdout);
-
-    std::thread::spawn(move || {
-        // Copy stdin from unix socket to guest
-        io::copy(&mut stdin, &mut guest_channel).unwrap();
-    });
-
-    true
-}
diff --git a/panda/plugins/hyperfuse/Cargo.lock b/panda/plugins/hyperfuse/Cargo.lock
deleted file mode 100644
index 23a39475c0b..00000000000
--- a/panda/plugins/hyperfuse/Cargo.lock
+++ /dev/null
@@ -1,749 +0,0 @@
-# This file is automatically @generated by Cargo.
-# It is not intended for manual editing.
-version = 3
-
-[[package]]
-name = "aho-corasick"
-version = "0.7.18"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e37cfd5e7657ada45f742d6e99ca5788580b5c529dc78faf11ece6dc702656f"
-dependencies = [
- "memchr",
-]
-
-[[package]]
-name = "atty"
-version = "0.2.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d9b39be18770d11421cdb1b9947a45dd3f37e93092cbf377614828a319d5fee8"
-dependencies = [
- "hermit-abi",
- "libc",
- "winapi",
-]
-
-[[package]]
-name = "bincode"
-version = "1.3.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b1f45e9417d87227c7a56d22e471c6206462cba514c7590c09aff4cf6d1ddcad"
-dependencies = [
- "serde",
-]
-
-[[package]]
-name = "bitflags"
-version = "1.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf1de2fe8c75bc145a2f577add951f8134889b4795d47466a54a5c846d691693"
-
-[[package]]
-name = "byteorder"
-version = "1.4.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "14c189c53d098945499cdfa7ecc63567cf3886b3332b312a5b4585d8d3a6a610"
-
-[[package]]
-name = "cached"
-version = "0.26.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c2bc2fd249a24a9cdd4276f3a3e0461713271ab63b0e9e656e200e8e21c8c927"
-dependencies = [
- "hashbrown",
- "once_cell",
-]
-
-[[package]]
-name = "cfg-if"
-version = "1.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
-
-[[package]]
-name = "crossbeam-queue"
-version = "0.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b10ddc024425c88c2ad148c1b0fd53f4c6d38db9697c9f1588381212fa657c9"
-dependencies = [
- "cfg-if",
- "crossbeam-utils",
-]
-
-[[package]]
-name = "crossbeam-utils"
-version = "0.8.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d82cfc11ce7f2c3faef78d8a684447b40d503d9681acebed6cb728d45940c4db"
-dependencies = [
- "cfg-if",
- "lazy_static",
-]
-
-[[package]]
-name = "ctor"
-version = "0.1.20"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5e98e2ad1a782e33928b96fc3948e7c355e5af34ba4de7670fe8bac2a3b2006d"
-dependencies = [
- "quote",
- "syn",
-]
-
-[[package]]
-name = "darling"
-version = "0.10.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0d706e75d87e35569db781a9b5e2416cff1236a47ed380831f959382ccd5f858"
-dependencies = [
- "darling_core",
- "darling_macro",
-]
-
-[[package]]
-name = "darling_core"
-version = "0.10.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f0c960ae2da4de88a91b2d920c2a7233b400bc33cb28453a2987822d8392519b"
-dependencies = [
- "fnv",
- "ident_case",
- "proc-macro2",
- "quote",
- "strsim",
- "syn",
-]
-
-[[package]]
-name = "darling_macro"
-version = "0.10.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d9b5a2f4ac4969822c62224815d069952656cadc7084fdca9751e6d959189b72"
-dependencies = [
- "darling_core",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "dirs"
-version = "3.0.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "30baa043103c9d0c2a57cf537cc2f35623889dc0d405e6c3cccfadbc81c71309"
-dependencies = [
- "dirs-sys",
-]
-
-[[package]]
-name = "dirs-sys"
-version = "0.3.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "03d86534ed367a67548dc68113a0f5db55432fdfbb6e6f9d77704397d95d5780"
-dependencies = [
- "libc",
- "redox_users",
- "winapi",
-]
-
-[[package]]
-name = "doc-comment"
-version = "0.3.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fea41bba32d969b513997752735605054bc0dfa92b4c56bf1189f2e174be7a10"
-
-[[package]]
-name = "env_logger"
-version = "0.7.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "44533bbbb3bb3c1fa17d9f2e4e38bbbaf8396ba82193c4cb1b6445d711445d36"
-dependencies = [
- "atty",
- "humantime",
- "log",
- "regex",
- "termcolor",
-]
-
-[[package]]
-name = "fnv"
-version = "1.0.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
-
-[[package]]
-name = "fuser"
-version = "0.9.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "096c834eabc44f7151b8f17d28eb0501e30ea9139b4a2d64f33ad9ef4bdae8d3"
-dependencies = [
- "libc",
- "log",
- "memchr",
- "page_size",
- "pkg-config",
- "serde",
- "smallvec",
- "users",
- "zerocopy",
-]
-
-[[package]]
-name = "getrandom"
-version = "0.2.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7fcd999463524c52659517fe2cea98493cfe485d10565e7b0fb07dbba7ad2753"
-dependencies = [
- "cfg-if",
- "libc",
- "wasi",
-]
-
-[[package]]
-name = "ghost"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1a5bcf1bbeab73aa4cf2fde60a846858dc036163c7c33bec309f8d17de785479"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "glib-sys"
-version = "0.10.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c7e9b997a66e9a23d073f2b1abb4dbfc3925e0b8952f67efd8d9b6e168e4cdc1"
-dependencies = [
- "libc",
- "system-deps",
-]
-
-[[package]]
-name = "hashbrown"
-version = "0.11.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ab5ef0d4909ef3724cc8cce6ccc8572c5c817592e9285f5464f8e86f8bd3726e"
-
-[[package]]
-name = "heck"
-version = "0.3.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6d621efb26863f0e9924c6ac577e8275e5e6b77455db64ffa6c65c904e9e132c"
-dependencies = [
- "unicode-segmentation",
-]
-
-[[package]]
-name = "hermit-abi"
-version = "0.1.19"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "62b467343b94ba476dcb2500d242dadbb39557df889310ac77c5d99100aaac33"
-dependencies = [
- "libc",
-]
-
-[[package]]
-name = "humantime"
-version = "1.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "df004cfca50ef23c36850aaaa59ad52cc70d0e90243c3c7737a4dd32dc7a3c4f"
-dependencies = [
- "quick-error",
-]
-
-[[package]]
-name = "hyperfuse"
-version = "0.1.0"
-dependencies = [
- "bincode",
- "cached",
- "crossbeam-queue",
- "fuser",
- "lazy_static",
- "libc",
- "panda-re",
- "parking_lot",
- "pretty_env_logger",
- "serde",
-]
-
-[[package]]
-name = "ident_case"
-version = "1.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b9e0384b61958566e926dc50660321d12159025e767c18e043daf26b70104c39"
-
-[[package]]
-name = "instant"
-version = "0.1.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "716d3d89f35ac6a34fd0eed635395f4c3b76fa889338a4632e5231a8684216bd"
-dependencies = [
- "cfg-if",
-]
-
-[[package]]
-name = "inventory"
-version = "0.1.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0f0f7efb804ec95e33db9ad49e4252f049e37e8b0a4652e3cd61f7999f2eff7f"
-dependencies = [
- "ctor",
- "ghost",
- "inventory-impl",
-]
-
-[[package]]
-name = "inventory-impl"
-version = "0.1.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "75c094e94816723ab936484666968f5b58060492e880f3c8d00489a1e244fa51"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "lazy_static"
-version = "1.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
-
-[[package]]
-name = "libc"
-version = "0.2.98"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "320cfe77175da3a483efed4bc0adc1968ca050b098ce4f2f1c13a56626128790"
-
-[[package]]
-name = "libloading"
-version = "0.6.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "351a32417a12d5f7e82c368a66781e307834dae04c6ce0cd4456d52989229883"
-dependencies = [
- "cfg-if",
- "winapi",
-]
-
-[[package]]
-name = "lock_api"
-version = "0.4.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "712a4d093c9976e24e7dbca41db895dabcbac38eb5f4045393d17a95bdfb1109"
-dependencies = [
- "scopeguard",
-]
-
-[[package]]
-name = "log"
-version = "0.4.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "51b9bbe6c47d51fc3e1a9b945965946b4c44142ab8792c50835a980d362c2710"
-dependencies = [
- "cfg-if",
-]
-
-[[package]]
-name = "memchr"
-version = "2.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "308cc39be01b73d0d18f82a0e7b2a3df85245f84af96fdddc5d202d27e47b86a"
-
-[[package]]
-name = "once_cell"
-version = "1.8.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "692fcb63b64b1758029e0a96ee63e049ce8c5948587f2f7208df04625e5f6b56"
-
-[[package]]
-name = "page_size"
-version = "0.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eebde548fbbf1ea81a99b128872779c437752fb99f217c45245e1a61dcd9edcd"
-dependencies = [
- "libc",
- "winapi",
-]
-
-[[package]]
-name = "panda-re"
-version = "0.26.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2dfc5b9d238b9f1d4785346b7d611dcc4236f615334e0719afbf3033f8c26e0e"
-dependencies = [
- "dirs",
- "glib-sys",
- "inventory",
- "lazy_static",
- "libloading",
- "once_cell",
- "panda-re-macros",
- "panda-re-sys",
- "paste",
- "strum 0.20.0",
- "strum_macros 0.20.1",
- "thiserror",
-]
-
-[[package]]
-name = "panda-re-macros"
-version = "0.16.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5be1d7a86fc7fc5c32ca9d7b430e5f12f76b664f381c4213c7071d14e88fc588"
-dependencies = [
- "darling",
- "doc-comment",
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "panda-re-sys"
-version = "0.7.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e00ee000dc315bf4a0a55d78b6d97456a7540d6ed01768da5f5aa89fdb660783"
-
-[[package]]
-name = "parking_lot"
-version = "0.11.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7d17b78036a60663b797adeaee46f5c9dfebb86948d1255007a1d6be0271ff99"
-dependencies = [
- "instant",
- "lock_api",
- "parking_lot_core",
-]
-
-[[package]]
-name = "parking_lot_core"
-version = "0.8.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d76e8e1493bcac0d2766c42737f34458f1c8c50c0d23bcb24ea953affb273216"
-dependencies = [
- "cfg-if",
- "instant",
- "libc",
- "redox_syscall",
- "smallvec",
- "winapi",
-]
-
-[[package]]
-name = "paste"
-version = "1.0.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "acbf547ad0c65e31259204bd90935776d1c693cec2f4ff7abb7a1bbbd40dfe58"
-
-[[package]]
-name = "pkg-config"
-version = "0.3.19"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3831453b3449ceb48b6d9c7ad7c96d5ea673e9b470a1dc578c2ce6521230884c"
-
-[[package]]
-name = "pretty_env_logger"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "926d36b9553851b8b0005f1275891b392ee4d2d833852c417ed025477350fb9d"
-dependencies = [
- "env_logger",
- "log",
-]
-
-[[package]]
-name = "proc-macro2"
-version = "1.0.27"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f0d8caf72986c1a598726adc988bb5984792ef84f5ee5aa50209145ee8077038"
-dependencies = [
- "unicode-xid",
-]
-
-[[package]]
-name = "quick-error"
-version = "1.2.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a1d01941d82fa2ab50be1e79e6714289dd7cde78eba4c074bc5a4374f650dfe0"
-
-[[package]]
-name = "quote"
-version = "1.0.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c3d0b9745dc2debf507c8422de05d7226cc1f0644216dfdfead988f9b1ab32a7"
-dependencies = [
- "proc-macro2",
-]
-
-[[package]]
-name = "redox_syscall"
-version = "0.2.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5ab49abadf3f9e1c4bc499e8845e152ad87d2ad2d30371841171169e9d75feee"
-dependencies = [
- "bitflags",
-]
-
-[[package]]
-name = "redox_users"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "528532f3d801c87aec9def2add9ca802fe569e44a544afe633765267840abe64"
-dependencies = [
- "getrandom",
- "redox_syscall",
-]
-
-[[package]]
-name = "regex"
-version = "1.5.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d07a8629359eb56f1e2fb1652bb04212c072a87ba68546a04065d525673ac461"
-dependencies = [
- "aho-corasick",
- "memchr",
- "regex-syntax",
-]
-
-[[package]]
-name = "regex-syntax"
-version = "0.6.25"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f497285884f3fcff424ffc933e56d7cbca511def0c9831a7f9b5f6153e3cc89b"
-
-[[package]]
-name = "scopeguard"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d29ab0c6d3fc0ee92fe66e2d99f700eab17a8d57d1c1d3b748380fb20baa78cd"
-
-[[package]]
-name = "serde"
-version = "1.0.126"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ec7505abeacaec74ae4778d9d9328fe5a5d04253220a85c4ee022239fc996d03"
-dependencies = [
- "serde_derive",
-]
-
-[[package]]
-name = "serde_derive"
-version = "1.0.126"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "963a7dbc9895aeac7ac90e74f34a5d5261828f79df35cbed41e10189d3804d43"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "smallvec"
-version = "1.7.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ecab6c735a6bb4139c0caafd0cc3635748bbb3acf4550e8138122099251f309"
-
-[[package]]
-name = "strsim"
-version = "0.9.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6446ced80d6c486436db5c078dde11a9f73d42b57fb273121e160b84f63d894c"
-
-[[package]]
-name = "strum"
-version = "0.18.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "57bd81eb48f4c437cadc685403cad539345bf703d78e63707418431cecd4522b"
-
-[[package]]
-name = "strum"
-version = "0.20.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7318c509b5ba57f18533982607f24070a55d353e90d4cae30c467cdb2ad5ac5c"
-
-[[package]]
-name = "strum_macros"
-version = "0.18.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "87c85aa3f8ea653bfd3ddf25f7ee357ee4d204731f6aa9ad04002306f6e2774c"
-dependencies = [
- "heck",
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "strum_macros"
-version = "0.20.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ee8bc6b87a5112aeeab1f4a9f7ab634fe6cbefc4850006df31267f4cfb9e3149"
-dependencies = [
- "heck",
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "syn"
-version = "1.0.74"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1873d832550d4588c3dbc20f01361ab00bfe741048f71e3fecf145a7cc18b29c"
-dependencies = [
- "proc-macro2",
- "quote",
- "unicode-xid",
-]
-
-[[package]]
-name = "synstructure"
-version = "0.12.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "474aaa926faa1603c40b7885a9eaea29b444d1cb2850cb7c0e37bb1a4182f4fa"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
- "unicode-xid",
-]
-
-[[package]]
-name = "system-deps"
-version = "1.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0f3ecc17269a19353b3558b313bba738b25d82993e30d62a18406a24aba4649b"
-dependencies = [
- "heck",
- "pkg-config",
- "strum 0.18.0",
- "strum_macros 0.18.0",
- "thiserror",
- "toml",
- "version-compare",
-]
-
-[[package]]
-name = "termcolor"
-version = "1.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2dfed899f0eb03f32ee8c6a0aabdb8a7949659e3466561fc0adf54e26d88c5f4"
-dependencies = [
- "winapi-util",
-]
-
-[[package]]
-name = "thiserror"
-version = "1.0.26"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "93119e4feac1cbe6c798c34d3a53ea0026b0b1de6a120deef895137c0529bfe2"
-dependencies = [
- "thiserror-impl",
-]
-
-[[package]]
-name = "thiserror-impl"
-version = "1.0.26"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "060d69a0afe7796bf42e9e2ff91f5ee691fb15c53d38b4b62a9a53eb23164745"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "toml"
-version = "0.5.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a31142970826733df8241ef35dc040ef98c679ab14d7c3e54d827099b3acecaa"
-dependencies = [
- "serde",
-]
-
-[[package]]
-name = "unicode-segmentation"
-version = "1.8.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8895849a949e7845e06bd6dc1aa51731a103c42707010a5b591c0038fb73385b"
-
-[[package]]
-name = "unicode-xid"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8ccb82d61f80a663efe1f787a51b16b5a51e3314d6ac365b08639f52387b33f3"
-
-[[package]]
-name = "users"
-version = "0.11.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "24cc0f6d6f267b73e5a2cadf007ba8f9bc39c6a6f9666f8cf25ea809a153b032"
-dependencies = [
- "libc",
- "log",
-]
-
-[[package]]
-name = "version-compare"
-version = "0.0.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d63556a25bae6ea31b52e640d7c41d1ab27faba4ccb600013837a3d0b3994ca1"
-
-[[package]]
-name = "wasi"
-version = "0.10.2+wasi-snapshot-preview1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fd6fbd9a79829dd1ad0cc20627bf1ed606756a7f77edff7b66b7064f9cb327c6"
-
-[[package]]
-name = "winapi"
-version = "0.3.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
-dependencies = [
- "winapi-i686-pc-windows-gnu",
- "winapi-x86_64-pc-windows-gnu",
-]
-
-[[package]]
-name = "winapi-i686-pc-windows-gnu"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
-
-[[package]]
-name = "winapi-util"
-version = "0.1.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "70ec6ce85bb158151cae5e5c87f95a8e97d2c0c4b001223f33a334e3ce5de178"
-dependencies = [
- "winapi",
-]
-
-[[package]]
-name = "winapi-x86_64-pc-windows-gnu"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
-
-[[package]]
-name = "zerocopy"
-version = "0.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5e59ec1d2457bd6c0dd89b50e7d9d6b0b647809bf3f0a59ac85557046950b7b2"
-dependencies = [
- "byteorder",
- "zerocopy-derive",
-]
-
-[[package]]
-name = "zerocopy-derive"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a0fbc82b82efe24da867ee52e015e58178684bd9dd64c34e66bdf21da2582a9f"
-dependencies = [
- "proc-macro2",
- "syn",
- "synstructure",
-]
diff --git a/panda/plugins/hyperfuse/Cargo.toml b/panda/plugins/hyperfuse/Cargo.toml
deleted file mode 100644
index b8b9dab060c..00000000000
--- a/panda/plugins/hyperfuse/Cargo.toml
+++ /dev/null
@@ -1,33 +0,0 @@
-[package]
-name = "hyperfuse"
-version = "0.1.0"
-authors = ["Luke Craig <Luke.Craig@ll.mit.edu>", "Jordan McLeod <Jordan.McLeod@ll.mit.edu>"]
-edition = "2018"
-
-[lib]
-crate-type = ["cdylib"]
-
-[dependencies]
-panda-re = { version = "0.26", default-features = false }
-fuser = { version = "0.9", features = ["serializable"] }
-#fuser = { git = "https://github.com/cberner/fuser", features = ["serializable"] }
-libc = "0.2.98"
-pretty_env_logger = "0.4.0"
-serde = { version = "1", features = ["derive"] }
-bincode = "1.3.3"
-lazy_static = "1"
-parking_lot = "0.11"
-crossbeam-queue = "0.3"
-cached = { version = "0.26", default-features = false }
-
-[features]
-default = ["x86_64"]
-
-x86_64 = ["panda-re/x86_64"]
-i386 = ["panda-re/i386"]
-arm = ["panda-re/arm"]
-ppc = ["panda-re/ppc"]
-mips = ["panda-re/mips"]
-mipsel = ["panda-re/mipsel"]
-aarch64 = ["panda-re/aarch64"]
-mips64 = ["panda-re/mips64"]
diff --git a/panda/plugins/hyperfuse/Makefile b/panda/plugins/hyperfuse/Makefile
deleted file mode 100644
index 2234476df57..00000000000
--- a/panda/plugins/hyperfuse/Makefile
+++ /dev/null
@@ -1,18 +0,0 @@
-# Don't forget to add your plugin to config.panda!
-
-# Build rust plugins with make!
-
-# The main rule for your plugin. List all object-file dependencies.
-
-PANDA_PATH = $(realpath $(shell pwd)/..)
-PLUGIN_DIR = $(realpath $(join $(PANDA_PATH), /../panda/plugins/$(PLUGIN_NAME)/))
-RUST_SOURCE = $(wildcard $(PLUGIN_DIR)/src/*.rs)
-PLUGIN_ARTIFACTS_DIR = $(PLUGIN_TARGET_DIR)/$(PLUGIN_NAME)/target
-
-$(PLUGIN_TARGET_DIR)/panda_$(PLUGIN_NAME).so : $(RUST_SOURCE) $(PLUGIN_DIR)/Cargo.toml
-	@echo "  CARGO   $(PLUGIN_DIR)"
-	@CARGO_TERM_PROGRESS_WHEN=never cargo build --release \
-		--no-default-features --features=$(TARGET_NAME) \
-		--manifest-path=$(PLUGIN_DIR)/Cargo.toml \
-		--target-dir=$(PLUGIN_ARTIFACTS_DIR)
-	@cp -p $(PLUGIN_ARTIFACTS_DIR)/release/lib$(PLUGIN_NAME).so $@
diff --git a/panda/plugins/hyperfuse/README.md b/panda/plugins/hyperfuse/README.md
deleted file mode 100644
index 81a52bc976b..00000000000
--- a/panda/plugins/hyperfuse/README.md
+++ /dev/null
@@ -1,95 +0,0 @@
-# Rust Skeleton
-
-This is a basic example of how to build a PANDA plugin with Rust.
-
-## Building
-
-To check if the plugin will build:
-
-```
-cargo check
-```
-
-To actually build the plugin:
-
-```
-cargo build --release
-```
-
-(remove `--release` if you want to build in debug mode)
-
-The resulting plugin will be located in `target/release/librust_skeleton.so`.
-
-## Structure
-
-```
-├── Cargo.toml
-├── Makefile
-├── README.md
-└── src
-   └── lib.rs
-```
-
-* Cargo.toml - The core plugin info. This informs `cargo` how to actually go about building the plugin. It includes the name, dependencies, and features of plugins.
-* Makefile - Instructions for how the PANDA build system will build the plugin.
-* lib.rs - The main source file of your plugin. Additional source files can be referenced from here.
-
-## Cargo.toml
-
-The dependencies section:
-
-```toml
-[dependencies]
-panda-re = { version = "0.5", default-features = false }
-```
-
-To add a new dependency, add a new line in the form `name = "version"`.
-
-For example to add [`libc`](https://docs.rs/libc), simply add the following line:
-
-```toml
-libc = "0.2"
-```
-
-## Targetting Multiple Architectures
-
-In PANDA, a plugin is recompiled once per target architecture (that is to say, the architecture of the guest). To enable this behavior in Rust plugins, we use ["features"](https://doc.rust-lang.org/cargo/reference/features.html) in order to specify which architecture we are building for.
-
-This is controlled by this section of Cargo.toml:
-
-```toml
-[features]
-default = ["x86_64"]
-
-x86_64 = ["panda-re/x86_64"]
-i386 = ["panda-re/i386"]
-arm = ["panda-re/arm"]
-ppc = ["panda-re/ppc"]
-mips = ["panda-re/mips"]
-mipsel = ["panda-re/mipsel"]
-```
-
-by default `x86_64` is the only feature enabled (which is why we don't need to specify any features to build), this is primarily so that IDE support (rust-analyzer for VSCode/vim/etc, IntelliJ/CLion integration) works out of the box, as IDEs typically do type checking with the default feature set.
-
-To build for, say, `arm` you can use the following command:
-
-```
-cargo build --release --no-default-features --features=arm
-```
-
-And if you wish to prevent certain code from compiling on certain platforms you can use the following:
-
-```rust
-#[cfg(not(feature = "arm"))]
-fn breaks_arm() {
-    // ...
-}
-```
-
-## Other Resources
-
-* [panda-rs documentation](https://docs.rs/panda-re) 
-* [panda-rs announcement blog post](https://panda.re/blog/panda-rs)
-* [panda-sys documentation](https://docs.rs/panda-re-sys)
-* [The Rust Programming Language](https://doc.rust-lang.org/book/)
-* [Some example Rust plugins](https://github.com/panda-re/panda-rs-plugins/)
diff --git a/panda/plugins/hyperfuse/src/lib.rs b/panda/plugins/hyperfuse/src/lib.rs
deleted file mode 100644
index 468658441eb..00000000000
--- a/panda/plugins/hyperfuse/src/lib.rs
+++ /dev/null
@@ -1,308 +0,0 @@
-use cached::{stores::TimedCache, Cached};
-use fuser::{
-    Filesystem, MountOption, ReplyAttr, ReplyData, ReplyDirectory, ReplyEntry, ReplyOpen,
-    ReplyWrite,
-};
-use libc::ENOENT;
-use panda::prelude::*;
-use serde::de::DeserializeOwned;
-use serde::Serialize;
-use std::borrow::Borrow;
-use std::ffi::{OsStr, OsString};
-use std::marker::PhantomData;
-
-mod types;
-use types::*;
-
-struct HyperFilesystem {
-    reply: Receiver<Reply>,
-    request: Sender<types::Request>,
-
-    link_target_cache: TimedCache<u64, Vec<u8>>,
-    lookup_cache: TimedCache<(u64, OsString), LookupCacheEntry>,
-}
-
-macro_rules! on_reply {
-    (
-        $self:ident => $reply:ident (
-            $type:ident { $($field:ident),* }
-
-            => $reply_ty:ident $({ $(
-                    $reply_field:ident
-                ),*})?
-
-                // tuple type
-                $(( $(
-                    $reply_field_tuple:ident
-                ),*))?
-
-            => $code:block
-        ) $(;)?
-    ) => {
-        $self.request.send(Request::$type { $( $field ),* }).unwrap();
-
-        match $self.reply.recv() {
-            Ok(Reply::$reply_ty
-               // struct variant
-               $({ $( $reply_field ),* })?
-               // tuple variant
-               $(( $( $reply_field_tuple ),* ))?
-            ) => $code,
-            Ok(Reply::Error(err)) => $reply.error(err),
-            Ok(reply) => panic!("Invalid reply {:?}", reply),
-            Err(_) => $reply.error(ENOENT),
-        }
-    };
-}
-
-macro_rules! send_reply {
-    (
-        $self:ident => $reply:ident.$method:ident (
-            $type:ident { $($field:ident),* }
-
-            => $reply_ty:ident
-                // struct type
-                $({$(
-                    $reply_field:ident $( . $reply_field_method:ident () )?
-                ),*})?
-                // tuple type
-                $(($(
-                    $reply_field_tup:ident $( . $reply_field_method_tup:ident () )?
-                ),*))?
-        ) $(;)?
-    ) => {
-        println!("{}(...)", stringify!($method));
-        on_reply! {
-            $self => $reply (
-                $type { $($field),* }
-
-                => $reply_ty
-                    // struct type
-                    $({ $(
-                        $reply_field
-                    ),*})?
-                    // tuple type
-                    $(( $(
-                        $reply_field_tup
-                    ),*))?
-
-                => {
-                    // struct type
-                    $(
-                        $(
-                            let $reply_field = $reply_field $( .$reply_field_method () )?;
-                        )*
-                        $reply.$method( $($reply_field),* );
-                    )?
-                    $(
-                        $(
-                            let $reply_field_tup = $reply_field_tup $( .$reply_field_method_tup () )?;
-                        )*
-                        $reply.$method( $($reply_field_tup),* );
-                    )?
-                }
-            )
-        }
-    };
-}
-
-impl Filesystem for HyperFilesystem {
-    fn lookup(&mut self, _req: &fuser::Request, parent_ino: u64, name: &OsStr, reply: ReplyEntry) {
-        if let Some(LookupCacheEntry {
-            ttl,
-            attr,
-            generation,
-        }) = self
-            .lookup_cache
-            .cache_get(&(parent_ino, name.to_os_string()))
-        {
-            reply.entry(ttl, attr, *generation);
-            return;
-        }
-
-        let name = name.to_string_lossy().into_owned();
-        send_reply! {
-            self => reply.entry(
-                Lookup { parent_ino, name } => Entry { ttl.borrow(), attr.borrow(), generation }
-            );
-        }
-    }
-
-    fn getattr(&mut self, _req: &fuser::Request, ino: u64, reply: ReplyAttr) {
-        send_reply! {
-            self => reply.attr(
-                GetAttr { ino } => Attr { ttl.borrow(), attr.borrow() }
-            );
-        }
-    }
-
-    fn read(
-        &mut self,
-        _req: &fuser::Request,
-        ino: u64,
-        _fh: u64,
-        offset: i64,
-        size: u32,
-        flags: i32,
-        _lock: Option<u64>,
-        reply: ReplyData,
-    ) {
-        send_reply! {
-            self => reply.data(
-                Read { ino, offset, size, flags } => Data(data.as_ref())
-            );
-        }
-    }
-
-    fn readlink(&mut self, _req: &fuser::Request<'_>, ino: u64, reply: ReplyData) {
-        if let Some(data) = self.link_target_cache.cache_get(&ino) {
-            reply.data(&data);
-            return;
-        }
-
-        send_reply! {
-            self => reply.data(
-                ReadLink { ino } => Data(data.as_ref())
-            );
-        }
-    }
-
-    fn readdir(
-        &mut self,
-        _req: &fuser::Request,
-        ino: u64,
-        _fh: u64,
-        offset: i64,
-        mut reply: ReplyDirectory,
-    ) {
-        let parent_ino = ino;
-        on_reply! {
-            self => reply(
-                ReadDir { ino, offset }
-                    => Directory { dir_entries }
-                    => {
-                        for DirEntry { ino, offset, kind, name, link_target, lookup_cache } in dir_entries {
-                            if let Some(LinkTarget { path, parent_ino, target_name, target_lookup }) = link_target {
-                                self.link_target_cache.cache_set(ino, path);
-                                self.lookup_cache.cache_set((parent_ino, target_name.into()), target_lookup);
-                            }
-                            self.lookup_cache.cache_set((parent_ino, name.clone().into()), lookup_cache);
-                            if reply.add(ino, offset, kind, name) {
-                                break
-                            }
-                        }
-
-                        reply.ok();
-                    }
-            );
-        }
-        println!("Finished reply");
-    }
-
-    fn open(&mut self, _req: &fuser::Request<'_>, ino: u64, flags: i32, reply: ReplyOpen) {
-        send_reply! {
-            self => reply.opened(
-                Open { ino, flags } => Opened { file_handle, flags }
-            );
-        }
-    }
-
-    fn write(
-        &mut self,
-        _req: &fuser::Request<'_>,
-        ino: u64,
-        _fh: u64,
-        offset: i64,
-        data: &[u8],
-        write_flags: u32,
-        flags: i32,
-        _lock_owner: Option<u64>,
-        reply: ReplyWrite,
-    ) {
-        let data = data.to_owned();
-        send_reply! {
-            self => reply.written(
-                Write { ino, offset, data, write_flags, flags } => Written { size }
-            );
-        }
-    }
-}
-
-struct Sender<T: Serialize>(Channel, PhantomData<T>);
-
-impl<T: Serialize> Sender<T> {
-    fn send(&mut self, val: T) -> Result<(), ()> {
-        bincode::serialize_into(&mut self.0, &val).map_err(|_| ())
-    }
-}
-
-struct Receiver<T: DeserializeOwned>(PhantomData<T>);
-
-impl<T: DeserializeOwned> Receiver<T> {
-    fn recv(&self) -> Result<Reply, ()> {
-        loop {
-            match MESSAGE_QUEUE.pop() {
-                Some(bytes) => break bincode::deserialize(&bytes).map_err(|_| ()),
-                None => {
-                    println!("Nothing recieved, sleeping...");
-                    std::thread::sleep(std::time::Duration::from_millis(500));
-                }
-            }
-        }
-    }
-}
-
-fn split_channel<InType, OutType>(channel: Channel) -> (Sender<OutType>, Receiver<InType>)
-where
-    InType: DeserializeOwned,
-    OutType: Serialize,
-{
-    (Sender(channel, PhantomData), Receiver(PhantomData))
-}
-
-fn mount(channel: Channel) {
-    // TODO: make this programatically configurable via a plugin-to-plugin API
-    let mountpoint = std::env::var("HYPERFUSE_MOUNT")
-        .expect("HYPERFUSE_MOUNT is not set but is required by 'hyperfuse' plugin");
-
-    let options = vec![
-        MountOption::FSName("hello".to_string()),
-        MountOption::AutoUnmount,
-    ];
-
-    let (request, reply) = split_channel(channel);
-
-    fuser::mount2(
-        HyperFilesystem {
-            request,
-            reply,
-            link_target_cache: TimedCache::with_lifespan(1),
-            lookup_cache: TimedCache::with_lifespan(1),
-        },
-        mountpoint,
-        &options,
-    )
-    .unwrap();
-    println!("Unmounted");
-}
-
-use crossbeam_queue::SegQueue;
-use panda::plugins::guest_plugin_manager::*; //GUEST_PLUGIN_MANAGER;
-
-static MESSAGE_QUEUE: SegQueue<Vec<u8>> = SegQueue::new();
-
-#[channel_recv]
-fn message_recv(_: u32, bytes: Vec<u8>) {
-    MESSAGE_QUEUE.push(bytes.to_owned());
-}
-
-#[panda::init]
-fn init(_: &mut PluginHandle) -> bool {
-    pretty_env_logger::init_custom_env("HYPERFUSE_LOG");
-
-    let channel = load_guest_plugin("hyperfuse_guest", message_recv);
-
-    std::thread::spawn(move || mount(channel));
-
-    true
-}
diff --git a/panda/plugins/hyperfuse/src/types.rs b/panda/plugins/hyperfuse/src/types.rs
deleted file mode 100644
index 262d5eb9540..00000000000
--- a/panda/plugins/hyperfuse/src/types.rs
+++ /dev/null
@@ -1,104 +0,0 @@
-use libc::c_int;
-use std::time::Duration;
-
-use fuser::{FileAttr, FileType};
-use serde::{Deserialize, Serialize};
-
-#[derive(Serialize, Deserialize)]
-pub enum Request {
-    Lookup {
-        parent_ino: u64,
-        name: String,
-    },
-    GetAttr {
-        ino: u64,
-    },
-    Read {
-        ino: u64,
-        offset: i64,
-        size: u32,
-        flags: i32,
-    },
-    ReadLink {
-        ino: u64,
-    },
-    ReadDir {
-        ino: u64,
-        offset: i64,
-    },
-    Open {
-        ino: u64,
-        flags: i32,
-    },
-    Write {
-        ino: u64,
-        offset: i64,
-        data: Vec<u8>,
-        write_flags: u32,
-        flags: i32,
-    },
-    Create {
-        parent: u64,
-        name: String,
-        mode: u32,
-        umask: u32,
-        flags: u32,
-    },
-}
-
-#[derive(Serialize, Deserialize, Debug)]
-pub enum Reply {
-    Entry {
-        ttl: Duration,
-        attr: FileAttr,
-        generation: u64,
-    },
-    Attr {
-        ttl: Duration,
-        attr: FileAttr,
-    },
-    Data(Vec<u8>),
-    Directory {
-        dir_entries: Vec<DirEntry>,
-    },
-    Opened {
-        file_handle: u64,
-        flags: u32,
-    },
-    Written {
-        size: u32,
-    },
-    Created {
-        ttl: Duration,
-        attr: FileAttr,
-        generation: u64,
-        fh: u64,
-        flags: u32,
-    },
-    Error(c_int),
-}
-
-#[derive(Serialize, Deserialize, Debug)]
-pub struct LinkTarget {
-    pub path: Vec<u8>,
-    pub parent_ino: u64,
-    pub target_name: String,
-    pub target_lookup: LookupCacheEntry,
-}
-
-#[derive(Serialize, Deserialize, Debug)]
-pub struct DirEntry {
-    pub ino: u64,
-    pub offset: i64,
-    pub kind: FileType,
-    pub name: String,
-    pub link_target: Option<LinkTarget>,
-    pub lookup_cache: LookupCacheEntry,
-}
-
-#[derive(Serialize, Deserialize, Debug)]
-pub struct LookupCacheEntry {
-    pub ttl: Duration,
-    pub attr: FileAttr,
-    pub generation: u64,
-}
diff --git a/panda/plugins/linjector/.gitignore b/panda/plugins/linjector/.gitignore
deleted file mode 100644
index bdb80413b49..00000000000
--- a/panda/plugins/linjector/.gitignore
+++ /dev/null
@@ -1,3 +0,0 @@
-/target
-src/injectables/injector
-src/injectables/tiny_mmap
diff --git a/panda/plugins/linjector/Cargo.lock b/panda/plugins/linjector/Cargo.lock
deleted file mode 100644
index 2250e0b1dbe..00000000000
--- a/panda/plugins/linjector/Cargo.lock
+++ /dev/null
@@ -1,705 +0,0 @@
-# This file is automatically @generated by Cargo.
-# It is not intended for manual editing.
-version = 3
-
-[[package]]
-name = "adler"
-version = "1.0.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f26201604c87b1e01bd3d98f8d5d9a8fcbb815e8cedb41ffccbeb4bf593a35fe"
-
-[[package]]
-name = "aho-corasick"
-version = "0.7.18"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e37cfd5e7657ada45f742d6e99ca5788580b5c529dc78faf11ece6dc702656f"
-dependencies = [
- "memchr",
-]
-
-[[package]]
-name = "array-init"
-version = "2.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6945cc5422176fc5e602e590c2878d2c2acd9a4fe20a4baa7c28022521698ec6"
-
-[[package]]
-name = "async-trait"
-version = "0.1.51"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "44318e776df68115a881de9a8fd1b9e53368d7a4a5ce4cc48517da3393233a5e"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "atty"
-version = "0.2.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d9b39be18770d11421cdb1b9947a45dd3f37e93092cbf377614828a319d5fee8"
-dependencies = [
- "hermit-abi",
- "libc",
- "winapi",
-]
-
-[[package]]
-name = "autocfg"
-version = "1.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cdb031dd78e28731d87d56cc8ffef4a8f36ca26c38fe2de700543e627f8a464a"
-
-[[package]]
-name = "bitflags"
-version = "1.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
-
-[[package]]
-name = "cfg-if"
-version = "1.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
-
-[[package]]
-name = "crc32fast"
-version = "1.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "81156fece84ab6a9f2afdb109ce3ae577e42b1228441eded99bd77f627953b1a"
-dependencies = [
- "cfg-if",
-]
-
-[[package]]
-name = "ctor"
-version = "0.1.21"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ccc0a48a9b826acdf4028595adc9db92caea352f7af011a3034acd172a52a0aa"
-dependencies = [
- "quote",
- "syn",
-]
-
-[[package]]
-name = "darling"
-version = "0.10.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0d706e75d87e35569db781a9b5e2416cff1236a47ed380831f959382ccd5f858"
-dependencies = [
- "darling_core",
- "darling_macro",
-]
-
-[[package]]
-name = "darling_core"
-version = "0.10.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f0c960ae2da4de88a91b2d920c2a7233b400bc33cb28453a2987822d8392519b"
-dependencies = [
- "fnv",
- "ident_case",
- "proc-macro2",
- "quote",
- "strsim",
- "syn",
-]
-
-[[package]]
-name = "darling_macro"
-version = "0.10.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d9b5a2f4ac4969822c62224815d069952656cadc7084fdca9751e6d959189b72"
-dependencies = [
- "darling_core",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "dashmap"
-version = "4.0.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e77a43b28d0668df09411cb0bc9a8c2adc40f9a048afe863e05fd43251e8e39c"
-dependencies = [
- "cfg-if",
- "num_cpus",
-]
-
-[[package]]
-name = "dirs"
-version = "3.0.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "30baa043103c9d0c2a57cf537cc2f35623889dc0d405e6c3cccfadbc81c71309"
-dependencies = [
- "dirs-sys",
-]
-
-[[package]]
-name = "dirs-sys"
-version = "0.3.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "03d86534ed367a67548dc68113a0f5db55432fdfbb6e6f9d77704397d95d5780"
-dependencies = [
- "libc",
- "redox_users",
- "winapi",
-]
-
-[[package]]
-name = "doc-comment"
-version = "0.3.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fea41bba32d969b513997752735605054bc0dfa92b4c56bf1189f2e174be7a10"
-
-[[package]]
-name = "env_logger"
-version = "0.7.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "44533bbbb3bb3c1fa17d9f2e4e38bbbaf8396ba82193c4cb1b6445d711445d36"
-dependencies = [
- "atty",
- "humantime",
- "log",
- "regex",
- "termcolor",
-]
-
-[[package]]
-name = "flate2"
-version = "1.0.22"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e6988e897c1c9c485f43b47a529cef42fde0547f9d8d41a7062518f1d8fc53f"
-dependencies = [
- "cfg-if",
- "crc32fast",
- "libc",
- "miniz_oxide",
-]
-
-[[package]]
-name = "fnv"
-version = "1.0.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
-
-[[package]]
-name = "getrandom"
-version = "0.2.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7fcd999463524c52659517fe2cea98493cfe485d10565e7b0fb07dbba7ad2753"
-dependencies = [
- "cfg-if",
- "libc",
- "wasi",
-]
-
-[[package]]
-name = "ghost"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1a5bcf1bbeab73aa4cf2fde60a846858dc036163c7c33bec309f8d17de785479"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "glib-sys"
-version = "0.10.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c7e9b997a66e9a23d073f2b1abb4dbfc3925e0b8952f67efd8d9b6e168e4cdc1"
-dependencies = [
- "libc",
- "system-deps",
-]
-
-[[package]]
-name = "heck"
-version = "0.3.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6d621efb26863f0e9924c6ac577e8275e5e6b77455db64ffa6c65c904e9e132c"
-dependencies = [
- "unicode-segmentation",
-]
-
-[[package]]
-name = "hermit-abi"
-version = "0.1.19"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "62b467343b94ba476dcb2500d242dadbb39557df889310ac77c5d99100aaac33"
-dependencies = [
- "libc",
-]
-
-[[package]]
-name = "humantime"
-version = "1.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "df004cfca50ef23c36850aaaa59ad52cc70d0e90243c3c7737a4dd32dc7a3c4f"
-dependencies = [
- "quick-error",
-]
-
-[[package]]
-name = "ident_case"
-version = "1.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b9e0384b61958566e926dc50660321d12159025e767c18e043daf26b70104c39"
-
-[[package]]
-name = "instant"
-version = "0.1.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7a5bbe824c507c5da5956355e86a746d82e0e1464f65d862cc5e71da70e94b2c"
-dependencies = [
- "cfg-if",
-]
-
-[[package]]
-name = "inventory"
-version = "0.1.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0f0f7efb804ec95e33db9ad49e4252f049e37e8b0a4652e3cd61f7999f2eff7f"
-dependencies = [
- "ctor",
- "ghost",
- "inventory-impl",
-]
-
-[[package]]
-name = "inventory-impl"
-version = "0.1.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "75c094e94816723ab936484666968f5b58060492e880f3c8d00489a1e244fa51"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "lazy_static"
-version = "1.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
-
-[[package]]
-name = "libc"
-version = "0.2.103"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dd8f7255a17a627354f321ef0055d63b898c6fb27eff628af4d1b66b7331edf6"
-
-[[package]]
-name = "libloading"
-version = "0.6.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "351a32417a12d5f7e82c368a66781e307834dae04c6ce0cd4456d52989229883"
-dependencies = [
- "cfg-if",
- "winapi",
-]
-
-[[package]]
-name = "linjector"
-version = "0.1.0"
-dependencies = [
- "lazy_static",
- "log",
- "object",
- "once_cell",
- "panda-re",
- "pretty_env_logger",
-]
-
-[[package]]
-name = "lock_api"
-version = "0.4.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "712a4d093c9976e24e7dbca41db895dabcbac38eb5f4045393d17a95bdfb1109"
-dependencies = [
- "scopeguard",
-]
-
-[[package]]
-name = "log"
-version = "0.4.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "51b9bbe6c47d51fc3e1a9b945965946b4c44142ab8792c50835a980d362c2710"
-dependencies = [
- "cfg-if",
-]
-
-[[package]]
-name = "memchr"
-version = "2.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "308cc39be01b73d0d18f82a0e7b2a3df85245f84af96fdddc5d202d27e47b86a"
-
-[[package]]
-name = "miniz_oxide"
-version = "0.4.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a92518e98c078586bc6c934028adcca4c92a53d6a958196de835170a01d84e4b"
-dependencies = [
- "adler",
- "autocfg",
-]
-
-[[package]]
-name = "num_cpus"
-version = "1.13.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "05499f3756671c15885fee9034446956fff3f243d6077b91e5767df161f766b3"
-dependencies = [
- "hermit-abi",
- "libc",
-]
-
-[[package]]
-name = "object"
-version = "0.26.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "39f37e50073ccad23b6d09bcb5b263f4e76d3bb6038e4a3c08e52162ffa8abc2"
-dependencies = [
- "flate2",
- "memchr",
-]
-
-[[package]]
-name = "once_cell"
-version = "1.8.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "692fcb63b64b1758029e0a96ee63e049ce8c5948587f2f7208df04625e5f6b56"
-
-[[package]]
-name = "panda-re"
-version = "0.38.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b59ef8fd95e7cecece17cf5d4d1c9aeafe79f020cc2b622cec18dd0a903b44ce"
-dependencies = [
- "array-init",
- "async-trait",
- "dashmap",
- "dirs",
- "glib-sys",
- "inventory",
- "lazy_static",
- "libloading",
- "log",
- "once_cell",
- "panda-re-macros",
- "panda-re-sys",
- "parking_lot",
- "paste",
- "strum 0.20.0",
- "strum_macros 0.20.1",
- "thiserror",
-]
-
-[[package]]
-name = "panda-re-macros"
-version = "0.21.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "29772398be20723c90088ae4380d62e25cefe54c174d9082532b258985e41d04"
-dependencies = [
- "darling",
- "doc-comment",
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "panda-re-sys"
-version = "0.7.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e00ee000dc315bf4a0a55d78b6d97456a7540d6ed01768da5f5aa89fdb660783"
-
-[[package]]
-name = "parking_lot"
-version = "0.11.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7d17b78036a60663b797adeaee46f5c9dfebb86948d1255007a1d6be0271ff99"
-dependencies = [
- "instant",
- "lock_api",
- "parking_lot_core",
-]
-
-[[package]]
-name = "parking_lot_core"
-version = "0.8.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d76e8e1493bcac0d2766c42737f34458f1c8c50c0d23bcb24ea953affb273216"
-dependencies = [
- "cfg-if",
- "instant",
- "libc",
- "redox_syscall",
- "smallvec",
- "winapi",
-]
-
-[[package]]
-name = "paste"
-version = "1.0.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "acbf547ad0c65e31259204bd90935776d1c693cec2f4ff7abb7a1bbbd40dfe58"
-
-[[package]]
-name = "pkg-config"
-version = "0.3.20"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7c9b1041b4387893b91ee6746cddfc28516aff326a3519fb2adf820932c5e6cb"
-
-[[package]]
-name = "pretty_env_logger"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "926d36b9553851b8b0005f1275891b392ee4d2d833852c417ed025477350fb9d"
-dependencies = [
- "env_logger",
- "log",
-]
-
-[[package]]
-name = "proc-macro2"
-version = "1.0.29"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b9f5105d4fdaab20335ca9565e106a5d9b82b6219b5ba735731124ac6711d23d"
-dependencies = [
- "unicode-xid",
-]
-
-[[package]]
-name = "quick-error"
-version = "1.2.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a1d01941d82fa2ab50be1e79e6714289dd7cde78eba4c074bc5a4374f650dfe0"
-
-[[package]]
-name = "quote"
-version = "1.0.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c3d0b9745dc2debf507c8422de05d7226cc1f0644216dfdfead988f9b1ab32a7"
-dependencies = [
- "proc-macro2",
-]
-
-[[package]]
-name = "redox_syscall"
-version = "0.2.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8383f39639269cde97d255a32bdb68c047337295414940c68bdd30c2e13203ff"
-dependencies = [
- "bitflags",
-]
-
-[[package]]
-name = "redox_users"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "528532f3d801c87aec9def2add9ca802fe569e44a544afe633765267840abe64"
-dependencies = [
- "getrandom",
- "redox_syscall",
-]
-
-[[package]]
-name = "regex"
-version = "1.5.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d07a8629359eb56f1e2fb1652bb04212c072a87ba68546a04065d525673ac461"
-dependencies = [
- "aho-corasick",
- "memchr",
- "regex-syntax",
-]
-
-[[package]]
-name = "regex-syntax"
-version = "0.6.25"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f497285884f3fcff424ffc933e56d7cbca511def0c9831a7f9b5f6153e3cc89b"
-
-[[package]]
-name = "scopeguard"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d29ab0c6d3fc0ee92fe66e2d99f700eab17a8d57d1c1d3b748380fb20baa78cd"
-
-[[package]]
-name = "serde"
-version = "1.0.130"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f12d06de37cf59146fbdecab66aa99f9fe4f78722e3607577a5375d66bd0c913"
-
-[[package]]
-name = "smallvec"
-version = "1.7.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ecab6c735a6bb4139c0caafd0cc3635748bbb3acf4550e8138122099251f309"
-
-[[package]]
-name = "strsim"
-version = "0.9.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6446ced80d6c486436db5c078dde11a9f73d42b57fb273121e160b84f63d894c"
-
-[[package]]
-name = "strum"
-version = "0.18.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "57bd81eb48f4c437cadc685403cad539345bf703d78e63707418431cecd4522b"
-
-[[package]]
-name = "strum"
-version = "0.20.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7318c509b5ba57f18533982607f24070a55d353e90d4cae30c467cdb2ad5ac5c"
-
-[[package]]
-name = "strum_macros"
-version = "0.18.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "87c85aa3f8ea653bfd3ddf25f7ee357ee4d204731f6aa9ad04002306f6e2774c"
-dependencies = [
- "heck",
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "strum_macros"
-version = "0.20.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ee8bc6b87a5112aeeab1f4a9f7ab634fe6cbefc4850006df31267f4cfb9e3149"
-dependencies = [
- "heck",
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "syn"
-version = "1.0.77"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5239bc68e0fef57495900cfea4e8dc75596d9a319d7e16b1e0a440d24e6fe0a0"
-dependencies = [
- "proc-macro2",
- "quote",
- "unicode-xid",
-]
-
-[[package]]
-name = "system-deps"
-version = "1.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0f3ecc17269a19353b3558b313bba738b25d82993e30d62a18406a24aba4649b"
-dependencies = [
- "heck",
- "pkg-config",
- "strum 0.18.0",
- "strum_macros 0.18.0",
- "thiserror",
- "toml",
- "version-compare",
-]
-
-[[package]]
-name = "termcolor"
-version = "1.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2dfed899f0eb03f32ee8c6a0aabdb8a7949659e3466561fc0adf54e26d88c5f4"
-dependencies = [
- "winapi-util",
-]
-
-[[package]]
-name = "thiserror"
-version = "1.0.29"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "602eca064b2d83369e2b2f34b09c70b605402801927c65c11071ac911d299b88"
-dependencies = [
- "thiserror-impl",
-]
-
-[[package]]
-name = "thiserror-impl"
-version = "1.0.29"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bad553cc2c78e8de258400763a647e80e6d1b31ee237275d756f6836d204494c"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "toml"
-version = "0.5.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a31142970826733df8241ef35dc040ef98c679ab14d7c3e54d827099b3acecaa"
-dependencies = [
- "serde",
-]
-
-[[package]]
-name = "unicode-segmentation"
-version = "1.8.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8895849a949e7845e06bd6dc1aa51731a103c42707010a5b591c0038fb73385b"
-
-[[package]]
-name = "unicode-xid"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8ccb82d61f80a663efe1f787a51b16b5a51e3314d6ac365b08639f52387b33f3"
-
-[[package]]
-name = "version-compare"
-version = "0.0.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d63556a25bae6ea31b52e640d7c41d1ab27faba4ccb600013837a3d0b3994ca1"
-
-[[package]]
-name = "wasi"
-version = "0.10.2+wasi-snapshot-preview1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fd6fbd9a79829dd1ad0cc20627bf1ed606756a7f77edff7b66b7064f9cb327c6"
-
-[[package]]
-name = "winapi"
-version = "0.3.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
-dependencies = [
- "winapi-i686-pc-windows-gnu",
- "winapi-x86_64-pc-windows-gnu",
-]
-
-[[package]]
-name = "winapi-i686-pc-windows-gnu"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
-
-[[package]]
-name = "winapi-util"
-version = "0.1.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "70ec6ce85bb158151cae5e5c87f95a8e97d2c0c4b001223f33a334e3ce5de178"
-dependencies = [
- "winapi",
-]
-
-[[package]]
-name = "winapi-x86_64-pc-windows-gnu"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
diff --git a/panda/plugins/linjector/Cargo.toml b/panda/plugins/linjector/Cargo.toml
deleted file mode 100644
index 20e981ade48..00000000000
--- a/panda/plugins/linjector/Cargo.toml
+++ /dev/null
@@ -1,28 +0,0 @@
-[package]
-name = "linjector"
-version = "0.1.0"
-authors = ["Luke Craig <Luke.Craig@ll.mit.edu>", "Jordan McLeod <Jordan.McLeod@ll.mit.edu>"]
-edition = "2018"
-
-[lib]
-crate-type = ["cdylib"]
-
-[dependencies]
-panda-re = { version = "0.38.0", default-features = false, features = ["syscall-injection"] }
-once_cell = "1.8.0"
-object = "0.26.2"
-lazy_static = "1.4.0"
-log = "0.4"
-pretty_env_logger = "0.4"
-
-[features]
-default = ["x86_64"]
-
-x86_64 = ["panda-re/x86_64"]
-i386 = ["panda-re/i386"]
-arm = ["panda-re/arm"]
-ppc = ["panda-re/ppc"]
-mips = ["panda-re/mips"]
-mipsel = ["panda-re/mipsel"]
-aarch64 = ["panda-re/aarch64"]
-mips64 = ["panda-re/mips64"]
diff --git a/panda/plugins/linjector/Makefile b/panda/plugins/linjector/Makefile
deleted file mode 100644
index 2234476df57..00000000000
--- a/panda/plugins/linjector/Makefile
+++ /dev/null
@@ -1,18 +0,0 @@
-# Don't forget to add your plugin to config.panda!
-
-# Build rust plugins with make!
-
-# The main rule for your plugin. List all object-file dependencies.
-
-PANDA_PATH = $(realpath $(shell pwd)/..)
-PLUGIN_DIR = $(realpath $(join $(PANDA_PATH), /../panda/plugins/$(PLUGIN_NAME)/))
-RUST_SOURCE = $(wildcard $(PLUGIN_DIR)/src/*.rs)
-PLUGIN_ARTIFACTS_DIR = $(PLUGIN_TARGET_DIR)/$(PLUGIN_NAME)/target
-
-$(PLUGIN_TARGET_DIR)/panda_$(PLUGIN_NAME).so : $(RUST_SOURCE) $(PLUGIN_DIR)/Cargo.toml
-	@echo "  CARGO   $(PLUGIN_DIR)"
-	@CARGO_TERM_PROGRESS_WHEN=never cargo build --release \
-		--no-default-features --features=$(TARGET_NAME) \
-		--manifest-path=$(PLUGIN_DIR)/Cargo.toml \
-		--target-dir=$(PLUGIN_ARTIFACTS_DIR)
-	@cp -p $(PLUGIN_ARTIFACTS_DIR)/release/lib$(PLUGIN_NAME).so $@
diff --git a/panda/plugins/linjector/README.md b/panda/plugins/linjector/README.md
deleted file mode 100644
index af971ae6d1f..00000000000
--- a/panda/plugins/linjector/README.md
+++ /dev/null
@@ -1,15 +0,0 @@
-# linjector
-
-linjector is a PANDA plugin responsible for non-cooperatively injecting a binary into
-a linux guest. This process is done via system call injection, chaining system calls
-together in order to run the provided executable. It is not recommended to use this directly, but rather to use `guest_plugin_manager` in order to spawn your executable as a child of the PANDA-provided guest agent (`guest_daemon`).
-
-### Arguments
-
-* `guest_binary` - string, the path of the executable to load into the guest
-* `proc_name` - string, the process name to inject into. Defaults to `[any]`.
-* `require_root` - bool, whether or not to require the process being injected into to have a UID of root
-
-### Compatibility
-
-Currently linjector only has support for x86_64 and arm guests. For other targets one may need to provide their own process injection mechanism.
diff --git a/panda/plugins/linjector/linjector_ppp.h b/panda/plugins/linjector/linjector_ppp.h
deleted file mode 100644
index 2a407a8ee0f..00000000000
--- a/panda/plugins/linjector/linjector_ppp.h
+++ /dev/null
@@ -1,11 +0,0 @@
-#ifndef __LINJECTOR_PPP_H
-#define __LINJECTOR_PPP_H
-// BEGIN_PYPANDA_NEEDS_THIS -- do not delete this comment bc pypanda
-// api autogen needs it.  And don't put any compiler directives
-// between this and END_PYPANDA_NEEDS_THIS except includes of other
-// files in this directory that contain subsections like this one.
-
-PPP_CB_TYPEDEF(void,before_guest_inject,CPUState *);
-
-// END_PYPANDA_NEEDS_THIS -- do not delete this comment!
-#endif
diff --git a/panda/plugins/linjector/rustfmt.toml b/panda/plugins/linjector/rustfmt.toml
deleted file mode 100644
index 5c8d9318b3b..00000000000
--- a/panda/plugins/linjector/rustfmt.toml
+++ /dev/null
@@ -1 +0,0 @@
-max_width = 80
\ No newline at end of file
diff --git a/panda/plugins/linjector/src/args.rs b/panda/plugins/linjector/src/args.rs
deleted file mode 100644
index f740916a27a..00000000000
--- a/panda/plugins/linjector/src/args.rs
+++ /dev/null
@@ -1,55 +0,0 @@
-use once_cell::sync::OnceCell;
-use panda::plugins::guest_plugin_manager::guest_plugin_path;
-use panda::prelude::*;
-
-use std::fs;
-use std::path::Path;
-
-static ELF_TO_INJECT: OnceCell<Vec<u8>> = OnceCell::new();
-
-#[derive(PandaArgs)]
-#[name = "linjector"] // plugin name
-pub struct Args {
-    #[arg(default = "guest_daemon")]
-    pub guest_binary: String,
-
-    #[arg(default = "[any]")]
-    pub proc_name: String,
-
-    #[arg(default = true)]
-    pub require_root: bool,
-}
-
-lazy_static::lazy_static! {
-    pub static ref ARGS: Args = Args::from_panda_args();
-}
-
-pub fn ensure_init() {
-    lazy_static::initialize(&ARGS);
-}
-
-pub fn load_elf() {
-    log::info!("Loading binary: {:?}", ARGS.guest_binary);
-
-    let binary_name = &ARGS.guest_binary;
-
-    let guest_binary = match guest_plugin_path(binary_name) {
-        Some(path) => path.to_string_lossy().into_owned(),
-        None if Path::new(binary_name).exists() => binary_name.clone(),
-        None => panic!("Failed to get binary {:?}", binary_name),
-    };
-
-    ELF_TO_INJECT.get_or_init(|| fs::read(&guest_binary).unwrap());
-}
-
-pub fn elf_to_inject() -> &'static [u8] {
-    &ELF_TO_INJECT.get().expect("No elf file loaded")[..]
-}
-
-pub fn require_root() -> bool {
-    ARGS.require_root
-}
-
-pub fn proc_name() -> &'static str {
-    ARGS.proc_name.as_str()
-}
diff --git a/panda/plugins/linjector/src/injectables/Makefile b/panda/plugins/linjector/src/injectables/Makefile
deleted file mode 100644
index 1616672f058..00000000000
--- a/panda/plugins/linjector/src/injectables/Makefile
+++ /dev/null
@@ -1,31 +0,0 @@
-.DEFAULT_GOAL := all
-LIST=injector tiny_mmap
-
-all: $(LIST)
-
-.PHONY: all
-
-CC=gcc -m32
-EXTRA_GCC_ARGS= -fomit-frame-pointer -nodefaultlibs -nostdlib -fpic
-
-
-hello_world: hello_world.c
-	$(CC) $(EXTRA_GCC_ARGS) $< -o $@
-
-read_file: read_file.c
-	$(CC) $(EXTRA_GCC_ARGS) $< -o $@
-
-read_all_files: read_all_files.c
-	$(CC) $(EXTRA_GCC_ARGS) $< -o $@
-
-injector: injector.c
-	$(CC) -O3 $(EXTRA_GCC_ARGS) $< -o $@
-
-tiny_mmap: tiny_mmap.c
-	$(CC) $(EXTRA_GCC_ARGS) $< -o $@
-
-basic_hello_world: basic_hello_world.c
-	$(CC) -static $< -o $@
-
-clean: 
-	rm -rf  $(LIST)
diff --git a/panda/plugins/linjector/src/injectables/include/hypercall.h b/panda/plugins/linjector/src/injectables/include/hypercall.h
deleted file mode 100644
index c1235ede477..00000000000
--- a/panda/plugins/linjector/src/injectables/include/hypercall.h
+++ /dev/null
@@ -1,66 +0,0 @@
-// stolen from recctrl.h; modified to make more generic
-#include "hypercall_constants.h"
-
-
-#if defined(__x86_64__) || defined(__i386__)
-static inline __attribute__((always_inline)) int hc_rec(hc_cmd action, char *s, int len) {
-    int eax = HC_MAGIC;
-    int ret = HC_ERROR;
-
-    asm __volatile__(
-	"mov %1, %%eax \t\n\
-     mov %2, %%ebx \t\n\
-     mov %3, %%ecx \t\n\
-     mov %4, %%edx \t\n\
-     cpuid \t\n\
-     mov %%eax, %0 \t\n\
-    "
-	: "=g"(ret) /* output operand */
-	: "g" (eax), "g" (action), "g" (s), "g" (len)/* input operands */
-	: "eax", "ebx", "ecx", "edx" /* clobbered registers */
-    );
-
-    return ret;
-}
-static inline __attribute__((always_inline)) int hc(hc_cmd action, char *s) {
-    int eax = HC_MAGIC;
-    int ret = HC_ERROR;
-
-    asm __volatile__(
-	"mov %1, %%eax \t\n\
-     mov %2, %%ebx \t\n\
-     mov %3, %%ecx \t\n\
-     cpuid \t\n\
-     mov %%eax, %0 \t\n\
-    "
-	: "=g"(ret) /* output operand */
-	: "g" (eax), "g" (action), "g" (s) /* input operands */
-	: "eax", "ebx", "ecx", "edx" /* clobbered registers */
-    );
-
-    return ret;
-}
-#elif defined(__arm__)
-static inline __attribute__((always_inline)) int hc(hc_cmd action, char *s) {
-    unsigned long r0 = HC_MAGIC;
-    int ret = HC_ERROR;
-
-    asm __volatile__(
-    "push {r0-r4} \t\n\
-     ldr r0, %1 \t\n\
-     ldr r1, %2 \t\n\
-     ldr r2, %3 \t\n\
-     ldr p7, 0, r0, c0, c0, 0 \t\n\
-     sdr r0, %0 \t\n\
-     pop {r0-r4} \t\n\
-    "
-    : "=g"(ret) /* output operand */
-    : "g" (r0), "g" (action), "g" (s) /* input operands */
-    : "r0", "r1", "r2", "r3" /* clobbered registers */
-    );
-
-    return ret;
-}
-#else
-#error Unsupported platform.
-#endif
diff --git a/panda/plugins/linjector/src/injectables/include/hypercall_constants.h b/panda/plugins/linjector/src/injectables/include/hypercall_constants.h
deleted file mode 100644
index d2b234195f8..00000000000
--- a/panda/plugins/linjector/src/injectables/include/hypercall_constants.h
+++ /dev/null
@@ -1,15 +0,0 @@
-/** @brief Magic code to use in cpuid hypercall. */
-#define HC_MAGIC 0x10adc0d3
-
-typedef enum {
-    HC_NOOP = 0,
-    HC_START,               /* start new action */
-    HC_STOP,                /* stop action */
-    HC_READ,                /* read buffer from hypervisor */
-    HC_WRITE,               /* write buffer TO hypervisor*/
-    HC_ERROR,               /* report error to hypervisor*/
-    HC_CONDITIONAL_OP,      /* ask the hypervisor if op should be completed*/
-    HC_NEXT_STATE_MACHINE,  /* ask the hypervisor manager to move to the next
-                            state machine*/
-} hc_cmd;
-
diff --git a/panda/plugins/linjector/src/injectables/include/syscall_x86.h b/panda/plugins/linjector/src/injectables/include/syscall_x86.h
deleted file mode 100644
index cf20621a6d7..00000000000
--- a/panda/plugins/linjector/src/injectables/include/syscall_x86.h
+++ /dev/null
@@ -1,103 +0,0 @@
-#ifndef BASE_C_EXAMPLE
-#include "/usr/include/i386-linux-gnu/asm/unistd_32.h"
-#include "/usr/include/asm-generic/fcntl.h"
-#define _SYS_MMAN_H // it's a lie. but it's a good intention
-#define __USE_MISC
-#include "/usr/include/bits/mman-linux.h"
-#endif
-#define NULL 0L
-
-#define SYSINL static inline __attribute__((always_inline))
-
-/*
-* All the syscall stuff is from musl /arch/i386/syscall_arch.h
-*/
-
-#define SYSCALL_INSNS "int $128"
-
-#define SYSCALL_INSNS_12 "xchg %%ebx,%%edx ; " SYSCALL_INSNS " ; xchg %%ebx,%%edx"
-#define SYSCALL_INSNS_34 "xchg %%ebx,%%edi ; " SYSCALL_INSNS " ; xchg %%ebx,%%edi"
-
-
-SYSINL long syscall_0(long n)
-{
-	unsigned long __ret;
-	__asm__ __volatile__ (SYSCALL_INSNS : "=a"(__ret) : "a"(n) : "memory");
-	return __ret;
-}
-
-SYSINL long syscall_1(long n, long a1)
-{
-	unsigned long __ret;
-	__asm__ __volatile__ (SYSCALL_INSNS_12 : "=a"(__ret) : "a"(n), "d"(a1) : "memory");
-	return __ret;
-}
-
-SYSINL long syscall_2(long n, long a1, long a2)
-{
-	unsigned long __ret;
-	__asm__ __volatile__ (SYSCALL_INSNS_12 : "=a"(__ret) : "a"(n), "d"(a1), "c"(a2) : "memory");
-	return __ret;
-}
-
-SYSINL long syscall_3(long n, long a1, long a2, long a3)
-{
-	unsigned long __ret;
-#if !defined(__PIC__) || !defined(BROKEN_EBX_ASM)
-	__asm__ __volatile__ (SYSCALL_INSNS : "=a"(__ret) : "a"(n), "b"(a1), "c"(a2), "d"(a3) : "memory");
-#else
-	__asm__ __volatile__ (SYSCALL_INSNS_34 : "=a"(__ret) : "a"(n), "D"(a1), "c"(a2), "d"(a3) : "memory");
-#endif
-	return __ret;
-}
-
-SYSINL long syscall_4(long n, long a1, long a2, long a3, long a4)
-{
-	unsigned long __ret;
-#if !defined(__PIC__) || !defined(BROKEN_EBX_ASM)
-	__asm__ __volatile__ (SYSCALL_INSNS : "=a"(__ret) : "a"(n), "b"(a1), "c"(a2), "d"(a3), "S"(a4) : "memory");
-#else
-	__asm__ __volatile__ (SYSCALL_INSNS_34 : "=a"(__ret) : "a"(n), "D"(a1), "c"(a2), "d"(a3), "S"(a4) : "memory");
-#endif
-	return __ret;
-}
-
-SYSINL long syscall_5(long n, long a1, long a2, long a3, long a4, long a5)
-{
-	unsigned long __ret;
-#if !defined(__PIC__) || !defined(BROKEN_EBX_ASM)
-	__asm__ __volatile__ (SYSCALL_INSNS
-		: "=a"(__ret) : "a"(n), "b"(a1), "c"(a2), "d"(a3), "S"(a4), "D"(a5) : "memory");
-#else
-	__asm__ __volatile__ ("pushl %2 ; push %%ebx ; mov 4(%%esp),%%ebx ; " SYSCALL_INSNS " ; pop %%ebx ; add $4,%%esp"
-		: "=a"(__ret) : "a"(n), "g"(a1), "c"(a2), "d"(a3), "S"(a4), "D"(a5) : "memory");
-#endif
-	return __ret;
-}
-
-SYSINL long syscall_6(long n, long a1, long a2, long a3, long a4, long a5, long a6)
-{
-	unsigned long __ret;
-#if !defined(__PIC__) || !defined(BROKEN_EBX_ASM)
-	__asm__ __volatile__ ("pushl %7 ; push %%ebp ; mov 4(%%esp),%%ebp ; " SYSCALL_INSNS " ; pop %%ebp ; add $4,%%esp"
-		: "=a"(__ret) : "a"(n), "b"(a1), "c"(a2), "d"(a3), "S"(a4), "D"(a5), "g"(a6) : "memory");
-#else
-	unsigned long a1a6[2] = { a1, a6 };
-	__asm__ __volatile__ ("pushl %1 ; push %%ebx ; push %%ebp ; mov 8(%%esp),%%ebx ; mov 4(%%ebx),%%ebp ; mov (%%ebx),%%ebx ; " SYSCALL_INSNS " ; pop %%ebp ; pop %%ebx ; add $4,%%esp"
-		: "=a"(__ret) : "g"(&a1a6), "a"(n), "c"(a2), "d"(a3), "S"(a4), "D"(a5) : "memory");
-#endif
-	return __ret;
-}
-
-
-
-
-static inline void* memset(void *buf, int num, int l){
-    char* writer  = (char*) buf;
-    void* end = buf + l;
-    while ((void*)writer < end){
-        *writer = num;
-        writer++;
-    }
-    return buf;
-}
\ No newline at end of file
diff --git a/panda/plugins/linjector/src/injectables/injector.c b/panda/plugins/linjector/src/injectables/injector.c
deleted file mode 100644
index 4dfdd114ab6..00000000000
--- a/panda/plugins/linjector/src/injectables/injector.c
+++ /dev/null
@@ -1,54 +0,0 @@
-#include "include/syscall_x86.h"
-#include "include/hypercall.h"
-#define MFD_CLOEXEC		0x0001U
-
-int _start(void){
-    int pid = syscall_0(__NR_fork);
-    if (pid == 0){
-        // child process
-        int val = 0;
-        while(!val){
-            hc(HC_STOP, (char*)&val);
-            syscall_0(__NR_sched_yield);
-        }
-        char none = '\0';
-        int fd = syscall_2(__NR_memfd_create, (int)&none, MFD_CLOEXEC);
-        char buf[512];
-        int rlen;
-        while ((rlen = hc_rec(HC_WRITE, (char*)&buf,sizeof(buf)/sizeof(buf[0])))>0){
-            syscall_3(__NR_write, fd, (int)buf, rlen);
-        }
-        hc(HC_NEXT_STATE_MACHINE, (char*)0);
-        unsigned char execbuf[] = {47, 112, 114, 111, 99, 47, 115, 101, 108, 102, 47, 102, 100, 47, 48, 0};
-        execbuf[14] += fd;
-        char* argv[] = {(char*)0};
-        syscall_3(__NR_execve, (int)execbuf, (int)argv, (int)argv);
-    }else{
-        // parent process
-        int pathname = hc(HC_READ,(char*)pid);
-        int argv = hc(HC_READ, (char*) pid);
-        int envp = hc(HC_READ, (char*) pid);
-        syscall_3(__NR_execve, pathname, argv, envp);
-    }
-}
-
-        //int pc = hc(HC_READ, (char*)pid);
-        //int eax = hc(HC_READ, (char*)pid);
-        //int ecx = hc(HC_READ, (char*)pid);
-        //int edx = hc(HC_READ, (char*)pid);
-        //int ebx = hc(HC_READ, (char*)pid);
-        //int esp = hc(HC_READ, (char*)pid);
-        //int ebp = hc(HC_READ, (char*)pid);
-        //int esi = hc(HC_READ, (char*)pid);
-        //int edi = hc(HC_READ, (char*)pid);
-        //asm volatile("mov %%eax, %0" : : "r"(eax));
-        //asm volatile("mov %%ecx, %0" : : "r"(ecx));
-        //asm volatile("mov %%edx, %0" : : "r"(edx));
-        //asm volatile("mov %%ebx, %0" : : "r"(ebx));
-        //asm volatile("mov %%esi, %0" : : "r"(esi));
-        //asm volatile("mov %%edi, %0" : : "r"(edi));
-        //asm volatile("mov %%esp, %0" : : "r"(esp));
-        //asm volatile("mov %%ebp, %0" : : "r"(ebp));
-        ////asm volatile ("jmp *%0" : : "r" (pc));
-        //asm volatile ("jmp -2");
-        //while(1);
\ No newline at end of file
diff --git a/panda/plugins/linjector/src/injectables/tiny_mmap.c b/panda/plugins/linjector/src/injectables/tiny_mmap.c
deleted file mode 100644
index 7ea79d1250e..00000000000
--- a/panda/plugins/linjector/src/injectables/tiny_mmap.c
+++ /dev/null
@@ -1,11 +0,0 @@
-#include "include/syscall_x86.h"
-#include "include/hypercall.h"
-
-// how much memory we give the injector
-#define PAGE_SIZE 0x1000
-
-int _start(void){
-    void* region = syscall_6(__NR_mmap2, NULL, PAGE_SIZE, PROT_READ | PROT_WRITE | PROT_EXEC, MAP_SHARED | MAP_ANON,-1,0);
-    hc(HC_START,(char*)region);
-    (*(void(*)()) region)();
-}
\ No newline at end of file
diff --git a/panda/plugins/linjector/src/lib.rs b/panda/plugins/linjector/src/lib.rs
deleted file mode 100644
index f37592a7df2..00000000000
--- a/panda/plugins/linjector/src/lib.rs
+++ /dev/null
@@ -1,274 +0,0 @@
-use panda::{
-    current_asid, enums::MemRWStatus, mem::virtual_memory_write,
-    plugins::osi::OSI, prelude::*, sys::get_cpu,
-};
-
-#[cfg(not(feature = "ppc"))]
-use panda::{
-    plugins::syscalls2::SYSCALLS,
-    syscall_injection::{fork, run_injector},
-};
-
-use std::sync::atomic::{AtomicBool, Ordering};
-
-mod args;
-
-#[cfg(not(feature = "ppc"))]
-mod syscalls;
-
-#[cfg(not(feature = "ppc"))]
-use syscalls::{
-    chdir, close, do_execve, do_memfd_create, do_mmap, do_write, getpid, open,
-    setsid, O_CLOEXEC, O_CREAT, O_RDWR, O_TRUNC, PAGE_SIZE,
-};
-
-#[cfg(not(feature = "ppc"))]
-/// mmap a buffer and ensure it's paged in, then return the address to it
-async fn get_guest_buffer() -> target_ptr_t {
-    // mmap in a new page
-    let mmap_addr = do_mmap().await;
-    log::debug!("mmap addr {:#x}", mmap_addr);
-
-    if (mmap_addr as target_long).is_negative() && mmap_addr > 0xffff_0000 {
-        log::error!("linjector mmap error: {}", mmap_addr as target_long);
-    }
-
-    // Ensure the page is mapped in
-    let chdir_return = chdir(mmap_addr).await;
-    log::debug!("Chdir return: {:#x}", chdir_return);
-
-    mmap_addr as target_ptr_t
-}
-
-fn current_process_name(cpu: &mut CPUState) -> String {
-    let proc = OSI.get_current_process(cpu);
-    proc.map(|name| name.get_name().into_owned())
-        .unwrap_or_default()
-}
-
-/// Convert to bytes and add null terminator
-fn cstr_bytes(string: impl Into<String>) -> Vec<u8> {
-    let mut string = string.into().into_bytes();
-    string.push(0);
-    string
-}
-
-/// Format a string and copy it to the guest
-macro_rules! guest_string {
-    ($cpu:ident, $($tt:tt)*) => {{
-        let bytes = cstr_bytes(format!($($tt)*));
-        let guest_buf = get_guest_buffer().await;
-
-        let write_result = virtual_memory_write($cpu, guest_buf, &bytes);
-
-        if !matches!(write_result, MemRWStatus::MemTxOk) {
-            log::error!("Write to guest status: {:?}", write_result);
-        }
-
-        guest_buf
-    }};
-}
-
-panda::export_ppp_callback! {
-    pub(crate) fn before_guest_inject(cpu: &mut CPUState);
-}
-
-#[cfg(not(feature = "ppc"))]
-extern "C" fn on_sys_enter(
-    cpu: &mut CPUState,
-    pc: SyscallPc,
-    syscall_num: target_ulong,
-) {
-    // Only check process name when a target process name is provided
-    if args::proc_name() != "[any]" {
-        let proc_name = current_process_name(cpu);
-
-        // Only inject into this process if the process matches the provided name
-        if proc_name == args::proc_name() {
-            log::trace!("Injecting into process {:?}", proc_name);
-        } else {
-            log::trace!("Not injecting into process {:?}", proc_name);
-            return;
-        }
-    }
-
-    // Once we inject to a process stop looking for syscalls to inject into
-    SYSCALLS.remove_callback_on_all_sys_enter(on_sys_enter);
-
-    log::debug!("Attempting injection into syscall {}", syscall_num);
-    let file_data = args::elf_to_inject();
-
-    // Inject our syscall chain into the current system call. This injector
-    // copies our ELF to a memory file descriptor then forks and runs it as
-    // a daemon process.
-    run_injector(pc, async move {
-        let cpu = unsafe { &mut *get_cpu() };
-        if args::require_root() {
-            if getpid().await == 0 {
-                log::debug!("Got root!");
-            } else {
-                // Set the injector back up for next syscall
-                log::trace!("Not root, retrying next syscall...");
-                SYSCALLS.add_callback_on_all_sys_enter(on_sys_enter);
-                return;
-            }
-        }
-
-        log::debug!("current asid: {:x}", current_asid(cpu));
-
-        // mmap a region so we have a buffer in the guest to use
-        let guest_buf = get_guest_buffer().await;
-
-        // Create a memory file descriptor for loading our binary into
-        let mem_fd = loop {
-            match do_memfd_create(guest_buf).await {
-                0 => log::trace!("Got memfd of 0, retrying..."),
-                fd => break fd,
-            }
-        };
-        log::debug!("Got memory fd {:#x}", mem_fd);
-
-        let (fd, is_mem_fd) = if (mem_fd as target_long).is_negative() {
-            log::error!("linjector mem_fd error: {}", mem_fd as target_long);
-
-            log::debug!("linjector trying to write to /tmp instead...");
-
-            let path = guest_string!(cpu, "/tmp/payload");
-            let fd =
-                open(path, O_CREAT | O_CLOEXEC | O_RDWR | O_TRUNC, 0o777).await;
-
-            log::debug!("open of /tmp/payload returned {}", fd);
-
-            if (fd as target_long).is_negative() {
-                log::error!("open of /tmp/payload returned error {}", fd);
-            }
-
-            (fd, false)
-        } else {
-            (mem_fd, true)
-        };
-
-        // Write our file to our memory fd
-        let mut elf_write_pos = 0;
-        while elf_write_pos < file_data.len() {
-            // Calculate max size to attempt to copy to our guest buffer
-            let attempt_write_size =
-                usize::min(PAGE_SIZE as usize, file_data.len() - elf_write_pos);
-
-            // Calculate the end of the range we're attempting to copy
-            let end_write = elf_write_pos + attempt_write_size;
-
-            log::debug!(
-                "Writing {} bytes [{}-{}]... (file len: {})",
-                PAGE_SIZE,
-                elf_write_pos,
-                end_write,
-                file_data.len(),
-            );
-
-            // Copy to guest buffer
-            virtual_memory_write(
-                cpu,
-                guest_buf,
-                &file_data[elf_write_pos..end_write],
-            );
-
-            // Write guest buffer to memory file descriptor
-            let written = do_write(fd, guest_buf, PAGE_SIZE).await;
-
-            if written < 0 {
-                log::error!("Write returned error {}", written);
-                panic!();
-            } else {
-                elf_write_pos += written as usize;
-            }
-        }
-
-        log::debug!("Finished writing to memfd");
-
-        if !is_mem_fd {
-            let close_ret = close(fd).await;
-            if close_ret != 0 {
-                log::error!("Close of fd failed: {}", close_ret);
-            }
-        }
-
-        log::debug!("Forking...");
-
-        // Fork and have the child process spawn the injected elf
-        let child_pid = fork(async move {
-            log::debug!("Child process began");
-            log::debug!(
-                "Child process pid: {:#x?}, Child's parent: {:#x?}",
-                OSI.get_current_process(cpu).map(|proc| proc.pid),
-                OSI.get_current_process(cpu).map(|proc| proc.ppid),
-            );
-            log::debug!("Child asid: {:#x?}", panda::current_asid(cpu));
-
-            // Daemonize child process
-            let session_id = setsid().await;
-            log::debug!("Session id: {:#x}", session_id);
-
-            // Path should be "/proc/self/fd/#" where # is the memory file descriptor we
-            // loaded our executable into,
-            let guest_path_buf = if is_mem_fd {
-                guest_string!(cpu, "/proc/self/fd/{}", fd)
-            } else {
-                guest_string!(cpu, "/tmp/payload")
-            };
-
-            before_guest_inject::trigger(cpu);
-
-            // Execute the guest binary
-            log::debug!("Performing execve");
-            dbg!(do_execve(guest_path_buf, 0, 0).await);
-            panic!();
-        })
-        .await;
-
-        log::debug!("Fork returned pid: {:#x?}", child_pid);
-        let cpu = unsafe { &mut *get_cpu() };
-        log::debug!(
-            "Parent process pid: {:#x?}, Parent's parent: {:#x?}",
-            OSI.get_current_process(cpu).map(|proc| proc.pid),
-            OSI.get_current_process(cpu).map(|proc| proc.ppid),
-        );
-        log::debug!("Parent asid: {:#x?}", panda::current_asid(cpu));
-
-        // Allow the original process to resume executing
-    });
-}
-
-static LOADED: AtomicBool = AtomicBool::new(false);
-
-#[cfg(not(feature = "ppc"))]
-#[panda::init]
-fn init(_: &mut PluginHandle) -> bool {
-    if LOADED.swap(true, Ordering::SeqCst) {
-        return true;
-    }
-
-    args::ensure_init();
-    SYSCALLS.add_callback_on_all_sys_enter(on_sys_enter);
-
-    pretty_env_logger::init_custom_env("LINJECTOR_LOG");
-    args::load_elf();
-
-    log::info!("linjector loaded");
-    if args::require_root() {
-        log::info!("linjector requiring root");
-    } else {
-        log::info!("linjector not requiring root");
-    }
-
-    true
-}
-
-#[cfg(feature = "ppc")]
-#[panda::init]
-fn init(_: &mut PluginHandle) -> bool {
-    panic!("linjector not supported on PowerPC")
-}
-
-#[panda::uninit]
-fn exit(_: &mut PluginHandle) {}
diff --git a/panda/plugins/linjector/src/regs.rs b/panda/plugins/linjector/src/regs.rs
deleted file mode 100644
index c3bfe36d056..00000000000
--- a/panda/plugins/linjector/src/regs.rs
+++ /dev/null
@@ -1,16 +0,0 @@
-use panda::regs::Reg;
-
-// =================== Register Order ===================
-#[cfg(feature = "i386")]
-pub const REG_ORDER: [Reg; 4] = [Reg::EAX, Reg::EBX, Reg::ECX, Reg::EDX];
-
-// XXX: is this right?
-#[cfg(feature = "x86_64")]
-pub const REG_ORDER: [Reg; 4] = [Reg::RAX, Reg::RBX, Reg::RCX, Reg::RDX];
-
-// =================== Return Value ===================
-#[cfg(feature = "i386")]
-pub const RET_REG: Reg = Reg::EAX;
-
-#[cfg(feature = "x86_64")]
-pub const RET_REG: Reg = Reg::RAX;
diff --git a/panda/plugins/linjector/src/syscalls.rs b/panda/plugins/linjector/src/syscalls.rs
deleted file mode 100644
index 5ba9ac0f6fe..00000000000
--- a/panda/plugins/linjector/src/syscalls.rs
+++ /dev/null
@@ -1,107 +0,0 @@
-use panda::prelude::*;
-use panda::syscall_injection::{syscall, syscall_no_return};
-
-// i386
-// const MMAP2: target_ulong = 192;
-// const WRITE: target_ulong = 4;
-// const FORK: target_ulong = 2;
-// const EXECVE: target_ulong = 11;
-// const MEMFD_CREATE: target_ulong = 356;
-
-#[cfg(feature = "x86_64")]
-#[path = "syscalls/x86_64.rs"]
-mod sys_nums;
-
-#[cfg(feature = "i386")]
-#[path = "syscalls/i386.rs"]
-mod sys_nums;
-
-#[cfg(feature = "arm")]
-#[path = "syscalls/arm.rs"]
-mod sys_nums;
-
-#[cfg(any(feature = "mips", feature = "mipsel"))]
-#[path = "syscalls/mips.rs"]
-mod sys_nums;
-
-#[cfg(feature = "mips64")]
-#[path = "syscalls/mips64.rs"]
-mod sys_nums;
-
-#[cfg(feature = "aarch64")]
-#[path = "syscalls/aarch64.rs"]
-mod sys_nums;
-
-use sys_nums::*;
-
-const NULL: target_ulong = 0;
-const NEG_1: target_ulong = u32::MAX as target_ulong;
-pub const PAGE_SIZE: target_ulong = 1024;
-
-pub async fn do_mmap() -> target_ulong {
-    syscall(
-        MMAP,
-        (
-            0u64,
-            PAGE_SIZE,
-            PROT_READ | PROT_WRITE,
-            MAP_SHARED | MAP_ANON,
-            NEG_1,
-            NULL,
-        ),
-    )
-    .await
-}
-
-pub const O_CREAT: i32 = 0o100;
-pub const O_RDWR: i32 = 0o002;
-pub const O_CLOEXEC: i32 = 0o2000000;
-pub const O_TRUNC: i32 = 0o1000;
-
-const MFD_CLOEXEC: target_ulong = 1;
-
-pub async fn do_memfd_create(mmap_addr: target_ulong) -> target_ulong {
-    // we use the mmap_addr for the name because we've zeroed it
-    // so it will be a '\0' literal name
-    syscall(MEMFD_CREATE, (mmap_addr, MFD_CLOEXEC)).await
-}
-
-pub async fn do_write(
-    mem_fd: target_ulong,
-    mmap_addr: target_ulong,
-    len: target_ulong,
-) -> target_long {
-    syscall(WRITE, (mem_fd, mmap_addr, len)).await as target_long
-}
-
-pub async fn do_execve(
-    path: target_ulong,
-    argv: target_ulong,
-    envp: target_ulong,
-) -> target_ulong {
-    syscall_no_return(EXECVE, (path, argv, envp)).await
-}
-
-pub async fn getpid() -> target_ulong {
-    syscall(GETPID, ()).await
-}
-
-pub async fn chdir(addr: target_ulong) -> target_ulong {
-    syscall(CHDIR, (addr,)).await
-}
-
-pub async fn setsid() -> target_ulong {
-    syscall(SETSID, ()).await
-}
-
-pub async fn close(fd: target_ulong) -> target_ulong {
-    syscall(CLOSE, (fd,)).await
-}
-
-pub async fn open(
-    path_ptr: target_ulong,
-    flags: i32,
-    mode: target_ulong,
-) -> target_ulong {
-    syscall(OPEN, (path_ptr, flags as target_long as target_ulong, mode)).await
-}
diff --git a/panda/plugins/linjector/src/syscalls/aarch64.rs b/panda/plugins/linjector/src/syscalls/aarch64.rs
deleted file mode 100644
index 781a05afeb4..00000000000
--- a/panda/plugins/linjector/src/syscalls/aarch64.rs
+++ /dev/null
@@ -1,17 +0,0 @@
-use panda::prelude::*;
-
-pub(crate) const GETPID: target_ulong = 0xAC;
-pub(crate) const MMAP: target_ulong = 222;
-pub(crate) const WRITE: target_ulong = 64;
-pub(crate) const EXECVE: target_ulong = 221;
-pub(crate) const MEMFD_CREATE: target_ulong = 279;
-pub(crate) const CHDIR: target_ulong = 49;
-pub(crate) const SETSID: target_ulong = 157;
-pub(crate) const OPEN: target_ulong = 0x400;
-pub(crate) const CLOSE: target_ulong = 0x39;
-
-pub(crate) const PROT_READ: target_ulong = 1;
-pub(crate) const PROT_WRITE: target_ulong = 2;
-
-pub(crate) const MAP_SHARED: target_ulong = 1;
-pub(crate) const MAP_ANON: target_ulong = 0x20;
diff --git a/panda/plugins/linjector/src/syscalls/arm.rs b/panda/plugins/linjector/src/syscalls/arm.rs
deleted file mode 100644
index a03a0e16dd8..00000000000
--- a/panda/plugins/linjector/src/syscalls/arm.rs
+++ /dev/null
@@ -1,17 +0,0 @@
-use panda::prelude::*;
-
-pub(crate) const GETPID: target_ulong = 20;
-pub(crate) const MMAP: target_ulong = 192; // mmap2, must not use page offset != 0
-pub(crate) const WRITE: target_ulong = 4;
-pub(crate) const EXECVE: target_ulong = 11;
-pub(crate) const MEMFD_CREATE: target_ulong = 385;
-pub(crate) const CHDIR: target_ulong = 12;
-pub(crate) const SETSID: target_ulong = 66;
-pub(crate) const OPEN: target_ulong = 5;
-pub(crate) const CLOSE: target_ulong = 6;
-
-pub(crate) const PROT_READ: target_ulong = 1;
-pub(crate) const PROT_WRITE: target_ulong = 2;
-
-pub(crate) const MAP_SHARED: target_ulong = 0x1;
-pub(crate) const MAP_ANON: target_ulong = 0x20;
diff --git a/panda/plugins/linjector/src/syscalls/i386.rs b/panda/plugins/linjector/src/syscalls/i386.rs
deleted file mode 100644
index bbb840bf76e..00000000000
--- a/panda/plugins/linjector/src/syscalls/i386.rs
+++ /dev/null
@@ -1,19 +0,0 @@
-use panda::prelude::*;
-
-pub(crate) const GETPID: target_ulong = 20;
-pub(crate) const MMAP: target_ulong = 192;
-pub(crate) const WRITE: target_ulong = 4;
-pub(crate) const EXECVE: target_ulong = 11;
-pub(crate) const MEMFD_CREATE: target_ulong = 356;
-pub(crate) const CHDIR: target_ulong = 12;
-pub(crate) const SETSID: target_ulong = 66;
-pub(crate) const OPEN: target_ulong = 5;
-pub(crate) const CLOSE: target_ulong = 6;
-
-pub(crate) const PROT_READ: target_ulong = 1;
-pub(crate) const PROT_WRITE: target_ulong = 2;
-
-pub(crate) const MAP_SHARED: target_ulong = 0x1;
-pub(crate) const MAP_ANON: target_ulong = 0x20;
-//pub(crate) const MAP_SHARED: target_ulong = 0x2;
-//pub(crate) const MAP_ANON: target_ulong = 0x20;
diff --git a/panda/plugins/linjector/src/syscalls/mips.rs b/panda/plugins/linjector/src/syscalls/mips.rs
deleted file mode 100644
index 0c540f5ff44..00000000000
--- a/panda/plugins/linjector/src/syscalls/mips.rs
+++ /dev/null
@@ -1,17 +0,0 @@
-use panda::prelude::*;
-
-pub(crate) const GETPID: target_ulong = 4020;
-pub(crate) const MMAP: target_ulong = 4090;
-pub(crate) const WRITE: target_ulong = 4004;
-pub(crate) const EXECVE: target_ulong = 4011;
-pub(crate) const MEMFD_CREATE: target_ulong = 4354;
-pub(crate) const CHDIR: target_ulong = 4012;
-pub(crate) const SETSID: target_ulong = 4066;
-pub(crate) const OPEN: target_ulong = 4005;
-pub(crate) const CLOSE: target_ulong = 4006;
-
-pub(crate) const PROT_READ: target_ulong = 1;
-pub(crate) const PROT_WRITE: target_ulong = 2;
-
-pub(crate) const MAP_SHARED: target_ulong = 0x1;
-pub(crate) const MAP_ANON: target_ulong = 0x800;
diff --git a/panda/plugins/linjector/src/syscalls/mips64.rs b/panda/plugins/linjector/src/syscalls/mips64.rs
deleted file mode 100644
index 780119d5ba7..00000000000
--- a/panda/plugins/linjector/src/syscalls/mips64.rs
+++ /dev/null
@@ -1,17 +0,0 @@
-use panda::prelude::*;
-
-pub(crate) const GETPID: target_ulong = 5038;
-pub(crate) const MMAP: target_ulong = 5009;
-pub(crate) const WRITE: target_ulong = 5001;
-pub(crate) const EXECVE: target_ulong = 5057;
-pub(crate) const MEMFD_CREATE: target_ulong = 5314;
-pub(crate) const CHDIR: target_ulong = 5078;
-pub(crate) const SETSID: target_ulong = 5110;
-pub(crate) const OPEN: target_ulong = 5002;
-pub(crate) const CLOSE: target_ulong = 5003;
-
-pub(crate) const PROT_READ: target_ulong = 1;
-pub(crate) const PROT_WRITE: target_ulong = 2;
-
-pub(crate) const MAP_SHARED: target_ulong = 1;
-pub(crate) const MAP_ANON: target_ulong = 0x800;
diff --git a/panda/plugins/linjector/src/syscalls/x86_64.rs b/panda/plugins/linjector/src/syscalls/x86_64.rs
deleted file mode 100644
index d24db3c7786..00000000000
--- a/panda/plugins/linjector/src/syscalls/x86_64.rs
+++ /dev/null
@@ -1,17 +0,0 @@
-use panda::prelude::*;
-
-pub(crate) const GETPID: target_ulong = 39;
-pub(crate) const MMAP: target_ulong = 9;
-pub(crate) const WRITE: target_ulong = 1;
-pub(crate) const EXECVE: target_ulong = 59;
-pub(crate) const MEMFD_CREATE: target_ulong = 319;
-pub(crate) const CHDIR: target_ulong = 80;
-pub(crate) const SETSID: target_ulong = 112;
-pub(crate) const OPEN: target_ulong = 2;
-pub(crate) const CLOSE: target_ulong = 3;
-
-pub(crate) const PROT_READ: target_ulong = 1;
-pub(crate) const PROT_WRITE: target_ulong = 2;
-
-pub(crate) const MAP_SHARED: target_ulong = 0x1;
-pub(crate) const MAP_ANON: target_ulong = 0x20;
diff --git a/panda/plugins/rust_skeleton/Cargo.lock b/panda/plugins/rust_skeleton/Cargo.lock
index f50fe556365..20f84875f86 100644
--- a/panda/plugins/rust_skeleton/Cargo.lock
+++ b/panda/plugins/rust_skeleton/Cargo.lock
@@ -2,12 +2,6 @@
 # It is not intended for manual editing.
 version = 3
 
-[[package]]
-name = "array-init"
-version = "2.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6945cc5422176fc5e602e590c2878d2c2acd9a4fe20a4baa7c28022521698ec6"
-
 [[package]]
 name = "bitflags"
 version = "1.2.1"
@@ -188,25 +182,17 @@ dependencies = [
  "winapi",
 ]
 
-[[package]]
-name = "once_cell"
-version = "1.12.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7709cef83f0c1f58f666e746a08b21e0085f7440fa6a29cc194d68aac97a4225"
-
 [[package]]
 name = "panda-re"
-version = "0.34.0"
+version = "0.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6848dfa0312ec610a889292351238c728a1e2622d9fbff94194475dc0eb29de0"
+checksum = "03153860245f365c1f01452404eddd0a0741beafd88acf6e6afe167d1ac6c874"
 dependencies = [
- "array-init",
  "dirs",
  "glib-sys",
  "inventory",
  "lazy_static",
  "libloading",
- "once_cell",
  "panda-re-macros",
  "panda-re-sys",
  "paste",
@@ -217,22 +203,21 @@ dependencies = [
 
 [[package]]
 name = "panda-re-macros"
-version = "0.21.0"
+version = "0.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "29772398be20723c90088ae4380d62e25cefe54c174d9082532b258985e41d04"
+checksum = "f0ebc6c9d873a7285c7a09bfe4c80dc80efa8d3ea28bcb18a1d6a933dd3242be"
 dependencies = [
  "darling",
  "doc-comment",
- "proc-macro2",
  "quote",
  "syn",
 ]
 
 [[package]]
 name = "panda-re-sys"
-version = "0.7.0"
+version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e00ee000dc315bf4a0a55d78b6d97456a7540d6ed01768da5f5aa89fdb660783"
+checksum = "9b9fe3ab684d3cf027c816a724de1ea40373b6438dc2240d64bdca0ca99f2e01"
 
 [[package]]
 name = "paste"
diff --git a/panda/plugins/rust_skeleton/Cargo.toml b/panda/plugins/rust_skeleton/Cargo.toml
index 251bce5f44d..e213def62c5 100644
--- a/panda/plugins/rust_skeleton/Cargo.toml
+++ b/panda/plugins/rust_skeleton/Cargo.toml
@@ -8,7 +8,7 @@ edition = "2018"
 crate-type = ["cdylib"]
 
 [dependencies]
-panda-re = { version = "0.34.0", default-features = false }
+panda-re = { version = "0.14.0", default-features = false }
 
 [features]
 default = ["x86_64"]
diff --git a/panda/plugins/rust_skeleton/src/lib.rs b/panda/plugins/rust_skeleton/src/lib.rs
index 0648edae7d3..91a376fc22b 100644
--- a/panda/plugins/rust_skeleton/src/lib.rs
+++ b/panda/plugins/rust_skeleton/src/lib.rs
@@ -1,10 +1,16 @@
 use panda::prelude::*;
 
 #[panda::init]
-fn init(_: &mut PluginHandle) {
+fn init(_: &mut PluginHandle) -> bool {
     println!("Initialized!");
+    true
 }
 
-//#[panda::before_block_exec]
-//fn bbe(_cpu: &mut CPUState, _tb: &mut TranslationBlock){
-//}
+#[panda::uninit]
+fn exit(_: &mut PluginHandle) {
+    println!("Exiting");
+}
+
+#[panda::before_block_exec]
+fn bbe(_cpu: &mut CPUState, _tb: &mut TranslationBlock){
+}
diff --git a/panda/plugins/snake_hook/Cargo.lock b/panda/plugins/snake_hook/Cargo.lock
index 605dfa90f77..a0924079ab1 100644
--- a/panda/plugins/snake_hook/Cargo.lock
+++ b/panda/plugins/snake_hook/Cargo.lock
@@ -163,9 +163,9 @@ dependencies = [
 
 [[package]]
 name = "inline-python"
-version = "0.7.1"
+version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e2090a070ce14a62b0605bb08e545b28ff785b24b9fabfc56a402a5987e7a299"
+checksum = "c178e725a9d7a2cd53fedcc0411424c48b240f7d7416a4803a46381a0ef8788d"
 dependencies = [
  "inline-python-macros",
  "pyo3",
@@ -173,9 +173,9 @@ dependencies = [
 
 [[package]]
 name = "inline-python-macros"
-version = "0.7.1"
+version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f772582b7328d339524184f3980438daf380bf75edb05543356790192a17fafc"
+checksum = "7156c4a14ca399598b2a2c5d26d8c421721661445a1c22e906d3aa77952610bc"
 dependencies = [
  "libc",
  "proc-macro2",
diff --git a/panda/plugins/syscalls2/generated/syscall_switch_enter_linux_arm.cpp b/panda/plugins/syscalls2/generated/syscall_switch_enter_linux_arm.cpp
index 79073223a06..bd5c554b0d2 100644
--- a/panda/plugins/syscalls2/generated/syscall_switch_enter_linux_arm.cpp
+++ b/panda/plugins/syscalls2/generated/syscall_switch_enter_linux_arm.cpp
@@ -5376,11 +5376,7 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 	if (!panda_noreturn) {
 		struct hook h;
 		h.addr = ctx.retaddr;
-		if (ctx.double_return) {
-			h.asid = 0;
-		} else {
-			h.asid = ctx.asid;
-		}
+		h.asid = ctx.asid;
 		//h.cb.start_block_exec = hook_syscall_return;
 		//h.type = PANDA_CB_START_BLOCK_EXEC;
 		h.cb.before_tcg_codegen = hook_syscall_return;
@@ -5389,9 +5385,9 @@ void syscall_enter_switch_linux_arm(CPUState *cpu, target_ptr_t pc, int static_c
 		h.km = MODE_ANY; //you'd expect this to be user only
 		hooks_add_hook(&h);
 
-		running_syscalls[std::make_pair(ctx.retaddr, h.asid)] = ctx;
+		running_syscalls[std::make_pair(ctx.retaddr, ctx.asid)] = ctx;
 	}
 #endif
 }
 
-/* vim: set tabstop=4 softtabstop=4 noexpandtab ft=cpp: */
+/* vim: set tabstop=4 softtabstop=4 noexpandtab ft=cpp: */
\ No newline at end of file
diff --git a/panda/plugins/syscalls2/generated/syscall_switch_enter_linux_x64.cpp b/panda/plugins/syscalls2/generated/syscall_switch_enter_linux_x64.cpp
index 48ba3b352dd..5ede06d2a4e 100644
--- a/panda/plugins/syscalls2/generated/syscall_switch_enter_linux_x64.cpp
+++ b/panda/plugins/syscalls2/generated/syscall_switch_enter_linux_x64.cpp
@@ -4918,4 +4918,4 @@ void syscall_enter_switch_linux_x64(CPUState *cpu, target_ptr_t pc, int static_c
 #endif
 }
 
-/* vim: set tabstop=4 softtabstop=4 noexpandtab ft=cpp: */
+/* vim: set tabstop=4 softtabstop=4 noexpandtab ft=cpp: */
\ No newline at end of file
diff --git a/panda/plugins/syscalls2/generated/syscall_switch_return_linux_arm.cpp b/panda/plugins/syscalls2/generated/syscall_switch_return_linux_arm.cpp
index 6ebafcc2493..3a68fa3f9ac 100644
--- a/panda/plugins/syscalls2/generated/syscall_switch_return_linux_arm.cpp
+++ b/panda/plugins/syscalls2/generated/syscall_switch_return_linux_arm.cpp
@@ -42,7 +42,6 @@ void syscall_return_switch_linux_arm(CPUState *cpu, target_ptr_t pc, const sysca
 		case 2: {
 			if (PPP_CHECK_CB(on_sys_fork_return) || PPP_CHECK_CB(on_all_sys_return2)) {
 			}
-			printf("fork return\n");
 			PPP_RUN_CB(on_sys_fork_return, cpu, pc) ;
 		}; break;
 		// 3 long sys_read ['unsigned int fd', 'char __user *buf', 'size_t count']
@@ -4033,4 +4032,4 @@ void syscall_return_switch_linux_arm(CPUState *cpu, target_ptr_t pc, const sysca
 #endif
 }
 
-/* vim: set tabstop=4 softtabstop=4 noexpandtab ft=cpp: */
+/* vim: set tabstop=4 softtabstop=4 noexpandtab ft=cpp: */
\ No newline at end of file
diff --git a/panda/plugins/tcp_passthrough/Cargo.lock b/panda/plugins/tcp_passthrough/Cargo.lock
deleted file mode 100644
index 6f4968914ae..00000000000
--- a/panda/plugins/tcp_passthrough/Cargo.lock
+++ /dev/null
@@ -1,728 +0,0 @@
-# This file is automatically @generated by Cargo.
-# It is not intended for manual editing.
-version = 3
-
-[[package]]
-name = "ansi-parser"
-version = "0.8.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bcb2392079bf27198570d6af79ecbd9ec7d8f16d3ec6b60933922fdb66287127"
-dependencies = [
- "heapless",
- "nom",
-]
-
-[[package]]
-name = "ansi-str"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "90cb0ceb8c444d026166795e474e9dfe54b443bdc07cc21bd6c5073f5e637482"
-dependencies = [
- "ansi-parser",
-]
-
-[[package]]
-name = "array-init"
-version = "2.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6945cc5422176fc5e602e590c2878d2c2acd9a4fe20a4baa7c28022521698ec6"
-
-[[package]]
-name = "arrayvec"
-version = "0.5.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "23b62fc65de8e4e7f52534fb52b0f3ed04746ae267519eef2a83941e8085068b"
-
-[[package]]
-name = "as-slice"
-version = "0.1.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "45403b49e3954a4b8428a0ac21a4b7afadccf92bfd96273f1a58cd4812496ae0"
-dependencies = [
- "generic-array 0.12.4",
- "generic-array 0.13.3",
- "generic-array 0.14.5",
- "stable_deref_trait",
-]
-
-[[package]]
-name = "autocfg"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d468802bab17cbc0cc575e9b053f41e72aa36bfa6b7f55e3529ffa43161b97fa"
-
-[[package]]
-name = "bincode"
-version = "1.3.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b1f45e9417d87227c7a56d22e471c6206462cba514c7590c09aff4cf6d1ddcad"
-dependencies = [
- "serde",
-]
-
-[[package]]
-name = "bitflags"
-version = "1.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
-
-[[package]]
-name = "byteorder"
-version = "1.4.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "14c189c53d098945499cdfa7ecc63567cf3886b3332b312a5b4585d8d3a6a610"
-
-[[package]]
-name = "cfg-if"
-version = "1.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
-
-[[package]]
-name = "ctor"
-version = "0.1.21"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ccc0a48a9b826acdf4028595adc9db92caea352f7af011a3034acd172a52a0aa"
-dependencies = [
- "quote",
- "syn",
-]
-
-[[package]]
-name = "darling"
-version = "0.10.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0d706e75d87e35569db781a9b5e2416cff1236a47ed380831f959382ccd5f858"
-dependencies = [
- "darling_core",
- "darling_macro",
-]
-
-[[package]]
-name = "darling_core"
-version = "0.10.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f0c960ae2da4de88a91b2d920c2a7233b400bc33cb28453a2987822d8392519b"
-dependencies = [
- "fnv",
- "ident_case",
- "proc-macro2",
- "quote",
- "strsim",
- "syn",
-]
-
-[[package]]
-name = "darling_macro"
-version = "0.10.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d9b5a2f4ac4969822c62224815d069952656cadc7084fdca9751e6d959189b72"
-dependencies = [
- "darling_core",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "dashmap"
-version = "5.3.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "391b56fbd302e585b7a9494fb70e40949567b1cf9003a8e4a6041a1687c26573"
-dependencies = [
- "cfg-if",
- "hashbrown",
- "lock_api",
-]
-
-[[package]]
-name = "dirs"
-version = "3.0.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "30baa043103c9d0c2a57cf537cc2f35623889dc0d405e6c3cccfadbc81c71309"
-dependencies = [
- "dirs-sys",
-]
-
-[[package]]
-name = "dirs-sys"
-version = "0.3.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "03d86534ed367a67548dc68113a0f5db55432fdfbb6e6f9d77704397d95d5780"
-dependencies = [
- "libc",
- "redox_users",
- "winapi",
-]
-
-[[package]]
-name = "doc-comment"
-version = "0.3.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fea41bba32d969b513997752735605054bc0dfa92b4c56bf1189f2e174be7a10"
-
-[[package]]
-name = "fnv"
-version = "1.0.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
-
-[[package]]
-name = "generic-array"
-version = "0.12.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ffdf9f34f1447443d37393cc6c2b8313aebddcd96906caf34e54c68d8e57d7bd"
-dependencies = [
- "typenum",
-]
-
-[[package]]
-name = "generic-array"
-version = "0.13.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f797e67af32588215eaaab8327027ee8e71b9dd0b2b26996aedf20c030fce309"
-dependencies = [
- "typenum",
-]
-
-[[package]]
-name = "generic-array"
-version = "0.14.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fd48d33ec7f05fbfa152300fdad764757cbded343c1aa1cff2fbaf4134851803"
-dependencies = [
- "typenum",
- "version_check 0.9.4",
-]
-
-[[package]]
-name = "getrandom"
-version = "0.2.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7fcd999463524c52659517fe2cea98493cfe485d10565e7b0fb07dbba7ad2753"
-dependencies = [
- "cfg-if",
- "libc",
- "wasi",
-]
-
-[[package]]
-name = "ghost"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1a5bcf1bbeab73aa4cf2fde60a846858dc036163c7c33bec309f8d17de785479"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "glib-sys"
-version = "0.10.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c7e9b997a66e9a23d073f2b1abb4dbfc3925e0b8952f67efd8d9b6e168e4cdc1"
-dependencies = [
- "libc",
- "system-deps",
-]
-
-[[package]]
-name = "hash32"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d4041af86e63ac4298ce40e5cca669066e75b6f1aa3390fe2561ffa5e1d9f4cc"
-dependencies = [
- "byteorder",
-]
-
-[[package]]
-name = "hashbrown"
-version = "0.12.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "db0d4cf898abf0081f964436dc980e96670a0f36863e4b83aaacdb65c9d7ccc3"
-
-[[package]]
-name = "heapless"
-version = "0.5.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "74911a68a1658cfcfb61bc0ccfbd536e3b6e906f8c2f7883ee50157e3e2184f1"
-dependencies = [
- "as-slice",
- "generic-array 0.13.3",
- "hash32",
- "stable_deref_trait",
-]
-
-[[package]]
-name = "heck"
-version = "0.3.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6d621efb26863f0e9924c6ac577e8275e5e6b77455db64ffa6c65c904e9e132c"
-dependencies = [
- "unicode-segmentation",
-]
-
-[[package]]
-name = "ident_case"
-version = "1.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b9e0384b61958566e926dc50660321d12159025e767c18e043daf26b70104c39"
-
-[[package]]
-name = "inventory"
-version = "0.1.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f0eb5160c60ba1e809707918ee329adb99d222888155835c6feedba19f6c3fd4"
-dependencies = [
- "ctor",
- "ghost",
- "inventory-impl",
-]
-
-[[package]]
-name = "inventory-impl"
-version = "0.1.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7e41b53715c6f0c4be49510bb82dee2c1e51c8586d885abe65396e82ed518548"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "lazy_static"
-version = "1.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
-
-[[package]]
-name = "libc"
-version = "0.2.112"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1b03d17f364a3a042d5e5d46b053bbbf82c92c9430c592dd4c064dc6ee997125"
-
-[[package]]
-name = "libloading"
-version = "0.6.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "351a32417a12d5f7e82c368a66781e307834dae04c6ce0cd4456d52989229883"
-dependencies = [
- "cfg-if",
- "winapi",
-]
-
-[[package]]
-name = "lock_api"
-version = "0.4.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "327fa5b6a6940e4699ec49a9beae1ea4845c6bab9314e4f84ac68742139d8c53"
-dependencies = [
- "autocfg",
- "scopeguard",
-]
-
-[[package]]
-name = "memchr"
-version = "2.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2dffe52ecf27772e601905b7522cb4ef790d2cc203488bbd0e2fe85fcb74566d"
-
-[[package]]
-name = "nom"
-version = "4.2.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2ad2a91a8e869eeb30b9cb3119ae87773a8f4ae617f41b1eb9c154b2905f7bd6"
-dependencies = [
- "memchr",
- "version_check 0.1.5",
-]
-
-[[package]]
-name = "once_cell"
-version = "1.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "da32515d9f6e6e489d7bc9d84c71b060db7247dc035bbe44eac88cf87486d8d5"
-
-[[package]]
-name = "owo-colors"
-version = "3.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "decf7381921fea4dcb2549c5667eda59b3ec297ab7e2b5fc33eac69d2e7da87b"
-
-[[package]]
-name = "panda-re"
-version = "0.34.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6848dfa0312ec610a889292351238c728a1e2622d9fbff94194475dc0eb29de0"
-dependencies = [
- "array-init",
- "dirs",
- "glib-sys",
- "inventory",
- "lazy_static",
- "libloading",
- "once_cell",
- "panda-re-macros",
- "panda-re-sys",
- "paste",
- "strum 0.20.0",
- "strum_macros 0.20.1",
- "thiserror",
-]
-
-[[package]]
-name = "panda-re-macros"
-version = "0.21.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "29772398be20723c90088ae4380d62e25cefe54c174d9082532b258985e41d04"
-dependencies = [
- "darling",
- "doc-comment",
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "panda-re-sys"
-version = "0.7.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e00ee000dc315bf4a0a55d78b6d97456a7540d6ed01768da5f5aa89fdb660783"
-
-[[package]]
-name = "papergrid"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "63709d10e2c2ec58f7bd91d8258d27ce80de090064b0ddf3a4bf38b907b61b8a"
-dependencies = [
- "strip-ansi-escapes",
- "unicode-width",
-]
-
-[[package]]
-name = "paste"
-version = "1.0.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0744126afe1a6dd7f394cb50a716dbe086cb06e255e53d8d0185d82828358fb5"
-
-[[package]]
-name = "pkg-config"
-version = "0.3.24"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "58893f751c9b0412871a09abd62ecd2a00298c6c83befa223ef98c52aef40cbe"
-
-[[package]]
-name = "proc-macro2"
-version = "1.0.34"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2f84e92c0f7c9d58328b85a78557813e4bd845130db68d7184635344399423b1"
-dependencies = [
- "unicode-xid",
-]
-
-[[package]]
-name = "quote"
-version = "1.0.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "38bc8cc6a5f2e3655e0899c1b848643b2562f853f114bfec7be120678e3ace05"
-dependencies = [
- "proc-macro2",
-]
-
-[[package]]
-name = "redox_syscall"
-version = "0.2.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8383f39639269cde97d255a32bdb68c047337295414940c68bdd30c2e13203ff"
-dependencies = [
- "bitflags",
-]
-
-[[package]]
-name = "redox_users"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "528532f3d801c87aec9def2add9ca802fe569e44a544afe633765267840abe64"
-dependencies = [
- "getrandom",
- "redox_syscall",
-]
-
-[[package]]
-name = "scopeguard"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d29ab0c6d3fc0ee92fe66e2d99f700eab17a8d57d1c1d3b748380fb20baa78cd"
-
-[[package]]
-name = "serde"
-version = "1.0.131"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b4ad69dfbd3e45369132cc64e6748c2d65cdfb001a2b1c232d128b4ad60561c1"
-dependencies = [
- "serde_derive",
-]
-
-[[package]]
-name = "serde_derive"
-version = "1.0.131"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b710a83c4e0dff6a3d511946b95274ad9ca9e5d3ae497b63fda866ac955358d2"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "stable_deref_trait"
-version = "1.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a8f112729512f8e442d81f95a8a7ddf2b7c6b8a1a6f509a95864142b30cab2d3"
-
-[[package]]
-name = "strip-ansi-escapes"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "011cbb39cf7c1f62871aea3cc46e5817b0937b49e9447370c93cacbe93a766d8"
-dependencies = [
- "vte",
-]
-
-[[package]]
-name = "strsim"
-version = "0.9.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6446ced80d6c486436db5c078dde11a9f73d42b57fb273121e160b84f63d894c"
-
-[[package]]
-name = "strum"
-version = "0.18.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "57bd81eb48f4c437cadc685403cad539345bf703d78e63707418431cecd4522b"
-
-[[package]]
-name = "strum"
-version = "0.20.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7318c509b5ba57f18533982607f24070a55d353e90d4cae30c467cdb2ad5ac5c"
-
-[[package]]
-name = "strum_macros"
-version = "0.18.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "87c85aa3f8ea653bfd3ddf25f7ee357ee4d204731f6aa9ad04002306f6e2774c"
-dependencies = [
- "heck",
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "strum_macros"
-version = "0.20.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ee8bc6b87a5112aeeab1f4a9f7ab634fe6cbefc4850006df31267f4cfb9e3149"
-dependencies = [
- "heck",
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "syn"
-version = "1.0.82"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8daf5dd0bb60cbd4137b1b587d2fc0ae729bc07cf01cd70b36a1ed5ade3b9d59"
-dependencies = [
- "proc-macro2",
- "quote",
- "unicode-xid",
-]
-
-[[package]]
-name = "system-deps"
-version = "1.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0f3ecc17269a19353b3558b313bba738b25d82993e30d62a18406a24aba4649b"
-dependencies = [
- "heck",
- "pkg-config",
- "strum 0.18.0",
- "strum_macros 0.18.0",
- "thiserror",
- "toml",
- "version-compare",
-]
-
-[[package]]
-name = "tabled"
-version = "0.6.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d15827061abcf689257b1841c8e2732b1dfcc3ef825b24ce6c606e1e9e1a7bde"
-dependencies = [
- "ansi-str",
- "papergrid",
- "tabled_derive",
-]
-
-[[package]]
-name = "tabled_derive"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "278ea3921cee8c5a69e0542998a089f7a14fa43c9c4e4f9951295da89bd0c943"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "tcp_passthrough"
-version = "0.1.0"
-dependencies = [
- "bincode",
- "dashmap",
- "once_cell",
- "owo-colors",
- "panda-re",
- "serde",
- "tabled",
- "tcp_shared_types",
-]
-
-[[package]]
-name = "tcp_shared_types"
-version = "0.1.0"
-dependencies = [
- "serde",
-]
-
-[[package]]
-name = "thiserror"
-version = "1.0.30"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "854babe52e4df1653706b98fcfc05843010039b406875930a70e4d9644e5c417"
-dependencies = [
- "thiserror-impl",
-]
-
-[[package]]
-name = "thiserror-impl"
-version = "1.0.30"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aa32fd3f627f367fe16f893e2597ae3c05020f8bba2666a4e6ea73d377e5714b"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "toml"
-version = "0.5.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a31142970826733df8241ef35dc040ef98c679ab14d7c3e54d827099b3acecaa"
-dependencies = [
- "serde",
-]
-
-[[package]]
-name = "typenum"
-version = "1.15.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dcf81ac59edc17cc8697ff311e8f5ef2d99fcbd9817b34cec66f90b6c3dfd987"
-
-[[package]]
-name = "unicode-segmentation"
-version = "1.8.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8895849a949e7845e06bd6dc1aa51731a103c42707010a5b591c0038fb73385b"
-
-[[package]]
-name = "unicode-width"
-version = "0.1.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3ed742d4ea2bd1176e236172c8429aaf54486e7ac098db29ffe6529e0ce50973"
-
-[[package]]
-name = "unicode-xid"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8ccb82d61f80a663efe1f787a51b16b5a51e3314d6ac365b08639f52387b33f3"
-
-[[package]]
-name = "utf8parse"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "936e4b492acfd135421d8dca4b1aa80a7bfc26e702ef3af710e0752684df5372"
-
-[[package]]
-name = "version-compare"
-version = "0.0.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d63556a25bae6ea31b52e640d7c41d1ab27faba4ccb600013837a3d0b3994ca1"
-
-[[package]]
-name = "version_check"
-version = "0.1.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "914b1a6776c4c929a602fafd8bc742e06365d4bcbe48c30f9cca5824f70dc9dd"
-
-[[package]]
-name = "version_check"
-version = "0.9.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "49874b5167b65d7193b8aba1567f5c7d93d001cafc34600cee003eda787e483f"
-
-[[package]]
-name = "vte"
-version = "0.10.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6cbce692ab4ca2f1f3047fcf732430249c0e971bfdd2b234cf2c47ad93af5983"
-dependencies = [
- "arrayvec",
- "utf8parse",
- "vte_generate_state_changes",
-]
-
-[[package]]
-name = "vte_generate_state_changes"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d257817081c7dffcdbab24b9e62d2def62e2ff7d00b1c20062551e6cccc145ff"
-dependencies = [
- "proc-macro2",
- "quote",
-]
-
-[[package]]
-name = "wasi"
-version = "0.10.2+wasi-snapshot-preview1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fd6fbd9a79829dd1ad0cc20627bf1ed606756a7f77edff7b66b7064f9cb327c6"
-
-[[package]]
-name = "winapi"
-version = "0.3.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
-dependencies = [
- "winapi-i686-pc-windows-gnu",
- "winapi-x86_64-pc-windows-gnu",
-]
-
-[[package]]
-name = "winapi-i686-pc-windows-gnu"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
-
-[[package]]
-name = "winapi-x86_64-pc-windows-gnu"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
diff --git a/panda/plugins/tcp_passthrough/Cargo.toml b/panda/plugins/tcp_passthrough/Cargo.toml
deleted file mode 100644
index 41bff9ea788..00000000000
--- a/panda/plugins/tcp_passthrough/Cargo.toml
+++ /dev/null
@@ -1,31 +0,0 @@
-[package]
-name = "tcp_passthrough"
-version = "0.1.0"
-authors = ["Jordan McLeod <Jordan.McLeod@ll.mit.edu>"]
-edition = "2018"
-
-[lib]
-crate-type = ["cdylib"]
-
-[dependencies]
-panda-re = { version = "0.34", default-features = false }
-bincode = "1"
-serde = { version = "1", features = ["derive"] }
-tabled = { version = "0.6", features = ["color"] }
-once_cell = "1"
-owo-colors = "3"
-dashmap = "5"
-
-tcp_shared_types = { path = "./tcp_shared_types" }
-
-[features]
-default = ["x86_64"]
-
-x86_64 = ["panda-re/x86_64"]
-i386 = ["panda-re/i386"]
-arm = ["panda-re/arm"]
-ppc = ["panda-re/ppc"]
-mips = ["panda-re/mips"]
-mipsel = ["panda-re/mipsel"]
-aarch64 = ["panda-re/aarch64"]
-mips64 = ["panda-re/mips64"]
diff --git a/panda/plugins/tcp_passthrough/Makefile b/panda/plugins/tcp_passthrough/Makefile
deleted file mode 100644
index 2234476df57..00000000000
--- a/panda/plugins/tcp_passthrough/Makefile
+++ /dev/null
@@ -1,18 +0,0 @@
-# Don't forget to add your plugin to config.panda!
-
-# Build rust plugins with make!
-
-# The main rule for your plugin. List all object-file dependencies.
-
-PANDA_PATH = $(realpath $(shell pwd)/..)
-PLUGIN_DIR = $(realpath $(join $(PANDA_PATH), /../panda/plugins/$(PLUGIN_NAME)/))
-RUST_SOURCE = $(wildcard $(PLUGIN_DIR)/src/*.rs)
-PLUGIN_ARTIFACTS_DIR = $(PLUGIN_TARGET_DIR)/$(PLUGIN_NAME)/target
-
-$(PLUGIN_TARGET_DIR)/panda_$(PLUGIN_NAME).so : $(RUST_SOURCE) $(PLUGIN_DIR)/Cargo.toml
-	@echo "  CARGO   $(PLUGIN_DIR)"
-	@CARGO_TERM_PROGRESS_WHEN=never cargo build --release \
-		--no-default-features --features=$(TARGET_NAME) \
-		--manifest-path=$(PLUGIN_DIR)/Cargo.toml \
-		--target-dir=$(PLUGIN_ARTIFACTS_DIR)
-	@cp -p $(PLUGIN_ARTIFACTS_DIR)/release/lib$(PLUGIN_NAME).so $@
diff --git a/panda/plugins/tcp_passthrough/README.md b/panda/plugins/tcp_passthrough/README.md
deleted file mode 100644
index 4842c9a0a6c..00000000000
--- a/panda/plugins/tcp_passthrough/README.md
+++ /dev/null
@@ -1,5 +0,0 @@
-# Guest Agent TCP Passthrough
-
-A plugin for using the PANDA guest agent in order to perform passthrough of TCP servers present in the guest.
-
-See `try_it.py` for example on how to forward an HTTP server running on port 8000 in the guest to port 4343 on the host, as well as print out a table of the sockets listening in the guest.
diff --git a/panda/plugins/tcp_passthrough/cbindgen.toml b/panda/plugins/tcp_passthrough/cbindgen.toml
deleted file mode 100644
index dfad82285b5..00000000000
--- a/panda/plugins/tcp_passthrough/cbindgen.toml
+++ /dev/null
@@ -1,7 +0,0 @@
-language = "C"
-no_includes = true
-after_includes = """// BEGIN_PYPANDA_NEEDS_THIS -- do not delete this comment bc pypanda
-// api autogen needs it.  And don't put any compiler directives
-// between this and END_PYPANDA_NEEDS_THIS except includes of other
-// files in this directory that contain subsections like this one."""
-trailer = "// END_PYPANDA_NEEDS_THIS -- do not delete this comment!\n"
diff --git a/panda/plugins/tcp_passthrough/generate_header.sh b/panda/plugins/tcp_passthrough/generate_header.sh
deleted file mode 100755
index 5c6cdb5d8cb..00000000000
--- a/panda/plugins/tcp_passthrough/generate_header.sh
+++ /dev/null
@@ -1,3 +0,0 @@
-#!/bin/sh
-cbindgen -o tcp_passthrough.h
-echo "^^^ ignore those warnings thanks :)"
diff --git a/panda/plugins/tcp_passthrough/src/display.rs b/panda/plugins/tcp_passthrough/src/display.rs
deleted file mode 100644
index c7ee37c0e69..00000000000
--- a/panda/plugins/tcp_passthrough/src/display.rs
+++ /dev/null
@@ -1,70 +0,0 @@
-use std::collections::HashMap;
-use std::net::Ipv4Addr;
-
-use once_cell::sync::Lazy;
-use owo_colors::OwoColorize;
-use tabled::{object::FirstRow, style::Style, Format, Modify, Table, Tabled};
-
-use tcp_shared_types::SocketInfo;
-
-#[derive(Tabled)]
-struct TableEntry {
-    #[tabled(rename = "Listening")]
-    listening: &'static str,
-
-    #[tabled(rename = "Local IP")]
-    ip: Ipv4Addr,
-
-    #[tabled(rename = "Port")]
-    port: u16,
-
-    #[tabled(rename = "PID")]
-    pid: String,
-
-    #[tabled(rename = "Description")]
-    description: &'static str,
-}
-
-static TCP_NAMES_CSV: &str = include_str!("tcp.csv");
-
-static PORT_TO_NAME: Lazy<HashMap<u16, &'static str>> = Lazy::new(|| {
-    TCP_NAMES_CSV
-        .trim()
-        .split('\n')
-        .filter(|line| !line.is_empty())
-        .filter_map(|line| line.split_once(','))
-        .filter_map(|(port, name)| port.parse().ok().map(move |port| (port, name)))
-        .collect()
-});
-
-const CHECK_MARK: &str = "\u{1f5f8}";
-
-pub(crate) fn print_table(sockets: Vec<SocketInfo>) {
-    let tcp_server_table = sockets
-        .into_iter()
-        .map(|socket| TableEntry {
-            listening: if socket.server { CHECK_MARK } else { " " },
-            ip: socket.ip.clone(),
-            port: socket.port,
-            pid: socket
-                .pid
-                .as_ref()
-                .map(ToString::to_string)
-                .unwrap_or_else(|| String::from("")),
-            description: PORT_TO_NAME.get(&socket.port).copied().unwrap_or(""),
-        })
-        .collect::<Vec<_>>();
-
-    println!(
-        "\n\n{}\n",
-        Table::new(tcp_server_table)
-            .with(Style::modern())
-            .with(Modify::new(FirstRow).with(Format::new(|text| text.bold().to_string())))
-            .with(tabled::Header("TCP Sockets"))
-            .with(
-                Modify::new(FirstRow)
-                    .with(tabled::Alignment::center())
-                    .with(Format::new(|text| text.bold().to_string()))
-            )
-    );
-}
diff --git a/panda/plugins/tcp_passthrough/src/forward_socket.rs b/panda/plugins/tcp_passthrough/src/forward_socket.rs
deleted file mode 100644
index ff024539d3f..00000000000
--- a/panda/plugins/tcp_passthrough/src/forward_socket.rs
+++ /dev/null
@@ -1,72 +0,0 @@
-use dashmap::DashMap;
-use once_cell::sync::Lazy;
-use panda::plugins::guest_plugin_manager::*;
-use std::io::Write;
-use std::net::Ipv4Addr;
-use std::net::{TcpListener, TcpStream};
-use std::sync::Mutex;
-use std::thread;
-
-use tcp_shared_types::Request;
-
-static CONNECTIONS: Lazy<DashMap<u32, Mutex<TcpStream>>> = Lazy::new(DashMap::new);
-
-#[channel_recv]
-fn incoming_tcp(channel_id: u32, data: &[u8]) {
-    eprintln!("[{channel_id}] TCP data: len={}", data.len());
-    if let Some(channel) = CONNECTIONS.get(&channel_id) {
-        channel.lock().unwrap().write_all(data).unwrap();
-        eprintln!("[{channel_id}] TCP data written");
-    }
-}
-
-pub fn forward(ip: Ipv4Addr, guest_port: u16, host_port: u16, localhost_only: bool) {
-    thread::spawn(move || {
-        let listener = TcpListener::bind((
-            if localhost_only {
-                "localhost"
-            } else {
-                "0.0.0.0"
-            },
-            host_port,
-        ))
-        .expect("Could not bind to host port");
-        eprintln!("Listening on localhost:{}...", host_port);
-
-        for stream in listener.incoming() {
-            match stream {
-                Ok(mut outgoing_tcp_stream) => {
-                    println!(
-                        "Incoming connection for port {} (guest port {})",
-                        host_port, guest_port
-                    );
-                    let mut incoming_channel = Channel::new(incoming_tcp);
-
-                    CONNECTIONS.insert(
-                        incoming_channel.id(),
-                        Mutex::new(outgoing_tcp_stream.try_clone().unwrap()),
-                    );
-
-                    let channel_id = incoming_channel.id();
-
-                    thread::spawn(move || {
-                        if let Err(err) =
-                            std::io::copy(&mut outgoing_tcp_stream, &mut incoming_channel)
-                        {
-                            eprintln!("Connection Closed for host port {}: {:?}", host_port, err);
-                        }
-                    });
-
-                    crate::send_request(Request::ForwardConnection {
-                        ip,
-                        port: guest_port,
-                        channel_id,
-                    });
-                }
-                Err(_) => {
-                    eprintln!("Failed to accept connection to localhost:{}", host_port);
-                }
-            }
-        }
-    });
-}
diff --git a/panda/plugins/tcp_passthrough/src/lib.rs b/panda/plugins/tcp_passthrough/src/lib.rs
deleted file mode 100644
index 53a5b8f91a4..00000000000
--- a/panda/plugins/tcp_passthrough/src/lib.rs
+++ /dev/null
@@ -1,138 +0,0 @@
-use once_cell::sync::Lazy;
-use panda::{plugins::guest_plugin_manager::*, prelude::*};
-use std::ffi::CStr;
-use std::net::Ipv4Addr;
-use std::os::raw::c_char;
-use std::sync::Mutex;
-
-mod display;
-mod forward_socket;
-mod send_ext;
-mod socket_list;
-
-use send_ext::SendExt;
-
-use tcp_shared_types::Request;
-
-/// Request that a table of sockets be printed once guest execution resumes
-#[no_mangle]
-pub extern "C" fn print_socket_info() {
-    socket_list::on_get_socket_list(display::print_table);
-}
-
-fn forward_socket_internal(ip: Ipv4Addr, port: u16, host_port: u16) {
-    forward_socket::forward(ip, port, host_port, false);
-}
-
-/// Information about a given socket binding
-#[repr(C)]
-pub struct SocketInfo {
-    pub ip: [u8; 4],
-    pub pid: u64,
-    pub port: u16,
-    pub server: bool,
-}
-
-/// Provide a callback for receiving a socket list that will get called once the guest
-/// resumes execution
-#[no_mangle]
-pub extern "C" fn on_get_socket_list(callback: extern "C" fn(*const SocketInfo, usize)) {
-    socket_list::on_get_socket_list(move |socket_list| {
-        let socket_list: Vec<SocketInfo> = socket_list
-            .into_iter()
-            .map(
-                |tcp_shared_types::SocketInfo {
-                     ip,
-                     port,
-                     pid,
-                     server,
-                 }| {
-                    SocketInfo {
-                        ip: ip.octets(),
-                        port,
-                        pid: pid.unwrap_or(u64::MAX),
-                        server,
-                    }
-                },
-            )
-            .collect();
-
-        callback(socket_list.as_ptr(), socket_list.len());
-
-        drop(socket_list);
-    })
-}
-
-/// Forward a socket from the guest, returning true if no issue is hit. Returns `false` if
-/// the IP address fails to parse. A null IP address is treated as 0.0.0.0
-///
-/// Guest must resume execution for an unspecified amount of time before TCP traffic
-/// will actually be processed.
-#[no_mangle]
-pub unsafe extern "C" fn forward_socket(
-    ip: *const c_char,
-    guest_port: u16,
-    host_port: u16,
-) -> bool {
-    let ip = if ip.is_null() {
-        "0.0.0.0".parse().unwrap()
-    } else {
-        let ip = CStr::from_ptr(ip);
-
-        if let Ok(ip) = ip.to_str().unwrap().parse() {
-            ip
-        } else {
-            return false;
-        }
-    };
-
-    forward_socket_internal(ip, guest_port, host_port);
-
-    true
-}
-
-#[channel_recv]
-fn main_channel_cb(_: u32, _: &[u8]) {
-    // TODO: support for guest closing the socket
-}
-
-static MAIN_CHANNEL: Lazy<Mutex<Channel>> =
-    Lazy::new(|| Mutex::new(load_guest_plugin("tcp_servers", main_channel_cb)));
-
-fn send_request(req: Request) {
-    MAIN_CHANNEL.lock().unwrap().send(req)
-}
-
-#[derive(PandaArgs)]
-#[name = "tcp_passthrough"]
-struct Args {
-    print_sockets: bool,
-    forward_port: u32,
-    host_port: u32,
-}
-
-static ARGS: Lazy<Args> = Lazy::new(Args::from_panda_args);
-
-#[panda::init]
-fn init(_: &mut PluginHandle) {
-    // TODO: switch to pretty_env_logger
-
-    if ARGS.print_sockets {
-        print_socket_info();
-    }
-
-    let forward_port = ARGS.forward_port as u16;
-    let host_port = ARGS.host_port as u16;
-    if forward_port != 0 {
-        Lazy::force(&MAIN_CHANNEL);
-
-        forward_socket_internal(
-            "0.0.0.0".parse().unwrap(),
-            forward_port,
-            match host_port {
-                0 => forward_port,
-                port => port,
-            },
-        );
-    }
-}
diff --git a/panda/plugins/tcp_passthrough/src/send_ext.rs b/panda/plugins/tcp_passthrough/src/send_ext.rs
deleted file mode 100644
index dca58b0a02e..00000000000
--- a/panda/plugins/tcp_passthrough/src/send_ext.rs
+++ /dev/null
@@ -1,12 +0,0 @@
-use panda::plugins::guest_plugin_manager::Channel;
-use serde::Serialize;
-
-pub(crate) trait SendExt {
-    fn send<T: Serialize>(&mut self, val: T);
-}
-
-impl SendExt for Channel {
-    fn send<T: Serialize>(&mut self, val: T) {
-        self.write_packet(&bincode::serialize(&val).unwrap());
-    }
-}
diff --git a/panda/plugins/tcp_passthrough/src/socket_list.rs b/panda/plugins/tcp_passthrough/src/socket_list.rs
deleted file mode 100644
index d45778c9200..00000000000
--- a/panda/plugins/tcp_passthrough/src/socket_list.rs
+++ /dev/null
@@ -1,51 +0,0 @@
-use crate::send_request;
-use once_cell::sync::Lazy;
-use panda::plugins::guest_plugin_manager::*;
-use std::sync::Mutex;
-
-use tcp_shared_types::{Request, SocketInfo};
-
-type SocketListCb = Box<dyn FnOnce(Vec<SocketInfo>) + Send + 'static>;
-
-static SOCKET_LIST_CHANNEL: Lazy<Channel> = Lazy::new(|| Channel::new(recv_socket_info));
-
-static SOCKET_INFO_CALLBACK: Lazy<Mutex<Option<SocketListCb>>> = Lazy::new(|| Mutex::new(None));
-
-#[channel_recv]
-fn recv_socket_info(_: u32, data: &[u8]) {
-    if let Some(callback) = take_callback() {
-        callback(bincode::deserialize(data).unwrap());
-    }
-}
-
-fn take_callback() -> Option<SocketListCb> {
-    SOCKET_INFO_CALLBACK.lock().unwrap().take()
-}
-
-fn set_callback(cb: SocketListCb) {
-    SOCKET_INFO_CALLBACK.lock().unwrap().replace(cb);
-}
-
-pub(crate) fn on_get_socket_list<CallbackFn>(new_callback: CallbackFn)
-where
-    CallbackFn: FnOnce(Vec<SocketInfo>) + Send + 'static,
-{
-    let callback = if let Some(existing_callback) = take_callback() {
-        // pending callback, chain them
-        let replacement_callback = move |sockets: Vec<SocketInfo>| {
-            existing_callback(sockets.clone());
-            new_callback(sockets);
-        };
-
-        Box::new(replacement_callback) as SocketListCb
-    } else {
-        // no callback pending, queue a request for listing
-        send_request(Request::GetSocketList {
-            channel_id: SOCKET_LIST_CHANNEL.id(),
-        });
-
-        Box::new(new_callback) as SocketListCb
-    };
-
-    set_callback(callback);
-}
diff --git a/panda/plugins/tcp_passthrough/src/tcp.csv b/panda/plugins/tcp_passthrough/src/tcp.csv
deleted file mode 100644
index 143907685e3..00000000000
--- a/panda/plugins/tcp_passthrough/src/tcp.csv
+++ /dev/null
@@ -1,3266 +0,0 @@
-0,Reserved
-1,Port Service Multiplexer
-2,Management Utility
-3,Compression Process
-4,Unassigned
-5,Remote Job Entry
-6,Unassigned
-7,Echo
-8,Unassigned
-9,Discard
-10,Unassigned
-11,Active Users
-12,Unassigned
-13,Daytime (RFC 867)
-14,Unassigned
-15,Unassigned [was netstat]
-16,Unassigned
-17,Quote of the Day
-18,Message Send Protocol
-19,Character Generator
-20,File Transfer [Default Data]
-21,File Transfer [Control]
-22,SSH Remote Login Protocol
-23,Telnet
-24,any private mail system
-25,Simple Mail Transfer
-26,Unassigned
-27,NSW User System FE
-28,Unassigned
-29,MSG ICP
-30,Unassigned
-31,MSG Authentication
-32,Unassigned
-33,Display Support Protocol
-34,Unassigned
-35,any private printer server
-36,Unassigned
-37,Time / W32.Sober.I virus
-38,Route Access Protocol
-39,Resource Location Protocol
-40,Unassigned
-41,Graphics
-42,Host Name Server
-43,WhoIs
-44,MPM FLAGS Protocol
-45,Message Processing Module [recv]
-46,MPM [default send]
-47,NI FTP
-48,Digital Audit Daemon
-49,Login Host Protocol (TACACS)
-50,Remote Mail Checking Protocol
-51,IMP Logical Address Maintenance
-52,XNS Time Protocol
-53,Domain Name Server
-54,XNS Clearinghouse
-55,ISI Graphics Language
-56,XNS Authentication
-57,any private terminal access
-58,XNS Mail
-59,any private file service
-60,Unassigned
-61,NI MAIL
-62,ACA Services
-63,whois++
-64,Communications Integrator (CI)
-65,TACACS-Database Service
-66,Oracle SQL*NET
-67,Bootstrap Protocol Server
-68,Bootstrap Protocol Client
-69,Trivial File Transfer
-70,Gopher
-71,Remote Job Service
-72,Remote Job Service
-73,Remote Job Service
-74,Remote Job Service
-75,any private dial out service
-76,Distributed External Object Store
-77,any private RJE service
-78,vettcp
-79,Finger
-80,World Wide Web HTTP
-81,HOSTS2 Name Server / Bagle-AZ worm / Win32.Rbot worm
-82,XFER Utility
-83,MIT ML Device
-84,Common Trace Facility
-85,MIT ML Device
-86,Micro Focus Cobol
-87,any private terminal link
-88,Kerberos
-89,SU/MIT Telnet Gateway
-90,DNSIX Securit Attribute Token Map
-91,MIT Dover Spooler
-92,Network Printing Protocol
-93,Device Control Protocol
-94,Tivoli Object Dispatcher
-95,SUPDUP
-96,DIXIE Protocol Specification
-97,Swift Remote Virtural File Protocol
-98,Linuxconf / TAC News
-99,Metagram Relay
-100,[unauthorized use]
-101,NIC Host Name Server
-102,MSExchangeMTA X.400 / ISO-TSAP Class 0
-103,Genesis Point-to-Point Trans Net
-104,ACR-NEMA Digital Imag. & Comm. 300
-105,Mailbox Name Nameserver
-106,3COM-TSMUX
-107,Remote Telnet Service
-108,SNA Gateway Access Server
-109,Post Office Protocol - Version 2
-110,Post Office Protocol - Version 3
-111,SUN Remote Procedure Call
-112,McIDAS Data Transmission Protocol
-113,Authentication Service
-114,Audio News Multicast
-115,Simple File Transfer Protocol
-116,ANSA REX Notify
-117,UUCP Path Service
-118,SQL Services
-119,Network News Transfer Protocol
-120,CFDPTKT
-121,Encore Expedited Remote Pro.Call
-122,SMAKYNET
-123,Network Time Protocol
-124,ANSA REX Trader
-125,Locus PC-Interface Net Map Ser
-126,Unisys Unitary Login
-127,Locus PC-Interface Conn Server
-128,GSS X License Verification
-129,Password Generator Protocol
-130,cisco FNATIVE
-131,cisco TNATIVE
-132,cisco SYSMAINT
-133,Statistics Service
-134,INGRES-NET Service
-135,DCE endpoint resolution
-136,PROFILE Naming System
-137,NETBIOS Name Service
-138,NETBIOS Datagram Service
-139,NETBIOS Session Service
-140,EMFIS Data Service
-141,EMFIS Control Service
-142,Britton-Lee IDM
-143,Internet Message Access Protocol
-144,Universal Management Architecture
-145,UAAC Protocol
-146,ISO-IP0
-147,ISO-IP
-148,Jargon
-149,AED 512 Emulation Service
-150,SQL-NET
-151,HEMS
-152,Background File Transfer Program
-153,SGMP
-154,NETSC
-155,NETSC
-156,SQL Service
-157,KNET/VM Command/Message Protocol
-158,PCMail Server
-159,NSS-Routing
-160,SGMP-TRAPS
-161,SNMP
-162,SNMPTRAP
-163,CMIP/TCP Manager
-164,CMIP/TCP Agent
-165,Xerox
-166,Sirius Systems
-167,NAMP
-168,RSVD
-169,SEND
-170,Network PostScript
-171,Network Innovations Multiplex
-172,Network Innovations CL/1
-173,Xyplex
-174,MAILQ
-175,VMNET
-176,GENRAD-MUX
-177,X Display Manager Control Protocol
-178,NextStep Window Server
-179,Border Gateway Protocol
-180,Intergraph
-181,Unify
-182,Unisys Audit SITP
-183,OCBinder
-184,OCServer
-185,Remote-KIS
-186,KIS Protocol
-187,Application Communication Interface
-188,Plus Five's MUMPS
-189,Queued File Transport
-190,Gateway Access Control Protocol
-191,Prospero Directory Service
-192,OSU Network Monitoring System
-193,Spider Remote Monitoring Protocol
-194,Internet Relay Chat Protocol
-195,DNSIX Network Level Module Audit
-196,DNSIX Session Mgt Module Audit Redir
-197,Directory Location Service
-198,Directory Location Service Monitor
-199,SMUX
-200,IBM System Resource Controller
-201,AppleTalk Routing Maintenance
-202,AppleTalk Name Binding
-203,AppleTalk Unused
-204,AppleTalk Echo
-205,AppleTalk Unused
-206,AppleTalk Zone Information
-207,AppleTalk Unused
-208,AppleTalk Unused
-209,The Quick Mail Transfer Protocol
-210,ANSI Z39.50
-211,Texas Instruments 914C/G Terminal
-212,ATEXSSTR
-213,IPX
-214,VM PWSCS
-215,Insignia Solutions
-216,Computer Associates Int'l License Server
-217,dBASE Unix
-218,Netix Message Posting Protocol
-219,Unisys ARPs
-220,Interactive Mail Access Protocol v3
-221,Berkeley rlogind with SPX auth
-222,Berkeley rshd with SPX auth
-223,Certificate Distribution Center
-224,masqdialer
-242,Direct
-243,Survey Measurement
-244,inbusiness
-245,LINK
-246,Display Systems Protocol
-247,SUBNTBCST_TFTP
-248,bhfhs
-256,RAP/Checkpoint SNMP
-257,Check Point / Secure Electronic Transaction
-258,Check Point / Yak Winsock Personal Chat
-259,Check Point Firewall-1 telnet auth / Efficient Short Remote Operations
-260,Openport
-261,IIOP Name Service over TLS/SSL
-262,Arcisdms
-263,HDAP
-264,BGMP / Check Point
-265,X-Bone CTL
-266,SCSI on ST
-267,Tobit David Service Layer
-268,Tobit David Replica
-280,HTTP-mgmt
-281,Personal Link
-282,Cable Port A/X
-283,rescap
-284,corerjd
-286,FXP-1
-287,K-BLOCK
-308,Novastor Backup
-309,EntrustTime
-310,bhmds
-311,AppleShare IP WebAdmin
-312,VSLMP
-313,Magenta Logic
-314,Opalis Robot
-315,DPSI
-316,decAuth
-317,Zannet
-318,PKIX TimeStamp
-319,PTP Event
-320,PTP General
-321,PIP
-322,RTSPS
-333,Texar Security Port
-344,Prospero Data Access Protocol
-345,Perf Analysis Workbench
-346,Zebra server
-347,Fatmen Server
-348,Cabletron Management Protocol
-349,mftp
-350,MATIP Type A
-351,bhoetty (added 5/21/97)
-352,bhoedap4 (added 5/21/97)
-353,NDSAUTH
-354,bh611
-355,DATEX-ASN
-356,Cloanto Net 1
-357,bhevent
-358,Shrinkwrap
-359,Tenebris Network Trace Service
-360,scoi2odialog
-361,Semantix
-362,SRS Send
-363,RSVP Tunnel
-364,Aurora CMGR
-365,DTK
-366,ODMR
-367,MortgageWare
-368,QbikGDP
-369,rpc2portmap
-370,codaauth2
-371,Clearcase
-372,ListProcessor
-373,Legent Corporation
-374,Legent Corporation
-375,Hassle
-376,Amiga Envoy Network Inquiry Proto
-377,NEC Corporation
-378,NEC Corporation
-379,TIA/EIA/IS-99 modem client
-380,TIA/EIA/IS-99 modem server
-381,hp performance data collector
-382,hp performance data managed node
-383,hp performance data alarm manager
-384,A Remote Network Server System
-385,IBM Application
-386,ASA Message Router Object Def.
-387,Appletalk Update-Based Routing Pro.
-388,Unidata LDM
-389,Lightweight Directory Access Protocol / Internet Locator Service (ILS)
-390,UIS
-391,SynOptics SNMP Relay Port
-392,SynOptics Port Broker Port
-393,Data Interpretation System
-394,EMBL Nucleic Data Transfer
-395,NETscout Control Protocol
-396,Novell Netware over IP
-397,Multi Protocol Trans. Net.
-398,Kryptolan
-399,ISO Transport Class 2 Non-Control over TCP
-400,Workstation Solutions
-401,Uninterruptible Power Supply
-402,Genie Protocol
-403,decap
-404,nced
-405,ncld
-406,Interactive Mail Support Protocol
-407,Timbuktu
-408,Prospero Resource Manager Sys. Man.
-409,Prospero Resource Manager Node Man.
-410,DECLadebug Remote Debug Protocol
-411,Remote MT Protocol
-412,NeoModus Direct Connect (Windows file sharing program) / Trap Convention Port
-413,SMSP
-414,InfoSeek
-415,BNet
-416,Silverplatter
-417,Onmux
-418,Hyper-G
-419,Ariel
-420,SMPTE
-421,Ariel
-422,Ariel
-423,IBM Operations Planning and Control Start
-424,IBM Operations Planning and Control Track
-425,ICAD
-426,smartsdp
-427,Server Location
-428,OCS_CMU
-429,OCS_AMU
-430,UTMPSD
-431,UTMPCD
-432,IASD
-433,NNSP
-434,MobileIP-Agent
-435,MobilIP-MN
-436,DNA-CML
-437,comscm
-438,dsfgw
-439,dasp
-440,sgcp
-441,decvms-sysmgt
-442,cvc_hostd
-443,HTTP protocol over TLS/SSL
-444,Simple Network Paging Protocol
-445,Microsoft-DS
-446,DDM-RDB
-447,DDM-RFM
-448,DDM-SSL
-449,AS Server Mapper
-450,TServer
-451,Cray Network Semaphore server
-452,Cray SFS config server
-453,CreativeServer
-454,ContentServer
-455,CreativePartnr
-456,macon-tcp
-457,scohelp
-458,apple quick time
-459,ampr-rcmd
-460,skronk
-461,DataRampSrv
-462,DataRampSrvSec
-463,alpes
-464,kpasswd
-465,SMTPS
-466,digital-vrc
-467,mylex-mapd
-468,proturis
-469,Radio Control Protocol
-470,scx-proxy
-471,Mondex
-472,ljk-login
-473,hybrid-pop
-474,tn-tl-w1
-475,tcpnethaspsrv
-476,tn-tl-fd1
-477,ss7ns
-478,spsc
-479,iafserver
-480,iafdbase
-481,Ph service
-482,bgs-nsi
-483,ulpnet
-484,Integra Software Management Environment
-485,Air Soft Power Burst
-486,avian
-487,saft Simple Asynchronous File Transfer
-488,gss-HTTP
-489,nest-protocol
-490,micom-pfs
-491,go-login
-492,Transport Independent Convergence for FNA
-493,Transport Independent Convergence for FNA
-494,POV-Ray
-495,intecourier
-496,PIM-RP-DISC
-497,dantz
-498,siam
-499,ISO ILL Protocol
-500,ISAKMP
-501,STMF
-502,asa-appl-proto
-503,Intrinsa
-504,citadel
-505,mailbox-lm
-506,ohimsrv
-507,crs
-508,xvttp
-509,snare
-510,FirstClass Protocol
-511,PassGo
-512,Remote process execution
-513,Remote Login
-514,Remote Shell
-515,spooler
-516,videotex
-517,like tenex link but across
-518,talkd
-519,unixtime
-520,extended file name server
-521,ripng
-522,User Location Service / ULP
-523,IBM-DB2
-524,NCP
-525,timeserver
-526,newdate
-527,Stock IXChange
-528,Customer IXChange
-529,IRC-SERV
-530,rpc
-531,chat
-532,readnews
-533,for emergency broadcasts
-534,MegaMedia Admin
-535,iiop
-536,opalis-rdv
-537,Networked Media Streaming Protocol
-538,gdomap
-539,Apertus Technologies Load Determination
-540,uucpd
-541,uucp-rlogin
-542,commerce
-543,kerberos (v4/v5)
-544,krcmd
-545,appleqtcsrvr
-546,DHCPv6 Client
-547,DHCPv6 Server
-548,AppleShare AFP over TCP
-549,IDFP
-550,new-who
-551,cybercash
-552,deviceshare
-553,pirp
-554,Real Time Stream Control Protocol
-555,phAse Zero backdoor (Win 9x, NT) / dsf
-556,rfs server
-557,openvms-sysipc
-558,SDNSKMP
-559,TEEDTAP / Backdoor.Domwis Win32 trojan
-560,rmonitord
-561,monitor
-562,chcmd
-563,AOL IM / NNTP protocol over TLS/SSL
-564,plan 9 file service
-565,whoami
-566,streettalk
-567,banyan-rpc
-568,microsoft shuttle
-569,microsoft rome
-570,demon
-571,udemon
-572,sonar
-573,banyan-vip
-574,FTP Software Agent System
-575,VEMMI
-576,ipcd
-577,vnas
-578,ipdd
-579,decbsrv
-580,SNTP HEARTBEAT
-581,Bundle Discovery Protocol
-582,SCC Security
-583,Philips Video-Conferencing
-584,Key Server
-585,IMAP4+SSL
-586,Password Change
-587,Message Submission (Sendmail)
-588,CAL
-589,EyeLink
-590,TNS CML
-591,FileMaker Inc. - HTTP Alternate
-592,Eudora Set
-593,HTTP RPC Ep Map
-594,TPIP
-595,CAB Protocol
-596,SMSD
-597,PTC Name Service
-598,SCO Web Server Manager 3
-599,Aeolon Core Protocol
-600,Sun IPC server
-606,Cray Unified Resource Manager
-607,nqs
-608,Sender-Initiated/Unsolicited File Transfer
-609,npmp-trap
-610,Apple Admin Service / npmp-local
-611,npmp-gui
-612,HMMP Indication
-613,HMMP Operation
-614,SSLshell
-615,Internet Configuration Manager
-616,SCO System Administration Server
-617,SCO Desktop Administration Server
-618,DEI-ICDA
-619,Digital EVM
-620,SCO WebServer Manager
-621,ESCP
-622,Collaborator
-623,Aux Bus Shunt
-624,Crypto Admin
-625,DEC DLM
-626,ASIA
-627,PassGo Tivoli
-628,QMQP
-629,3Com AMP3
-630,RDA
-631,IPP (Internet Printing Protocol)
-632,bmpp
-633,Service Status update (Sterling Software)
-634,ginad
-635,RLZ DBase
-636,LDAP protocol over TLS/SSL
-637,lanserver
-638,mcns-sec
-639,MSDP
-640,entrust-sps
-641,repcmd
-642,ESRO-EMSDP V1.3
-643,SANity
-644,dwr
-645,PSSC
-646,LDP
-647,DHCP Failover
-648,Registry Registrar Protocol (RRP)
-649,Aminet
-650,OBEX
-651,IEEE MMS
-652,UDLR_DTCP
-653,RepCmd
-654,AODV
-655,TINC
-656,SPMP
-657,RMC
-658,TenFold
-659,URL Rendezvous
-660,MacOS Server Admin
-661,HAP
-662,PFTP
-663,PureNoise
-664,Secure Aux Bus
-665,Sun DR
-666,doom Id Software
-667,campaign contribution disclosures - SDR Technologies
-668,MeComm
-669,MeRegister
-670,VACDSM-SWS
-671,VACDSM-APP
-672,VPPS-QUA
-673,CIMPLEX
-674,ACAP
-675,DCTP
-676,VPPS Via
-677,Virtual Presence Protocol
-678,GNU Gereration Foundation NCP
-679,MRM
-680,entrust-aaas
-681,entrust-aams
-682,XFR
-683,CORBA IIOP
-684,CORBA IIOP SSL
-685,MDC Port Mapper
-686,Hardware Control Protocol Wismar
-687,asipregistry
-688,REALM-RUSD
-689,NMAP
-690,VATP
-691,MS Exchange Routing
-692,Hyperwave-ISP
-693,connendp
-694,ha-cluster
-695,IEEE-MMS-SSL
-696,RUSHD
-697,UUIDGEN
-698,OLSR
-704,errlog copy/server daemon
-705,AgentX
-706,SILC
-707,W32.Nachi Worm / Borland DSJ
-709,Entrust Key Management Service Handler
-710,Entrust Administration Service Handler
-711,Cisco TDP
-729,IBM NetView DM/6000 Server/Client
-730,IBM NetView DM/6000 send/tcp
-731,IBM NetView DM/6000 receive/tcp
-740,(old) NETscout Control Protocol (old)
-741,netGW
-742,Network based Rev. Cont. Sys.
-744,Flexible License Manager
-747,Fujitsu Device Control
-748,Russell Info Sci Calendar Manager
-749,kerberos administration
-750,rfile
-751,pump
-752,Kerberos password server
-753,Kerberos userreg server
-754,send
-758,nlogin
-759,con
-760,kreg, kerberos/4 registration
-761,kpwd, Kerberos/4 password
-762,quotad
-763,cycleserv
-764,omserv
-765,webster
-767,phone
-769,vid
-770,cadlock
-771,rtip
-772,cycleserv2
-773,submit
-774,rpasswd
-775,entomb
-776,wpages
-777,Multiling HTTP
-780,wpgs
-781,HP performance data collector
-782,node HP performance data managed node
-783,HP performance data alarm manager
-786,Concert
-787,QSC
-799,ControlIT / Remotely Possible
-800,mdbs_daemon / Remotely Possible
-801,device
-808,CCProxy
-810,FCP
-828,itm-mcell-s
-829,PKIX-3 CA/RA
-871,SUP server
-873,rsync
-886,ICL coNETion locate server
-887,ICL coNETion server info
-888,CD Database Protocol
-900,Check Point Firewall-1 HTTP administration / OMG Initial Refs
-901,Samba Web Administration Tool / Realsecure / SMPNAMERES/ NetDevil trojan
-902,VMware Authentication Daemon / IDEAFARM-CHAT
-903,IDEAFARM-CATCH / NetDevil trojan
-911,xact-backup
-912,VMware Authentication Daemon
-989,FTP protocol data over TLS/SSL
-990,FTP protocol control over TLS/SSL
-991,Netnews Administration System
-992,Telnet protocol over TLS/SSL
-993,IMAP4 protocol over TLS/SSL
-994,IRC protocol over TLS/SSL
-995,POP3 protocol over TLS/SSL
-996,vsinet
-997,maitrd
-998,busboy
-999,puprouter
-1000,cadlock
-1002,Microsoft Site Server Internet Locator Service (Netmeeting/ICF)
-1008,UFS-aware server
-1010,surf
-1011,Doly (Windows Trojan)
-1015,Doly (Windows Trojan)
-1023,Reserved
-1024,Reserved
-1025,MSTASK / network blackjack
-1026,MSTASK / Remote Login Network Terminal
-1030,BBN IAD
-1031,InetInfo / BBN IAD
-1032,BBN IAD
-1042,W32.Mydoom.L virus
-1047,Sun's NEO Object Request Broker
-1048,Sun's NEO Object Request Broker
-1049,Tobit David Postman VPMN
-1050,CORBA Management Agent
-1051,Optima VNET
-1052,Dynamic DNS Tools
-1053,Remote Assistant (RA)
-1054,BRVREAD
-1055,ANSYS - License Manager
-1056,VFO
-1057,STARTRON
-1058,nim
-1059,nimreg
-1060,POLESTAR
-1061,KIOSK
-1062,Veracity
-1063,KyoceraNetDev
-1064,JSTEL
-1065,SYSCOMLAN
-1066,FPO-FNS
-1067,Installation Bootstrap Proto. Serv.
-1068,Installation Bootstrap Proto. Cli.
-1069,COGNEX-INSIGHT
-1070,GMRUpdateSERV
-1071,BSQUARE-VOIP
-1072,CARDAX
-1073,BridgeControl
-1074,FASTechnologies License Manager
-1075,RDRMSHC
-1076,DAB STI-C
-1077,IMGames
-1078,eManageCstp
-1079,ASPROVATalk
-1080,Socks / W32.Beagle.AB trojan
-1081,PVUNIWIEN
-1082,AMT-ESD-PROT
-1083,Anasoft License Manager
-1084,Anasoft License Manager
-1085,Web Objects
-1086,CPL Scrambler Logging
-1087,CPL Scrambler Internal
-1088,CPL Scrambler Alarm Log
-1089,FF Annunciation
-1090,FF Fieldbus Message Specification
-1091,FF System Management
-1092,OBRPD
-1093,PROOFD
-1094,ROOTD
-1095,NICELink
-1096,Common Name Resolution Protocol
-1097,Sun Cluster Manager
-1098,RMI Activation
-1099,RMI Registry
-1100,MCTP
-1101,PT2-DISCOVER
-1102,ADOBE SERVER 1
-1103,ADOBE SERVER 2
-1104,XRL
-1105,FTRANHC
-1106,ISOIPSIGPORT-1
-1107,ISOIPSIGPORT-2
-1108,ratio-adp
-1109,Pop with Kerberos
-1110,Cluster status info
-1111,LM Social Server
-1112,Intelligent Communication Protocol
-1114,Mini SQL
-1115,ARDUS Transfer
-1116,ARDUS Control
-1117,ARDUS Multicast Transfer
-1123,Murray
-1127,SUP debugging
-1155,Network File Access
-1161,Health Polling
-1162,Health Trap
-1169,TRIPWIRE
-1178,SKK (kanji input)
-1180,Millicent Client Proxy
-1188,HP Web Admin
-1200,SCOL
-1201,Nucleus Sand
-1202,caiccipc
-1203,License Validation
-1204,Log Request Listener
-1205,Accord-MGC
-1206,Anthony Data
-1207,MetaSage
-1208,SEAGULL AIS
-1209,IPCD3
-1210,EOSS
-1211,Groove DPP
-1212,lupa
-1213,MPC LIFENET
-1214,KAZAA (Morpheus)
-1215,scanSTAT 1.0
-1216,ETEBAC 5
-1217,HPSS-NDAPI
-1218,AeroFlight-ADs
-1219,AeroFlight-Ret
-1220,QT SERVER ADMIN
-1221,SweetWARE Apps
-1222,SNI R&D network
-1223,TGP
-1224,VPNz
-1225,SLINKYSEARCH
-1226,STGXFWS
-1227,DNS2Go
-1228,FLORENCE
-1229,Novell ZFS
-1234,W32.Beagle.Y trojan / Infoseek Search Agent
-1239,NMSD
-1241,Nessus Daemon / remote message service
-1243,SubSeven (Windows Trojan)
-1245,Subseven backdoor remote access tool
-1248,hermes
-1270,Microsoft Operations Manager MOM-Encrypted
-1300,H323 Host Call Secure
-1310,Husky
-1311,RxMon
-1312,STI Envision
-1313,BMC_PATROLDB
-1314,Photoscript Distributed Printing System
-1319,Panja-ICSP
-1320,Panja-AXBNET
-1321,PIP
-1335,Digital Notary Protocol
-1345,VPJP
-1346,Alta Analytics License Manager
-1347,multi media conferencing
-1348,multi media conferencing
-1349,Registration Network Protocol
-1350,Registration Network Protocol
-1351,Digital Tool Works (MIT)
-1352,Lotus Notes
-1353,Relief Consulting
-1354,RightBrain Software
-1355,Intuitive Edge
-1356,CuillaMartin Company
-1357,Electronic PegBoard
-1358,CONNLCLI
-1359,FTSRV
-1360,MIMER
-1361,LinX
-1362,TimeFlies
-1363,Network DataMover Requester
-1364,Network DataMover Server
-1365,Network Software Associates
-1366,Novell NetWare Comm Service Platform
-1367,DCS
-1368,ScreenCast
-1369,GlobalView to Unix Shell
-1370,Unix Shell to GlobalView
-1371,Fujitsu Config Protocol
-1372,Fujitsu Config Protocol
-1373,Chromagrafx
-1374,EPI Software Systems
-1375,Bytex
-1376,IBM Person to Person Software
-1377,Cichlid License Manager
-1378,Elan License Manager
-1379,Integrity Solutions
-1380,Telesis Network License Manager
-1381,Apple Network License Manager
-1382,udt_os
-1383,GW Hannaway Network License Manager
-1384,Objective Solutions License Manager
-1385,Atex Publishing License Manager
-1386,CheckSum License Manager
-1387,Computer Aided Design Software Inc LM
-1388,Objective Solutions DataBase Cache
-1389,Document Manager
-1390,Storage Controller
-1391,Storage Access Server
-1392,Print Manager
-1393,Network Log Server
-1394,Network Log Client
-1395,PC Workstation Manager software
-1396,DVL Active Mail
-1397,Audio Active Mail
-1398,Video Active Mail
-1399,Cadkey License Manager
-1400,Cadkey Tablet Daemon
-1401,Goldleaf License Manager
-1402,Prospero Resource Manager
-1403,Prospero Resource Manager
-1404,Infinite Graphics License Manager
-1405,IBM Remote Execution Starter
-1406,NetLabs License Manager
-1407,DBSA License Manager
-1408,Sophia License Manager
-1409,Here License Manager
-1410,HiQ License Manager
-1411,AudioFile
-1412,InnoSys
-1413,Innosys-ACL
-1414,IBM MQSeries
-1415,DBStar
-1416,Novell LU6.2
-1417,Timbuktu Service 1 Port
-1418,Timbuktu Service 2 Port
-1419,Timbuktu Service 3 Port
-1420,Timbuktu Service 4 Port
-1421,Gandalf License Manager
-1422,Autodesk License Manager
-1423,Essbase Arbor Software
-1424,Hybrid Encryption Protocol
-1425,Zion Software License Manager
-1426,Satellite-data Acquisition System 1
-1427,mloadd monitoring tool
-1428,Informatik License Manager
-1429,Hypercom NMS
-1430,Hypercom TPDU
-1431,Reverse Gossip Transport
-1432,Blueberry Software License Manager
-1433,Microsoft-SQL-Server
-1434,Microsoft-SQL-Monitor
-1435,IBM CICS
-1436,Satellite-data Acquisition System 2
-1437,Tabula
-1438,Eicon Security Agent/Server
-1439,Eicon X25/SNA Gateway
-1440,Eicon Service Location Protocol
-1441,Cadis License Management
-1442,Cadis License Management
-1443,Integrated Engineering Software
-1444,Marcam License Management
-1445,Proxima License Manager
-1446,Optical Research Associates License Manager
-1447,Applied Parallel Research LM
-1448,OpenConnect License Manager
-1449,PEport
-1450,Tandem Distributed Workbench Facility
-1451,IBM Information Management
-1452,GTE Government Systems License Man
-1453,Genie License Manager
-1454,interHDL License Manager
-1455,ESL License Manager
-1456,DCA
-1457,Valisys License Manager
-1458,Nichols Research Corp.
-1459,Proshare Notebook Application
-1460,Proshare Notebook Application
-1461,IBM Wireless LAN
-1462,World License Manager
-1463,Nucleus
-1464,MSL License Manager
-1465,Pipes Platform
-1466,Ocean Software License Manager
-1467,CSDMBASE
-1468,CSDM
-1469,Active Analysis Limited License Manager
-1470,Universal Analytics
-1471,csdmbase
-1472,csdm
-1473,OpenMath
-1474,Telefinder
-1475,Taligent License Manager
-1476,clvm-cfg
-1477,ms-sna-server
-1478,ms-sna-base
-1479,dberegister
-1480,PacerForum
-1481,AIRS
-1482,Miteksys License Manager
-1483,AFS License Manager
-1484,Confluent License Manager
-1485,LANSource
-1486,nms_topo_serv
-1487,LocalInfoSrvr
-1488,DocStor
-1489,dmdocbroker
-1490,insitu-conf
-1491,anynetgateway
-1492,stone-design-1
-1493,netmap_lm
-1494,Citrix/ica
-1495,cvc
-1496,liberty-lm
-1497,rfx-lm
-1498,Sybase SQL Any
-1499,Federico Heinz Consultora
-1500,VLSI License Manager
-1501,Satellite-data Acquisition System 3
-1502,Shiva
-1503,MS Netmeeting / T.120 / Databeam
-1504,EVB Software Engineering License Manager
-1505,Funk Software Inc.
-1506,Universal Time daemon (utcd)
-1507,symplex
-1508,diagmond
-1509,Robcad Ltd. License Manager
-1510,Midland Valley Exploration Ltd. Lic. Man.
-1511,3l-l1
-1512,Microsoft's Windows Internet Name Service
-1513,Fujitsu Systems Business of America Inc
-1514,Fujitsu Systems Business of America Inc
-1515,ifor-protocol
-1516,Virtual Places Audio data
-1517,Virtual Places Audio control
-1518,Virtual Places Video data
-1519,Virtual Places Video control
-1520,atm zip office
-1521,Oracle8i Listener / nCube License Manager
-1522,Ricardo North America License Manager
-1523,cichild
-1524,dtspcd / ingres
-1525,Oracle / Prospero Directory Service non-priv
-1526,Prospero Data Access Prot non-priv
-1527,oracle
-1528,micautoreg
-1529,oracle
-1530,Oracle ExtProc (PLSExtProc) / rap-service
-1531,rap-listen
-1532,miroconnect
-1533,Virtual Places Software
-1534,micromuse-lm
-1535,ampr-info
-1536,ampr-inter
-1537,isi-lm
-1538,3ds-lm
-1539,Intellistor License Manager
-1540,rds
-1541,rds2
-1542,gridgen-elmd
-1543,simba-cs
-1544,aspeclmd
-1545,vistium-share
-1546,abbaccuray
-1547,laplink
-1548,Axon License Manager
-1549,Shiva Hose
-1550,Image Storage license manager 3M Company
-1551,HECMTL-DB
-1552,pciarray
-1553,sna-cs
-1554,CACI Products Company License Manager
-1555,livelan
-1556,AshWin CI Tecnologies
-1557,ArborText License Manager
-1558,xingmpeg
-1559,web2host
-1560,asci-val
-1561,facilityview
-1562,pconnectmgr
-1563,Cadabra License Manager
-1564,Pay-Per-View
-1565,WinDD
-1566,CORELVIDEO
-1567,jlicelmd
-1568,tsspmap
-1569,ets
-1570,orbixd
-1571,Oracle Remote Data Base
-1572,Chipcom License Manager
-1573,itscomm-ns
-1574,mvel-lm
-1575,oraclenames
-1576,moldflow-lm
-1577,hypercube-lm
-1578,Jacobus License Manager
-1579,ioc-sea-lm
-1580,tn-tl-r1
-1581,MIL-2045-47001
-1582,MSIMS
-1583,simbaexpress
-1584,tn-tl-fd2
-1585,intv
-1586,ibm-abtact
-1587,pra_elmd
-1588,triquest-lm
-1589,VQP
-1590,gemini-lm
-1591,ncpm-pm
-1592,commonspace
-1593,mainsoft-lm
-1594,sixtrak
-1595,radio
-1596,radio-sm
-1597,orbplus-iiop
-1598,picknfs
-1599,simbaservices
-1600,Bofra-A worm / issd
-1601,aas
-1602,inspect
-1603,pickodbc
-1604,icabrowser
-1605,Salutation Manager (Salutation Protocol)
-1606,Salutation Manager (SLM-API)
-1607,stt
-1608,Smart Corp. License Manager
-1609,isysg-lm
-1610,taurus-wh
-1611,Inter Library Loan
-1612,NetBill Transaction Server
-1613,NetBill Key Repository
-1614,NetBill Credential Server
-1615,NetBill Authorization Server
-1616,NetBill Product Server
-1617,Nimrod Inter-Agent Communication
-1618,skytelnet
-1619,xs-openstorage
-1620,faxportwinport
-1621,softdataphone
-1622,ontime
-1623,jaleosnd
-1624,udp-sr-port
-1625,svs-omagent
-1626,Shockwave
-1627,T.128 Gateway
-1628,LonTalk normal
-1629,LonTalk urgent
-1630,Oracle Net8 Cman
-1631,Visit view
-1632,PAMMRATC
-1633,PAMMRPC
-1634,Log On America Probe
-1635,EDB Server 1
-1636,CableNet Control Protocol
-1637,CableNet Admin Protocol
-1638,Bofra-A worm / CableNet Info Protocol
-1639,cert-initiator
-1640,cert-responder
-1641,InVision
-1642,isis-am
-1643,isis-ambc
-1644,Satellite-data Acquisition System 4
-1645,datametrics
-1646,sa-msg-port
-1647,rsap
-1648,concurrent-lm
-1649,kermit
-1650,nkd
-1651,shiva_confsrvr
-1652,xnmp
-1653,alphatech-lm
-1654,stargatealerts
-1655,dec-mbadmin
-1656,dec-mbadmin-h
-1657,fujitsu-mmpdc
-1658,sixnetudr
-1659,Silicon Grail License Manager
-1660,skip-mc-gikreq
-1661,netview-aix-1
-1662,netview-aix-2
-1663,netview-aix-3
-1664,netview-aix-4
-1665,netview-aix-5
-1666,netview-aix-6
-1667,netview-aix-7
-1668,netview-aix-8
-1669,netview-aix-9
-1670,netview-aix-10
-1671,netview-aix-11
-1672,netview-aix-12
-1673,Intel Proshare Multicast
-1674,Intel Proshare Multicast
-1675,Pacific Data Products
-1676,netcomm1
-1677,groupwise
-1678,prolink
-1679,darcorp-lm
-1680,microcom-sbp
-1681,sd-elmd
-1682,lanyon-lantern
-1683,ncpm-hip
-1684,SnareSecure
-1685,n2nremote
-1686,cvmon
-1687,nsjtp-ctrl
-1688,nsjtp-data
-1689,firefox
-1690,ng-umds
-1691,empire-empuma
-1692,sstsys-lm
-1693,rrirtr
-1694,rrimwm
-1695,rrilwm
-1696,rrifmm
-1697,rrisat
-1698,RSVP-ENCAPSULATION-1
-1699,RSVP-ENCAPSULATION-2
-1700,mps-raft
-1701,l2tp / AOL
-1702,deskshare
-1703,hb-engine
-1704,bcs-broker
-1705,slingshot
-1706,jetform
-1707,vdmplay
-1708,gat-lmd
-1709,centra
-1710,impera
-1711,pptconference
-1712,resource monitoring service
-1713,ConferenceTalk
-1714,sesi-lm
-1715,houdini-lm
-1716,xmsg
-1717,fj-hdnet
-1718,h323gatedisc
-1719,h323gatestat
-1720,h323hostcall
-1721,caicci
-1722,HKS License Manager
-1723,pptp
-1724,csbphonemaster
-1725,iden-ralp
-1726,IBERIAGAMES
-1727,winddx
-1728,TELINDUS
-1729,CityNL License Management
-1730,roketz
-1731,MS Netmeeting / Audio call control / MSICCP
-1732,proxim
-1733,SIMS - SIIPAT Protocol for Alarm Transmission
-1734,Camber Corporation License Management
-1735,PrivateChat
-1736,street-stream
-1737,ultimad
-1738,GameGen1
-1739,webaccess
-1740,encore
-1741,cisco-net-mgmt
-1742,3Com-nsd
-1743,Cinema Graphics License Manager
-1744,ncpm-ft
-1745,ISA Server proxy autoconfig / Remote Winsock
-1746,ftrapid-1
-1747,ftrapid-2
-1748,oracle-em1
-1749,aspen-services
-1750,Simple Socket Library's PortMaster
-1751,SwiftNet
-1752,Leap of Faith Research License Manager
-1753,Translogic License Manager
-1754,oracle-em2
-1755,Microsoft Streaming Server
-1756,capfast-lmd
-1757,cnhrp
-1758,tftp-mcast
-1759,SPSS License Manager
-1760,www-ldap-gw
-1761,cft-0
-1762,cft-1
-1763,cft-2
-1764,cft-3
-1765,cft-4
-1766,cft-5
-1767,cft-6
-1768,cft-7
-1769,bmc-net-adm
-1770,bmc-net-svc
-1771,vaultbase
-1772,EssWeb Gateway
-1773,KMSControl
-1774,global-dtserv
-1776,Federal Emergency Management Information System
-1777,powerguardian
-1778,prodigy-internet
-1779,pharmasoft
-1780,dpkeyserv
-1781,answersoft-lm
-1782,HP JetSend
-1783,Port 04/14/00 fujitsu.co.jp
-1784,Finle License Manager
-1785,Wind River Systems License Manager
-1786,funk-logger
-1787,funk-license
-1788,psmond
-1789,hello
-1790,Narrative Media Streaming Protocol
-1791,EA1
-1792,ibm-dt-2
-1793,rsc-robot
-1794,cera-bcm
-1795,dpi-proxy
-1796,Vocaltec Server Administration
-1797,UMA
-1798,Event Transfer Protocol
-1799,NETRISK
-1800,ANSYS-License manager
-1801,Microsoft Message Queuing
-1802,ConComp1
-1803,HP-HCIP-GWY
-1804,ENL
-1805,ENL-Name
-1806,Musiconline
-1807,Fujitsu Hot Standby Protocol
-1808,Oracle-VP2
-1809,Oracle-VP1
-1810,Jerand License Manager
-1811,Scientia-SDB
-1812,RADIUS
-1813,RADIUS Accounting / HackTool.SkSocket
-1814,TDP Suite
-1815,MMPFT
-1816,HARP
-1817,RKB-OSCS
-1818,Enhanced Trivial File Transfer Protocol
-1819,Plato License Manager
-1820,mcagent
-1821,donnyworld
-1822,es-elmd
-1823,Unisys Natural Language License Manager
-1824,metrics-pas
-1825,DirecPC Video
-1826,ARDT
-1827,ASI
-1828,itm-mcell-u
-1829,Optika eMedia
-1830,Oracle Net8 CMan Admin
-1831,Myrtle
-1832,ThoughtTreasure
-1833,udpradio
-1834,ARDUS Unicast
-1835,ARDUS Multicast
-1836,ste-smsc
-1837,csoft1
-1838,TALNET
-1839,netopia-vo1
-1840,netopia-vo2
-1841,netopia-vo3
-1842,netopia-vo4
-1843,netopia-vo5
-1844,DirecPC-DLL
-1850,GSI
-1851,ctcd
-1860,SunSCALAR Services
-1861,LeCroy VICP
-1862,techra-server
-1863,MSN Messenger
-1864,Paradym 31 Port
-1865,ENTP
-1870,SunSCALAR DNS Service
-1871,Cano Central 0
-1872,Cano Central 1
-1873,Fjmpjps
-1874,Fjswapsnp
-1881,IBM MQSeries
-1895,Vista 4GL
-1899,MC2Studios
-1900,SSDP
-1901,Fujitsu ICL Terminal Emulator Program A
-1902,Fujitsu ICL Terminal Emulator Program B
-1903,Local Link Name Resolution
-1904,Fujitsu ICL Terminal Emulator Program C
-1905,Secure UP.Link Gateway Protocol
-1906,TPortMapperReq
-1907,IntraSTAR
-1908,Dawn
-1909,Global World Link
-1910,ultrabac
-1911,Starlight Networks Multimedia Transport Protocol
-1912,rhp-iibp
-1913,armadp
-1914,Elm-Momentum
-1915,FACELINK
-1916,Persoft Persona
-1917,nOAgent
-1918,Candle Directory Service - NDS
-1919,Candle Directory Service - DCH
-1920,Candle Directory Service - FERRET
-1921,NoAdmin
-1922,Tapestry
-1923,SPICE
-1924,XIIP
-1930,Drive AppServer
-1931,AMD SCHED
-1944,close-combat
-1945,dialogic-elmd
-1946,tekpls
-1947,hlserver
-1948,eye2eye
-1949,ISMA Easdaq Live
-1950,ISMA Easdaq Test
-1951,bcs-lmserver
-1952,mpnjsc
-1953,Rapid Base
-1961,BTS APPSERVER
-1962,BIAP-MP
-1963,WebMachine
-1964,SOLID E ENGINE
-1965,Tivoli NPM
-1966,Slush
-1967,SNS Quote
-1972,Cache
-1973,Data Link Switching Remote Access Protocol
-1974,DRP
-1975,TCO Flash Agent
-1976,TCO Reg Agent
-1977,TCO Address Book
-1978,UniSQL
-1979,UniSQL Java
-1984,BB
-1985,Hot Standby Router Protocol
-1986,cisco license management
-1987,cisco RSRB Priority 1 port
-1988,cisco RSRB Priority 2 port
-1989,MHSnet system
-1990,cisco STUN Priority 1 port
-1991,cisco STUN Priority 2 port
-1992,IPsendmsg
-1993,cisco SNMP TCP port
-1994,cisco serial tunnel port
-1995,cisco perf port
-1996,cisco Remote SRB port
-1997,cisco Gateway Discovery Protocol
-1998,cisco X.25 service (XOT)
-1999,cisco identification port / SubSeven (Windows Trojan) / Backdoor (Windows Trojan)
-2000,Remotely Anywhere / VIA NET.WORKS PostOffice Plus
-2001,Cisco mgmt / Remotely Anywhere
-2002,globe
-2003,GNU finger
-2004,mailbox
-2005,encrypted symmetric telnet/login
-2006,invokator
-2007,dectalk
-2008,conf
-2009,news
-2010,search
-2011,raid
-2012,ttyinfo
-2013,raid-am
-2014,troff
-2015,cypress
-2016,bootserver
-2017,cypress-stat
-2018,terminaldb
-2019,whosockami
-2020,xinupageserver
-2021,servexec
-2022,down
-2023,xinuexpansion3
-2024,xinuexpansion4
-2025,ellpack
-2026,scrabble
-2027,shadowserver
-2028,submitserver
-2030,device2
-2032,blackboard
-2033,glogger
-2034,scoremgr
-2035,imsldoc
-2038,objectmanager
-2040,lam
-2041,W32.Korgo Worm / interbase
-2042,isis
-2043,isis-bcast
-2044,rimsl
-2045,cdfunc
-2046,sdfunc
-2047,dls
-2048,dls-monitor
-2049,Network File System - Sun Microsystems
-2053,Kerberos de-multiplexer
-2054,distrib-net
-2065,Data Link Switch Read Port Number
-2067,Data Link Switch Write Port Number
-2080,Wingate
-2090,Load Report Protocol
-2091,PRP
-2092,Descent 3
-2093,NBX CC
-2094,NBX AU
-2095,NBX SER
-2096,NBX DIR
-2097,Jet Form Preview
-2098,Dialog Port
-2099,H.225.0 Annex G
-2100,amiganetfs
-2101,Microsoft Message Queuing / rtcm-sc104
-2102,Zephyr server
-2103,Microsoft Message Queuing RPC / Zephyr serv-hm connection
-2104,Zephyr hostmanager
-2105,Microsoft Message Queuing RPC / MiniPay
-2106,MZAP
-2107,Microsoft Message Queuing Management / BinTec Admin
-2108,Comcam
-2109,Ergolight
-2110,UMSP
-2111,DSATP
-2112,Idonix MetaNet
-2113,HSL StoRM
-2114,NEWHEIGHTS
-2115,KDM / Bugs (Windows Trojan)
-2116,CCOWCMR
-2117,MENTACLIENT
-2118,MENTASERVER
-2119,GSIGATEKEEPER
-2120,Quick Eagle Networks CP
-2121,CCProxy FTP / SCIENTIA-SSDB
-2122,CauPC Remote Control
-2123,GTP-Control Plane (3GPP)
-2124,ELATELINK
-2125,LOCKSTEP
-2126,PktCable-COPS
-2127,INDEX-PC-WB
-2128,Net Steward Control
-2129,cs-live.com
-2130,SWC-XDS
-2131,Avantageb2b
-2132,AVAIL-EPMAP
-2133,ZYMED-ZPP
-2134,AVENUE
-2135,Grid Resource Information Server
-2136,APPWORXSRV
-2137,CONNECT
-2138,UNBIND-CLUSTER
-2139,IAS-AUTH
-2140,IAS-REG
-2141,IAS-ADMIND
-2142,TDM-OVER-IP
-2143,Live Vault Job Control
-2144,Live Vault Fast Object Transfer
-2145,Live Vault Remote Diagnostic Console Support
-2146,Live Vault Admin Event Notification
-2147,Live Vault Authentication
-2148,VERITAS UNIVERSAL COMMUNICATION LAYER
-2149,ACPTSYS
-2150,DYNAMIC3D
-2151,DOCENT
-2152,GTP-User Plane (3GPP)
-2165,X-Bone API
-2166,IWSERVER
-2180,Millicent Vendor Gateway Server
-2181,eforward
-2190,TiVoConnect Beacon
-2191,TvBus Messaging
-2200,ICI
-2201,Advanced Training System Program
-2202,Int. Multimedia Teleconferencing Cosortium
-2213,Kali
-2220,Ganymede
-2221,Rockwell CSP1
-2222,Rockwell CSP2
-2223,Rockwell CSP3
-2232,IVS Video default
-2233,INFOCRYPT
-2234,DirectPlay
-2235,Sercomm-WLink
-2236,Nani
-2237,Optech Port1 License Manager
-2238,AVIVA SNA SERVER
-2239,Image Query
-2240,RECIPe
-2241,IVS Daemon
-2242,Folio Remote Server
-2243,Magicom Protocol
-2244,NMS Server
-2245,HaO
-2279,xmquery
-2280,LNVPOLLER
-2281,LNVCONSOLE
-2282,LNVALARM
-2283,Dumaru.Y (Windows trojan) / LNVSTATUS
-2284,LNVMAPS
-2285,LNVMAILMON
-2286,NAS-Metering
-2287,DNA
-2288,NETML
-2294,Konshus License Manager (FLEX)
-2295,Advant License Manager
-2296,Theta License Manager (Rainbow)
-2297,D2K DataMover 1
-2298,D2K DataMover 2
-2299,PC Telecommute
-2300,CVMMON
-2301,Compaq HTTP
-2302,Bindery Support
-2303,Proxy Gateway
-2304,Attachmate UTS
-2305,MT ScaleServer
-2306,TAPPI BoxNet
-2307,pehelp
-2308,sdhelp
-2309,SD Server
-2310,SD Client
-2311,Message Service
-2313,IAPP (Inter Access Point Protocol)
-2314,CR WebSystems
-2315,Precise Sft.
-2316,SENT License Manager
-2317,Attachmate G32
-2318,Cadence Control
-2319,InfoLibria
-2320,Siebel NS
-2321,RDLAP over UDP
-2322,ofsd
-2323,3d-nfsd
-2324,Cosmocall
-2325,Design Space License Management
-2326,IDCP
-2327,xingcsm
-2328,Netrix SFTM
-2329,NVD
-2330,TSCCHAT
-2331,AGENTVIEW
-2332,RCC Host
-2333,SNAPP
-2334,ACE Client Auth
-2335,ACE Proxy
-2336,Apple UG Control
-2337,ideesrv
-2338,Norton Lambert
-2339,3Com WebView
-2340,WRS Registry
-2341,XIO Status
-2342,Seagate Manage Exec
-2343,nati logos
-2344,fcmsys
-2345,dbm
-2346,Game Connection Port
-2347,Game Announcement and Location
-2348,Information to query for game status
-2349,Diagnostics Port
-2350,psbserver
-2351,psrserver
-2352,pslserver
-2353,pspserver
-2354,psprserver
-2355,psdbserver
-2356,GXT License Managemant
-2357,UniHub Server
-2358,Futrix
-2359,FlukeServer
-2360,NexstorIndLtd
-2361,TL1
-2362,digiman
-2363,Media Central NFSD
-2364,OI-2000
-2365,dbref
-2366,qip-login
-2367,Service Control
-2368,OpenTable
-2369,ACS2000 DSP
-2370,L3-HBMon
-2381,Compaq HTTPS
-2382,Microsoft OLAP
-2383,Microsoft OLAP
-2384,SD-REQUEST
-2389,OpenView Session Mgr
-2390,RSMTP
-2391,3COM Net Management
-2392,Tactical Auth
-2393,MS OLAP 1
-2394,MS OLAP 2
-2395,LAN900 Remote
-2396,Wusage
-2397,NCL
-2398,Orbiter
-2399,FileMaker Inc. - Data Access Layer
-2400,OpEquus Server
-2401,cvspserver
-2402,TaskMaster 2000 Server
-2403,TaskMaster 2000 Web
-2404,IEC870-5-104
-2405,TRC Netpoll
-2406,JediServer
-2407,Orion
-2408,OptimaNet
-2409,SNS Protocol
-2410,VRTS Registry
-2411,Netwave AP Management
-2412,CDN
-2413,orion-rmi-reg
-2414,Interlingua
-2415,COMTEST
-2416,RMT Server
-2417,Composit Server
-2418,cas
-2419,Attachmate S2S
-2420,DSL Remote Management
-2421,G-Talk
-2422,CRMSBITS
-2423,RNRP
-2424,KOFAX-SVR
-2425,Fujitsu App Manager
-2426,Appliant TCP
-2427,Media Gateway Control Protocol Gateway
-2428,One Way Trip Time
-2429,FT-ROLE
-2430,venus
-2431,venus-se
-2432,codasrv
-2433,codasrv-se
-2434,pxc-epmap
-2435,OptiLogic
-2436,TOP/X
-2437,UniControl
-2438,MSP
-2439,SybaseDBSynch
-2440,Spearway Lockers
-2441,pvsw-inet
-2442,Netangel
-2443,PowerClient Central Storage Facility
-2444,BT PP2 Sectrans
-2445,DTN1
-2446,bues_service
-2447,OpenView NNM daemon
-2448,hpppsvr
-2449,RATL
-2450,netadmin
-2451,netchat
-2452,SnifferClient
-2453,madge-om
-2454,IndX-DDS
-2455,WAGO-IO-SYSTEM
-2456,altav-remmgt
-2457,Rapido_IP
-2458,griffin
-2459,Community
-2460,ms-theater
-2461,qadmifoper
-2462,qadmifevent
-2463,Symbios Raid
-2464,DirecPC SI
-2465,Load Balance Management
-2466,Load Balance Forwarding
-2467,High Criteria
-2468,qip_msgd
-2469,MTI-TCS-COMM
-2470,taskman port
-2471,SeaODBC
-2472,C3
-2473,Aker-cdp
-2474,Vital Analysis
-2475,ACE Server
-2476,ACE Server Propagation
-2477,SecurSight Certificate Valifation Service
-2478,SecurSight Authentication Server (SLL)
-2479,SecurSight Event Logging Server (SSL)
-2480,Lingwood's Detail
-2481,Oracle GIOP
-2482,Oracle GIOP SSL
-2483,Oracle TTC
-2484,Oracle TTC SSL
-2485,Net Objects1
-2486,Net Objects2
-2487,Policy Notice Service
-2488,Moy Corporation
-2489,TSILB
-2490,qip_qdhcp
-2491,Conclave CPP
-2492,GROOVE
-2493,Talarian MQS
-2494,BMC AR
-2495,Fast Remote Services
-2496,DIRGIS
-2497,Quad DB
-2498,ODN-CasTraq
-2499,UniControl
-2500,Resource Tracking system server
-2501,Resource Tracking system client
-2502,Kentrox Protocol
-2503,NMS-DPNSS
-2504,WLBS
-2505,torque-traffic
-2506,jbroker
-2507,spock
-2508,JDataStore
-2509,fjmpss
-2510,fjappmgrbulk
-2511,Metastorm
-2512,Citrix IMA
-2513,Citrix ADMIN
-2514,Facsys NTP
-2515,Facsys Router
-2516,Main Control
-2517,H.323 Annex E call signaling transport
-2518,Willy
-2519,globmsgsvc
-2520,pvsw
-2521,Adaptec Manager
-2522,WinDb
-2523,Qke LLC V.3
-2524,Optiwave License Management
-2525,MS V-Worlds
-2526,EMA License Manager
-2527,IQ Server
-2528,NCR CCL
-2529,UTS FTP
-2530,VR Commerce
-2531,ITO-E GUI
-2532,OVTOPMD
-2533,SnifferServer
-2534,Combox Web Access
-2535,W32.Beagle trojan / MADCAP
-2536,btpp2audctr1
-2537,Upgrade Protocol
-2538,vnwk-prapi
-2539,VSI Admin
-2540,LonWorks
-2541,LonWorks2
-2542,daVinci
-2543,REFTEK
-2544,Novell ZEN
-2545,sis-emt
-2546,vytalvaultbrtp
-2547,vytalvaultvsmp
-2548,vytalvaultpipe
-2549,IPASS
-2550,ADS
-2551,ISG UDA Server
-2552,Call Logging
-2553,efidiningport
-2554,VCnet-Link v10
-2555,Compaq WCP
-2556,W32.Beagle.N trojan / MADCAP / nicetec-nmsvc
-2557,nicetec-mgmt
-2558,PCLE Multi Media
-2559,LSTP
-2560,labrat
-2561,MosaixCC
-2562,Delibo
-2563,CTI Redwood
-2564,HP 3000 NS/VT block mode telnet
-2565,Coordinator Server
-2566,pcs-pcw
-2567,Cisco Line Protocol
-2568,SPAM TRAP
-2569,Sonus Call Signal
-2570,HS Port
-2571,CECSVC
-2572,IBP
-2573,Trust Establish
-2574,Blockade BPSP
-2575,HL7
-2576,TCL Pro Debugger
-2577,Scriptics Lsrvr
-2578,RVS ISDN DCP
-2579,mpfoncl
-2580,Tributary
-2581,ARGIS TE
-2582,ARGIS DS
-2583,MON / Wincrash2
-2584,cyaserv
-2585,NETX Server
-2586,NETX Agent
-2587,MASC
-2588,Privilege
-2589,quartus tcl
-2590,idotdist
-2591,Maytag Shuffle
-2592,netrek
-2593,MNS Mail Notice Service
-2594,Data Base Server
-2595,World Fusion 1
-2596,World Fusion 2
-2597,Homestead Glory
-2598,Citrix MA Client
-2599,Meridian Data
-2600,HPSTGMGR
-2601,discp client
-2602,discp server
-2603,Service Meter
-2604,NSC CCS
-2605,NSC POSA
-2606,Dell Netmon
-2607,Dell Connection
-2608,Wag Service
-2609,System Monitor
-2610,VersaTek
-2611,LIONHEAD
-2612,Qpasa Agent
-2613,SMNTUBootstrap
-2614,Never Offline
-2615,firepower
-2616,appswitch-emp
-2617,Clinical Context Managers
-2618,Priority E-Com
-2619,bruce
-2620,LPSRecommender
-2621,Miles Apart Jukebox Server
-2622,MetricaDBC
-2623,LMDP
-2624,Aria
-2625,Blwnkl Port
-2626,gbjd816
-2627,Moshe Beeri
-2628,DICT
-2629,Sitara Server
-2630,Sitara Management
-2631,Sitara Dir
-2632,IRdg Post
-2633,InterIntelli
-2634,PK Electronics
-2635,Back Burner
-2636,Solve
-2637,Import Document Service
-2638,Sybase Anywhere
-2639,AMInet
-2640,Sabbagh Associates Licence Manager
-2641,HDL Server
-2642,Tragic
-2643,GTE-SAMP
-2644,Travsoft IPX Tunnel
-2645,Novell IPX CMD
-2646,AND Licence Manager
-2647,SyncServer
-2648,Upsnotifyprot
-2649,VPSIPPORT
-2650,eristwoguns
-2651,EBInSite
-2652,InterPathPanel
-2653,Sonus
-2654,Corel VNC Admin
-2655,UNIX Nt Glue
-2656,Kana
-2657,SNS Dispatcher
-2658,SNS Admin
-2659,SNS Query
-2660,GC Monitor
-2661,OLHOST
-2662,BinTec-CAPI
-2663,BinTec-TAPI
-2664,Command MQ GM
-2665,Command MQ PM
-2666,extensis
-2667,Alarm Clock Server
-2668,Alarm Clock Client
-2669,TOAD
-2670,TVE Announce
-2671,newlixreg
-2672,nhserver
-2673,First Call 42
-2674,ewnn
-2675,TTC ETAP
-2676,SIMSLink
-2677,Gadget Gate 1 Way
-2678,Gadget Gate 2 Way
-2679,Sync Server SSL
-2680,pxc-sapxom
-2681,mpnjsomb
-2682,SRSP
-2683,NCDLoadBalance
-2684,mpnjsosv
-2685,mpnjsocl
-2686,mpnjsomg
-2687,pq-lic-mgmt
-2688,md-cf-HTTP
-2689,FastLynx
-2690,HP NNM Embedded Database
-2691,IT Internet
-2692,Admins LMS
-2693,belarc-HTTP
-2694,pwrsevent
-2695,VSPREAD
-2696,Unify Admin
-2697,Oce SNMP Trap Port
-2698,MCK-IVPIP
-2699,Csoft Plus Client
-2700,tqdata
-2701,SMS Remote Control (control)
-2702,SMS Remote Control (data)
-2703,SMS Remote Control (chat)
-2704,SMS Remote File Transfer
-2705,SDS Admin
-2706,NCD Mirroring
-2707,EMCSYMAPIPORT
-2708,Banyan-Net
-2709,Supermon
-2710,SSO Service
-2711,SSO Control
-2712,Axapta Object Communication Protocol
-2713,Raven1
-2714,Raven2
-2715,HPSTGMGR2
-2716,Inova IP Disco
-2717,PN REQUESTER
-2718,PN REQUESTER 2
-2719,Scan & Change
-2720,wkars
-2721,Smart Diagnose
-2722,Proactive Server
-2723,WatchDog NT
-2724,qotps
-2725,SQL Analysis Services / MSOLAP PTP2
-2726,TAMS
-2727,Media Gateway Control Protocol Call Agent
-2728,SQDR
-2729,TCIM Control
-2730,NEC RaidPlus
-2731,NetDragon Messanger
-2732,G5M
-2733,Signet CTF
-2734,CCS Software
-2735,Monitor Console
-2736,RADWIZ NMS SRV
-2737,SRP Feedback
-2738,NDL TCP-OSI Gateway
-2739,TN Timing
-2740,Alarm
-2741,TSB
-2742,TSB2
-2743,murx
-2744,honyaku
-2745,W32.Beagle.C trojan) / URBISNET
-2746,CPUDPENCAP
-2747,yk.fujitsu.co.jp
-2748,yk.fujitsu.co.jp
-2749,yk.fujitsu.co.jp
-2750,yk.fujitsu.co.jp
-2751,yk.fujitsu.co.jp
-2752,RSISYS ACCESS
-2753,de-spot
-2754,APOLLO CC
-2755,Express Pay
-2756,simplement-tie
-2757,CNRP
-2758,APOLLO Status
-2759,APOLLO GMS
-2760,Saba MS
-2761,DICOM ISCL
-2762,DICOM TLS
-2763,Desktop DNA
-2764,Data Insurance
-2765,qip-audup
-2766,Compaq SCP
-2767,UADTC
-2768,UACS
-2769,Single Point MVS
-2770,Veronica
-2771,Vergence CM
-2772,auris
-2773,PC Backup
-2774,PC Backup
-2775,SMMP
-2776,Ridgeway Systems & Software
-2777,Ridgeway Systems & Software
-2778,Gwen-Sonya
-2779,LBC Sync
-2780,LBC Control
-2781,whosells
-2782,everydayrc
-2783,AISES
-2784,world wide web - development
-2785,aic-np
-2786,aic-oncrpc - Destiny MCD database
-2787,piccolo - Cornerstone Software
-2788,NetWare Loadable Module - Seagate Software
-2789,Media Agent
-2790,PLG Proxy
-2791,MT Port Registrator
-2792,f5-globalsite
-2793,initlsmsad
-2794,aaftp
-2795,LiveStats
-2796,ac-tech
-2797,esp-encap
-2798,TMESIS-UPShot
-2799,ICON Discover
-2800,ACC RAID
-2801,IGCP
-2802,Veritas TCP1
-2803,btprjctrl
-2804,Telexis VTU
-2805,WTA WSP-S
-2806,cspuni
-2807,cspmulti
-2808,J-LAN-P
-2809,CORBA LOC
-2810,Active Net Steward
-2811,GSI FTP
-2812,atmtcp
-2813,llm-pass
-2814,llm-csv
-2815,LBC Measurement
-2816,LBC Watchdog
-2817,NMSig Port
-2818,rmlnk
-2819,FC Fault Notification
-2820,UniVision
-2821,vml_dms
-2822,ka0wuc
-2823,CQG Net/LAN
-2826,slc systemlog
-2827,slc ctrlrloops
-2828,ITM License Manager
-2829,silkp1
-2830,silkp2
-2831,silkp3
-2832,silkp4
-2833,glishd
-2834,EVTP
-2835,EVTP-DATA
-2836,catalyst
-2837,Repliweb
-2838,Starbot
-2839,NMSigPort
-2840,l3-exprt
-2841,l3-ranger
-2842,l3-hawk
-2843,PDnet
-2844,BPCP POLL
-2845,BPCP TRAP
-2846,AIMPP Hello
-2847,AIMPP Port Req
-2848,AMT-BLC-PORT
-2849,FXP
-2850,MetaConsole
-2851,webemshttp
-2852,bears-01
-2853,ISPipes
-2854,InfoMover
-2856,cesdinv
-2857,SimCtIP
-2858,ECNP
-2859,Active Memory
-2860,Dialpad Voice 1
-2861,Dialpad Voice 2
-2862,TTG Protocol
-2863,Sonar Data
-2864,main 5001 cmd
-2865,pit-vpn
-2866,lwlistener
-2867,esps-portal
-2868,NPEP Messaging
-2869,SSDP event notification / ICSLAP
-2870,daishi
-2871,MSI Select Play
-2872,CONTRACT
-2873,PASPAR2 ZoomIn
-2874,dxmessagebase1
-2875,dxmessagebase2
-2876,SPS Tunnel
-2877,BLUELANCE
-2878,AAP
-2879,ucentric-ds
-2880,synapse
-2881,NDSP
-2882,NDTP
-2883,NDNP
-2884,Flash Msg
-2885,TopFlow
-2886,RESPONSELOGIC
-2887,aironet
-2888,SPCSDLOBBY
-2889,RSOM
-2890,CSPCLMULTI
-2891,CINEGRFX-ELMD License Manager
-2892,SNIFFERDATA
-2893,VSECONNECTOR
-2894,ABACUS-REMOTE
-2895,NATUS LINK
-2896,ECOVISIONG6-1
-2897,Citrix RTMP
-2898,APPLIANCE-CFG
-2899,case.nm.fujitsu.co.jp
-2900,magisoft.com
-2901,ALLSTORCNS
-2902,NET ASPI
-2903,SUITCASE
-2904,M2UA
-2905,M3UA
-2906,CALLER9
-2907,WEBMETHODS B2B
-2908,mao
-2909,Funk Dialout
-2910,TDAccess
-2911,Blockade
-2912,Epicon
-2913,Booster Ware
-2914,Game Lobby
-2915,TK Socket
-2916,Elvin Server
-2917,Elvin Client
-2918,Kasten Chase Pad
-2919,ROBOER
-2920,ROBOEDA
-2921,CESD Contents Delivery Management
-2922,CESD Contents Delivery Data Transfer
-2923,WTA-WSP-WTP-S
-2924,PRECISE-VIP
-2925,Firewall Redundancy Protocol
-2926,MOBILE-FILE-DL
-2927,UNIMOBILECTRL
-2928,REDSTONE-CPSS
-2929,PANJA-WEBADMIN
-2930,PANJA-WEBLINX
-2931,Circle-X
-2932,INCP
-2933,4-TIER OPM GW
-2934,4-TIER OPM CLI
-2935,QTP
-2936,OTPatch
-2937,PNACONSULT-LM
-2938,SM-PAS-1
-2939,SM-PAS-2
-2940,SM-PAS-3
-2941,SM-PAS-4
-2942,SM-PAS-5
-2943,TTNRepository
-2944,Megaco H-248
-2945,H248 Binary
-2946,FJSVmpor
-2947,GPSD
-2948,WAP PUSH
-2949,WAP PUSH SECURE
-2950,ESIP
-2951,OTTP
-2952,MPFWSAS
-2953,OVALARMSRV
-2954,OVALARMSRV-CMD
-2955,CSNOTIFY
-2956,OVRIMOSDBMAN
-2957,JAMCT5
-2958,JAMCT6
-2959,RMOPAGT
-2960,DFOXSERVER
-2961,BOLDSOFT-LM
-2962,IPH-POLICY-CLI
-2963,IPH-POLICY-ADM
-2964,BULLANT SRAP
-2965,BULLANT RAP
-2966,IDP-INFOTRIEVE
-2967,SSC-AGENT
-2968,ENPP
-2969,UPnP / ESSP
-2970,INDEX-NET
-2971,Net Clip
-2972,PMSM Webrctl
-2973,SV Networks
-2974,Signal
-2975,Fujitsu Configuration Management Service
-2976,CNS Server Port
-2977,TTCs Enterprise Test Access Protocol - NS
-2978,TTCs Enterprise Test Access Protocol - DS
-2979,H.263 Video Streaming
-2980,Instant Messaging Service
-2981,MYLXAMPORT
-2982,IWB-WHITEBOARD
-2983,NETPLAN
-2984,HPIDSADMIN
-2985,HPIDSAGENT
-2986,STONEFALLS
-2987,IDENTIFY
-2988,CLASSIFY
-2989,ZARKOV
-2990,BOSCAP
-2991,WKSTN-MON
-2992,ITB301
-2993,VERITAS VIS1
-2994,VERITAS VIS2
-2995,IDRS
-2996,vsixml
-2997,REBOL
-2998,Real Secure
-2999,RemoteWare Unassigned
-3000,RemoteWare Client
-3001,Phatbot Worm / Redwood Broker
-3002,RemoteWare Server
-3003,CGMS
-3004,Csoft Agent
-3005,Genius License Manager
-3006,Instant Internet Admin
-3007,Lotus Mail Tracking Agent Protocol
-3008,Midnight Technologies
-3009,PXC-NTFY
-3010,Telerate Workstation
-3011,Trusted Web
-3012,Trusted Web Client
-3013,Gilat Sky Surfer
-3014,Broker Service
-3015,NATI DSTP
-3016,Notify Server
-3017,Event Listener
-3018,Service Registry
-3019,Resource Manager
-3020,CIFS
-3021,AGRI Server
-3022,CSREGAGENT
-3023,magicnotes
-3024,NDS_SSO
-3025,Arepa Raft
-3026,AGRI Gateway
-3027,LiebDevMgmt_C
-3028,LiebDevMgmt_DM
-3029,LiebDevMgmt_A
-3030,Arepa Cas
-3031,AgentVU
-3032,Redwood Chat
-3033,PDB
-3034,Osmosis AEEA
-3035,FJSV gssagt
-3036,Hagel DUMP
-3037,HP SAN Mgmt
-3038,Santak UPS
-3039,Cogitate Inc.
-3040,Tomato Springs
-3041,di-traceware
-3042,journee
-3043,BRP
-3045,ResponseNet
-3046,di-ase
-3047,Fast Security HL Server
-3048,Sierra Net PC Trader
-3049,NSWS
-3050,gds_db
-3051,Galaxy Server
-3052,APCPCNS
-3053,dsom-server
-3054,AMT CNF PROT
-3055,Policy Server
-3056,CDL Server
-3057,GoAhead FldUp
-3058,videobeans
-3059,qsoft
-3060,interserver
-3061,cautcpd
-3062,ncacn-ip-tcp
-3063,ncadg-ip-udp
-3065,slinterbase
-3066,NETATTACHSDMP
-3067,W32.Korgo Worm / FJHPJP
-3068,ls3 Broadcast
-3069,ls3
-3070,MGXSWITCH
-3075,Orbix 2000 Locator
-3076,Orbix 2000 Config
-3077,Orbix 2000 Locator SSL
-3078,Orbix 2000 Locator SSL
-3079,LV Front Panel
-3080,stm_pproc
-3081,TL1-LV
-3082,TL1-RAW
-3083,TL1-TELNET
-3084,ITM-MCCS
-3085,PCIHReq
-3086,JDL-DBKitchen
-3105,Cardbox
-3106,Cardbox HTTP
-3127,W32.Mydoom.A virus
-3128,Squid HTTP Proxy / W32.Mydoom.B virus
-3129,Master's Paradise (Windows Trojan)
-3130,ICPv2
-3131,Net Book Mark
-3141,VMODEM
-3142,RDC WH EOS
-3143,Sea View
-3144,Tarantella
-3145,CSI-LFAP
-3147,RFIO
-3148,NetMike Game Administrator
-3149,NetMike Game Server
-3150,NetMike Assessor Administrator
-3151,NetMike Assessor
-3180,Millicent Broker Server
-3181,BMC Patrol Agent
-3182,BMC Patrol Rendezvous
-3262,NECP
-3264,cc:mail/lotus
-3265,Altav Tunnel
-3266,NS CFG Server
-3267,IBM Dial Out
-3268,Microsoft Global Catalog
-3269,Microsoft Global Catalog with LDAP/SSL
-3270,Verismart
-3271,CSoft Prev Port
-3272,Fujitsu User Manager
-3273,Simple Extensible Multiplexed Protocol
-3274,Ordinox Server
-3275,SAMD
-3276,Maxim ASICs
-3277,AWG Proxy
-3278,LKCM Server
-3279,admind
-3280,VS Server
-3281,SYSOPT
-3282,Datusorb
-3283,Net Assistant
-3284,4Talk
-3285,Plato
-3286,E-Net
-3287,DIRECTVDATA
-3288,COPS
-3289,ENPC
-3290,CAPS LOGISTICS TOOLKIT - LM
-3291,S A Holditch & Associates - LM
-3292,Cart O Rama
-3293,fg-fps
-3294,fg-gip
-3295,Dynamic IP Lookup
-3296,Rib License Manager
-3297,Cytel License Manager
-3298,Transview
-3299,pdrncs
-3300,bmc-patrol-agent
-3301,Unathorised use by SAP R/3
-3302,MCS Fastmail
-3303,OP Session Client
-3304,OP Session Server
-3305,ODETTE-FTP
-3306,MySQL
-3307,OP Session Proxy
-3308,TNS Server
-3309,TNS ADV
-3310,Dyna Access
-3311,MCNS Tel Ret
-3312,Application Management Server
-3313,Unify Object Broker
-3314,Unify Object Host
-3315,CDID
-3316,AICC/CMI
-3317,VSAI PORT
-3318,Swith to Swith Routing Information Protocol
-3319,SDT License Manager
-3320,Office Link 2000
-3321,VNSSTR
-3325,isi.edu
-3326,SFTU
-3327,BBARS
-3328,Eaglepoint License Manager
-3329,HP Device Disc
-3330,MCS Calypso ICF
-3331,MCS Messaging
-3332,MCS Mail Server
-3333,DEC Notes
-3334,Direct TV Webcasting
-3335,Direct TV Software Updates
-3336,Direct TV Tickers
-3337,Direct TV Data Catalog
-3338,OMF data b
-3339,OMF data l
-3340,OMF data m
-3341,OMF data h
-3342,WebTIE
-3343,MS Cluster Net
-3344,BNT Manager
-3345,Influence
-3346,Trnsprnt Proxy
-3347,Phoenix RPC
-3348,Pangolin Laser
-3349,Chevin Services
-3350,FINDVIATV
-3351,BTRIEVE
-3352,SSQL
-3353,FATPIPE
-3354,SUITJD
-3355,Hogle (proxy backdoor) / Ordinox Dbase
-3356,UPNOTIFYPS
-3357,Adtech Test IP
-3358,Mp Sys Rmsvr
-3359,WG NetForce
-3360,KV Server
-3361,KV Agent
-3362,DJ ILM
-3363,NATI Vi Server
-3364,Creative Server
-3365,Content Server
-3366,Creative Partner
-3371,ccm.jf.intel.com
-3372,Microsoft Distributed Transaction Coordinator (MSDTC) / TIP 2
-3373,Lavenir License Manager
-3374,Cluster Disc
-3375,VSNM Agent
-3376,CD Broker
-3377,Cogsys Network License Manager
-3378,WSICOPY
-3379,SOCORFS
-3380,SNS Channels
-3381,Geneous
-3382,Fujitsu Network Enhanced Antitheft function
-3383,Enterprise Software Products License Manager
-3384,Cluster Management Services
-3385,qnxnetman
-3386,GPRS Data
-3387,Back Room Net
-3388,CB Server
-3389,MS Terminal Server
-3390,Distributed Service Coordinator
-3391,SAVANT
-3392,EFI License Management
-3393,D2K Tapestry Client to Server
-3394,D2K Tapestry Server to Server
-3395,Dyna License Manager (Elam)
-3396,Printer Agent
-3397,Cloanto License Manager
-3398,Mercantile
-3399,CSMS
-3400,CSMS2
-3401,filecast
-3410,Backdoor.OptixPro.13
-3421,Bull Apprise portmapper
-3454,Apple Remote Access Protocol
-3455,RSVP Port
-3456,VAT default data
-3457,VAT default control
-3458,D3WinOsfi
-3459,TIP Integral
-3460,EDM Manger
-3461,EDM Stager
-3462,EDM STD Notify
-3463,EDM ADM Notify
-3464,EDM MGR Sync
-3465,EDM MGR Cntrl
-3466,WORKFLOW
-3467,RCST
-3468,TTCM Remote Controll
-3469,Pluribus
-3470,jt400
-3471,jt400-ssl
-3535,MS-LA
-3563,Watcom Debug
-3572,harlequin.co.uk
-3672,harlequinorb
-3689,Apple Digital Audio Access Protocol
-3802,VHD
-3845,V-ONE Single Port Proxy
-3862,GIGA-POCKET
-3875,PNBSCADA
-3900,Unidata UDT OS
-3984,MAPPER network node manager
-3985,MAPPER TCP/IP server
-3986,MAPPER workstation server
-3987,Centerline
-4000,Terabase
-4001,Cisco mgmt / NewOak
-4002,pxc-spvr-ft
-4003,pxc-splr-ft
-4004,pxc-roid
-4005,pxc-pin
-4006,pxc-spvr
-4007,pxc-splr
-4008,NetCheque accounting
-4009,Chimera HWM
-4010,Samsung Unidex
-4011,Alternate Service Boot
-4012,PDA Gate
-4013,ACL Manager
-4014,TAICLOCK
-4015,Talarian Mcast
-4016,Talarian Mcast
-4017,Talarian Mcast
-4018,Talarian Mcast
-4019,Talarian Mcast
-4045,nfs-lockd
-4096,BRE (Bridge Relay Element)
-4097,Patrol View
-4098,drmsfsd
-4099,DPCP
-4132,NUTS Daemon
-4133,NUTS Bootp Server
-4134,NIFTY-Serve HMI protocol
-4141,Workflow Server
-4142,Document Server
-4143,Document Replication
-4144,Compuserve pc windows
-4160,Jini Discovery
-4199,EIMS ADMIN
-4299,earth.path.net
-4300,Corel CCam
-4321,Remote Who Is
-4333,mini-sql server
-4343,UNICALL
-4344,VinaInstall
-4345,Macro 4 Network AS
-4346,ELAN LM
-4347,LAN Surveyor
-4348,ITOSE
-4349,File System Port Map
-4350,Net Device
-4351,PLCY Net Services
-4353,F5 iQuery
-4397,Phatbot Worm
-4442,Saris
-4443,Pharos
-4444,AdSubtract / NV Video default
-4445,UPNOTIFYP
-4446,N1-FWP
-4447,N1-RMGMT
-4448,ASC Licence Manager
-4449,PrivateWire
-4450,Camp
-4451,CTI System Msg
-4452,CTI Program Load
-4453,NSS Alert Manager
-4454,NSS Agent Manager
-4455,PR Chat User
-4456,PR Chat Server
-4457,PR Register
-4500,sae-urn
-4501,urn-x-cdchoice
-4545,WorldScores
-4546,SF License Manager (Sentinel)
-4547,Lanner License Manager
-4557,FAX transmission service
-4559,HylaFAX client-service protocol
-4567,TRAM
-4568,BMC Reporting
-4600,Piranha1
-4601,Piranha2
-4661,eDonkey2k
-4662,eDonkey2k
-4663,eDonkey
-4665,eDonkey2k
-4672,remote file access server
-4675,eMule
-4711,eMule
-4751,W32.Beagle.V trojan
-4772,eMule
-4800,Icona Instant Messenging System
-4801,Icona Web Embedded Chat
-4802,Icona License System Server
-4820,Backdoor.Tuxter
-4827,HTCP
-4837,Varadero-0
-4838,Varadero-1
-4868,Photon Relay
-4869,Photon Relay Debug
-4885,ABBS
-4899,RAdmin Win32 remote control
-4983,AT&T Intercom
-5000,UPnP / filmaker.com / Socket de Troie (Windows Trojan)
-5001,filmaker.com / Socket de Troie (Windows Trojan)
-5002,radio free ethernet
-5003,FileMaker Inc. - Proprietary transport
-5004,avt-profile-1
-5005,avt-profile-2
-5006,wsm server
-5007,wsm server ssl
-5010,TelepathStart
-5011,TelepathAttack
-5020,zenginkyo-1
-5021,zenginkyo-2
-5042,asnaacceler8db
-5050,Yahoo Messenger / multimedia conference control tool
-5051,ITA Agent
-5052,ITA Manager
-5055,UNOT
-5060,SIP
-5069,I/Net 2000-NPR
-5071,PowerSchool
-5093,Sentinel LM
-5099,SentLM Srv2Srv
-5101,Yahoo! Messenger
-5145,RMONITOR SECURE
-5150,Ascend Tunnel Management Protocol
-5151,ESRI SDE Instance
-5152,ESRI SDE Instance Discovery
-5165,ife_1corp
-5190,America-Online
-5191,AmericaOnline1
-5192,AmericaOnline2
-5193,AmericaOnline3
-5200,Targus AIB 1
-5201,Targus AIB 2
-5202,Targus TNTS 1
-5203,Targus TNTS 2
-5222,Jabber Server
-5232,SGI Distribution Graphics
-5236,padl2sim
-5272,PK
-5300,HA cluster heartbeat
-5301,HA cluster general services
-5302,HA cluster configuration
-5303,HA cluster probing
-5304,HA Cluster Commands
-5305,HA Cluster Test
-5306,Sun MC Group
-5307,SCO AIP
-5308,CFengine
-5309,J Printer
-5310,Outlaws
-5311,TM Login
-5373,W32.Gluber.B@mm
-5400,Excerpt Search / Blade Runner (Windows Trojan)
-5401,Excerpt Search Secure / Blade Runner (Windows Trojan)
-5402,MFTP / Blade Runner (Windows Trojan)
-5403,HPOMS-CI-LSTN
-5404,HPOMS-DPS-LSTN
-5405,NetSupport
-5406,Systemics Sox
-5407,Foresyte-Clear
-5408,Foresyte-Sec
-5409,Salient Data Server
-5410,Salient User Manager
-5411,ActNet
-5412,Continuus
-5413,WWIOTALK
-5414,StatusD
-5415,NS Server
-5416,SNS Gateway
-5417,SNS Agent
-5418,MCNTP
-5419,DJ-ICE
-5420,Cylink-C
-5421,Net Support 2
-5422,Salient MUX
-5423,VIRTUALUSER
-5426,DEVBASIC
-5427,SCO-PEER-TTA
-5428,TELACONSOLE
-5429,Billing and Accounting System Exchange
-5430,RADEC CORP
-5431,PARK AGENT
-5432,postgres database server
-5435,Data Tunneling Transceiver Linking (DTTL)
-5454,apc-tcp-udp-4
-5455,apc-tcp-udp-5
-5456,apc-tcp-udp-6
-5461,SILKMETER
-5462,TTL Publisher
-5465,NETOPS-BROKER
-5490,Squid HTTP Proxy
-5500,fcp-addr-srvr1
-5501,fcp-addr-srvr2
-5502,fcp-srvr-inst1
-5503,fcp-srvr-inst2
-5504,fcp-cics-gw1
-5510,ACE/Server Services
-5520,ACE/Server Services
-5530,ACE/Server Services
-5540,ACE/Server Services
-5550,ACE/Server Services / Xtcp 2.0x
-5554,Sasser Worm FTP backdoor / SGI ESP HTTP
-5555,Personal Agent / W32.Mimail.P@mm
-5556,Mtbd (mtb backup)
-5559,Enterprise Security Remote Install axent.com
-5599,Enterprise Security Remote Install
-5600,Enterprise Security Manager
-5601,Enterprise Security Agent
-5602,A1-MSC
-5603,A1-BS
-5604,A3-SDUNode
-5605,A4-SDUNode
-5631,pcANYWHEREdata
-5632,pcANYWHEREstat
-5678,LinkSys EtherFast Router Remote Administration / Remote Replication Agent Connection
-5679,Direct Cable Connect Manager
-5680,Canna (Japanese Input)
-5713,proshare conf audio
-5714,proshare conf video
-5715,proshare conf data
-5716,proshare conf request
-5717,proshare conf notify
-5729,Openmail User Agent Layer
-5741,IDA Discover Port 1
-5742,IDA Discover Port 2 / Wincrash (Windows Trojan)
-5745,fcopy-server
-5746,fcopys-server
-5755,OpenMail Desk Gateway server
-5757,OpenMail X.500 Directory Server
-5766,OpenMail NewMail Server
-5767,OpenMail Suer Agent Layer (Secure)
-5768,OpenMail CMTS Server
-5771,NetAgent
-5800,VNC Virtual Network Computing
-5801,VNC Virtual Network Computing
-5813,ICMPD
-5859,WHEREHOO
-5882,Y3k
-5900,VNC Virtual Network Computing
-5901,VNC Virtual Network Computing
-5968,mppolicy-v5
-5969,mppolicy-mgr
-5977,NCD preferences TCP port
-5978,NCD diagnostic TCP port
-5979,NCD configuration TCP port
-5980,VNC Virtual Network Computing
-5981,VNC Virtual Network Computing
-5987,Solaris Web Enterprise Management RMI
-5997,NCD preferences telnet port
-5998,NCD diagnostic telnet port
-5999,CVSup
-6000,X-Windows / W32.LoveGate.ak virus
-6001,Cisco mgmt
-6003,Half-Life WON server
-6063,X Windows System mit.edu
-6064,NDL-AHP-SVC
-6065,WinPharaoh
-6066,EWCTSP
-6067,SRB
-6068,GSMP
-6069,TRIP
-6070,Messageasap
-6071,SSDTP
-6072,DIAGNOSE-PROC
-6073,DirectPlay8
-6100,SynchroNet-db
-6101,SynchroNet-rtc
-6102,SynchroNet-upd
-6103,RETS
-6104,DBDB
-6105,Prima Server
-6106,MPS Server
-6107,ETC Control
-6108,Sercomm-SCAdmin
-6109,GLOBECAST-ID
-6110,HP SoftBench CM
-6111,HP SoftBench Sub-Process Control
-6112,dtspcd / Blizzard Battlenet
-6123,Backup Express
-6129,DameWare
-6141,Meta Corporation License Manager
-6142,Aspen Technology License Manager
-6143,Watershed License Manager
-6144,StatSci License Manager - 1
-6145,StatSci License Manager - 2
-6146,Lone Wolf Systems License Manager
-6147,Montage License Manager
-6148,Ricardo North America License Manager
-6149,tal-pod
-6253,CRIP
-6321,Empress Software Connectivity Server 1
-6322,Empress Software Connectivity Server 2
-6346,Gnutella/Bearshare file sharing Application
-6348,Limewire P2P
-6389,clariion-evr01
-6400,saegatesoftware.com
-6401,saegatesoftware.com
-6402,saegatesoftware.com
-6403,saegatesoftware.com
-6404,saegatesoftware.com
-6405,saegatesoftware.com
-6406,saegatesoftware.com
-6407,saegatesoftware.com
-6408,saegatesoftware.com
-6409,saegatesoftware.com
-6410,saegatesoftware.com
-6455,SKIP Certificate Receive
-6456,SKIP Certificate Send
-6471,LVision License Manager
-6500,BoKS Master
-6501,BoKS Servc
-6502,BoKS Servm
-6503,BoKS Clntd
-6505,BoKS Admin Private Port
-6506,BoKS Admin Public Port
-6507,BoKS Dir Server Private Port
-6508,BoKS Dir Server Public Port
-6547,apc-tcp-udp-1
-6548,apc-tcp-udp-2
-6549,apc-tcp-udp-3
-6550,fg-sysupdate
-6558,xdsxdm
-6588,AnalogX Web Proxy
-6665,Internet Relay Chat
-6666,IRC / Windows Media Unicast Service
-6667,IRC
-6668,IRC
-6669,IRC
-6670,Vocaltec Global Online Directory / Deep Throat 2 (Windows Trojan)
-6672,vision_server
-6673,vision_elmd
-6699,Napster
-6700,Napster / Carracho (server)
-6701,KTI/ICAD Nameserver
-6701,Napster / Carracho (server)
-6711,SubSeven (Windows Trojan)
-6723,DDOS communication TCP
-6767,BMC PERFORM AGENT
-6768,BMC PERFORM MGRD
-6776,SubSeven/BackDoor-G (Windows Trojan)
-6777,W32.Beagle.A trojan
-6789,IBM DB2
-6790,HNMP / IBM DB2
-6831,ambit-lm
-6841,Netmo Default
-6842,Netmo HTTP
-6850,ICCRUSHMORE
-6881,BitTorrent Network
-6888,MUSE
-6891,MS Messenger file transfer
-6901,MS Messenger voice calls
-6961,JMACT3
-6962,jmevt2
-6963,swismgr1
-6964,swismgr2
-6965,swistrap
-6966,swispol
-6969,acmsoda
-6998,IATP-highPri
-6999,IATP-normalPri
-7000,IRC / file server itself
-7001,WebLogic Server / Callbacks to cache managers
-7002,WebLogic Server (SSL) / Half-Life Auth Server / Users & groups database
-7003,volume location database
-7004,AFS/Kerberos authentication service
-7005,volume managment server
-7006,error interpretation service
-7007,Windows Media Services / basic overseer process
-7008,server-to-server updater
-7009,remote cache manager service
-7010,onlinet uninterruptable power supplies
-7011,Talon Discovery Port
-7012,Talon Engine
-7013,Microtalon Discovery
-7014,Microtalon Communications
-7015,Talon Webserver
-7020,DP Serve
-7021,DP Serve Admin
-7070,ARCP
-7099,lazy-ptop
-7100,X Font Service
-7121,Virtual Prototypes License Manager
-7141,vnet.ibm.com
-7161,Catalyst
-7174,Clutild
-7200,FODMS FLIP
-7201,DLIP
-7323,3.11 Remote Administration
-7326,Internet Citizen's Band
-7390,The Swiss Exchange swx.ch
-7395,winqedit
-7426,OpenView DM Postmaster Manager
-7427,OpenView DM Event Agent Manager
-7428,OpenView DM Log Agent Manager
-7429,OpenView DM rqt communication
-7430,OpenView DM xmpv7 api pipe
-7431,OpenView DM ovc/xmpv3 api pipe
-7437,Faximum
-7491,telops-lmd
-7511,pafec-lm
-7544,FlowAnalyzer DisplayServer
-7545,FlowAnalyzer UtilityServer
-7566,VSI Omega
-7570,Aries Kfinder
-7588,Sun License Manager
-7597,TROJAN WORM
-7633,PMDF Management
-7640,CUSeeMe
-7777,Oracle App server / cbt
-7778,Windows Media Services / Interwise
-7781,accu-lmgr
-7786,MINIVEND
-7932,Tier 2 Data Resource Manager
-7933,Tier 2 Business Rules Manager
-7967,Supercell
-7979,Micromuse-ncps
-7980,Quest Vista
-7999,iRDMI2
-8000,HTTP/iRDMI
-8001,HTTP/VCOM Tunnel
-8002,HTTP/Teradata ORDBMS
-8007,Apache JServ Protocol
-8008,HTTP Alternate
-8009,Apache JServ Protocol
-8010,Wingate HTTP Proxy
-8032,ProEd
-8033,MindPrint
-8080,HTTP / HTTP Proxy
-8081,HTTP / HTTP Proxy
-8082,BlackICE Capture
-8129,Snapstream PVS Server
-8130,INDIGO-VRMI
-8131,INDIGO-VBCP
-8160,Patrol
-8161,Patrol SNMP
-8181,IPSwitch IMail / Monitor
-8200,TRIVNET
-8201,TRIVNET
-8204,LM Perfworks
-8205,LM Instmgr
-8206,LM Dta
-8207,LM SServer
-8208,LM Webwatcher
-8351,Server Find
-8376,Cruise ENUM
-8377,Cruise SWROUTE
-8378,Cruise CONFIG
-8379,Cruise DIAGS
-8380,Cruise UPDATE
-8383,Web Email
-8400,cvd
-8401,sabarsd
-8402,abarsd
-8403,admind
-8431,Micro PC-Cilin
-8450,npmp
-8473,Virtual Point to Point
-8484,Ipswitch IMail
-8554,RTSP Alternate (see port 554)
-8733,iBus
-8763,MC-APPSERVER
-8764,OPENQUEUE
-8765,Ultraseek HTTP
-8804,truecm
-8866,W32.Beagle.B trojan
-8880,CDDBP
-8888,NewsEDGE server TCP / AnswerBook2
-8889,Desktop Data TCP 1
-8890,Desktop Data TCP 2
-8891,Desktop Data TCP 3: NESS application
-8892,Desktop Data TCP 4: FARM product
-8893,Desktop Data TCP 5: NewsEDGE/Web application
-8894,Desktop Data TCP 6: COAL application
-8900,JMB-CDS 1
-8901,JMB-CDS 2
-8967,Win32/Dabber (Windows worm)
-8999,Firewall
-9000,CSlistener
-9001,cisco-xremote
-9090,WebSM
-9100,HP JetDirect
-9160,NetLOCK1
-9161,NetLOCK2
-9162,NetLOCK3
-9163,NetLOCK4
-9164,NetLOCK5
-9200,WAP connectionless session service
-9201,WAP session service
-9202,WAP secure connectionless session service
-9203,WAP secure session service
-9204,WAP vCard
-9205,WAP vCal
-9206,WAP vCard Secure
-9207,WAP vCal Secure
-9273,BackGate (Windows rootkit)
-9274,BackGate (Windows rootkit)
-9275,BackGate (Windows rootkit)
-9276,BackGate (Windows rootkit)
-9277,BackGate (Windows rootkit)
-9278,BackGate (Windows rootkit)
-9280,HP JetDirect Embedded Web Server
-9290,HP JetDirect
-9291,HP JetDirect
-9292,HP JetDirect
-9321,guibase
-9343,MpIdcMgr
-9344,Mphlpdmc
-9374,fjdmimgr
-9396,fjinvmgr
-9397,MpIdcAgt
-9400,InCommand
-9500,ismserver
-9535,Remote man server
-9537,Remote man server, testing
-9594,Message System
-9595,Ping Discovery Service
-9600,MICROMUSE-NCPW
-9753,rasadv
-9876,Session Director
-9888,CYBORG Systems
-9898,MonkeyCom / Win32/Dabber (Windows worm)
-9899,SCTP TUNNELING
-9900,IUA
-9909,domaintime
-9950,APCPCPLUSWIN1
-9951,APCPCPLUSWIN2
-9952,APCPCPLUSWIN3
-9992,Palace
-9993,Palace
-9994,Palace
-9995,Palace
-9996,Sasser Worm shell / Palace
-9997,Palace
-9998,Distinct32
-9999,distinct / Win32/Dabber (Windows worm)
-10000,Webmin / Network Data Management Protocol/ Dumaru.Y (Windows trojan)
-10001,queue
-10002,poker
-10003,gateway
-10004,remp
-10005,Secure telnet
-10007,MVS Capacity
-10012,qmaster
-10080,Amanda / MyDoom.B (Windows trojan)
-10082,Amanda Indexing
-10083,Amanda Tape Indexing
-10113,NetIQ Endpoint
-10114,NetIQ Qcheck
-10115,Ganymede Endpoint
-10128,BMC-PERFORM-SERVICE DAEMON
-10202,Computer Associate License Manager
-10203,Computer Associate License Manager
-10204,Computer Associate License Manager
-10288,Blocks
-10520,Acid Shivers (Windows Trojan)
-11000,IRISA
-11001,Metasys
-11111,Viral Computing Environment (VCE)
-11117,W32.Beagle.L trojan / URBISNET
-11367,ATM UHAS
-11523,AOL / AdSubtract AOL Proxy
-11720,h323 Call Signal Alternate
-11722,RK Test
-12000,IBM Enterprise Extender SNA XID Exchange
-12001,IBM Enterprise Extender SNA COS Network Priority
-12002,IBM Enterprise Extender SNA COS High Priority
-12003,IBM Enterprise Extender SNA COS Medium Priority
-12004,IBM Enterprise Extender SNA COS Low Priority
-12172,HiveP
-12345,Netbus (Windows Trojan)
-12346,NetBus (Windows Trojan)
-12348,BioNet (Windows Trojan)
-12349,BioNet (Windows Trojan)
-12361,Whack-a-mole (Windows Trojan)
-12362,Whack-a-mole (Windows Trojan)
-12753,tsaf port
-12754,DDOS communication TCP
-13160,I-ZIPQD
-13223,PowWow Client
-13224,PowWow Server
-13326,game
-13720,BPRD Protocol (VERITAS NetBackup)
-13721,BPBRM Protocol (VERITAS NetBackup)
-13722,BP Java MSVC Protocol
-13782,VERITAS NetBackup
-13783,VOPIED Protnocol
-13818,DSMCC Config
-13819,DSMCC Session Messages
-13820,DSMCC Pass-Thru Messages
-13821,DSMCC Download Protocol
-13822,DSMCC Channel Change Protocol
-14001,ITU SCCP (SS7)
-14237,Palm Network Hotsync
-14247,Mitglieder.H trojan
-15104,DDOS communication TCP
-16360,netserialext1
-16361,netserialext2
-16367,netserialext3
-16368,netserialext4
-16660,Stacheldraht distributed attack tool client
-16959,Subseven DEFCON8 2.1 backdoor remote access tool
-16991,INTEL-RCI-MP
-17007,isode-dua
-17219,Chipper
-17300,Kuang2 (Windows trojan)
-17569,Infector
-17990,Worldspan gateway
-18000,Beckman Instruments Inc.
-18181,OPSEC CVP
-18182,OPSEC UFP
-18183,OPSEC SAM
-18184,OPSEC LEA
-18185,OPSEC OMI
-18187,OPSEC ELA
-18463,AC Cluster
-18753,Shaft distributed attack tool handler agent
-18888,APCNECMP
-19216,BackGate (Windows rootkit)
-19283,Key Server for SASSAFRAS
-19315,Key Shadow for SASSAFRAS
-19410,hp-sco
-19411,hp-sca
-19412,HP-SESSMON
-19541,JCP Client
-20000,DNP
-20005,xcept4 (German Telekom's CEPT videotext service)
-20031,BakBone NetVault
-20034,NetBus 2 Pro (Windows Trojan)
-20432,Shaft distributed attack client
-20670,Track
-20742,Mitglieder.E trojan
-20999,At Hand MMP
-21554,Girlfriend (Windows Trojan)
-21590,VoFR Gateway
-21845,webphone
-21846,NetSpeak Corp. Directory Services
-21847,NetSpeak Corp. Connection Services
-21848,NetSpeak Corp. Automatic Call Distribution
-21849,NetSpeak Corp. Credit Processing System
-22000,SNAPenetIO
-22001,OptoControl
-22156,Phatbot Worm
-22273,wnn6
-22289,Wnn6 (Chinese Input)
-22305,Wnn6 (Korean Input)
-22321,Wnn6 (Taiwanese Input)
-22555,Vocaltec Web Conference
-22800,Telerate Information Platform LAN
-22951,Telerate Information Platform WAN
-23005,W32.HLLW.Nettrash
-23006,W32.HLLW.Nettrash
-23432,Asylum
-23476,Donald Dick
-23477,Donald Dick
-23485,Shareasa file sharing
-24000,med-ltp
-24001,med-fsp-rx
-24002,med-fsp-tx
-24003,med-supp
-24004,med-ovw
-24005,med-ci
-24006,med-net-svc
-24386,Intel RCI
-24554,BINKP
-25000,icl-twobase1
-25001,icl-twobase2
-25002,icl-twobase3
-25003,icl-twobase4
-25004,icl-twobase5
-25005,icl-twobase6
-25006,icl-twobase7
-25007,icl-twobase8
-25008,icl-twobase9
-25009,icl-twobase10
-25555,Mitglieder.D trojan
-25793,Vocaltec Address Server
-25867,WebCam32 Admin
-26000,quake
-26208,wnn6-ds
-26274,Delta Source (Windows Trojan)
-27347,SubSeven / Linux.Ramen.Worm (RedHat Linux)
-27374,SubSeven / Linux.Ramen.Worm (RedHat Linux)
-27665,Trinoo distributed attack tool Master server control port
-27999,TW Authentication/Key Distribution and
-30100,Netsphere (Windows Trojan)
-30101,Netsphere (Windows Trojan)
-30102,Netsphere (Windows Trojan)
-30999,Kuang
-31337,BO2K
-31785,Hack-A-Tack (Windows Trojan)
-31787,Hack-A-Tack (Windows Trojan)
-31788,Hack-A-Tack (Windows Trojan)
-31789,Hack-A-Tack (Windows Trojan)
-31791,Hack-A-Tack (Windows Trojan)
-32000,XtraMail v1.11
-32768,Filenet TMS
-32769,Filenet RPC
-32770,Filenet NCH
-32771,Solaris RPC
-32772,Solaris RPC
-32773,Solaris RPC
-32774,Solaris RPC
-32775,Solaris RPC
-32776,Solaris RPC
-32777,Solaris RPC
-32780,RPC
-33434,traceroute use
-34324,Big Gluck (Windows Trojan)
-36865,KastenX Pipe
-40421,Master's Paradise (Windows Trojan)
-40422,Master's Paradise (Windows Trojan)
-40423,Master's Paradise (Windows Trojan)
-40426,Master's Paradise (Windows Trojan)
-40841,CSCP
-42424,ASP.NET Session State
-43118,Reachout
-43188,Reachout
-44333,Kerio WinRoute Firewall Administration
-44334,Kerio Personal Firewall Administration
-44337,Kerio MailServer Administration
-44444,Prosiak
-44818,Rockwell Encapsulation
-45092,BackGate (Windows rootkit)
-45678,EBA PRISE
-45966,SSRServerMgr
-47262,Delta Source (Windows Trojan)
-47557,Databeam Corporation
-47624,Direct Play Server
-47806,ALC Protocol
-47808,Building Automation and Control Networks
-48000,Nimbus Controller
-48001,Nimbus Spooler
-48002,Nimbus Hub
-48003,Nimbus Gateway
-49400,Compaq Insight Manager
-49401,Compaq Insight Manager
-50300,O&O Defrag
-51515,Microsoft Operations Manager MOM-Clear
-52673,Stickies
-54283,SubSeven
-54320,Orifice 2000 (TCP)
-54321,Orifice 2000 (TCP)
-60000,DeepThroat
-65000,distributed attack tool / Devil (Windows Trojan)
-65301,pcAnywhere-def
-65506,PhatBot, Agobot, Gaobot (Windows trojans)
diff --git a/panda/plugins/tcp_passthrough/tcp_passthrough.h b/panda/plugins/tcp_passthrough/tcp_passthrough.h
deleted file mode 100644
index 3af6dc322cc..00000000000
--- a/panda/plugins/tcp_passthrough/tcp_passthrough.h
+++ /dev/null
@@ -1,36 +0,0 @@
-// BEGIN_PYPANDA_NEEDS_THIS -- do not delete this comment bc pypanda
-// api autogen needs it.  And don't put any compiler directives
-// between this and END_PYPANDA_NEEDS_THIS except includes of other
-// files in this directory that contain subsections like this one.
-
-/**
- * Information about a given socket binding
- */
-typedef struct SocketInfo {
-  uint8_t ip[4];
-  uint64_t pid;
-  uint16_t port;
-  bool server;
-} SocketInfo;
-
-/**
- * Request that a table of sockets be printed once guest execution resumes
- */
-void print_socket_info(void);
-
-/**
- * Provide a callback for receiving a socket list that will get called once the guest
- * resumes execution
- */
-void on_get_socket_list(void (*callback)(const struct SocketInfo*, uintptr_t));
-
-/**
- * Forward a socket from the guest, returning true if no issue is hit. Returns `false` if
- * the IP address fails to parse. A null IP address is treated as 0.0.0.0
- *
- * Guest must resume execution for an unspecified amount of time before TCP traffic
- * will actually be processed.
- */
-bool forward_socket(const char *ip, uint16_t guest_port, uint16_t host_port);
-
-// END_PYPANDA_NEEDS_THIS -- do not delete this comment!
diff --git a/panda/plugins/tcp_passthrough/tcp_shared_types/Cargo.lock b/panda/plugins/tcp_passthrough/tcp_shared_types/Cargo.lock
deleted file mode 100644
index 80f047aed59..00000000000
--- a/panda/plugins/tcp_passthrough/tcp_shared_types/Cargo.lock
+++ /dev/null
@@ -1,65 +0,0 @@
-# This file is automatically @generated by Cargo.
-# It is not intended for manual editing.
-version = 3
-
-[[package]]
-name = "proc-macro2"
-version = "1.0.37"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ec757218438d5fda206afc041538b2f6d889286160d649a86a24d37e1235afd1"
-dependencies = [
- "unicode-xid",
-]
-
-[[package]]
-name = "quote"
-version = "1.0.18"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a1feb54ed693b93a84e14094943b84b7c4eae204c512b7ccb95ab0c66d278ad1"
-dependencies = [
- "proc-macro2",
-]
-
-[[package]]
-name = "serde"
-version = "1.0.137"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "61ea8d54c77f8315140a05f4c7237403bf38b72704d031543aa1d16abbf517d1"
-dependencies = [
- "serde_derive",
-]
-
-[[package]]
-name = "serde_derive"
-version = "1.0.137"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1f26faba0c3959972377d3b2d306ee9f71faee9714294e41bb777f83f88578be"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "syn"
-version = "1.0.92"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7ff7c592601f11445996a06f8ad0c27f094a58857c2f89e97974ab9235b92c52"
-dependencies = [
- "proc-macro2",
- "quote",
- "unicode-xid",
-]
-
-[[package]]
-name = "tcp_shared_types"
-version = "0.1.0"
-dependencies = [
- "serde",
-]
-
-[[package]]
-name = "unicode-xid"
-version = "0.2.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "957e51f3646910546462e67d5f7599b9e4fb8acdd304b087a6494730f9eebf04"
diff --git a/panda/plugins/tcp_passthrough/tcp_shared_types/Cargo.toml b/panda/plugins/tcp_passthrough/tcp_shared_types/Cargo.toml
deleted file mode 100644
index 124d2ac4406..00000000000
--- a/panda/plugins/tcp_passthrough/tcp_shared_types/Cargo.toml
+++ /dev/null
@@ -1,7 +0,0 @@
-[package]
-name = "tcp_shared_types"
-version = "0.1.0"
-edition = "2021"
-
-[dependencies]
-serde = { version = "1", features = ["derive"] }
diff --git a/panda/plugins/tcp_passthrough/tcp_shared_types/src/lib.rs b/panda/plugins/tcp_passthrough/tcp_shared_types/src/lib.rs
deleted file mode 100644
index 6f5d221b79d..00000000000
--- a/panda/plugins/tcp_passthrough/tcp_shared_types/src/lib.rs
+++ /dev/null
@@ -1,29 +0,0 @@
-use serde::{Deserialize, Serialize};
-use std::net::Ipv4Addr;
-
-pub type Pid = u64;
-
-#[derive(Serialize, Deserialize, Clone, Debug)]
-pub struct SocketInfo {
-    pub ip: Ipv4Addr,
-    pub port: u16,
-    pub pid: Option<Pid>,
-    pub server: bool,
-}
-
-#[derive(Serialize, Deserialize, Clone, Debug)]
-pub enum Request {
-    /// Request a Vec<SocketInfo> be sent to a given channel
-    GetSocketList { channel_id: u32 },
-
-    /// Connect to the given TCP port at the provided IP and forward the connection
-    /// over the given channel
-    ForwardConnection {
-        ip: Ipv4Addr,
-        port: u16,
-        channel_id: u32,
-    },
-
-    /// Closes a socket so the TCP server knows the connection ended
-    CloseSocket { channel_id: u32 },
-}
diff --git a/panda/plugins/tcp_passthrough/try_it.py b/panda/plugins/tcp_passthrough/try_it.py
deleted file mode 100644
index deb08c83362..00000000000
--- a/panda/plugins/tcp_passthrough/try_it.py
+++ /dev/null
@@ -1,34 +0,0 @@
-from pandare import Panda
-
-panda = Panda(generic="x86_64")
-
-@panda.queue_blocking
-def run_cmd():
-    panda.revert_sync("root")
-
-    # Start up an HTTP server as a background job
-    panda.run_serial_cmd("python3 -m http.server &")
-
-    # Give the HTTP server time to start up before pulling socket info
-    panda.run_serial_cmd("sleep 2")
-
-    # Print a table of the TCP servers in the guest
-    panda.tcp.print_socket_info()
-
-    # Forward a socket from localhost:8000 in the guest to localhost:4343 on the host
-    panda.tcp.forward_socket(8000, 4343)
-
-    # print out the socket list ourselves too
-    @panda.tcp.on_get_socket_list
-    def callback(socket_info: list):
-        print(" Ip Address\tPID\tIs Server?")
-        print("====================================")
-        for socket in socket_info:
-            print(f" {socket.ip}:{socket.port}\t{socket.pid}\t{socket.is_server}")
-
-    # Injecting into a cat command, but this could be anything
-    panda.run_serial_cmd("cat", no_timeout=True)
-
-    panda.end_analysis()
-
-panda.run()
diff --git a/panda/python/core/create_panda_datatypes.py b/panda/python/core/create_panda_datatypes.py
index fc5a5e8df27..1a23272b022 100755
--- a/panda/python/core/create_panda_datatypes.py
+++ b/panda/python/core/create_panda_datatypes.py
@@ -307,8 +307,6 @@ def expand_ppp_def(line):
     define_clean_header(ffi, include_dir + "/proc_start_linux_ppp.h")
     define_clean_header(ffi, include_dir + "/forcedexec_ppp.h")
     define_clean_header(ffi, include_dir + "/stringsearch_ppp.h")
-    define_clean_header(ffi, include_dir + "/guest_plugin_manager_ppp.h")
-    define_clean_header(ffi, include_dir + "/linjector_ppp.h")
     # END PPP headers
 
     define_clean_header(ffi, include_dir + "/breakpoints.h")
@@ -384,13 +382,10 @@ def main(install=False,recompile=True):
     # TODO: programtically copy anything that ends with _ppp.h
     copy_ppp_header("%s/%s" % (PLUGINS_DIR+"/forcedexec",   "forcedexec_ppp.h"))
     copy_ppp_header("%s/%s" % (PLUGINS_DIR+"/stringsearch", "stringsearch_ppp.h"))
-    copy_ppp_header("%s/%s" % (PLUGINS_DIR+"/guest_plugin_manager", "guest_plugin_manager_ppp.h"))
-    copy_ppp_header("%s/%s" % (PLUGINS_DIR+"/linjector", "linjector_ppp.h"))
     create_pypanda_header("%s/%s" % (PLUGINS_DIR+"/hooks2", "hooks2.h"))
-
+    
     copy_ppp_header("%s/%s" % (PLUGINS_DIR+"/proc_start_linux", "proc_start_linux_ppp.h"))
     create_pypanda_header("%s/%s" % (PLUGINS_DIR+"/proc_start_linux", "proc_start_linux.h"))
-    create_pypanda_header("%s/%s" % (PLUGINS_DIR+"/tcp_passthrough", "tcp_passthrough.h"))
     copy_ppp_header("%s/taint2/taint2.h" % PLUGINS_DIR)
 
     with open(os.path.join(OUTPUT_DIR, "panda_datatypes.py"), "w") as pdty:
diff --git a/panda/python/core/pandare/panda.py b/panda/python/core/pandare/panda.py
index fa44ce7fb94..53602fc61f3 100755
--- a/panda/python/core/pandare/panda.py
+++ b/panda/python/core/pandare/panda.py
@@ -39,7 +39,6 @@
 from .qcows_internal import Qcows
 from .qemu_logging import QEMU_Log_Manager
 from .arch import ArmArch, Aarch64Arch, MipsArch, Mips64Arch, X86Arch, X86_64Arch
-from .tcp_passthrough import TcpPassthrough, SocketInfo
 
 # Might be worth importing and auto-initilizing a PLogReader
 # object within Panda for the current architecture?
@@ -92,7 +91,6 @@ def __init__(self, arch="i386", mem="128M",
         self.os_type = os
         self.qcow = qcow
         self.plugins = plugin_list(self)
-        self.tcp = TcpPassthrough(self)
         self.expect_prompt = expect_prompt
         self.lambda_cnt = 0
         self.__sighandler = None
@@ -651,8 +649,6 @@ def load_plugin(self, name, args={}):
         argstrs_ffi = []
         if isinstance(args, dict):
             for k,v in args.items():
-                if type(v) is bool:
-                    v = "true" if v else "false"
                 this_arg_s = "{}={}".format(k,v)
                 this_arg = self.ffi.new("char[]", bytes(this_arg_s, "utf-8"))
                 argstrs_ffi.append(this_arg)
diff --git a/panda/python/core/pandare/tcp_passthrough.py b/panda/python/core/pandare/tcp_passthrough.py
deleted file mode 100644
index 1ebcdf2c986..00000000000
--- a/panda/python/core/pandare/tcp_passthrough.py
+++ /dev/null
@@ -1,88 +0,0 @@
-from dataclasses import dataclass
-from ipaddress import IPv4Address
-from typing import Callable
-
-@dataclass
-class SocketInfo:
-    '''
-    Information about a socket running in the guest.
-
-    Fields:
-        * `ip`: `IPv4Address` - the IP address within the guest being bound to
-        * `pid`: `int` - the Process ID of the process which is bound to the socket
-        * `port`: `int` - the TCP port (0-65565) within the guest being used
-        * `is_server`: `bool` - Whether the socket within the guest is a listener or an outgoing connection
-    '''
-
-    ip: IPv4Address
-    pid: int
-    port: int
-    is_server: bool
-
-    def from_ffi(raw):
-        '''
-        Takes a C FFI instances of SocketInfo and converts it to a python-native type
-        '''
-
-        ip = IPv4Address(bytes([raw.ip[i] for i in range(4)]))
-        pid = raw.pid
-        port = raw.port
-        is_server = raw.server
-
-        return SocketInfo(ip, pid, port, is_server)
-
-class TcpPassthrough:
-    '''
-    Object to interact with the `tcp_passthrough` PANDA plugin. An instance can be found
-    at `panda.tcp`, where `panda` is a `Panda` object.
-    '''
-
-    def __init__(self, panda):
-        self.panda = panda
-
-    def forward_socket(self, guest_port: int, host_port: int):
-        '''
-        Forward TCP connections performed on a host port to a TCP server running in the
-        guest. This could, for example, be used to allow access to a guest HTTP server.
-
-        ```
-        # Allow connecting to the guest localhost:80 via the host localhost:8500
-        panda.tcp.forward_socket(80, 8500)
-        ```
-        '''
-        self.panda.plugins["tcp_passthrough"].forward_socket(
-            self.panda.ffi.cast("const char*", self.panda.ffi.NULL),
-            self.panda.ffi.cast("uint16_t", guest_port),
-            self.panda.ffi.cast("uint16_t", host_port)
-        )
-
-    def on_get_socket_list(self, callback: Callable[[list], None]):
-        '''
-        Request a list of sockets from the guest, running a provided callback when they
-        are available. The callback is given a `list` of `SocketInfo`s.
-
-        ```
-        @panda.tcp.on_get_socket_list
-        def with_sockets(sockets):
-            for socket in sockets:
-                print(f"Socket bound on guest port {socket.port}")
-        ```
-        '''
-        @self.panda.ffi.callback("void(*)(const struct SocketInfo*, uintptr_t)")
-        def cb(ptr, length):
-            callback([SocketInfo.from_ffi(ptr[i]) for i in range(length)])
-
-        self.socket_list = (self.__dict__.get("socket_list") or []) + [cb]
-
-        self.panda.plugins["tcp_passthrough"].on_get_socket_list(cb)
-
-    def print_socket_info(self):
-        '''
-        Request that a list of sockets in the guest is printed as a table to stdout,
-        including information about what the given port is typically reserved for.
-
-        ```
-        panda.tcp.print_socket_info()
-        ```
-        '''
-        self.panda.plugins["tcp_passthrough"].print_socket_info()
diff --git a/panda/python/core/setup.py b/panda/python/core/setup.py
index 8650db0d628..a4cecede530 100644
--- a/panda/python/core/setup.py
+++ b/panda/python/core/setup.py
@@ -62,7 +62,6 @@ def copy_objs():
         softmmu = arch+"-softmmu"
         path      = os.path.join(*[build_root, softmmu, libname])
         plugindir = os.path.join(*[build_root, softmmu, "panda", "plugins"])
-        guestplugindir = os.path.join(*[build_root, softmmu, "panda", "guest_plugins"])
         llvm1     = os.path.join(*[build_root, softmmu, "llvm-helpers.bc1"])
         llvm2     = os.path.join(*[build_root, softmmu, f"llvm-helpers-{arch}.bc"])
 
@@ -83,12 +82,6 @@ def copy_objs():
 
         shutil.copytree(plugindir,  new_plugindir, ignore=shutil.ignore_patterns('*.o', '*.d'))
 
-        new_guestplugindir = os.path.join(lib_dir, softmmu, "panda/guest_plugins")
-        print("\n\n")
-        print(guestplugindir, new_guestplugindir)
-        if os.path.exists(guestplugindir):
-            shutil.copytree(guestplugindir,  new_guestplugindir, ignore=shutil.ignore_patterns('*.o', '*.d'))
-
     # Strip libpandas and plugins to save space (Need <100mb for pypi)
     if pypi_build:
         check_output(f"find {lib_dir} -type f -executable -exec strip {{}} \;", shell=True)
@@ -170,8 +163,6 @@ def run(self):
           'data/*-softmmu/llvm-helpers*.bc*', # Llvm-helpers
           'data/*-softmmu/panda/plugins/*',   # All plugins
           'data/*-softmmu/panda/plugins/**/*',# All plugin files
-          'data/*-softmmu/panda/guest_plugins/*',   # All plugins
-          'data/*-softmmu/panda/guest_plugins/**/*',# All plugin files
           'data/pypanda/include/*.h',         # Includes files
           'data/pc-bios/*',                   # BIOSes
           'data/pc-bios/**/*',                # Keymaps
diff --git a/panda/python/examples/guest_shell.py b/panda/python/examples/guest_shell.py
deleted file mode 100644
index 8963b47e35b..00000000000
--- a/panda/python/examples/guest_shell.py
+++ /dev/null
@@ -1,26 +0,0 @@
-# See panda/plugins/guest_shell/guest_shell_pty.sh for actually interacting with the shell
-from pandare import Panda
-import os
-
-if os.path.exists("/tmp/guest_shell.sock"):
-    os.remove("/tmp/guest_shell.sock")
-
-panda = Panda(generic="x86_64")
-
-@panda.queue_blocking
-def run_cmd():
-    panda.revert_sync("root")
-    panda.load_plugin("guest_shell")
-
-    # if it's worth running it's worth running twice
-    # (don't ask, and definitely don't remove either line)
-    panda.load_plugin("linjector", {
-        "guest_binary": "guest_daemon",
-        "proc_name": "cat"
-    })
-    panda.run_serial_cmd("cat", no_timeout=True)
-    panda.run_serial_cmd("cat", no_timeout=True)
-
-    panda.end_analysis()
-
-panda.run()
diff --git a/panda/python/examples/hyperfuse.py b/panda/python/examples/hyperfuse.py
deleted file mode 100644
index 9ec21609eea..00000000000
--- a/panda/python/examples/hyperfuse.py
+++ /dev/null
@@ -1,22 +0,0 @@
-from pandare import Panda
-import os
-
-panda = Panda(generic="x86_64")
-panda.load_plugin("hyperfuse", {})
-
-@panda.queue_blocking
-def run_cmd():
-    panda.revert_sync("root")
-
-    # if it's worth running it's worth running twice
-    # (don't ask, and definitely don't remove either line)
-    panda.load_plugin("linjector", {
-        "guest_binary": "guest_daemon",
-        "proc_name": "cat"
-    })
-    panda.run_serial_cmd("cat", no_timeout=True)
-    panda.run_serial_cmd("cat", no_timeout=True)
-
-    panda.end_analysis()
-
-panda.run()
diff --git a/panda/python/examples/linject.py b/panda/python/examples/linject.py
deleted file mode 100644
index 50987c3b367..00000000000
--- a/panda/python/examples/linject.py
+++ /dev/null
@@ -1,31 +0,0 @@
-from pandare import Panda
-from termcolor import colored
-import os
-
-# Please don't do it this way normally
-code = """#include <stdio.h>
-#include <unistd.h>
-
-int main() {
-    printf("Hello World!\\n");
-    sleep(3);
-
-    return 0;
-}
-"""
-os.system(f'printf {repr(code)} | gcc -x c - -o hello_world_x86_64')
-
-panda = Panda(generic="x86_64")
-panda.load_plugin("linjector", {
-    "require_root": False,
-    "guest_binary": "hello_world_x86_64",
-    "proc_name": "cat"
-})
-
-@panda.queue_blocking
-def run_cmd():
-    panda.revert_sync("root")
-    print(colored(panda.run_serial_cmd("cat /proc/cpuinfo"), "white", attrs=['bold']))
-    panda.end_analysis()
-
-panda.run()
diff --git a/panda/python/examples/tcp_passthrough.py b/panda/python/examples/tcp_passthrough.py
deleted file mode 100644
index 98aedcaed51..00000000000
--- a/panda/python/examples/tcp_passthrough.py
+++ /dev/null
@@ -1,51 +0,0 @@
-from pandare import Panda
-
-panda = Panda(generic="x86_64")
-
-page = "<html><body><h1>Guest Web Server</h1><p>CPU Info:</p><iframe src=\"/cpuinfo.html\" style=\"width: 70%; height: 70%\"></iframe></body></html>"
-
-@panda.queue_blocking
-def run_cmd():
-    panda.revert_sync("root")
-
-    panda.run_serial_cmd("echo '<html><body><pre>' > cpuinfo.html")
-    panda.run_serial_cmd("cat /proc/cpuinfo >> cpuinfo.html")
-    panda.run_serial_cmd("echo '</pre></body></html>' >> cpuinfo.html")
-    panda.run_serial_cmd(f"echo '{page}' > index.html")
-
-    #print(panda.run_serial_cmd("mknod -m 777 fifo p"))
-    #print(panda.run_serial_cmd("head -c10000 fifo | netcat -l -k localhost 1234 > fifo"))
-
-    # Start up an HTTP server as a background job
-    panda.run_serial_cmd("python3 -m http.server &")
-
-    # Give the HTTP server time to start up before pulling socket info
-    panda.run_serial_cmd("sleep 2")
-
-    # Print a table of the TCP servers in the guest
-    panda.tcp.print_socket_info()
-
-    # Forward a socket from localhost:8000 in the guest to localhost:8000 on the host
-    panda.tcp.forward_socket(8000, 8000)
-
-    # Forward a socket from localhost:1234 in the guest to localhost:1234 on the host
-    panda.tcp.forward_socket(1234, 1234)
-
-    # print out the socket list ourselves too
-    @panda.tcp.on_get_socket_list
-    def callback(socket_info: list):
-        print(" Ip Address\tPID\tIs Server?")
-        print("====================================")
-        for socket in socket_info:
-            print(f" {socket.ip}:{socket.port}\t{socket.pid}\t{socket.is_server}")
-
-    # Injecting into a cat command, but this could be anything
-    panda.load_plugin("linjector", {
-        "guest_binary": "guest_daemon",
-        "proc_name": "cat"
-    })
-    panda.run_serial_cmd("cat", no_timeout=True)
-
-    panda.end_analysis()
-
-panda.run()
diff --git a/panda/scripts/musl_toolchains.sh b/panda/scripts/musl_toolchains.sh
deleted file mode 100755
index e23ad58494f..00000000000
--- a/panda/scripts/musl_toolchains.sh
+++ /dev/null
@@ -1,337 +0,0 @@
-#!/bin/bash
-
-TARGETS=(i486-linux-musl-cross mips-linux-musl-cross mipsel-linux-musl-cross mips64-linux-musl-cross arm-linux-musleabi-cross aarch64-linux-musl-cross)
-
-bold=$(tput bold)
-red=$(tput setaf 1)
-cyan=$(tput setaf 6)
-normal=$(tput sgr0)
-
-CMD_NAME="./musl_toolchains.sh"
-
-function error {
-    >&2 echo "${bold}${red}error${normal}: $@"
-}
-
-function suggest {
-    >&2 echo "  ${bold}${cyan}help${normal}: $@"
-}
-
-function help {
-    >&2 echo "${bold}Usage:${normal}"
-    >&2 echo "    ${CMD_NAME} [subcommand]"
-    >&2 echo ""
-    >&2 echo "${bold}Subcommands:${normal}"
-    >&2 echo "    install               Install all needed musl toolchains to the current directory"
-    >&2 echo "    uninstall             Remove all installed musl toolchains from the current directory"
-    >&2 echo "    list                  List the musl toolchains supported or installed by this script"
-    >&2 echo "    check-installed       Checks if a target or set of targets are installed"
-    >&2 echo "    help                  Print this help text"
-}
-
-function install_help {
-    >&2 echo "${bold}Usage:${normal}"
-    >&2 echo "    ${CMD_NAME} install [args]"
-    >&2 echo ""
-    >&2 echo "Install all the toolchains supported by this script"
-    >&2 echo ""
-    >&2 echo "${bold}Arguments:${normal}"
-    >&2 echo "    --help                Print this help text"
-    >&2 echo "    --to <dir>            Install the toolchains inside of the <dir> directory (default: cwd)"
-}
-
-function uninstall_help {
-    >&2 echo "${bold}Usage:${normal}"
-    >&2 echo "    ${CMD_NAME} uninstall [args]"
-    >&2 echo ""
-    >&2 echo "Uninstall all the toolchains supported by this script"
-    >&2 echo ""
-    >&2 echo "${bold}Arguments:${normal}"
-    >&2 echo "    --help                Print this help text"
-    >&2 echo "    --from <dir>          Uninstall any toolchains inside of the <dir> directory (default: cwd)"
-}
-
-function list_targets_help {
-    >&2 echo "${bold}Usage:${normal}"
-    >&2 echo "    ${CMD_NAME} list [args]"
-    >&2 echo ""
-    >&2 echo "List the target triples supported or installed by this script"
-    >&2 echo ""
-    >&2 echo "${bold}Arguments:${normal}"
-    >&2 echo "    --help                Print this help text"
-    >&2 echo "    --installed           Show only installed targets"
-    >&2 echo "    --in <dir>            When checking for installed toolchains, look inside of the <dir> directory (default: cwd)"
-}
-
-function check_installed_help {
-    >&2 echo "${bold}Usage:${normal}"
-    >&2 echo "    ${CMD_NAME} check-installed [args]"
-    >&2 echo ""
-    >&2 echo "Checks if a set of targets are installed"
-    >&2 echo ""
-    >&2 echo "${bold}Arguments:${normal}"
-    >&2 echo "    --help                Print this help text"
-    >&2 echo "    --all                 Check that all available targets are selected"
-    >&2 echo "    --in <dir>            When checking for installed toolchains, look inside of the <dir> directory (default: cwd)"
-    >&2 echo "    <TARGETS...>          A list of targets to check are installed"
-}
-
-function install {
-    cwd=`pwd`
-    args=("$@")
-
-    while [[  ${#args[@]} -ne 0 ]]
-    do
-        case ${args[0]} in
-            "--help" | "-h")
-                install_help
-                exit 0
-                ;;
-            "--to")
-                cwd="${args[1]}"
-                args=("${args[@]:2}")
-                ;;
-            *)
-                error "Found '${args[0]}'"
-                install_help
-                exit 1
-                ;;
-        esac
-    done
-
-    if [[ $cwd == "" ]]
-    then
-        error "empty directory to install to"
-        exit 1
-    fi
-
-    if ! [[ -d $cwd ]]
-    then
-        >&2 echo "Directory '$cwd' does not exist, creating for you..."
-        mkdir -p $cwd
-    fi
-
-    path_prefix=""
-
-    for target in ${TARGETS[@]}
-    do
-        full_path="$cwd/$target/bin"
-        if [ -d $full_path ]
-        then
-            echo "$target is already installed"
-        else
-            echo "${bold}Downloading $target...${normal}"
-            curl -o "$cwd/$target.tgz" https://musl.cc/$target.tgz && tar -xzf "$cwd/$target.tgz"
-            rm "$cwd/$target.tgz"
-        fi
-
-        path_prefix="$full_path:$path_prefix"
-    done
-
-    QUOTE='"'
-    DOLLAR='$'
-
-    >&2 echo ""
-    >&2 echo "${bold}Add to PATH using:${normal}"
-    echo "    export PATH=${QUOTE}${path_prefix}${DOLLAR}PATH${QUOTE}"
-}
-
-function uninstall {
-    cwd=`pwd`
-    args=("$@")
-
-    while [[  ${#args[@]} -ne 0 ]]
-    do
-        case ${args[0]} in
-            "--help" | "-h")
-                uninstall_help
-                exit 0
-                ;;
-            "--from")
-                cwd="${args[1]}"
-                args=("${args[@]:2}")
-                ;;
-            *)
-                error "Found '${args[0]}'"
-                uninstall_help
-                exit 1
-                ;;
-        esac
-    done
-
-    if [[ $cwd == "" ]]
-    then
-        error "empty directory to uninstall from"
-        exit 1
-    fi
-
-    for target in ${TARGETS[@]}
-    do
-        full_path="$cwd/$target/bin"
-        if [ -d $full_path ]
-        then
-            rm -rf "$cwd/$target" && echo "Removed $target"
-            >/dev/null 2>/dev/null rm $target.tgz || true
-        else
-            >/dev/null 2>/dev/null rm $target.tgz || true
-        fi
-    done
-
-    echo ""
-    echo "All targets uninstalled"
-}
-
-function list_targets {
-    check_installed=false
-    cwd_set=false
-
-    cwd=`pwd`
-    args=("$@")
-
-    while [[  ${#args[@]} -ne 0 ]]
-    do
-        case ${args[0]} in
-            "--help" | "-h")
-                list_targets_help
-                exit 0
-                ;;
-            "--installed")
-                check_installed=true
-                args=("${args[@]:1}")
-                ;;
-            "--in")
-                cwd_set=true
-                cwd="${args[1]}"
-                args=("${args[@]:2}")
-                ;;
-            *)
-                error "Found '${args[0]}', unexpected for 'list' subcommand"
-                list_targets_help
-                exit 1
-                ;;
-        esac
-    done
-
-    if [[ $cwd_set = true && $check_installed = false ]]
-    then
-        error "'--in' was passed, requires '--installed' to be passed as well"
-        exit 1
-    fi
-
-    at_least_one_installed=false
-
-    for target in ${TARGETS[@]}
-    do
-        full_path="$cwd/$target/bin"
-
-        if [[ $check_installed = false || -d $full_path ]]
-        then
-            echo $target
-            at_least_one_installed=true
-        fi
-    done
-
-    if [[ $check_installed = true && $at_least_one_installed = false ]]
-    then
-        >&2 echo "${bold}No targets installed${normal}"
-    fi
-}
-
-containsElement () {
-    local e match="$1"
-    shift
-
-    for e; do [[ "$e" == "$match"  ]] && return 0; done
-
-    return 1
-}
-
-function check_installed {
-    check_installed=false
-    cwd_set=false
-
-    cwd=`pwd`
-    args=("$@")
-
-    selected_targets=()
-
-    while [[  ${#args[@]} -ne 0 ]]
-    do
-        case ${args[0]} in
-            "--help" | "-h")
-                check_installed_help
-                exit 0
-                ;;
-            "--all")
-                check_all=true
-                args=("${args[@]:1}")
-                ;;
-            "--in")
-                cwd="${args[1]}"
-                args=("${args[@]:2}")
-                ;;
-            *)
-                if containsElement "${args[0]}" "${TARGETS[@]}"; then
-                    selected_targets+=("${args[0]}")
-                    args=("${args[@]:1}")
-                else
-                    error "Found '${args[0]}', unexpected for 'check-installed' subcommand, not a valid flag or target name"
-                    suggest "use '${CMD_NAME} list' to see a list of valid targets"
-                    >&2 echo ""
-                    check_installed_help
-                    exit 1
-                fi
-                ;;
-        esac
-    done
-
-    if [[ $check_all = true ]]; then
-        selected_targets=("${TARGETS[@]}")
-    fi
-
-    if [[ ${#selected_targets[@]} -eq 0 ]]; then
-        error "No targets specified"
-        suggest "pass '--all' or a space-separated list of toolchain names"
-        exit 1
-    fi
-
-    for target in ${selected_targets[@]}
-    do
-        full_path="$cwd/$target/bin"
-
-        if ! [[ -d $full_path ]]
-        then
-            error "Toolchain '$target' is not installed in '$cwd'"
-            exit 1
-        fi
-    done
-
-    >&2 echo "All toolchains are installed."
-}
-
-if [[ $# -lt 1 ]]
-then
-    help
-    exit 1
-fi
-
-case $1 in
-    help | "-h" | "--help")
-        help
-        ;;
-    list)
-        list_targets ${@:2}
-        ;;
-    install)
-        install ${@:2}
-        ;;
-    uninstall | remove | delete)
-        uninstall ${@:2}
-        ;;
-    "check-installed")
-        check_installed ${@:2}
-        ;;
-    *)
-        >&2 echo "Invalid usage"
-        help
-esac
diff --git a/panda/src/callbacks.c b/panda/src/callbacks.c
index 5d90a353035..58bdaa8f84c 100644
--- a/panda/src/callbacks.c
+++ b/panda/src/callbacks.c
@@ -264,30 +264,6 @@ bool _panda_load_plugin(const char *filename, const char *plugin_name, bool libr
 
 extern const char *qemu_file;
 
-char *panda_guest_plugin_path(const char *plugin_name) {
-    gchar* plugin_path;
-    // Note qemu_file is set in the first call to main_aux
-    // so if this is called (likely via load_plugin) qemu_file must be set directly
-    assert(qemu_file != NULL);
-
-    // try relative to PANDA binary as it would be in the build or install directory
-    char *dir = g_path_get_dirname(qemu_file);
-    plugin_path = g_strdup_printf("%s/panda/guest_plugins/bin/%s", dir,
-                                  plugin_name);
-
-    g_free(dir);
-    if (TRUE == g_file_test(plugin_path, G_FILE_TEST_EXISTS)) {
-        char* path = strdup(plugin_path);
-        g_free(plugin_path);
-        return path;
-    }
-    printf("Failed to find guest plugin '%s' at '%s'", plugin_name, plugin_path);
-    g_free(plugin_path);
-
-    // Return null if plugin resolution failed.
-    return NULL;
-}
-
 // Resolve a file in the plugin directory to a path. If the file doesn't
 // exist in any of the search paths, then NULL is returned. The search order 
 // for files is as follows:

From 14461e27ac6b377f84e5dcde3179d32b9ad5c31f Mon Sep 17 00:00:00 2001
From: Andrew Fasano <fasano@mit.edu>
Date: Tue, 25 Oct 2022 10:43:40 -0400
Subject: [PATCH 118/140] Detect failures in docker build

---
 Dockerfile | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/Dockerfile b/Dockerfile
index 34a6e4ed5d7..5d029157123 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -82,6 +82,9 @@ RUN cd /panda/panda/python/core && \
     python3 setup.py install
 RUN python3 -m pip install --ignore-install pycparser && python3 -m pip install --force-reinstall --no-binary :all: cffi
 
+# BUG: PANDA sometimes fails to generate all the necessary files for PyPANDA. This is a temporary fix to detect and fail when this occurs
+RUN ls $(pip show pandare | grep Location: | awk '{print $2}')/pandare/autogen/panda_{aarch64_64,arm_32,mips64_64,mips_32,mipsel_32,ppc_32,ppc_64,x86_64_64,i386_32}.py
+
 ### Copy files for panda+pypanda from installer  - Stage 5
 FROM base as panda
 

From d94a7649a8fcf7edfef29bdb750b4bf9f16e3f36 Mon Sep 17 00:00:00 2001
From: Andrew Fasano <fasano@mit.edu>
Date: Wed, 2 Nov 2022 22:46:09 -0400
Subject: [PATCH 119/140] Detect missing PyPANDA files in container build

---
 Dockerfile | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/Dockerfile b/Dockerfile
index 5d029157123..588c5e5d109 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -83,7 +83,8 @@ RUN cd /panda/panda/python/core && \
 RUN python3 -m pip install --ignore-install pycparser && python3 -m pip install --force-reinstall --no-binary :all: cffi
 
 # BUG: PANDA sometimes fails to generate all the necessary files for PyPANDA. This is a temporary fix to detect and fail when this occurs
-RUN ls $(pip show pandare | grep Location: | awk '{print $2}')/pandare/autogen/panda_{aarch64_64,arm_32,mips64_64,mips_32,mipsel_32,ppc_32,ppc_64,x86_64_64,i386_32}.py
+RUN ls -alt $(pip show pandare | grep Location: | awk '{print $2}')/pandare/autogen/
+RUN bash -c "ls $(pip show pandare | grep Location: | awk '{print $2}')/pandare/autogen/panda_{aarch64_64,arm_32,mips64_64,mips_32,mipsel_32,ppc_32,ppc_64,x86_64_64,i386_32}.py"
 
 ### Copy files for panda+pypanda from installer  - Stage 5
 FROM base as panda

From 204897554fc0bd70d1df1d1c999434faba38157d Mon Sep 17 00:00:00 2001
From: Andrew Fasano <fasano@mit.edu>
Date: Thu, 3 Nov 2022 14:13:41 -0400
Subject: [PATCH 120/140] CI: detect failures pypanda setup multi-processing

---
 .github/workflows/README.md                 |  2 +-
 panda/python/core/create_panda_datatypes.py | 28 ++++++++++++++++++++-
 2 files changed, 28 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/README.md b/.github/workflows/README.md
index ae9062f8fe2..0ce5b381c76 100644
--- a/.github/workflows/README.md
+++ b/.github/workflows/README.md
@@ -15,6 +15,6 @@ This is much easier than repeatedly pushing to a branch/PR if you have a CI fail
 
 Running with the `-b` flag seems to be required, but then your directory will be owned by `root`:
 
-``
+```
 act -b -j local_build_container; sudo chown -R $USER:$USER . .git
 ```
diff --git a/panda/python/core/create_panda_datatypes.py b/panda/python/core/create_panda_datatypes.py
index 1a23272b022..71625be58cb 100755
--- a/panda/python/core/create_panda_datatypes.py
+++ b/panda/python/core/create_panda_datatypes.py
@@ -594,7 +594,33 @@ def get_cbs(ffi):
             ("mips64",64),
         ]
 
-        from multiprocessing import Process
+        from __future__ import print_function
+        import multiprocessing as mp
+        import traceback
+
+        # https://stackoverflow.com/a/33599967
+        class Process(mp.Process):
+            def __init__(self, *args, **kwargs):
+                mp.Process.__init__(self, *args, **kwargs)
+                self._pconn, self._cconn = mp.Pipe()
+                self._exception = None
+
+            def run(self):
+                try:
+                    mp.Process.run(self)
+                    self._cconn.send(None)
+                except Exception as e:
+                    tb = traceback.format_exc()
+                    self._cconn.send((e, tb))
+                    # raise e  # You can still rise this exception if you need to
+
+            @property
+            def exception(self):
+                if self._pconn.poll():
+                    self._exception = self._pconn.recv()
+                return self._exception
+
+
         ps = (
             Process(target=compile, args=(arch[0], arch[1], pypanda_headers, install, INCLUDE_DIR_PYP))
             for arch in arches

From 767a7338d32801e25492fd751ca436002e3d278b Mon Sep 17 00:00:00 2001
From: Andrew Fasano <fasano@mit.edu>
Date: Thu, 3 Nov 2022 23:44:31 -0400
Subject: [PATCH 121/140] CI: another attempt to detect pypanda setup failure

---
 panda/python/core/create_panda_datatypes.py | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/panda/python/core/create_panda_datatypes.py b/panda/python/core/create_panda_datatypes.py
index 71625be58cb..ea966a8faee 100755
--- a/panda/python/core/create_panda_datatypes.py
+++ b/panda/python/core/create_panda_datatypes.py
@@ -389,7 +389,7 @@ def main(install=False,recompile=True):
     copy_ppp_header("%s/taint2/taint2.h" % PLUGINS_DIR)
 
     with open(os.path.join(OUTPUT_DIR, "panda_datatypes.py"), "w") as pdty:
-        pdty.write("""
+        pdty.write("""from __future__ import print_function
 \"\"\"
 Auto-generated type declaration to provide c-definitions for the cffi interface. It's highly unlikely you actually need this.
 If you simply need a list of callbacks consult the manual in main PANDA.
@@ -594,7 +594,6 @@ def get_cbs(ffi):
             ("mips64",64),
         ]
 
-        from __future__ import print_function
         import multiprocessing as mp
         import traceback
 

From 3e4974304a79780bcf827430e4f83d356653b35e Mon Sep 17 00:00:00 2001
From: Andrew Fasano <fasano@mit.edu>
Date: Fri, 4 Nov 2022 08:53:58 -0400
Subject: [PATCH 122/140] PyPANDA: Un-parallelize failing loop to reveal CI bug

---
 panda/python/core/create_panda_datatypes.py | 17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

diff --git a/panda/python/core/create_panda_datatypes.py b/panda/python/core/create_panda_datatypes.py
index ea966a8faee..5dbe7e01e88 100755
--- a/panda/python/core/create_panda_datatypes.py
+++ b/panda/python/core/create_panda_datatypes.py
@@ -619,13 +619,16 @@ def exception(self):
                     self._exception = self._pconn.recv()
                 return self._exception
 
-
-        ps = (
-            Process(target=compile, args=(arch[0], arch[1], pypanda_headers, install, INCLUDE_DIR_PYP))
-            for arch in arches
-        )
-        [p.start() for p in ps]
-        [p.join() for p in ps]
+        for arch in arches:
+            print("Compiling headers for:", arch)
+            compile(arch[0], arch[1], pypanda_headers, install, INCLUDE_DIR_PYP)
+
+        #ps = (
+        #    Process(target=compile, args=(arch[0], arch[1], pypanda_headers, install, INCLUDE_DIR_PYP))
+        #    for arch in arches
+        #)
+        #[p.start() for p in ps]
+        #[p.join() for p in ps]
 
 
 if __name__ == '__main__':

From d240b8b1922b2f034cc5de3fcbf39b5eaedceb1c Mon Sep 17 00:00:00 2001
From: zacogen <54382416+zacogen@users.noreply.github.com>
Date: Sat, 5 Nov 2022 02:47:16 -0400
Subject: [PATCH 123/140] RR2 file compressed format (#1194)

* Add code for using rr2 file compressed format in record and replay

* Fix formatting in rr_log.c

* Add RR2 dependencies to docker builds

* Add new rrpack script for RR2 format

* Remove rrunpack script for old rr compressed format

* Update panda_restore to use rrfile_fseek_set for RR2

* Get rr_print to work properly with rr2 code

* Add support for rr2 and old rr replay format

* Revert "Add new rrpack script for RR2 format"

This reverts commit 4d4ee04130c97514050c0655ac004e1176d613e6.

* Revert "Remove rrunpack script for old rr compressed format"

This reverts commit c53407fa4bf59d350e905b1c4157c38438e7e388.

* Add script for packing old recordings in rr2 format

* Add documentation on the new rr2 format and support

* Fix errors in record and replay documentation

* Fix errors found during parallel tests container build

* Remove duplicate packing script for rr2 format

* Update the scissors plugin to handle old and new format

* Update how rr2 filenames are created

* Fix how gargv is copied

* Fix failing qemu test from rr2 modifications

* Update argc copy over to use correct int

* Add support for calling replay without rr2 extension

* Add support for rr2 format in pypanda

* Increase timeout for pypanda panda_expect

* Simplify naming for RR_log fp

* Separate out the loading of snapshot state

* Update comment for RR2

* Capture change in rr2 replay format

* Update snapshot and nondet log print statement for end location

* Make record rr2 creation optional

* Update README to mention command line file created

* Update error in manual related to command line file

* Update scissors to output both rr1 and rr2

* remove rr2 ext from rr_name for recording

* Remove casting replay name automatically to rr2 file if it exists

* Use panda_get_rr_name for replay_name in scissors

* Ignore .rr2 files in git

* Ignore rr.cmd files in git

* Remove code to include cmdline in rr1 recording
---
 .gitignore                                |   1 +
 configure                                 |  25 +
 include/migration/qemu-file.h             |   1 +
 migration/qemu-file.c                     |  32 ++
 panda/Makefile.panda.target               |   3 +-
 panda/dependencies/ubuntu:18.04_build.txt |   4 +
 panda/dependencies/ubuntu:20.04_build.txt |   4 +
 panda/docs/manual.md                      |  28 +-
 panda/include/panda/rr/panda_rr2.h        | 104 ++++
 panda/include/panda/rr/rr_log.h           |   8 +-
 panda/include/panda/rr/rr_log_all.h       |  13 +-
 panda/plugins/scissors/README.md          |   8 +-
 panda/plugins/scissors/scissors.c         | 243 ++++++---
 panda/python/core/pandare/panda.py        |   8 +-
 panda/python/core/pandare/utils.py        |  29 ++
 panda/scripts/rr2pack.py                  | 142 ++++++
 panda/src/checkpoint.c                    |   2 +-
 panda/src/rr/panda_rr2.c                  | 574 ++++++++++++++++++++++
 panda/src/rr/rr_log.c                     | 283 +++++++++--
 panda/src/rr/rr_print.c                   | 171 ++++---
 tests/Makefile.include                    |   1 +
 vl.c                                      |  15 +-
 22 files changed, 1496 insertions(+), 203 deletions(-)
 create mode 100644 panda/include/panda/rr/panda_rr2.h
 mode change 100755 => 100644 panda/python/core/pandare/panda.py
 create mode 100644 panda/scripts/rr2pack.py
 create mode 100644 panda/src/rr/panda_rr2.c

diff --git a/.gitignore b/.gitignore
index 4bf6bdb67ba..5c05676219e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -152,6 +152,7 @@ pwc_log
 
 # Recordings and pandalogs
 *-rr-*
+*.rr2
 *.plog
 
 # Kerenels/qcows
diff --git a/configure b/configure
index a2e85de2d36..355f9c6226a 100755
--- a/configure
+++ b/configure
@@ -3254,6 +3254,31 @@ if ! compile_prog "$glib_cflags -Werror" "$glib_libs" ; then
     fi
 fi
 
+##########################################
+# libarchive support probe
+if $pkg_config --modversion libarchive > /dev/null 2>&1 ; then
+    archive_libs=`$pkg_config --libs libarchive`
+    LIBS="$archive_libs $LIBS"
+else
+    echo "libarchive is required to compile PANDA"
+    exit 1
+fi
+
+##########################################
+# openssl support probe
+if $pkg_config --modversion libssl > /dev/null 2>&1; then
+    if $pkg_config --modversion libcrypto > /dev/null 2>&1; then
+        ssl_libs=`$pkg_config --libs libssl libcrypto`
+        LIBS="$ssl_libs $LIBS"
+    else
+        echo "libcrypto is required to compile PANDA"
+        exit1
+    fi
+else
+    echo "libssl (openssl) is required to compile PANDA"
+    exit 1
+fi
+
 ##########################################
 # SHA command probe for modules
 if test "$modules" = yes; then
diff --git a/include/migration/qemu-file.h b/include/migration/qemu-file.h
index 0cd648a733e..18621483203 100644
--- a/include/migration/qemu-file.h
+++ b/include/migration/qemu-file.h
@@ -29,6 +29,7 @@
 #include "exec/cpu-common.h"
 #include "io/channel.h"
 
+QEMUFile *load_snapshot_rr(const char *filename, const char* section);
 
 /* Read a chunk of data from a file at the given position.  The pos argument
  * can be ignored if the file is only be used for streaming.  The number of
diff --git a/migration/qemu-file.c b/migration/qemu-file.c
index 195fa94fcf3..9fd468917f2 100644
--- a/migration/qemu-file.c
+++ b/migration/qemu-file.c
@@ -32,6 +32,8 @@
 #include "migration/qemu-file.h"
 #include "trace.h"
 
+#include "panda/include/panda/rr/panda_rr2.h"
+
 #define IO_BUF_SIZE 32768
 #define MAX_IOV_SIZE MIN(IOV_MAX, 64)
 
@@ -56,6 +58,36 @@ struct QEMUFile {
     int last_error;
 };
 
+typedef struct QEMUPandaTarFile
+{
+    struct rr_file* rr;
+    QEMUFile *file;
+} QEMUPandaTarFile;
+
+static const QEMUFileOps rrfile_ops = {
+    .get_buffer = rrfile_qemu_getbuffer,
+    .close = rrfile_qemu_close,
+};
+
+static QEMUFile *qemu_rrfile_open(const char *filename, const char* section, const QEMUFileOps *ops)
+{
+    QEMUPandaTarFile* pt = g_malloc0(sizeof(QEMUPandaTarFile));
+    if (!RRFILE_SUCCESS(rrfile_open_read(filename, section, &(pt->rr)))) {
+        abort();
+    }
+
+    pt->file = g_new0(QEMUFile, 1);
+    pt->file->ops = ops;
+    pt->file->opaque = pt->rr;
+    pt->file->pos = rrfile_section_size(pt->rr);
+    return pt->file;
+}
+
+QEMUFile *load_snapshot_rr(const char *filename, const char* section)
+{
+ return qemu_rrfile_open(filename, section, &rrfile_ops);
+}
+
 /*
  * Stop a file from being read/written - not all backing files can do this
  * typically only sockets can.
diff --git a/panda/Makefile.panda.target b/panda/Makefile.panda.target
index 34a71ce5a8e..7f8bd7b9cea 100644
--- a/panda/Makefile.panda.target
+++ b/panda/Makefile.panda.target
@@ -115,6 +115,7 @@ obj-y += panda/src/rr/rr_log.o
 obj-y += panda/src/checkpoint.o
 obj-y += panda/src/tcg-utils.o
 obj-y += panda/src/cb-installer.o
+obj-y += panda/src/rr/panda_rr2.o
 # These are for C++ protobuf pandalog
 obj-y += panda/src/plog-cc.o
 obj-y += plog.pb.o
@@ -122,7 +123,7 @@ obj-y += plog.pb.o
 #obj-y += panda/src/example_plog_reader.o
 #obj-y += panda/src/guestarch.o
 
-$(RR_PRINT_PROG): panda/src/rr/rr_print.o
+$(RR_PRINT_PROG): panda/src/rr/rr_print.o panda/src/rr/panda_rr2.o 
 	$(call LINK,$^)
 
 $(PLOG_READER_PROG): panda/src/example_plog_reader.o \
diff --git a/panda/dependencies/ubuntu:18.04_build.txt b/panda/dependencies/ubuntu:18.04_build.txt
index b0695e00e85..5b43bbd8424 100644
--- a/panda/dependencies/ubuntu:18.04_build.txt
+++ b/panda/dependencies/ubuntu:18.04_build.txt
@@ -76,3 +76,7 @@ zlib1g-dev
 cmake
 ninja-build
 rapidjson-dev
+
+# RR2 install deps
+libarchive-dev
+libssl-dev
diff --git a/panda/dependencies/ubuntu:20.04_build.txt b/panda/dependencies/ubuntu:20.04_build.txt
index 57a682f20da..097486919e9 100644
--- a/panda/dependencies/ubuntu:20.04_build.txt
+++ b/panda/dependencies/ubuntu:20.04_build.txt
@@ -88,3 +88,7 @@ curl
 cmake
 ninja-build
 rapidjson-dev
+
+# RR2 install deps
+libarchive-dev
+libssl-dev
diff --git a/panda/docs/manual.md b/panda/docs/manual.md
index 16f5ac506e2..d1df68b3a70 100644
--- a/panda/docs/manual.md
+++ b/panda/docs/manual.md
@@ -450,17 +450,37 @@ more details.
 
 You can also debug the guest under replay using PANDA's [**time-travel debugging**](./time-travel.md).
 
+To create a recording with the new `rr2` format, simply add `.rr2` as an 
+extention to your `begin_record` call, e.g. `begin_record new_format.rr2`. The 
+new format produces a `.tar.gz` file with extention ending in `.rr2`. 
+The compressed file contains a magic `RRv2`, the `snapshot`, the `nondetlog`, a 
+`capture.cmd` containing the command line command used to initiate PANDA for 
+recording, and a `sha1` file containing the sha1 hashes of the other files. 
+The replay command supports both the new `rr2` format, as well as the old 
+format. When you start a replay, the format will automatically be detected.
+
 ### Sharing Recordings
 
-To make it easier to share record/replay logs, PANDA has two scripts,
-`rrpack.py` and `rrunpack.py`, that bundle up and compress a recording.
-These can be found in the `scripts` directory. To pack up a recording,
+To produce a `rr2` file with an old recording use the `rr2pack.py`
+script, which can be found in the `scripts` directory. To pack up a recording,
 just use:
 
-    scripts/rrpack.py <name>
+    scripts/rr2pack.py <name> --output <output_name>
 
 This will bundle up `<name>-rr-snp` and `<name>-rr-nondet.log` and put
 them into PANDA's packed record/replay format in a file named
+`<output_name>.rr2`. This file can be unpacked using:
+
+    tar -xvf <output_name>.rr2
+
+
+For older recordings use the `scripts/rrpack.py`. To pack an old recording into
+the old packed record/replay format use:
+
+    scripts/rrpack.py <name>
+
+This will bundle up `<name>-rr-snp` and `<name>-rr-nondet.log` and put
+them into PANDA's old packed record/replay format, in a file named
 `<name>.rr`. This file can be unpacked and verified using:
 
     scripts/rrunpack.py <name>.rr
diff --git a/panda/include/panda/rr/panda_rr2.h b/panda/include/panda/rr/panda_rr2.h
new file mode 100644
index 00000000000..58f638ffec2
--- /dev/null
+++ b/panda/include/panda/rr/panda_rr2.h
@@ -0,0 +1,104 @@
+#ifndef __RR2_H
+#define __RR2_H
+
+#include <stdbool.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include <archive.h>
+#include <archive_entry.h>
+
+#define RRFILE_SUCCESS(X) ((X) == 0)
+
+struct rr_file {
+    char* section;
+    struct archive* archive;
+    struct archive_entry* entry;
+};
+
+// Used to hold path and name info when creating a new recording
+struct rr_file_info {
+    char* path;
+    char* name;
+};
+void rrfile_info_create(struct rr_file_info** rr_info, char* rr_path, char* rr_name);
+void rrfile_info_clear(struct rr_file_info** rr_info);
+
+// Used to hold state when creating a new recording
+struct rr_file_state;
+
+int rrfile_open_read(const char* fpath, const char* section, struct rr_file** rr);
+int rrfile_read_cmdline(const char* fpath, char** cmdline);
+int rrfile_read_metadata(const char* fpath, char** metadata);
+int rrfile_read_hashes(const char* fpath, char** hashes);
+int rrfile_read_contents_as_string(const char* fpath, const char* section,
+                                   char** contents, bool strip);
+int rrfile_free(struct rr_file* rr);
+
+int64_t rrfile_section_size(struct rr_file* rr);
+
+void rrfile_fseek_cur(struct rr_file* rr, size_t len);
+void rrfile_fseek_set(struct rr_file** rr, const char *filename, size_t len);
+
+/** 
+ * rrfile_qemu_getbuffer implements QEMUFileGetBufferFunc
+ *
+ * The pos argument is ignored because the tar file can only stream
+ *
+ * Returns:
+ *   The number of bytes actually read
+ */
+ssize_t rrfile_qemu_getbuffer(void* opaque, uint8_t* buffer, int64_t pos, size_t size);
+
+/**
+ * rrfile_close implements QEMUFileCloseFunc *close
+ *
+ * Returns:
+ *   An error code
+ */
+int rrfile_qemu_close(void* opaque);
+
+/**
+ * An fread like wrapper for an rrfile
+ */
+size_t rrfile_fread(void* ptr, size_t size, size_t nmemb, struct rr_file* rr);
+
+/**
+ * Open an rr2 file for writing. This creates the archive and the magic file,
+ * but does not create the snapshot
+ */
+struct rr_file_state* rrfile_open_write(const char* fpath);
+
+/**
+ * Add a file to the recording archive, deleting the original
+ */
+bool rrfile_add_recording_file(struct rr_file_state* rstate, const char* type,
+                               const char* fpath);
+
+/**
+ * copy a file file from one recording archive to another recording archive
+ */
+int rrfile_copy_recording_file(struct rr_file_state* rstate, const char* type,
+                               char * replay_name);
+
+/**
+ * Close a newly create rr2 file, calculating file hashes, etc
+ */
+void rrfile_finalize(struct rr_file_state*);
+
+/**
+ * Update the rrfile module to use rr_archive as its working archive.
+ * This is used to store the open archive file while the vm is writing
+ * and the nondetlog is being written
+ */
+void rrfile_set_working(struct rr_file_state* rr_archive);
+
+struct rr_file_state* rrfile_get_working(void);
+
+bool has_rr2_file_extention(const char *filename);
+bool is_gzip(const char *filename);
+char* rr2_name(const char* fpath);
+bool is_rr2_file(const char *filename);
+char* remove_rr2_ext(const char* base_name);
+#endif
diff --git a/panda/include/panda/rr/rr_log.h b/panda/include/panda/rr/rr_log.h
index 678fb20b323..f82dd3a7cd2 100644
--- a/panda/include/panda/rr/rr_log.h
+++ b/panda/include/panda/rr/rr_log.h
@@ -14,6 +14,7 @@
 #include "panda/cheaders.h"
 #endif
 #include "panda/rr/rr_log_all.h"
+#include "panda/rr/panda_rr2.h"
 
 // accessors
 uint64_t rr_get_pc(void);
@@ -140,8 +141,13 @@ typedef struct RR_log_t {
     RR_log_type type;              // record or replay
     RR_prog_point last_prog_point; // to report progress
 
+    bool rr2; // indicate if using rr2 format
     char* name; // file name
-    FILE* fp;   // file pointer for log
+    union {
+    	FILE* fp; // file pointer for creating recording log and non-rr2 replays
+    	struct rr_file* replay_rr; // struct used for log when running rr2 replays
+    } file;
+
     unsigned long long
         size; // for a log being opened for read, this will be the size in bytes
     uint64_t bytes_read;
diff --git a/panda/include/panda/rr/rr_log_all.h b/panda/include/panda/rr/rr_log_all.h
index 20abeb67132..7923b9ce0c6 100644
--- a/panda/include/panda/rr/rr_log_all.h
+++ b/panda/include/panda/rr/rr_log_all.h
@@ -42,18 +42,29 @@
 #define GENERATE_STRING(STRING) #STRING
 
 // Log management
-void rr_create_record_log(const char* filename);
+// for log compressed in rr2 file
+void rr2_create_replay_log(void);
+// for uncompressed log
+void rr1_create_replay_log(void);
 void rr_create_replay_log(const char* filename);
+void rr_create_record_log(const char* filename);
 void rr_destroy_log(void);
 uint8_t rr_replay_finished(void);
+void rr_fseek_cur(size_t size);
 
 // used from monitor.c
 int rr_do_begin_record(const char* name, CPUState* cpu_state);
 void rr_do_end_record(void);
+int load_snapshot_state(QEMUFile* snp);
 int rr_do_begin_replay(const char* name, CPUState* cpu_state);
 void rr_do_end_replay(int is_error);
 void rr_reset_state(CPUState* cpu_state);
 
+//misc rr2 record and replay functions
+int rr2_add_recording_files(char* rr_name, char* rr_path);
+int rr2_load_snapshot(char* name_buf, int name_buf_size, const char* file_name_full);
+int rr1_load_snapshot(char* rr_name, char* rr_path, char* name_buf, int name_buf_size);
+
 // mz display indication of replay progress
 extern void replay_progress(void);
 
diff --git a/panda/plugins/scissors/README.md b/panda/plugins/scissors/README.md
index 9a3a69f0edf..56ff240d352 100644
--- a/panda/plugins/scissors/README.md
+++ b/panda/plugins/scissors/README.md
@@ -10,6 +10,8 @@ For example, if you're doing a heavyweight analysis like taint tracking, and you
 
 If you don't know what starting and ending instruction count contains your region of interest, you can use QEMU's debug output to determine it. Running a replay with `-d in_asm,rr` will print the rr instruction counts of each guest instruction. 
 
+The plugin can handle both the old and new record and replay format. The file produced by the plugin will be in rr2 format, if the `.rr2` extention is supplied with the new name, or the rr1 format, if not.
+
 Arguments
 ---------
 
@@ -30,11 +32,11 @@ None.
 Example
 -------
 
-Snipping from instruction 12345 to 8675309 into `foo_reduced`:
+Snipping from instruction 12345 to 8675309 into `foo_reduced[.rr2]`:
 
 ```sh
-$PANDA_PATH/x86_64-softmmu/panda-system-x86_64 -replay foo \
-    -panda scissors:name=foo_reduced,start=12345,end=8675309
+$PANDA_PATH/x86_64-softmmu/panda-system-x86_64 -replay foo[.rr2] \
+    -panda scissors:name=foo_reduced[.rr2],start=12345,end=8675309
 ```
 
 Bugs
diff --git a/panda/plugins/scissors/scissors.c b/panda/plugins/scissors/scissors.c
index 349823a7612..d97a77e2364 100644
--- a/panda/plugins/scissors/scissors.c
+++ b/panda/plugins/scissors/scissors.c
@@ -15,6 +15,7 @@
 #include "panda/rr/rr_log.h"
 #include "panda/rr/rr_api.h"
 #include "panda/common.h"
+#include "panda/include/panda/rr/panda_rr2.h"
 
 #include "migration/migration.h"
 #include "include/exec/address-spaces.h"
@@ -35,10 +36,18 @@ static uint64_t end_count;
 
 static char *nondet_name;
 static char *snp_name;
-
-static FILE *oldlog = NULL;
+static char *cmdline_file_name;
+static char *new_rr2_name;
+
+static bool oldlog_rr2;
+static bool newlog_rr2;
+union {
+    struct rr_file *rr2; // used if input is rr2 format
+    FILE *rr1; // used if input is old format
+} oldlog;
 static FILE *newlog = NULL;
-
+struct rr_file_state* new_rr_archive;
+static size_t bytes_read = 0;
 static RR_log_type rr_nondet_log_type;
 static unsigned long long rr_nondet_log_size;
 
@@ -46,7 +55,6 @@ static unsigned long long rr_nondet_log_size;
 static RR_prog_point orig_last_prog_point = {0};
 static RR_prog_point pp_last_copied_log_entry;
 
-
 static bool snipping = false;
 static bool done = false;
 
@@ -68,18 +76,32 @@ static INLINEIT size_t rr_fwrite(void *ptr, size_t size, size_t nmemb, FILE *f)
     return result;
 }
 
-static INLINEIT size_t rr_fread(void *ptr, size_t size, size_t nmemb, FILE *f) {
-    size_t result = fread(ptr, size, nmemb, f);
+static INLINEIT size_t rr_fread(void *ptr, size_t size, size_t nmemb) {
+    size_t result;
+    if (oldlog_rr2) {
+        result = rrfile_fread(ptr, size, nmemb, oldlog.rr2);
+    } else {
+        result = fread(ptr, size, nmemb, oldlog.rr1);
+    }
     sassert(result == nmemb, 2);
+    bytes_read += nmemb * size;
     return result;
 }
 
-static INLINEIT void rr_fcopy(void *ptr, size_t size, size_t nmemb, FILE *oldlog, FILE *newlog) {
-    rr_fread(ptr, size, nmemb, oldlog);
+static INLINEIT void rr_fcopy(void *ptr, size_t size, size_t nmemb, FILE *newlog) {
+    rr_fread(ptr, size, nmemb);
     rr_fwrite(ptr, size, nmemb, newlog);
 }
 
-static INLINEIT RR_log_entry *alloc_new_entry(void) 
+static INLINEIT bool rr_log_is_empty(void) {
+    if (rr_nondet_log_type == REPLAY){
+        return bytes_read == rr_nondet_log_size;
+    } else {
+        return false;
+    }
+}
+
+static INLINEIT RR_log_entry *alloc_new_entry(void)
 {
     static RR_log_entry *new_entry = NULL;
     if(!new_entry) new_entry = g_new(RR_log_entry, 1);
@@ -87,13 +109,22 @@ static INLINEIT RR_log_entry *alloc_new_entry(void)
     return new_entry;
 }
 
-static INLINEIT bool rr_log_is_empty(void) {
-    if (rr_nondet_log_type == REPLAY){
-        long pos = ftell(oldlog);
-        return pos == rr_nondet_log_size;
-    } else {
-        return false;
-    }
+static void rr_fseek_set(size_t bytes){
+  if (oldlog_rr2) {
+      rrfile_fseek_set(&(oldlog.rr2), rr_nondet_log->name, bytes);
+  } else {
+      fseek(oldlog.rr1, bytes, SEEK_SET);
+  }
+  bytes_read = bytes;
+}
+
+static inline char *rr1_cmdline_file_name(char* replay_name) {
+    size_t needed;
+    char* cmdline_name;
+    needed = snprintf(NULL, 0, "%s-rr.cmd", replay_name);
+    cmdline_name = malloc(needed+1);
+    snprintf(cmdline_name, needed+1, "%s-rr.cmd", replay_name);
+    return cmdline_name;
 }
 
 // Returns guest instr count (in old replay counting mode)
@@ -102,13 +133,11 @@ static RR_prog_point copy_entry(void) {
     // Copy entry.
     RR_log_entry *item = alloc_new_entry();
 
-    long pos = ftell(oldlog);
-
-    rr_fread(&(item->header.prog_point.guest_instr_count), sizeof(item->header.prog_point.guest_instr_count), 1, oldlog);
+    rr_fread(&(item->header.prog_point.guest_instr_count), sizeof(item->header.prog_point.guest_instr_count), 1);
 
     if (item->header.prog_point.guest_instr_count > end_count) {
         // We don't want to copy this one.
-        fseek(oldlog, pos, SEEK_SET);
+        rr_fseek_set(bytes_read);
         return item->header.prog_point;
     }
 
@@ -117,10 +146,10 @@ static RR_prog_point copy_entry(void) {
     item->header.prog_point.guest_instr_count -= actual_start_count;
     rr_fwrite(&item->header.prog_point, sizeof(item->header.prog_point), 1, newlog);
 
-#define RR_COPY_ITEM(field) rr_fcopy(&(field), sizeof(field), 1, oldlog, newlog)
+#define RR_COPY_ITEM(field) rr_fcopy(&(field), sizeof(field), 1, newlog)
     //rw only read 1 byte for kind and callsite_loc even though it's an enum, due to mz's optimization (see rr_log.h)
-    rr_fcopy(&(item->header.kind), 1, 1, oldlog, newlog);
-    rr_fcopy(&(item->header.callsite_loc), 1, 1, oldlog, newlog);
+    rr_fcopy(&(item->header.kind), 1, 1, newlog);
+    rr_fcopy(&(item->header.callsite_loc), 1, 1, newlog);
 
     //mz read the rest of the item
     switch (item->header.kind) {
@@ -151,7 +180,7 @@ static RR_prog_point copy_entry(void) {
         case RR_SKIPPED_CALL: {
             RR_skipped_call_args *args = &item->variant.call_args;
             //mz read kind first!
-            rr_fcopy(&args->kind, 1, 1, oldlog, newlog);
+            rr_fcopy(&args->kind, 1, 1, newlog);
 
             switch(args->kind) {
                 case RR_CALL_CPU_MEM_RW:
@@ -160,7 +189,7 @@ static RR_prog_point copy_entry(void) {
                         g_malloc(args->variant.cpu_mem_rw_args.len);
                     rr_fcopy(args->variant.cpu_mem_rw_args.buf, 1,
                             args->variant.cpu_mem_rw_args.len,
-                            oldlog, newlog);
+                            newlog);
                     break;
                 case RR_CALL_CPU_MEM_UNMAP:
                     RR_COPY_ITEM(args->variant.cpu_mem_unmap);
@@ -168,7 +197,7 @@ static RR_prog_point copy_entry(void) {
                         g_malloc(args->variant.cpu_mem_unmap.len);
                     rr_fcopy(args->variant.cpu_mem_unmap.buf, 1,
                                 args->variant.cpu_mem_unmap.len,
-                                oldlog, newlog);
+                                newlog);
                     break;
                 case RR_CALL_MEM_REGION_CHANGE:
                     RR_COPY_ITEM(args->variant.mem_region_change_args);
@@ -176,7 +205,7 @@ static RR_prog_point copy_entry(void) {
                         g_malloc0(args->variant.mem_region_change_args.len + 1);
                     rr_fcopy(args->variant.mem_region_change_args.name, 1,
                             args->variant.mem_region_change_args.len,
-                            oldlog, newlog);
+                            newlog);
                     break;
                 case RR_CALL_HD_TRANSFER:
                     RR_COPY_ITEM(args->variant.hd_transfer_args);
@@ -190,7 +219,7 @@ static RR_prog_point copy_entry(void) {
                         g_malloc(args->variant.handle_packet_args.size);
                     rr_fcopy(args->variant.handle_packet_args.buf,
                             args->variant.handle_packet_args.size, 1,
-                            oldlog, newlog);
+                            newlog);
                     break;
                 case RR_CALL_SERIAL_READ:
                     RR_COPY_ITEM(args->variant.serial_read_args);
@@ -221,50 +250,113 @@ static RR_prog_point copy_entry(void) {
     return original_prog_point;
 }
 
-static void start_snip(uint64_t count) {
-    sassert((oldlog = fopen(rr_nondet_log->name, "r")), 8);
-    rr_nondet_log_type = rr_nondet_log->type;
-    rr_nondet_log_size = rr_nondet_log->size;
-    sassert(fread(&orig_last_prog_point, sizeof(RR_prog_point), 1, oldlog) == 1, 9);
-    printf("Original ending prog point: %" PRId64 "\n", (uint64_t) orig_last_prog_point.guest_instr_count);
-
-    actual_start_count = count;
-    printf("Saving snapshot at instr count %" PRIx64 "...\n", count);
-    
+static inline void save_snp_shot(void) {
     // Force running state
     global_state_store_running();
-    printf("writing snapshot:\t%s\n", snp_name);
     QIOChannelFile* ioc =
         qio_channel_file_new_path(snp_name, O_WRONLY | O_CREAT, 0660, NULL);
     QEMUFile* snp = qemu_fopen_channel_output(QIO_CHANNEL(ioc));
     qemu_savevm_state(snp, NULL);
     qemu_fclose(snp);
-    
-    printf("Beginning cut-and-paste process at prog point: % " PRId64 "\n", (uint64_t) rr_get_guest_instr_count());
+}
+
+static void create_command_file(void) {
+    char *replay_name = strdup(panda_get_rr_name());
+    FILE *fp = fopen(cmdline_file_name, "w");
+    sassert(fp!=NULL, 5);
+
+    if (oldlog_rr2) {
+        char* cmdline_contents;
+        rrfile_read_cmdline(replay_name, &cmdline_contents);
+        fwrite(cmdline_contents, 1, strlen(cmdline_contents), fp);
+    } else {
+        fprintf (fp, "created with the scissors plugin\n");
+    }
+    free(replay_name);
+    fclose(fp);
+}
+
+static bool open_old_log(void){
+    bool success;
+    if (oldlog_rr2) {
+        success = (rrfile_open_read(rr_nondet_log->name, "nondetlog", &(oldlog.rr2)) == 0) ? true : false;
+    } else {
+        success = (oldlog.rr1 = fopen(rr_nondet_log->name, "r"));
+    }
+    return success;
+}
 
-    printf("Writing entries to %s...\n", nondet_name);
+static void write_to_rr2(void) {
+    printf("Moving files over to rr2 archive %s\n", new_rr2_name);
+    printf("    moving cmdline to %s/capture.cmd ...\n", new_rr2_name);
+    sassert(rrfile_add_recording_file(new_rr_archive, "capture.cmd", cmdline_file_name), 8);
+
+    printf("    moving snapshot to %s/snapshot ...\n", new_rr2_name);
+    sassert(rrfile_add_recording_file(new_rr_archive, "snapshot", snp_name), 7);
+
+    printf("    moving nondetlog entries to %s/nondetlog ...\n", new_rr2_name);
+    sassert(rrfile_add_recording_file(new_rr_archive, "nondetlog", nondet_name), 9);
+    rrfile_finalize(new_rr_archive);
+}
+
+static void clean_up(void){
+    free(nondet_name);
+    free(snp_name);
+    if (newlog_rr2) {
+        free(cmdline_file_name);
+        free(new_rr2_name);
+    }
+    if (oldlog_rr2) {
+        rrfile_free(oldlog.rr2);
+    }
+}
+
+static void start_snip(uint64_t count) {
+    oldlog_rr2 = rr_nondet_log->rr2;
+    sassert(open_old_log(), 10);
+    rr_nondet_log_type = rr_nondet_log->type;
+    rr_nondet_log_size = rr_nondet_log->size;
+
+    // initiate rr2 file creation
+    if (newlog_rr2) {
+        new_rr_archive = rrfile_open_write(new_rr2_name);
+        sassert(new_rr_archive, 11);
+        printf("Writing cmdline to %s ...\n", cmdline_file_name);
+        create_command_file();
+    }
+
+    sassert(rr_fread(&orig_last_prog_point, sizeof(RR_prog_point), 1) == 1, 12);
+    printf("Original ending prog point: %" PRId64 "\n", (uint64_t) orig_last_prog_point.guest_instr_count);
+
+    actual_start_count = count;
+    printf("Saving snapshot at instr count %" PRIx64 "...\n", count);
+    printf("Writing snapshot to %s ...\n", snp_name);
+    save_snp_shot();
+
+    printf("Beginning cut-and-paste process at prog point: % " PRId64 "\n", (uint64_t) rr_get_guest_instr_count());
+    printf("Writing entries to %s ...\n", nondet_name);
     newlog = fopen(nondet_name, "w");
-    sassert(newlog, 10);
+    sassert(newlog, 13);
     // We'll fix this up later.
     RR_prog_point prog_point = {0};
     fwrite(&prog_point.guest_instr_count,
            sizeof(prog_point.guest_instr_count), 1, newlog);
-    
-    fseek(oldlog, ftell(rr_nondet_log->fp), SEEK_SET);
-    
+
+    rr_fseek_set(rr_nondet_log->bytes_read);
+
     // If there are items in the queue, then start copying the log
     // from there
     RR_log_entry *item = rr_get_queue_head();
-    if (item != NULL) fseek(oldlog, item->header.file_pos, SEEK_SET);
-    
+    if (item != NULL) rr_fseek_set(item->header.file_pos);
+
     //rw: For some reason I need to add an interrupt entry at the beginning of the log?
     RR_log_entry temp;
-    
+
     memset(&temp, 0, sizeof(RR_log_entry));
     temp.header.kind = RR_INTERRUPT_REQUEST;
     temp.header.callsite_loc = RR_CALLSITE_CPU_HANDLE_INTERRUPT_BEFORE;
     temp.variant.pending_interrupts = 2;
-    
+
     fwrite(&temp.header.prog_point, sizeof(temp.header.prog_point), 1, newlog);
     fwrite(&temp.header.kind, 1, 1, newlog);
     fwrite(&temp.header.callsite_loc, 1, 1, newlog);
@@ -274,14 +366,11 @@ static void start_snip(uint64_t count) {
         prog_point = copy_entry();
     }
     pp_last_copied_log_entry = prog_point;
-    
+
     snipping = true;
     printf("Continuing with replay.\n");
 }
 
-
-
-
 static void end_snip(void) {
     RR_prog_point prog_point = rr_prog_point();
     printf("Ending cut-and-paste on prog point: %" PRId64 "\n", prog_point.guest_instr_count);
@@ -295,7 +384,7 @@ static void end_snip(void) {
             pp = copy_entry();
         }
     }
-    
+
 
     printf ("rr_queue_empy = %d\n", (int) rr_queue_empty());
 
@@ -306,19 +395,23 @@ static void end_snip(void) {
     end.callsite_loc = RR_CALLSITE_LAST;
     end.prog_point = prog_point;
     sassert(fwrite(&(end.prog_point.guest_instr_count),
-                sizeof(end.prog_point.guest_instr_count), 1, newlog) == 1, 5);
-    sassert(fwrite(&(end.kind), 1, 1, newlog) == 1, 6);
-    sassert(fwrite(&(end.callsite_loc), 1, 1, newlog) == 1, 7);
+                sizeof(end.prog_point.guest_instr_count), 1, newlog) == 1, 14);
+    sassert(fwrite(&(end.kind), 1, 1, newlog) == 1, 15);
+    sassert(fwrite(&(end.callsite_loc), 1, 1, newlog) == 1, 16);
 
     rewind(newlog);
     fwrite(&prog_point.guest_instr_count,
             sizeof(prog_point.guest_instr_count), 1, newlog);
     fclose(newlog);
 
+    if (newlog_rr2) {
+        write_to_rr2();
+    }
+    clean_up();
+    printf("...complete!\n");
     done = true;
 }
 
-
 bool request_start_snip = false;
 bool snip_started = false;
 bool snip_done = false;
@@ -343,7 +436,6 @@ void check_end_snip(CPUState *env) {
     end_snip();
 }
 
-
 void before_block_exec(CPUState *env, TranslationBlock *tb) {
     uint64_t count = rr_get_guest_instr_count();
     if (!snipping && count+tb->icount > start_count) {
@@ -358,6 +450,14 @@ void before_block_exec(CPUState *env, TranslationBlock *tb) {
     return;
 }
 
+static inline char*  initialize_file_name(char* sciss_dir, const char* name, const char* ext) {
+    size_t needed;
+    needed = snprintf(NULL, 0, "%s/%s%s", sciss_dir, name, ext);
+    char * file_name = malloc(needed+1);
+    snprintf(file_name, needed+1, "%s/%s%s", sciss_dir, name, ext);
+    return file_name;
+}
+
 bool init_plugin(void *self) {
     panda_cb pcb = { .before_block_exec = before_block_exec };
     panda_register_callback(self, PANDA_CB_BEFORE_BLOCK_EXEC, pcb);
@@ -381,8 +481,10 @@ bool init_plugin(void *self) {
     }
 
     // we will seg fault in savevm if path to scissors files doesnt exist...
-    char *name_copy = strdup(name);
-    char *sciss_dir = dirname(name_copy);    
+    char* name_copy = strdup(name);
+    char* rr_base_name = basename(name_copy);
+    char* rr_name = remove_rr2_ext(rr_base_name);
+    char* sciss_dir = dirname(name_copy);
     DIR* dir = opendir(sciss_dir);
     if (dir) {
         /* Directory exists. */
@@ -397,13 +499,16 @@ bool init_plugin(void *self) {
         return false;
     }
 
-    size_t needed;
-    needed = snprintf(NULL, 0, "%s-rr-nondet.log", name);
-    nondet_name = malloc(needed+1);
-    snprintf(nondet_name, needed+1, "%s-rr-nondet.log", name);
-    needed = snprintf(NULL, 0, "%s-rr-snp", name);
-    snp_name = malloc(needed+1);
-    snprintf(snp_name, needed+1, "%s-rr-snp", name);
+    newlog_rr2 = has_rr2_file_extention(name_copy);
+    nondet_name = initialize_file_name(sciss_dir, rr_name, "-rr-nondet.log");
+    snp_name = initialize_file_name(sciss_dir, rr_name, "-rr-snp");
+    if (newlog_rr2) {
+        cmdline_file_name = initialize_file_name(sciss_dir, rr_name, "-rr.cmd");
+        new_rr2_name = initialize_file_name(sciss_dir, rr_name, ".rr2");
+    }
+
+    free(name_copy);
+    free(rr_name);
 
     return true;
 }
diff --git a/panda/python/core/pandare/panda.py b/panda/python/core/pandare/panda.py
old mode 100755
new mode 100644
index 53602fc61f3..64917305c15
--- a/panda/python/core/pandare/panda.py
+++ b/panda/python/core/pandare/panda.py
@@ -32,7 +32,7 @@
 from time import sleep
 from cffi import FFI
 
-from .utils import progress, warn, make_iso, debug, blocking, GArrayIterator, plugin_list, find_build_dir
+from .utils import progress, warn, make_iso, debug, blocking, GArrayIterator, plugin_list, find_build_dir, rr2_recording, rr2_contains_member
 from .taint import TaintQuery
 from .panda_expect import Expect
 from .asyncthread import AsyncThread
@@ -562,7 +562,7 @@ def end_record(self):
         res_string_enum = self.ffi.string(self.ffi.cast("RRCTRL_ret",result))
         if res_string_enum != "RRCTRL_OK":
            raise Exception(f"record method failed with RTCTL_ret {res_string_enum} ({result})")
-    
+
     def recording_exists(self, name):
         '''
         Checks if a recording file exists on disk.
@@ -573,7 +573,7 @@ def recording_exists(self, name):
         Returns:
             boolean: true if file exists, false otherwise
         '''
-        if exists(name + "-rr-snp"):
+        if exists(name + "-rr-snp") or rr2_contains_member(name, "snapshot"):
             return True
 
     def run_replay(self, replaypfx):
@@ -586,7 +586,7 @@ def run_replay(self, replaypfx):
         Returns:
             None
         '''
-        if not isfile(replaypfx+"-rr-snp") or not isfile(replaypfx+"-rr-nondet.log"):
+        if (not isfile(replaypfx+"-rr-snp") or not isfile(replaypfx+"-rr-nondet.log")) and not rr2_recording(replaypfx):
             raise ValueError("Replay files not present to run replay of {}".format(replaypfx))
 
         self.ending = False
diff --git a/panda/python/core/pandare/utils.py b/panda/python/core/pandare/utils.py
index 508e7a8d9ea..dda2172415b 100644
--- a/panda/python/core/pandare/utils.py
+++ b/panda/python/core/pandare/utils.py
@@ -9,9 +9,12 @@
 from subprocess import check_call, STDOUT
 from sys import platform, stdout
 from threading import current_thread, main_thread
+
 #for _find_build_path
 from os import dup, getenv, environ, path
 from os.path import realpath, isfile, dirname, join as pjoin
+# for rr2 format
+import  tarfile
 
 # Set to enable pypanda debugging
 debug = False
@@ -105,6 +108,32 @@ def wrapper(*args, **kwargs):
     wrapper.__name__ = func.__name__ + " (with async thread)"
     return wrapper
 
+
+def rr2_name(name):
+    return name if name.endswith(".rr2") else name + ".rr2"
+
+def rr2_recording(name):
+    def is_gzip(name):
+        rr = open(name, "rb")
+        return rr.read(2) == b'\x1f\x8b'
+
+    rr2_filename = rr2_name(name)
+    if isfile(rr2_filename) and is_gzip(rr2_filename):
+        return True
+    return False
+
+def rr2_contains_member(name, member):
+    rr2_filename = rr2_name(name)
+    contains_member = False
+    if rr2_recording(rr2_filename):
+        try:
+            tar = tarfile.open(rr2_filename)
+            tar.getmember(member)
+            contains_member = True
+        except (KeyError, IsADirectoryError, FileNotFoundError, tarfile.ReadError):
+            pass
+    return contains_member
+
 class GArrayIterator():
     '''
     Iterator which will run a function on each iteration incrementing
diff --git a/panda/scripts/rr2pack.py b/panda/scripts/rr2pack.py
new file mode 100644
index 00000000000..4a4cb3ecbac
--- /dev/null
+++ b/panda/scripts/rr2pack.py
@@ -0,0 +1,142 @@
+import os
+import sys
+import time
+import json
+import tarfile
+import traceback
+import argparse
+import itertools
+import tempfile
+import hashlib
+from io import StringIO
+
+SUFFIX_MAPPER = {
+    '-rr-nondet.log' : 'nondetlog',
+    '-rr-snp'        : 'snapshot',
+    '-rr.cmd'        : 'capture.cmd'
+}
+
+def fixup_basename(basename):
+    potential_endings = itertools.chain(SUFFIX_MAPPER.keys(), ['-rr'])
+    for ending in potential_endings:
+        if basename.endswith(ending):
+            basename = basename.replace(ending, '')
+            break
+
+    for required_ending in SUFFIX_MAPPER.keys():
+        fpath = basename + required_ending
+        if not os.path.isfile(fpath):
+            raise IOError("Could not find required RR file {}".format(fpath))
+    return basename
+
+def validate_args(args):
+    args.basename = fixup_basename(args.basename)
+    if not args.output:
+        args.output = os.path.basename(args.basename) + '.rr2'
+    if os.path.exists(args.output):
+        if not os.path.isfile(args.output):
+            raise IOError("Output must be a file path, not a directory")
+        if not args.force:
+            raise IOError("Output file already exists. Please remove or use --force")
+        os.unlink(args.output)
+    if args.metadata:
+        if not os.path.isfile(args.metadata):
+            raise IOError("Cannot read {}".format(args.metadata))
+        with open(args.metadata, 'r') as fobj:
+            json.load(fobj)
+    return args
+
+def dbg_print(args, string):
+    if args.verbose:
+        print(string)
+
+def add_rrmagic(tfile):
+    with tempfile.NamedTemporaryFile(mode = "w") as fobj:
+        fobj.write("Packed at {}".format(time.ctime()))
+        fobj.flush()
+        tfile.add(fobj.name, "RRv2", recursive=False)
+
+def calculate_hashes(tfile, args):
+    hashes = {}
+    for member in tfile.getmembers():
+        filename = member.name
+        sha1 = hashlib.sha1()
+        inobj = tfile.extractfile(member)
+        data = inobj.read(4096)
+        while data:
+            sha1.update(data)
+            data = inobj.read(4096)
+        digest = sha1.hexdigest()
+        hashes[filename] = digest
+    return hashes
+
+def add_hashes(args):
+    hashes = {}
+    with tarfile.open(name=args.output, mode='r') as tfile:
+        hashes = calculate_hashes(tfile, args)
+    with tarfile.open(name=args.output, mode='a:') as tfile:
+        with tempfile.NamedTemporaryFile(mode = "w") as tempobj:
+            for filename, digest in sorted(hashes.items()):
+                dbg_print(args, "...{}: {}".format(filename, digest))
+                tempobj.write("{}: {}\n".format(filename, digest))
+            tempobj.flush()
+            tfile.add(tempobj.name, 'sha1')
+
+def add_files(tfile, args):
+    for required_ending, arcname in sorted(SUFFIX_MAPPER.items()):
+        dbg_print(args, "...adding {}".format(arcname))
+        fpath = args.basename + required_ending
+        tfile.add(fpath, arcname=arcname, recursive=False)
+
+def add_metadata(tfile, args):
+    if not args.metadata:
+        with tempfile.NamedTemporaryFile(mode = "w") as tempobj:
+            json.dump({}, tempobj)
+            tempobj.flush()
+            tfile.add(tempobj.name, 'metadata.json')
+    else:
+        tfile.add(args.metadata, 'metadata.json', recursive=False)
+
+def create_rr2(args):
+    print("Packing {} into {}".format(args.basename, args.output))
+
+    with tarfile.open(name=args.output, mode='w:') as tfile:
+        dbg_print(args, "Adding RRv2 magic file")
+        add_rrmagic(tfile)
+        dbg_print(args, "Adding replay files")
+        add_files(tfile, args)
+        dbg_print(args, "Adding metadata")
+        add_metadata(tfile, args)
+    dbg_print(args, "Adding file hashes")
+    add_hashes(args)
+
+def main():
+    parser = argparse.ArgumentParser("Pack output from PANDA recording into an .rr2")
+    parser.add_argument("basename", type=str,
+                            help="Path to one of the recording files (or common prefix)")
+    parser.add_argument("--metadata", type=str, help="An optional JSON file of metadata")
+    parser.add_argument("--output", type=str,
+                            help="Path for the new .rr2 (default basename.rr2)")
+    parser.add_argument("--force", action="store_true",
+                            help="Overwrite --output if it exists")
+    parser.add_argument("--verbose", action="store_true",
+                            help="Print extra information messages")
+    args = parser.parse_args()
+    try:
+        args = validate_args(args)
+    except:
+        traceback.print_exc()
+        print ("\n\n[ERROR]: Failed to validate arguments, exiting...")
+        sys.exit(1)
+
+    try:
+        create_rr2(args)
+    except:
+        traceback.print_exc()
+        print("Failed to pack {}".format(args.basename))
+        if os.path.exists(args.output):
+            os.unlink(args.output)
+        sys.exit(2)
+
+if __name__ == '__main__':
+    main()
diff --git a/panda/src/checkpoint.c b/panda/src/checkpoint.c
index 6464d41835a..e1ba3baa56d 100644
--- a/panda/src/checkpoint.c
+++ b/panda/src/checkpoint.c
@@ -196,7 +196,7 @@ void panda_restore(void *opaque) {
     first_cpu->rr_guest_instr_count = checkpoint->guest_instr_count;
     first_cpu->panda_guest_pc = panda_current_pc(first_cpu);
     rr_nondet_log->bytes_read = checkpoint->nondet_log_position;
-    fseek(rr_nondet_log->fp, checkpoint->nondet_log_position, SEEK_SET);
+    rrfile_fseek_set(&rr_nondet_log->file.replay_rr, rr_nondet_log->name, checkpoint->nondet_log_position);
     rr_queue_head = rr_queue_tail = NULL;
 
     memcpy(rr_number_of_log_entries, checkpoint->number_of_log_entries,
diff --git a/panda/src/rr/panda_rr2.c b/panda/src/rr/panda_rr2.c
new file mode 100644
index 00000000000..c04f38ce06e
--- /dev/null
+++ b/panda/src/rr/panda_rr2.c
@@ -0,0 +1,574 @@
+#include <stdbool.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <time.h>
+
+#include <archive.h>
+#include <archive_entry.h>
+#include <openssl/sha.h>
+
+#include "config-host.h"
+#include "panda/rr/panda_rr2.h"
+
+// Forward decels for helper functions
+bool write_file_to_archive(struct rr_file_state* rstate, const char* fname,
+                           const uint8_t* contents, size_t len);
+void write_metadata_file(struct rr_file_state* rstate);
+void write_magic_file(struct rr_file_state* rstate);
+void write_hash_to_log(struct rr_file_state* rstate, const char* fname, SHA_CTX* ctx);
+bool is_valid_rrv2_file(const char* state);
+void add_file_hash_for_content(struct rr_file_state* rstate, const char* fname,
+                               const void* content, size_t len);
+
+struct rr_file_state {
+    struct archive* archive;
+    char* hash_fpath;
+    FILE* hash_fp;
+};
+
+// Used to hold state between rr_do_begin_record and rr_do_end_record
+// Add back in for second release of rr2
+struct rr_file_state* g_rr_file_state = NULL;
+
+void rrfile_set_working(struct rr_file_state* rr_archive)
+{
+    g_rr_file_state = rr_archive;
+}
+
+struct rr_file_state* rrfile_get_working(void) { return g_rr_file_state; }
+
+// Valid components of an RRv2 tar file
+const char* MAGIC_FILE    = "RRv2";
+const char* SNAPSHOT_FILE = "snapshot";
+const char* COMMAND_FILE  = "capture.cmd";
+const char* NONDET_FILE   = "nondetlog";
+const char* HASHES_FILE   = "sha1";
+const char* METADATA_FILE = "metadata.json";
+
+bool is_valid_rrv2_file(const char* state)
+{
+    if (strcmp(state, MAGIC_FILE) == 0) {
+        return true;
+    } else if (strcmp(state, SNAPSHOT_FILE) == 0) {
+        return true;
+    } else if (strcmp(state, COMMAND_FILE) == 0) {
+        return true;
+    } else if (strcmp(state, NONDET_FILE) == 0) {
+        return true;
+    } else if (strcmp(state, HASHES_FILE) == 0) {
+        return true;
+    } else if (strcmp(state, METADATA_FILE) == 0) {
+        return true;
+    } else {
+        return false;
+    }
+}
+
+/////////////////
+// RRv2 Reading
+/////////////////
+
+ssize_t rrfile_qemu_getbuffer(void* opaque, uint8_t* buffer, int64_t pos, size_t size)
+{
+    struct rr_file* rr = (struct rr_file*)opaque;
+    return archive_read_data(rr->archive, buffer, size);
+}
+
+int rrfile_qemu_close(void* opaque)
+{
+    if (opaque) {
+        rrfile_free((struct rr_file*)opaque);
+    }
+    return 0;
+}
+
+int rrfile_read_cmdline(const char* fpath, char** cmdline)
+{
+    return rrfile_read_contents_as_string(fpath, COMMAND_FILE, cmdline, true);
+}
+
+int rrfile_read_metadata(const char* fpath, char** metadata)
+{
+    return rrfile_read_contents_as_string(fpath, METADATA_FILE, metadata, true);
+}
+
+int rrfile_read_hashes(const char* fpath, char** hashes)
+{
+    return rrfile_read_contents_as_string(fpath, HASHES_FILE, hashes, true);
+}
+
+int rrfile_read_contents_as_string(const char* fpath, const char* section,
+                                   char** contents, bool strip)
+{
+    struct rr_file* rr = NULL;
+    int status = rrfile_open_read(fpath, section, &rr);
+    if (!RRFILE_SUCCESS(status)) {
+        *contents = NULL;
+        return status;
+    }
+    int64_t contents_size = archive_entry_size(rr->entry);
+    if (contents_size <= 0) {
+        rrfile_free(rr);
+        *contents = NULL;
+        return 5;
+    }
+    *contents = calloc(1, contents_size + 1);
+    ssize_t read_size = archive_read_data(rr->archive, *contents, contents_size);
+    if (read_size != contents_size) {
+        fprintf(stderr, "Failed to read entire command line\n");
+        return 6;
+    }
+    // Strip trailing newlines
+    if (strip) {
+        for (int64_t idx = contents_size - 1; idx > 0; --idx) {
+            if ((*contents)[idx] == '\n') {
+                (*contents)[idx] = '\0';
+            } else {
+                break;
+            }
+        }
+    }
+    rrfile_free(rr);
+    return 0;
+}
+
+int64_t rrfile_section_size(struct rr_file* rr)
+{
+    if (!rr->entry) {
+        return 0;
+    }
+    return archive_entry_size(rr->entry);
+}
+
+int rrfile_open_read(const char* fpath, const char* section, struct rr_file** rr)
+{
+    // Allocate a libarchive object for the RR file
+    struct archive_entry* entry = NULL;
+    struct rr_file* rrfile = calloc(1, sizeof(struct rr_file));
+    *rr = rrfile;
+    if (!rrfile) {
+        return 2;
+    }
+    rrfile->section = strdup(section);
+    struct archive* archive = archive_read_new();
+    rrfile->archive = archive;
+
+    // Open the archive (supporting anything libarchive can parse)
+    archive_read_support_filter_all(archive);
+    archive_read_support_format_all(archive);
+    int status = archive_read_open_filename(archive, fpath, 2048);
+    if (status != ARCHIVE_OK) {
+        archive_read_free(archive);
+        rrfile->archive = NULL;
+        return 3;
+    }
+
+    // Find the requested section
+    int found_section = 0;
+    entry = archive_entry_new();
+    while (archive_read_next_header2(archive, entry) == ARCHIVE_OK) {
+        if (strcmp(section, archive_entry_pathname(entry)) == 0) {
+            found_section = 1;
+            break;
+        }
+        archive_read_data_skip(archive);
+        archive_entry_clear(entry);
+    }
+    // If we didn't find it, exit
+    if (!found_section) {
+        archive_read_free(archive);
+        archive_entry_free(entry);
+        rrfile->archive = NULL;
+        return 4;
+    }
+    // Otherwise, capture it
+    rrfile->entry = entry;
+    return 0;
+}
+
+int rrfile_free(struct rr_file* rr)
+{
+    if (rr && rr->archive) {
+        archive_read_free(rr->archive);
+        rr->archive = 0;
+    }
+    if (rr->section) {
+        free(rr->section);
+        rr->section = 0;
+    }
+    if (rr->entry) {
+        archive_entry_free(rr->entry);
+        rr->entry = 0;
+    }
+    if (rr) {
+        free(rr);
+    }
+    return 0;
+}
+
+size_t rrfile_fread(void* input_ptr, size_t size, size_t nmemb, struct rr_file* rr)
+{
+    uint8_t* ptr = (uint8_t*)input_ptr;
+    size_t n = 0;
+    while (n < nmemb) {
+        int bytes_read = archive_read_data(rr->archive, ptr, size);
+        // Failed to read all the chunks, return the short item count
+        if (bytes_read != size) {
+            return n;
+        }
+	ptr += size;
+        n += 1;
+    }
+    return n;
+}
+
+/////////////////
+// RRv2 Writing
+/////////////////
+
+struct rr_file_state* rrfile_open_write(const char* fpath)
+{
+    struct rr_file_state* rstate =
+        (struct rr_file_state*)malloc(sizeof(struct rr_file_state));
+    // Allocate a libarchive object for the RR file
+    struct archive* archive = archive_write_new();
+    rstate->archive = archive;
+    if (ARCHIVE_OK != archive_write_add_filter_gzip(archive)) {
+        fprintf(stderr, "failed to set gzip mode %s\n", archive_error_string(archive));
+    }
+    if (ARCHIVE_OK != archive_write_set_format_ustar(archive)) {
+        fprintf(stderr, "failed to set ustar mode: %s\n", archive_error_string(archive));
+    }
+
+    // Open a temporary file to write hashes to
+    size_t needed = snprintf(NULL, 0, "%s-hashtmp", fpath);
+    rstate->hash_fpath = malloc(needed+1);
+    snprintf(rstate->hash_fpath, needed+1, "%s-hashtmp", fpath);
+
+    rstate->hash_fp = fopen(rstate->hash_fpath, "w");
+    if (rstate->hash_fp < 0) {
+        fprintf(stderr, "Failed to open temporary hash file at %s\n", rstate->hash_fpath);
+        return NULL;
+    }
+
+    // Open the archive (supporting anything libarchive can parse)
+    int status = archive_write_open_filename(archive, fpath);
+    if (status != ARCHIVE_OK) {
+        fprintf(stderr, "%s\n", archive_error_string(archive));
+        archive_write_free(archive);
+        return NULL;
+    }
+    write_magic_file(rstate);
+    return rstate;
+}
+
+bool rrfile_add_recording_file(struct rr_file_state* rstate, const char* type,
+                               const char* fpath)
+{
+    if (!is_valid_rrv2_file(type)) {
+        fprintf(stderr, "Invalid rrv2 file type: %s\n", type);
+        return false;
+    }
+    struct archive* a = rstate->archive;
+    struct stat st;
+    stat(fpath, &st);
+    struct archive_entry* entry = NULL;
+    entry = archive_entry_new();
+    archive_entry_set_pathname(entry, type);
+    archive_entry_set_filetype(entry, AE_IFREG);
+    FILE* fp = fopen(fpath, "rb");
+    fseek(fp, 0, SEEK_END);
+    archive_entry_set_size(entry, ftell(fp));
+    fseek(fp, 0, SEEK_SET);
+    archive_entry_copy_stat(entry, &st);
+    if (ARCHIVE_OK != archive_write_header(a, entry)) {
+        fprintf(stderr, "Failed to write archive header!\n");
+        fprintf(stderr, "Error: %s\n", archive_error_string(a));
+        archive_entry_free(entry);
+    }
+
+    // Initialize a SHA_CTX for openssl for this file
+    SHA_CTX* ctx = (SHA_CTX*)malloc(sizeof(SHA_CTX));
+    if (!ctx || !SHA1_Init(ctx)) {
+        fprintf(stderr, "Failed to find hash for file contents of %s\n", type);
+        if (ctx) {
+            free(ctx);
+        }
+        return false;
+    }
+
+    // Add the file contents
+    int len;
+    uint8_t buffer[1024 * 1024];
+    len = fread(buffer, 1, sizeof(buffer), fp);
+    while (len > 0) {
+        SHA1_Update(ctx, buffer, len);
+        int status = archive_write_data(a, buffer, len);
+        if (status <= 0) {
+            fprintf(stderr, "Failed to archive_write_data\n");
+        }
+        len = fread(buffer, 1, sizeof(buffer), fp);
+    }
+    fclose(fp);
+    if (ARCHIVE_OK != archive_write_finish_entry(a)) {
+        fprintf(stderr, "Failed to finish entry: %s\n", archive_error_string(a));
+    }
+    unlink(fpath);
+    // Write the hash for this file out to the log
+    write_hash_to_log(rstate, type, ctx);
+    free(ctx);
+    return true;
+}
+
+int rrfile_copy_recording_file(struct rr_file_state* rstate, const char* type,
+			       char * replay_name)
+{
+    if (!is_valid_rrv2_file(type)) {
+        fprintf(stderr, "Invalid rrv2 file type: %s\n", type);
+        return false;
+    }
+    struct rr_file* rr = NULL;
+    int status = rrfile_open_read(replay_name, type, &(rr));
+    if (!RRFILE_SUCCESS(status)) {
+        return status;
+    }
+    int64_t contents_size = archive_entry_size(rr->entry);
+    if (contents_size <= 0) {
+        rrfile_free(rr);
+        return 7;
+    }
+    if (ARCHIVE_OK != archive_write_header(rstate->archive, rr->entry)) {
+        fprintf(stderr, "Failed to write archive header!\n");
+        fprintf(stderr, "Error: %s\n", archive_error_string(rstate->archive));
+        rrfile_free(rr);
+        return 8;
+    }
+    void *buff;
+    buff = calloc(1, contents_size + 1);
+    ssize_t read_size = archive_read_data(rr->archive, buff, contents_size);
+    if (read_size != contents_size) {
+        fprintf(stderr, "Failed to read entire command line\n");
+        rrfile_free(rr);
+        free(buff);
+        return 9;
+    }
+    status = archive_write_data(rstate->archive, buff, contents_size);
+    rrfile_free(rr);
+    free(buff);
+    if (status <= 0) {
+        fprintf(stderr, "Failed to archive_write_data\n");
+        return 10;
+    }
+    return 0;
+}
+
+void rrfile_finalize(struct rr_file_state* rstate)
+{
+    if (rstate->hash_fp) {
+        fclose(rstate->hash_fp);
+        rstate->hash_fp = NULL;
+        if (!rrfile_add_recording_file(rstate, HASHES_FILE, rstate->hash_fpath)) {
+            fprintf(stderr, "Failed to write hash file to archive!\n");
+        }
+        free(rstate->hash_fpath);
+        rstate->hash_fpath = 0;
+    }
+    // Don't store the hash of the metadata file
+    write_metadata_file(rstate);
+    archive_write_free(rstate->archive);
+    rstate->archive = 0;
+}
+
+bool write_file_to_archive(struct rr_file_state* rstate, const char* fname,
+                           const uint8_t* contents, size_t len)
+{
+    // Create the header for this
+    struct archive* a = rstate->archive;
+    struct archive_entry* entry = NULL;
+    entry = archive_entry_new();
+    archive_entry_set_pathname(entry, MAGIC_FILE);
+    archive_entry_set_filetype(entry, AE_IFREG);
+    archive_entry_set_perm(entry, 0644);
+    archive_entry_set_size(entry, len);
+    if (ARCHIVE_OK != archive_write_header(a, entry)) {
+        fprintf(stderr, "Failed to write archive header!\n");
+        fprintf(stderr, "Error: %s\n", archive_error_string(a));
+        archive_entry_free(entry);
+        return false;
+    }
+
+    // Free the archive entry
+    archive_entry_free(entry);
+    entry = NULL;
+
+    // Write the file to the archive
+    size_t sent = 0;
+    while (len) {
+        int bytes = archive_write_data(a, contents + sent, len);
+        if (bytes <= 0) {
+            fprintf(stderr, "Failed to call to archive_write_data\n");
+            return false;
+        }
+        sent += bytes;
+        len -= bytes;
+    }
+    if (ARCHIVE_OK != archive_write_finish_entry(a)) {
+        fprintf(stderr, "Failed to finish entry: %s\n", archive_error_string(a));
+    }
+
+    return true;
+}
+
+void write_hash_to_log(struct rr_file_state* rstate, const char* fname, SHA_CTX* ctx)
+{
+    // If the log isn't open for writing, exit
+    if (!rstate->hash_fp) {
+        return;
+    }
+
+    size_t hexsize = 41;
+    unsigned char* hash_md = (unsigned char*)malloc(SHA_DIGEST_LENGTH);
+    char* hex = (char*)calloc(1, hexsize);
+
+    // Finalize the hash and snprintf the hexified string for it
+    if (!SHA1_Final(hash_md, ctx)) {
+        fprintf(stderr, "Failed to find hash for file contents of %s\n", fname);
+        goto cleanup;
+    }
+    for (int idx = 0; idx < 20; ++idx) {
+        snprintf(hex + 2 * idx, hexsize - 2 * idx, "%02x", hash_md[idx]);
+    }
+
+    // Write the hash out to the log in the format: fname hash\n
+    fprintf(rstate->hash_fp, "%s: %s\n", fname, hex);
+
+cleanup:
+    if (hash_md) {
+        free(hash_md);
+    }
+    if (hex) {
+        free(hex);
+    }
+}
+
+void add_file_hash_for_content(struct rr_file_state* rstate, const char* fname,
+                               const void* content, size_t len)
+{
+    // Initialize a SHA_CTX for openssl
+    SHA_CTX* ctx = (SHA_CTX*)malloc(sizeof(SHA_CTX));
+    if (!ctx || !SHA1_Init(ctx)) {
+        fprintf(stderr, "Failed to find hash for file contents of %s\n", fname);
+        goto cleanup;
+    }
+    // Calculate the SHA1 hash for these file contents
+    if (!SHA1_Update(ctx, content, len)) {
+        fprintf(stderr, "Failed to find hash for file contents of %s\n", fname);
+        goto cleanup;
+    }
+    // Write it to the log
+    write_hash_to_log(rstate, fname, ctx);
+
+cleanup:
+    if (ctx) {
+        free(ctx);
+    }
+}
+
+void write_metadata_file(struct rr_file_state* rstate)
+{
+    const char* contents = "{}\n";
+    if (!write_file_to_archive(rstate, METADATA_FILE, (const uint8_t*)contents,
+                               strlen(contents))) {
+        fprintf(stderr, "Failed to write metadata file to archive!\n");
+    }
+}
+
+void write_magic_file(struct rr_file_state* rstate)
+{
+    const char* contents = "Created with " QEMU_VERSION "!\n";
+    const char* rr_v2_fname = MAGIC_FILE;
+    if (!write_file_to_archive(rstate, rr_v2_fname, (const uint8_t*)contents,
+                               strlen(contents))) {
+        fprintf(stderr, "Failed to write magic file to archive!\n");
+    }
+    add_file_hash_for_content(rstate, rr_v2_fname, contents, strlen(contents));
+}
+
+void rrfile_fseek_cur(struct rr_file* rr, size_t len) {
+    uint8_t* buffer = (uint8_t*)malloc(len);
+    rrfile_qemu_getbuffer(rr, buffer, 0, len);
+    free(buffer);
+}
+
+void rrfile_fseek_set(struct rr_file** rr, const char *filename, size_t len) {
+    struct rr_file* copy = *rr;
+    uint8_t* buffer = (uint8_t*)malloc(len);
+    rrfile_open_read(filename, "nondetlog", rr);
+    rrfile_qemu_getbuffer(*rr, buffer, 0, len);
+    rrfile_free(copy);
+    free(buffer);
+}
+
+bool has_rr2_file_extention(const char *filename){
+    char* ext;
+    if ((ext = strrchr(filename,'.')) != NULL && strcmp(ext,".rr2") == 0){
+          return true;
+        }
+    return false;
+}
+
+bool is_gzip(const char *filename){
+    FILE *fp;
+    fp = fopen(filename,"r");
+    unsigned char buffer[2];
+    size_t nmemb = 2;
+    size_t result = fread(buffer,1,nmemb,fp);
+    if (result != nmemb){return false;}
+    if (buffer[0] == 0x1f && buffer[1] == 0x8b){return true;}
+    return false;
+}
+
+char* rr2_name(const char* fpath)
+{
+    char* rr2_name;
+    if (has_rr2_file_extention(fpath)){
+        rr2_name = strdup(fpath);
+    } else {
+        size_t needed = snprintf(NULL, 0, "%s.rr2", fpath);
+        rr2_name = malloc(needed+1);
+        if (!rr2_name) {
+            return NULL;
+        }
+        snprintf(rr2_name, needed+1, "%s.rr2", fpath);
+    }
+    return rr2_name;
+}
+
+bool is_rr2_file(const char *filename){
+    bool rr2_file;
+    struct stat buffer;
+    if (has_rr2_file_extention(filename) &&
+        stat(filename,&buffer) == 0 &&
+        is_gzip(filename))
+    {
+        rr2_file = true;
+    } else {
+        rr2_file = false;
+    }
+    return rr2_file;
+}
+
+char* remove_rr2_ext(const char* base_name){
+    char* rr_name;
+    if (has_rr2_file_extention(base_name)){
+        size_t size = strlen(base_name);
+        rr_name = malloc(size-4);
+        memcpy(rr_name, base_name, size-4);
+        rr_name[size-4] = '\0';
+     } else {
+        rr_name = strdup(base_name);
+     }
+     return rr_name;
+}
+
diff --git a/panda/src/rr/rr_log.c b/panda/src/rr/rr_log.c
index f0049eaa271..c091e3dd6a2 100644
--- a/panda/src/rr/rr_log.c
+++ b/panda/src/rr/rr_log.c
@@ -74,6 +74,9 @@ RR_log_entry* rr_queue_head;
 RR_log_entry* rr_queue_tail;
 RR_log_entry* rr_queue_end; // end of buffer.
 
+// RR2 function
+void rr_finalize_write_log(void);
+
 // mz 11.06.2009 Flags to manage nested recording
 volatile sig_atomic_t rr_record_in_progress = 0;
 volatile sig_atomic_t rr_record_in_main_loop_wait = 0;
@@ -81,6 +84,9 @@ volatile sig_atomic_t rr_skipped_callsite_location = 0;
 // mz the log of non-deterministic events
 RR_log* rr_nondet_log = NULL;
 
+// for holding info to create rr2 compressed file
+struct rr_file_info*  recording_info = NULL;
+
 bool rr_replay_complete = false;
 
 // our own assertion mechanism
@@ -258,7 +264,7 @@ static inline void rr_assert_fail(const char* exp, const char* file, int line,
 /******************************************************************************************/
 
 static inline size_t rr_fwrite(void *ptr, size_t size, size_t nmemb) {
-    size_t result = fwrite(ptr, size, nmemb, rr_nondet_log->fp);
+    size_t result = fwrite(ptr, size, nmemb, rr_nondet_log->file.fp);
     rr_assert(result == nmemb);
     return result;
 }
@@ -275,7 +281,6 @@ static inline void rr_write_item(RR_log_entry item)
     RR_WRITE_ITEM(item.header.prog_point.guest_instr_count);
     rr_fwrite(&(item.header.kind), 1, 1);
     rr_fwrite(&(item.header.callsite_loc), 1, 1);
-
     // mz also save the program point in the log structure to ensure that our
     // header will include the latest program point.
     rr_nondet_log->last_prog_point = item.header.prog_point;
@@ -694,7 +699,12 @@ static inline void free_entry_params(RR_log_entry* entry)
 }
 
 static inline size_t rr_fread(void *ptr, size_t size, size_t nmemb) {
-    size_t result = fread(ptr, size, nmemb, rr_nondet_log->fp);
+    size_t result;
+    if (rr_nondet_log->rr2){
+	result = rrfile_fread(ptr, size, nmemb, rr_nondet_log->file.replay_rr);
+    } else {
+        result = fread(ptr, size, nmemb, rr_nondet_log->file.fp);
+    }
     rr_nondet_log->bytes_read += nmemb * size;
     rr_assert(result == nmemb);
     return result;
@@ -753,7 +763,12 @@ static RR_log_entry *rr_read_item(void) {
 
     rr_assert(rr_in_replay());
     rr_assert(!rr_log_is_empty());
-    rr_assert(rr_nondet_log->fp != NULL);
+    if (rr_nondet_log->rr2){
+        rr_assert(rr_nondet_log->file.replay_rr != NULL);
+    }
+    else{
+        rr_assert(rr_nondet_log->file.fp != NULL);
+    }
 
     item->header.file_pos = rr_nondet_log->bytes_read;
 
@@ -887,7 +902,7 @@ void rr_fill_queue(void) {
     rr_assert(rr_queue_empty());
 
     while (!rr_log_is_empty() && num_entries < RR_QUEUE_MAX_LEN) {
-        RR_header header = rr_read_item()->header;
+	RR_header header = rr_read_item()->header;
         num_entries++;
 
         if ((header.kind == RR_SKIPPED_CALL
@@ -1197,8 +1212,8 @@ void rr_create_record_log(const char* filename)
 
     rr_nondet_log->type = RECORD;
     rr_nondet_log->name = g_strdup(filename);
-    rr_nondet_log->fp = fopen(rr_nondet_log->name, "w");
-    rr_assert(rr_nondet_log->fp != NULL);
+    rr_nondet_log->file.fp = fopen(rr_nondet_log->name, "w");
+    rr_assert(rr_nondet_log->file.fp != NULL);
 
     if (rr_debug_whisper()) {
         qemu_log("opened %s for write.\n", rr_nondet_log->name);
@@ -1214,18 +1229,11 @@ void rr_create_record_log(const char* filename)
             sizeof(rr_nondet_log->last_prog_point.guest_instr_count), 1);
 }
 
-// create replay log
-void rr_create_replay_log(const char* filename)
+void rr1_create_replay_log(void)
 {
     struct stat statbuf = {0};
-    // create log
-    rr_nondet_log = g_new0(RR_log, 1);
-    rr_assert(rr_nondet_log != NULL);
-
-    rr_nondet_log->type = REPLAY;
-    rr_nondet_log->name = g_strdup(filename);
-    rr_nondet_log->fp = fopen(rr_nondet_log->name, "r");
-    rr_assert(rr_nondet_log->fp != NULL);
+    rr_nondet_log->file.fp = fopen(rr_nondet_log->name, "r");
+    rr_assert(rr_nondet_log->file.fp != NULL);
 
     // mz fill in log size
     stat(rr_nondet_log->name, &statbuf);
@@ -1240,19 +1248,59 @@ void rr_create_replay_log(const char* filename)
             sizeof(rr_nondet_log->last_prog_point.guest_instr_count), 1);
 }
 
-// close file and free associated memory
-void rr_destroy_log(void)
+void rr2_create_replay_log(void)
 {
-    if (rr_nondet_log->fp) {
-        // mz if in record, update the header with the last written prog point.
-        if (rr_nondet_log->type == RECORD) {
-            rewind(rr_nondet_log->fp);
+    if (!RRFILE_SUCCESS(rrfile_open_read(rr_nondet_log->name, "nondetlog", &(rr_nondet_log->file.replay_rr)))) {
+        fprintf(stderr, "Failed to open nondetlog from RR archive\n");
+        exit(1);
+    } 
+
+    // mz fill in log size
+    rr_nondet_log->size = rrfile_section_size(rr_nondet_log->file.replay_rr);
+    rr_nondet_log->bytes_read = 0;
+    if (rr_debug_whisper()) {
+        qemu_log("opened %s/%s for read.  len=%llu bytes.\n", rr_nondet_log->name,
+                 "nondetlog", rr_nondet_log->size);
+    }
+    // mz read the last program point from the log header.
+    rr_fread(&(rr_nondet_log->last_prog_point.guest_instr_count),
+            sizeof(rr_nondet_log->last_prog_point.guest_instr_count), 1);
+}
+
+// create replay log
+void rr_create_replay_log(const char* filename)
+{
+    rr_nondet_log = g_new0(RR_log, 1);
+    rr_assert(rr_nondet_log != NULL);
+
+    rr_nondet_log->type = REPLAY;
+    rr_nondet_log->rr2 = is_rr2_file(filename);
+    if (rr_nondet_log->rr2) {
+        rr_nondet_log->name = rr2_name(filename);
+        rr2_create_replay_log();
+    }
+    else {
+        rr_nondet_log->name = g_strdup(filename);
+        rr1_create_replay_log();
+    }
+}
+
+void rr_finalize_write_log(void)
+{
+    if (rr_nondet_log->type == RECORD) {
+        if (rr_nondet_log->file.fp) {
+            rewind(rr_nondet_log->file.fp);
             rr_fwrite(&(rr_nondet_log->last_prog_point.guest_instr_count),
                     sizeof(rr_nondet_log->last_prog_point.guest_instr_count), 1);
+            fclose(rr_nondet_log->file.fp);
+            rr_nondet_log->file.fp = NULL;
         }
-        fclose(rr_nondet_log->fp);
-        rr_nondet_log->fp = NULL;
     }
+}
+
+// close file and free associated memory
+void rr_destroy_log(void)
+{
     g_free(rr_nondet_log->name);
     g_free(rr_nondet_log);
     rr_nondet_log = NULL;
@@ -1266,7 +1314,11 @@ void replay_progress(void)
 {
     if (rr_nondet_log && !panda_get_library_mode()) { // Silent if no nondet_log or if we're replaying in library mode
         if (rr_log_is_empty()) {
-            printf("%s:  log is empty.\n", rr_nondet_log->name);
+	    if (rr_nondet_log->rr2){
+		printf("%s/%s:  log is empty.\n", rr_nondet_log->name, "nondetlog");
+	    } else {
+		printf("%s:  log is empty.\n", rr_nondet_log->name);
+            }
         } else {
             struct rusage rusage;
             getrusage(RUSAGE_SELF, &rusage);
@@ -1330,6 +1382,11 @@ static inline void rr_get_nondet_log_file_name(char* rr_name, char* rr_path,
     snprintf(file_name, file_name_len, "%s/%s-rr-nondet.log", rr_path, rr_name);
 }
 
+static void rr_get_cmdline_file_name(char *rr_name, char *rr_path, char *file_name, size_t file_name_len) {
+    rr_assert (rr_name != NULL && rr_path != NULL);
+    snprintf(file_name, file_name_len, "%s/%s-rr.cmd", rr_path, rr_name);
+}
+
 void rr_reset_state(CPUState* cpu)
 {
     tb_flush(cpu);
@@ -1339,6 +1396,60 @@ void rr_reset_state(CPUState* cpu)
     cpu->rr_guest_instr_count = 0;
 }
 
+/******************************************************************************************/
+/* RR2 RECORDING MANAGEMENT */
+/******************************************************************************************/
+
+void rrfile_info_create(struct rr_file_info** rr_info, char* rr_path, char* rr_name)
+{
+    *rr_info  = (struct rr_file_info *) g_malloc(sizeof(struct rr_file_info));
+    (*rr_info)->path = g_strdup(rr_path);
+    (*rr_info)->name = g_strdup(rr_name);;
+}
+
+void rrfile_info_clear(struct rr_file_info** rr_info)
+{
+    g_free((*rr_info)->path);
+    g_free((*rr_info)->name);
+    g_free(*rr_info);
+    *rr_info = NULL;
+}
+
+int rr2_add_recording_files(char* rr_name, char* rr_path){
+    char name_buf[1024];
+
+    char *rr2_path = rr2_name(rr_name);
+    printf("Creating rr2 archive file at: %s\n", rr2_path);
+    struct rr_file_state* rr_archive = rrfile_open_write(rr2_path);
+    if (!rr_archive) {
+        return -2;
+    }
+
+    rr_get_cmdline_file_name(rr_name, rr_path, name_buf, sizeof(name_buf));
+    printf("    moving cmdline file %s to %s/capture.cmd\n", name_buf, rr2_path);
+    if (!rrfile_add_recording_file(rr_archive, "capture.cmd", name_buf)) {
+        fprintf(stderr, "Failed to add snapshot file to archive!\n");
+        return -4;
+    }
+
+    rr_get_snapshot_file_name(rr_name, rr_path, name_buf, sizeof(name_buf));
+    printf("    moving snapshot %s to %s/snapshot\n", name_buf, rr2_path);
+    if (!rrfile_add_recording_file(rr_archive, "snapshot", name_buf)) {
+        fprintf(stderr, "Failed to add snapshot file to archive!\n");
+        return -3;
+    }
+
+    rr_get_nondet_log_file_name(rr_name, rr_path, name_buf, sizeof(name_buf));
+    printf("    moving nondet log %s to %s/nondetlog\n", name_buf, rr2_path);
+    rrfile_add_recording_file(rr_archive, "nondetlog", name_buf);
+    rrfile_finalize(rr_archive);
+
+    free(rr2_path);
+    return 0;
+}
+
+
+
 //////////////////////////////////////////////////////////////
 //
 // QMP commands
@@ -1417,6 +1528,9 @@ void hmp_end_replay(Monitor* mon, const QDict* qdict)
 
 static time_t rr_start_time;
 
+extern int gargc;
+extern char **gargv;
+
 // mz file_name_full should be full path to desired record/replay log file
 int rr_do_begin_record(const char* file_name_full, CPUState* cpu_state)
 {
@@ -1433,7 +1547,23 @@ int rr_do_begin_record(const char* file_name_full, CPUState* cpu_state)
     char* rr_path_base = g_strdup(file_name_full);
     char* rr_name_base = g_strdup(file_name_full);
     char* rr_path = dirname(rr_path_base);
-    char* rr_name = basename(rr_name_base);
+    char* rr_name = remove_rr2_ext(basename(rr_name_base));
+    if (has_rr2_file_extention(rr_name_base)){
+        printf("Recording using rr2 format\n");
+        rrfile_info_create(&recording_info, rr_path, rr_name);
+
+        // save the cmd line so we dont have to guess mem size and arch later
+        rr_get_cmdline_file_name(rr_name, rr_path, name_buf, sizeof(name_buf));
+        printf("writing cmdline to file:\t%s\n", name_buf);
+        FILE *fp = fopen(name_buf, "w");
+        int i;
+        for (i=0; i<gargc; i++) {
+            fprintf (fp, "%s ", gargv[i]);
+        }
+        fprintf (fp, "\n");
+        fclose(fp);
+    }
+
     int snapshot_ret = -1;
     if (rr_debug_whisper()) {
         qemu_log("Begin vm record for file_name_full = %s\n", file_name_full);
@@ -1460,16 +1590,20 @@ int rr_do_begin_record(const char* file_name_full, CPUState* cpu_state)
     // save the time so we can report how long record takes
     time(&rr_start_time);
 
+
     // second, open non-deterministic input log for write.
     rr_get_nondet_log_file_name(rr_name, rr_path, name_buf, sizeof(name_buf));
     printf("opening nondet log for write:\t%s\n", name_buf);
     rr_create_record_log(name_buf);
     // reset record/replay counters and flags
     rr_reset_state(cpu_state);
+
     g_free(rr_path_base);
     g_free(rr_name_base);
+    free(rr_name);
     // set global to turn on recording
     rr_control.mode = RR_RECORD;
+
     return snapshot_ret;
 #endif
 }
@@ -1483,7 +1617,7 @@ void rr_do_end_record(void)
 
     char* rr_path_base = g_strdup(rr_nondet_log->name);
     char* rr_name_base = g_strdup(rr_nondet_log->name);
-    // char *rr_path = dirname(rr_path_base);
+    //char* rr_path = dirname(rr_path_base);
     char* rr_name = basename(rr_name_base);
 
     if (rr_debug_whisper()) {
@@ -1497,6 +1631,17 @@ void rr_do_end_record(void)
       printf("Time taken was: %ld seconds.\n", rr_end_time - rr_start_time);
       printf("Checksum of guest memory: %#08x\n", rr_checksum_memory_internal());
     }
+    
+    // Write the nondetlog to the archive
+    printf("Finalizing the recording\n");
+    rr_finalize_write_log();
+
+    if (recording_info){
+        rr2_add_recording_files(recording_info->name, recording_info->path);
+	rrfile_info_clear(&recording_info);
+    }
+
+    printf("...complete!\n");
 
     // log_all_cpu_states();
 
@@ -1519,6 +1664,49 @@ void rr_do_end_record(void)
 #endif
 }
 
+int load_snapshot_state(QEMUFile* snp){
+    __attribute__((unused)) int snapshot_ret;
+    
+    qemu_system_reset(VMRESET_SILENT);
+    MigrationIncomingState* mis = migration_incoming_get_current();
+    mis->from_src_file = snp;
+    snapshot_ret = qemu_loadvm_state(snp);
+    qemu_fclose(snp);
+    migration_incoming_state_destroy();
+
+    return snapshot_ret;
+}
+
+int rr2_load_snapshot(char* name_buf, int name_buf_size, const char* file_name_full){
+    snprintf(name_buf, name_buf_size, "%s/snapshot", file_name_full);
+    if (rr_debug_whisper()) {
+        qemu_log("reading snapshot:\t%s\n", name_buf);
+    }
+
+    printf("loading snapshot\n");
+    QEMUFile* snp = load_snapshot_rr(file_name_full, "snapshot");
+
+    return load_snapshot_state(snp);
+}
+
+int rr1_load_snapshot(char* rr_name, char* rr_path, char* name_buf, int name_buf_size){
+    rr_get_snapshot_file_name(rr_name, rr_path, name_buf, name_buf_size);
+    if (rr_debug_whisper()) {
+        qemu_log("reading snapshot:\t%s\n", name_buf);
+    }
+    printf("loading snapshot\n");
+    QIOChannelFile* ioc =
+        qio_channel_file_new_path(name_buf, O_RDONLY, 0, NULL);
+    if (ioc == NULL) {
+        printf ("... snapshot file doesn't exist?\n");
+        abort();
+    }
+    
+    QEMUFile* snp = qemu_fopen_channel_input(QIO_CHANNEL(ioc));
+
+    return load_snapshot_state(snp);
+}
+
 // file_name_full should be full path to the record/replay log
 int rr_do_begin_replay(const char* file_name_full, CPUState* cpu_state)
 {
@@ -1529,17 +1717,20 @@ int rr_do_begin_replay(const char* file_name_full, CPUState* cpu_state)
 #endif
 
 #ifdef CONFIG_SOFTMMU
+    __attribute__((unused)) int snapshot_ret;
     char name_buf[1024];
+    char replay_log_path[1024];
     // decompose file_name_base into path & file.
     char* rr_path = g_strdup(file_name_full);
     char* rr_name = g_strdup(file_name_full);
-    __attribute__((unused)) int snapshot_ret;
+
 
     vm_stop(RUN_STATE_PAUSED); // Stop execution of the CPU thread while the replay is being set up
     rr_path = dirname(rr_path);
     rr_name = basename(rr_name);
     rr_replay_complete = false;
 
+    bool rr2_replay = is_rr2_file(file_name_full);
     // When we start a replay, re-initialize state
     // so we can do this multiple times
     rr_next_progress = 1;
@@ -1548,41 +1739,33 @@ int rr_do_begin_replay(const char* file_name_full, CPUState* cpu_state)
         qemu_log("Begin vm replay for file_name_full = %s\n", file_name_full);
         qemu_log("path = [%s]  file_name_base = [%s]\n", rr_path, rr_name);
     }
-    // first retrieve snapshot
-    rr_get_snapshot_file_name(rr_name, rr_path, name_buf, sizeof(name_buf));
-    if (rr_debug_whisper()) {
-        qemu_log("reading snapshot:\t%s\n", name_buf);
+    
+    if (rr2_replay){
+        char* rr2_filename = rr2_name(file_name_full);
+        snapshot_ret = rr2_load_snapshot(name_buf, sizeof(name_buf), rr2_filename);
+        snprintf(name_buf, sizeof(name_buf), "%s/nondetlog", rr2_filename);
+        strcpy(replay_log_path, rr2_filename);
+        free(rr2_filename);
     }
-    printf("loading snapshot\n");
-    QIOChannelFile* ioc =
-        qio_channel_file_new_path(name_buf, O_RDONLY, 0, NULL);
-    if (ioc == NULL) {
-        printf ("... snapshot file doesn't exist?\n");
-        abort();
+    else {
+        snapshot_ret = rr1_load_snapshot(rr_name, rr_path, name_buf, sizeof(name_buf));
+	rr_get_nondet_log_file_name(rr_name, rr_path, name_buf, sizeof(name_buf));
+        strcpy(replay_log_path, name_buf);
     }
-    QEMUFile* snp = qemu_fopen_channel_input(QIO_CHANNEL(ioc));
-
-    qemu_system_reset(VMRESET_SILENT);
-    MigrationIncomingState* mis = migration_incoming_get_current();
-    mis->from_src_file = snp;
-    snapshot_ret = qemu_loadvm_state(snp);
-    qemu_fclose(snp);
-    migration_incoming_state_destroy();
-
     if (snapshot_ret < 0) {
         fprintf(stderr, "Failed to load vmstate\n");
         return snapshot_ret;
     }
     printf("... done.\n");
+
     // log_all_cpu_states();
 
     // save the time so we can report how long replay takes
     time(&rr_start_time);
 
     // second, open non-deterministic input log for read.
-    rr_get_nondet_log_file_name(rr_name, rr_path, name_buf, sizeof(name_buf));
     printf("opening nondet log for read :\t%s\n", name_buf);
-    rr_create_replay_log(name_buf);
+    rr_create_replay_log(replay_log_path);
     // reset record/replay counters and flags
     rr_reset_state(cpu_state);
     // set global to turn on replay
diff --git a/panda/src/rr/rr_print.c b/panda/src/rr/rr_print.c
index a079065ee4f..65583273fd6 100644
--- a/panda/src/rr/rr_print.c
+++ b/panda/src/rr/rr_print.c
@@ -6,6 +6,7 @@
 
 #define RR_LOG_STANDALONE
 #include "panda/include/panda/rr/rr_log.h"
+#include "panda/include/panda/rr/panda_rr2.h"
 #include "qemu/osdep.h"
 #include "cpu.h"
 
@@ -26,8 +27,8 @@ volatile sig_atomic_t rr_skipped_callsite_location = 0;
 RR_log *rr_nondet_log = NULL;
 
 static inline uint8_t log_is_empty(void) {
-    if ((rr_nondet_log->type == REPLAY) &&
-        (rr_nondet_log->size - ftell(rr_nondet_log->fp) == 0)) {
+    if ((rr_nondet_log->type == REPLAY) && 
+	((rr_nondet_log->size - rr_nondet_log->bytes_read) == 0)){
         return 1;
     }
     else {
@@ -47,6 +48,7 @@ void rr_spit_prog_point(RR_prog_point pp) {
   rr_spit_prog_point_fp(stdout,pp);
 }
 
+
 static void rr_spit_log_entry(RR_log_entry item) {
     rr_spit_prog_point(item.header.prog_point);
     switch (item.header.kind) {
@@ -160,6 +162,29 @@ static inline void free_entry_params(RR_log_entry *entry)
     }
 }
 
+static inline size_t rr_fread(void *ptr, size_t size, size_t nmemb){
+    size_t result;
+    if (rr_nondet_log->rr2){
+        result = rrfile_fread(ptr, size, nmemb, rr_nondet_log->file.replay_rr);
+    }
+    else{
+	result = fread(ptr, size, nmemb, rr_nondet_log->file.fp);
+    }
+    rr_nondet_log->bytes_read += nmemb * size;
+    assert(result == nmemb);
+    return result;
+}
+
+void rr_fseek_cur(size_t size){
+    if (rr_nondet_log->rr2){
+        rrfile_fseek_cur(rr_nondet_log->file.replay_rr, size);
+    }
+    else{
+        fseek(rr_nondet_log->file.fp, size, SEEK_CUR);
+    }
+    rr_nondet_log->bytes_read += size;
+}
+
 //mz fill an entry
 static RR_log_entry *rr_read_item(void) {
     RR_log_entry *item = alloc_new_entry();
@@ -167,116 +192,97 @@ static RR_log_entry *rr_read_item(void) {
     //mz read header
     assert (rr_in_replay());
     assert ( ! log_is_empty());
-    assert (rr_nondet_log->fp != NULL);
+    if (rr_nondet_log->rr2) {
+        assert(rr_nondet_log->file.replay_rr != NULL);
+    }
+    else {
+        assert(rr_nondet_log->file.fp != NULL);
+    }
+
+#define RR_READ_ITEM(field) rr_fread(&(field), sizeof(field), 1)
 
     //mz XXX we assume that the log is not trucated - should probably fix this.
-    if (fread(&(item->header.prog_point.guest_instr_count),
-                sizeof(item->header.prog_point.guest_instr_count), 1, rr_nondet_log->fp) != 1) {
-        //mz an error occurred
-        if (feof(rr_nondet_log->fp)) {
-            // replay is done - we've reached the end of file
-            //mz we should never get here!
-            assert(0);
-        } 
-        else {
-            //mz some other kind of error
-            //mz XXX something more graceful, perhaps?
-            assert(0);
-        }
-    }
+    RR_READ_ITEM(item->header.prog_point.guest_instr_count);
+
     //mz this is more compact, as it doesn't include extra padding.
-    assert(fread(&(item->header.kind), 1, 1, rr_nondet_log->fp) == 1);
-    assert(fread(&(item->header.callsite_loc), 1, 1, rr_nondet_log->fp) == 1);
+    rr_fread(&(item->header.kind), 1, 1);
+    rr_fread(&(item->header.callsite_loc), 1, 1);
 
     //mz read the rest of the item
     switch (item->header.kind) {
         case RR_INPUT_1:
-            assert(fread(&(item->variant.input_1), sizeof(item->variant.input_1), 1, rr_nondet_log->fp) == 1);
+            RR_READ_ITEM(item->variant.input_1);
             break;
         case RR_INPUT_2:
-            assert(fread(&(item->variant.input_2), sizeof(item->variant.input_2), 1, rr_nondet_log->fp) == 1);
+            RR_READ_ITEM(item->variant.input_2);
             break;
         case RR_INPUT_4:
-            assert(fread(&(item->variant.input_4), sizeof(item->variant.input_4), 1, rr_nondet_log->fp) == 1);
+            RR_READ_ITEM(item->variant.input_4);
             break;
         case RR_INPUT_8:
-            assert(fread(&(item->variant.input_8), sizeof(item->variant.input_8), 1, rr_nondet_log->fp) == 1);
+            RR_READ_ITEM(item->variant.input_8);
             break;
         case RR_INTERRUPT_REQUEST:
-            assert(fread(&(item->variant.interrupt_request), sizeof(item->variant.interrupt_request), 1, rr_nondet_log->fp) == 1);
+            RR_READ_ITEM(item->variant.interrupt_request);
             break;
         case RR_EXIT_REQUEST:
-            assert(fread(&(item->variant.exit_request), sizeof(item->variant.exit_request), 1, rr_nondet_log->fp) == 1);
+            RR_READ_ITEM(item->variant.exit_request);
             break;
         case RR_PENDING_INTERRUPTS:
-            assert(fread(&(item->variant.pending_interrupts), sizeof(item->variant.pending_interrupts), 1, rr_nondet_log->fp) == 1);
+            RR_READ_ITEM(item->variant.pending_interrupts);
             break;
         case RR_EXCEPTION:
-            assert(fread(&(item->variant.exception_index), sizeof(item->variant.exception_index), 1, rr_nondet_log->fp) == 1);
+            RR_READ_ITEM(item->variant.exception_index);
             break;
         case RR_SKIPPED_CALL:
             {
                 RR_skipped_call_args *args = &item->variant.call_args;
                 //mz read kind first!
-                assert(fread(&(args->kind), 1, 1, rr_nondet_log->fp) == 1);
+                rr_fread(&(args->kind), 1, 1);
                 switch(args->kind) {
                     case RR_CALL_CPU_MEM_RW:
-                        assert(fread(&(args->variant.cpu_mem_rw_args), sizeof(args->variant.cpu_mem_rw_args), 1, rr_nondet_log->fp) == 1);
+			RR_READ_ITEM(args->variant.cpu_mem_rw_args);
                         //mz buffer length in args->variant.cpu_mem_rw_args.len
                         //mz always allocate a new one. we free it when the item is added to the recycle list
                         //args->variant.cpu_mem_rw_args.buf = g_malloc(args->variant.cpu_mem_rw_args.len);
                         //mz read the buffer
                         //assert(fread(args->variant.cpu_mem_rw_args.buf, 1, args->variant.cpu_mem_rw_args.len, rr_nondet_log->fp) > 0);
-                        fseek(rr_nondet_log->fp, args->variant.cpu_mem_rw_args.len, SEEK_CUR);
+                        rr_fseek_cur(args->variant.cpu_mem_rw_args.len);
                         break;
                     case RR_CALL_CPU_MEM_UNMAP:
-                        assert(fread(&(args->variant.cpu_mem_unmap), sizeof(args->variant.cpu_mem_unmap), 1, rr_nondet_log->fp) == 1);
+			RR_READ_ITEM(args->variant.cpu_mem_unmap);
                         //mz buffer length in args->variant.cpu_mem_unmap.len
                         //mz always allocate a new one. we free it when the item is added to the recycle list
                         //args->variant.cpu_mem_unmap.buf = g_malloc(args->variant.cpu_mem_unmap.len);
                         //mz read the buffer
                         //assert(fread(args->variant.cpu_mem_unmap.buf, 1, args->variant.cpu_mem_unmap.len, rr_nondet_log->fp) > 0);
-                        fseek(rr_nondet_log->fp, args->variant.cpu_mem_unmap.len, SEEK_CUR);
+                        rr_fseek_cur(args->variant.cpu_mem_unmap.len);
                         break;
                     case RR_CALL_MEM_REGION_CHANGE:
-                        assert(fread(&(args->variant.mem_region_change_args),
-                            sizeof(args->variant.mem_region_change_args), 1,
-                            rr_nondet_log->fp) == 1);
-                        fseek(rr_nondet_log->fp, args->variant.mem_region_change_args.len, SEEK_CUR);
+			RR_READ_ITEM(args->variant.mem_region_change_args);
+                        rr_fseek_cur(args->variant.mem_region_change_args.len);
                         break;
                     case RR_CALL_HD_TRANSFER:
-                        assert(fread(&(args->variant.hd_transfer_args),
-                              sizeof(args->variant.hd_transfer_args), 1, rr_nondet_log->fp) == 1);
+			RR_READ_ITEM(args->variant.hd_transfer_args);
                         break;
                     case RR_CALL_HANDLE_PACKET:
-                        assert(fread(&(args->variant.handle_packet_args),
-                              sizeof(args->variant.handle_packet_args), 1, rr_nondet_log->fp) == 1);
-                        fseek(rr_nondet_log->fp,
-                            args->variant.handle_packet_args.size, SEEK_CUR);
+			RR_READ_ITEM(args->variant.handle_packet_args);
+                        rr_fseek_cur(args->variant.handle_packet_args.size);
                         break;
                     case RR_CALL_NET_TRANSFER:
-                        assert(fread(&(args->variant.net_transfer_args),
-                              sizeof(args->variant.net_transfer_args), 1, rr_nondet_log->fp) == 1);
+			RR_READ_ITEM(args->variant.net_transfer_args);
                         break;
                     case RR_CALL_SERIAL_RECEIVE:
-                        assert(fread(&(args->variant.serial_receive_args),
-                                     sizeof(args->variant.serial_receive_args),
-                                     1, rr_nondet_log->fp) == 1);
+			RR_READ_ITEM(args->variant.serial_receive_args);
                         break;
                     case RR_CALL_SERIAL_READ:
-                        assert(fread(&(args->variant.serial_read_args),
-                                     sizeof(args->variant.serial_read_args), 1,
-                                     rr_nondet_log->fp) == 1);
+			RR_READ_ITEM(args->variant.serial_read_args);
                         break;
                     case RR_CALL_SERIAL_SEND:
-                        assert(fread(&(args->variant.serial_send_args),
-                                     sizeof(args->variant.serial_send_args), 1,
-                                     rr_nondet_log->fp) == 1);
+			RR_READ_ITEM(args->variant.serial_send_args);
                         break;
                     case RR_CALL_SERIAL_WRITE:
-                        assert(fread(&(args->variant.serial_write_args),
-                                     sizeof(args->variant.serial_write_args), 1,
-                                     rr_nondet_log->fp) == 1);
+			RR_READ_ITEM(args->variant.serial_write_args);
                         break;
                     default:
                         //mz unimplemented
@@ -297,18 +303,10 @@ static RR_log_entry *rr_read_item(void) {
     return item;
 }
 
-// create replay log
-void rr_create_replay_log (const char *filename) {
+void rr1_create_replay_log(void){
   struct stat statbuf = {0};
-  // create log
-  rr_nondet_log = (RR_log *) g_malloc (sizeof (RR_log));
-  assert (rr_nondet_log != NULL);
-  memset(rr_nondet_log, 0, sizeof(RR_log));
-
-  rr_nondet_log->type = REPLAY;
-  rr_nondet_log->name = g_strdup(filename);
-  rr_nondet_log->fp = fopen(rr_nondet_log->name, "r");
-  assert(rr_nondet_log->fp != NULL);
+  rr_nondet_log->file.fp = fopen(rr_nondet_log->name, "r");
+  assert(rr_nondet_log->file.fp != NULL);
 
   //mz fill in log size
   stat(rr_nondet_log->name, &statbuf);
@@ -316,7 +314,44 @@ void rr_create_replay_log (const char *filename) {
   fprintf (stdout, "opened %s for read.  len=%llu bytes.\n",
      rr_nondet_log->name, rr_nondet_log->size);
   //mz read the last program point from the log header.
-  assert(fread(&(rr_nondet_log->last_prog_point), sizeof(RR_prog_point), 1, rr_nondet_log->fp) == 1);
+  rr_fread(&(rr_nondet_log->last_prog_point), sizeof(RR_prog_point), 1);
+}
+
+void rr2_create_replay_log(void){
+  if (!RRFILE_SUCCESS(rrfile_open_read(rr_nondet_log->name, "nondetlog", &(rr_nondet_log->file.replay_rr)))) {
+      fprintf(stderr, "Failed to open nondetlog from RR archive\n");
+      exit(1);
+  } 
+  assert(rr_nondet_log->file.replay_rr != NULL);
+
+  //mz fill in log size
+  rr_nondet_log->size = rrfile_section_size(rr_nondet_log->file.replay_rr);
+  
+  rr_nondet_log->bytes_read = 0;
+  fprintf (stdout, "opened %s for read.  len=%llu bytes.\n",
+     rr_nondet_log->name, rr_nondet_log->size);
+  //mz read the last program point from the log header.
+  rr_fread(&(rr_nondet_log->last_prog_point), sizeof(RR_prog_point), 1);
+}
+
+// create replay log
+void rr_create_replay_log (const char *filename) {
+  // create log
+  rr_nondet_log = (RR_log *) g_malloc (sizeof (RR_log));
+  assert (rr_nondet_log != NULL);
+  memset(rr_nondet_log, 0, sizeof(RR_log));
+
+  rr_nondet_log->type = REPLAY;
+  //check if using rr2 format
+  rr_nondet_log->rr2 = is_rr2_file(filename);
+  if (rr_nondet_log->rr2){
+    rr_nondet_log->name = rr2_name(filename);
+    rr2_create_replay_log();
+  }
+  else{
+    rr_nondet_log->name = g_strdup(filename);
+    rr1_create_replay_log();
+  }
 }
 
 int main(int argc, char **argv) {
diff --git a/tests/Makefile.include b/tests/Makefile.include
index 0158b504edd..9394f90e1b9 100644
--- a/tests/Makefile.include
+++ b/tests/Makefile.include
@@ -576,6 +576,7 @@ tests/test-qdev-global-props$(EXESUF): tests/test-qdev-global-props.o \
 tests/test-vmstate$(EXESUF): tests/test-vmstate.o \
 	migration/vmstate.o migration/qemu-file.o \
         migration/qemu-file-channel.o migration/qjson.o \
+        panda/src/rr/panda_rr2.o \
 	$(test-io-obj-y)
 tests/test-timed-average$(EXESUF): tests/test-timed-average.o $(test-util-obj-y)
 tests/test-base64$(EXESUF): tests/test-base64.o \
diff --git a/vl.c b/vl.c
index 35d68850ef3..730a5e97758 100644
--- a/vl.c
+++ b/vl.c
@@ -3141,7 +3141,12 @@ int main_aux(int argc, char **argv, char **envp, PandaMainMode pmm)
         = QSIMPLEQ_HEAD_INITIALIZER(bdo_queue);
 
     // PANDA stuff
-    gargv = argv;
+    gargv = malloc(argc * sizeof(gargv));
+    int j;
+    for(j=0; j < argc ; ++j )
+    {
+        gargv[j] = strdup(argv[j]);
+    }
     gargc = argc;
     if (pmm == PANDA_NORMAL)
         qemu_file = this_executable_path(argv[0]);
@@ -5078,6 +5083,14 @@ int main_aux(int argc, char **argv, char **envp, PandaMainMode pmm)
         rr_do_end_record();
     }
 
+    int x;
+    for(x=0; x < gargc ; ++x )
+    {
+        free(gargv[x]);
+        gargv[x] = NULL;
+    }
+    free(gargv);
+
     replay_disable_events();
     iothread_stop_all();
 

From c88291546729caf96e862852a224e0aaa941a0e6 Mon Sep 17 00:00:00 2001
From: Luke Craig <lacraig3@gmail.com>
Date: Sat, 5 Nov 2022 21:44:38 -0400
Subject: [PATCH 124/140] add libarchive dependency

---
 panda/dependencies/ubuntu:18.04_base.txt | 3 +++
 panda/dependencies/ubuntu:20.04_base.txt | 2 ++
 panda/dependencies/ubuntu:22.04_base.txt | 2 ++
 3 files changed, 7 insertions(+)

diff --git a/panda/dependencies/ubuntu:18.04_base.txt b/panda/dependencies/ubuntu:18.04_base.txt
index aacc9988df2..7005aee243a 100644
--- a/panda/dependencies/ubuntu:18.04_base.txt
+++ b/panda/dependencies/ubuntu:18.04_base.txt
@@ -74,3 +74,6 @@ libusbredirparser1
 libx11-6
 zlib1g
 libxen-4.9
+
+#rr2 depends on libarchive
+libarchive
diff --git a/panda/dependencies/ubuntu:20.04_base.txt b/panda/dependencies/ubuntu:20.04_base.txt
index 96fa204441d..40c5ab56a6f 100644
--- a/panda/dependencies/ubuntu:20.04_base.txt
+++ b/panda/dependencies/ubuntu:20.04_base.txt
@@ -80,3 +80,5 @@ libusbredirparser1
 libvirglrenderer1
 zlib1g
 
+#rr2 depends on libarchive
+libarchive
diff --git a/panda/dependencies/ubuntu:22.04_base.txt b/panda/dependencies/ubuntu:22.04_base.txt
index ecbf8a33f9e..ea9640f3c7f 100644
--- a/panda/dependencies/ubuntu:22.04_base.txt
+++ b/panda/dependencies/ubuntu:22.04_base.txt
@@ -79,3 +79,5 @@ libusbredirparser1
 libvirglrenderer1
 zlib1g
 
+#rr2 depends on libarchive
+libarchive

From f7b27a103e41d36a6802759da779b558b18e8178 Mon Sep 17 00:00:00 2001
From: Luke Craig <lacraig3@gmail.com>
Date: Sat, 5 Nov 2022 22:40:47 -0400
Subject: [PATCH 125/140] fix to make -dev

---
 panda/dependencies/ubuntu:18.04_base.txt | 2 +-
 panda/dependencies/ubuntu:20.04_base.txt | 2 +-
 panda/dependencies/ubuntu:22.04_base.txt | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/panda/dependencies/ubuntu:18.04_base.txt b/panda/dependencies/ubuntu:18.04_base.txt
index 7005aee243a..c655422be34 100644
--- a/panda/dependencies/ubuntu:18.04_base.txt
+++ b/panda/dependencies/ubuntu:18.04_base.txt
@@ -76,4 +76,4 @@ zlib1g
 libxen-4.9
 
 #rr2 depends on libarchive
-libarchive
+libarchive-dev
diff --git a/panda/dependencies/ubuntu:20.04_base.txt b/panda/dependencies/ubuntu:20.04_base.txt
index 40c5ab56a6f..4f57663db5d 100644
--- a/panda/dependencies/ubuntu:20.04_base.txt
+++ b/panda/dependencies/ubuntu:20.04_base.txt
@@ -81,4 +81,4 @@ libvirglrenderer1
 zlib1g
 
 #rr2 depends on libarchive
-libarchive
+libarchive-dev
diff --git a/panda/dependencies/ubuntu:22.04_base.txt b/panda/dependencies/ubuntu:22.04_base.txt
index ea9640f3c7f..5530a24f085 100644
--- a/panda/dependencies/ubuntu:22.04_base.txt
+++ b/panda/dependencies/ubuntu:22.04_base.txt
@@ -80,4 +80,4 @@ libvirglrenderer1
 zlib1g
 
 #rr2 depends on libarchive
-libarchive
+libarchive-dev

From c8de219784d76f23a8a474e7bb3693f2a7e7156e Mon Sep 17 00:00:00 2001
From: wpence <56977224+wpence@users.noreply.github.com>
Date: Fri, 11 Nov 2022 04:13:52 -0500
Subject: [PATCH 126/140] PR for Issue #1219 (#1242)

* Fix overflowing instruction count in pyPANDA

Updated rr_get_guest_instr_count_external() in panda_api to return uint64_t to fix an overflow issue in pyPANDA.

* Fix instruction count overflow in pyPANDA

Updated rr_get_guest_instr_count_external() in panda_api to return uint64_t to fix an overflow issue in pyPANDA.
---
 panda/include/panda/panda_api.h | 2 +-
 panda/src/panda_api.c           | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/panda/include/panda/panda_api.h b/panda/include/panda/panda_api.h
index 0bad333c5ba..dddca0270d0 100644
--- a/panda/include/panda/panda_api.h
+++ b/panda/include/panda/panda_api.h
@@ -31,7 +31,7 @@ void panda_register_callback_helper(void* plugin, panda_cb_type type, panda_cb*
 void panda_enable_callback_helper(void *plugin, panda_cb_type, panda_cb* cb);
 void panda_disable_callback_helper(void *plugin, panda_cb_type, panda_cb* cb);
 
-int rr_get_guest_instr_count_external(void);
+uint64_t rr_get_guest_instr_count_external(void);
 
 int panda_virtual_memory_read_external(CPUState *env, target_ulong addr, char *buf, int len);
 int panda_virtual_memory_write_external(CPUState *env, target_ulong addr, char *buf, int len);
diff --git a/panda/src/panda_api.c b/panda/src/panda_api.c
index c6e02af9d6f..5f15e279341 100644
--- a/panda/src/panda_api.c
+++ b/panda/src/panda_api.c
@@ -129,7 +129,7 @@ void panda_disable_callback_helper(void *plugin, panda_cb_type type, panda_cb* c
 
 //int panda_replay(char *replay_name) -> Now use panda_replay_being(char * replay_name)
 
-int rr_get_guest_instr_count_external(void){
+uint64_t rr_get_guest_instr_count_external(void){
 	return rr_get_guest_instr_count();
 }
 

From 7f2cff2ff560c3cf27f71000ef38d94a6a43c201 Mon Sep 17 00:00:00 2001
From: Andrew Fasano <fasano@mit.edu>
Date: Tue, 15 Nov 2022 09:56:05 -0500
Subject: [PATCH 127/140] PyPANDA: Improve error message on bad memory read

---
 panda/python/core/pandare/panda.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/panda/python/core/pandare/panda.py b/panda/python/core/pandare/panda.py
index 64917305c15..eaa97cb9081 100644
--- a/panda/python/core/pandare/panda.py
+++ b/panda/python/core/pandare/panda.py
@@ -802,7 +802,8 @@ def _memory_read(self, env, addr, length, physical=False, fmt='bytearray'):
             err = self.libpanda.panda_virtual_memory_read_external(env, addr_u, buf_a, length_a)
 
         if err < 0:
-            raise ValueError(f"Memory access failed with err={err}") # TODO: make a PANDA Exn class
+            # TODO: We should support a custom error class instead of a generic ValueError
+            raise ValueError(f"Failed to read guest memory at {addr:x} got err={err}")
 
         r = self.ffi.unpack(buf, length)
         if fmt == 'bytearray':

From 65ed37d99ab8389792d5a1b91385cb11a7992c9a Mon Sep 17 00:00:00 2001
From: Andrew Fasano <fasano@mit.edu>
Date: Tue, 15 Nov 2022 10:01:03 -0500
Subject: [PATCH 128/140] OSI_linux bugfix: fix fd_to_filename for big-endian
 guests

---
 panda/plugins/osi_linux/default_profile.cpp |  1 -
 panda/plugins/osi_linux/osi_linux.cpp       | 14 +++++---------
 2 files changed, 5 insertions(+), 10 deletions(-)

diff --git a/panda/plugins/osi_linux/default_profile.cpp b/panda/plugins/osi_linux/default_profile.cpp
index f7fd8bab867..8061a48b841 100644
--- a/panda/plugins/osi_linux/default_profile.cpp
+++ b/panda/plugins/osi_linux/default_profile.cpp
@@ -111,7 +111,6 @@ target_ptr_t default_get_file_fds(CPUState *cpu, target_ptr_t files)
         LOG_ERROR("Failed to retrieve file structs (error code: %d)", err);
         return (target_ptr_t)NULL;
     }
-    fixupendian(files_fds);
     return files_fds;
 }
 
diff --git a/panda/plugins/osi_linux/osi_linux.cpp b/panda/plugins/osi_linux/osi_linux.cpp
index 7ba2a3b2f22..cbc58925829 100644
--- a/panda/plugins/osi_linux/osi_linux.cpp
+++ b/panda/plugins/osi_linux/osi_linux.cpp
@@ -99,18 +99,14 @@ static uint64_t get_file_position(CPUState *env, target_ptr_t file_struct) {
 static target_ptr_t get_file_struct_ptr(CPUState *env, target_ptr_t task_struct, int fd) {
     target_ptr_t files = get_files(env, task_struct);
     target_ptr_t fds = kernel_profile->get_files_fds(env, files);
-    target_ptr_t fd_file_ptr, fd_file;
-
+    target_ptr_t fd_file = NULL;
     // fds is a flat array with struct file pointers.
-    // Calculate the address of the nth pointer and read it.
-    fd_file_ptr = fds + fd*sizeof(target_ptr_t);
-    if (-1 == panda_virtual_memory_rw(env, fd_file_ptr, (uint8_t *)&fd_file, sizeof(target_ptr_t), 0)) {
-        return (target_ptr_t)NULL;
+    // fds+fd*sizeof(target_ptr_t) is the address of the nth pointer that we need to read
+    auto err = struct_get(env, &fd_file, fds, fd*sizeof(target_ptr_t));
+    if (err != struct_get_ret_t::SUCCESS) {
+      LOG_ERROR("Unable to load file descriptor details");
     }
     fixupendian(fd_file);
-    if (fd_file == (target_ptr_t)NULL) {
-        return (target_ptr_t)NULL;
-    }
     return fd_file;
 }
 

From a5ac10a8bca7df2df835e923ed51038b59f400ec Mon Sep 17 00:00:00 2001
From: Andrew Fasano <fasano@mit.edu>
Date: Tue, 15 Nov 2022 12:25:56 -0500
Subject: [PATCH 129/140] OSI_linux: fix read_dentry_name for big endian
 kernels >= v3.5

Linux kernel 3.5 and up swap the order of the len and hash fields in the
qstr structure, but only for big endian guests. This commit adjusts
OSI_linux to properly handle this. It also changes many commented
out helper functions to use a #defined helper and provide more
information for future debugging.
---
 panda/plugins/osi_linux/osi_linux.cpp |  9 +++-
 panda/plugins/osi_linux/osi_linux.h   | 66 ++++++++++++++++++---------
 2 files changed, 52 insertions(+), 23 deletions(-)

diff --git a/panda/plugins/osi_linux/osi_linux.cpp b/panda/plugins/osi_linux/osi_linux.cpp
index cbc58925829..81d8e14da99 100644
--- a/panda/plugins/osi_linux/osi_linux.cpp
+++ b/panda/plugins/osi_linux/osi_linux.cpp
@@ -76,6 +76,8 @@ static char *get_file_name(CPUState *env, target_ptr_t file_struct) {
     // Read addresses for dentry, vfsmnt structs.
     file_dentry = get_file_dentry(env, file_struct);
     file_mnt = get_file_mnt(env, file_struct);
+   OG_printf("(struct dentry *) file_dentry at " TARGET_FMT_lx "\n", file_dentry);
+   OG_printf("(struct vfsmount *) file_mnt at " TARGET_FMT_lx "\n", file_mnt);
 
     if (unlikely(file_dentry == (target_ptr_t)NULL || file_mnt == (target_ptr_t)NULL)) {
         LOG_INFO("failure resolving file struct " TARGET_PTR_FMT "/" TARGET_PTR_FMT, file_dentry, file_mnt);
@@ -85,6 +87,7 @@ static char *get_file_name(CPUState *env, target_ptr_t file_struct) {
     char *s1, *s2;
     s1 = read_vfsmount_name(env, file_mnt);
     s2 = read_dentry_name(env, file_dentry);
+    OG_printf("S1=%s, S2=%s\n", s1, s2);
     name = g_strconcat(s1, s2, NULL);
     g_free(s1);
     g_free(s2);
@@ -99,9 +102,12 @@ static uint64_t get_file_position(CPUState *env, target_ptr_t file_struct) {
 static target_ptr_t get_file_struct_ptr(CPUState *env, target_ptr_t task_struct, int fd) {
     target_ptr_t files = get_files(env, task_struct);
     target_ptr_t fds = kernel_profile->get_files_fds(env, files);
-    target_ptr_t fd_file = NULL;
+    target_ptr_t fd_file = 0;
     // fds is a flat array with struct file pointers.
     // fds+fd*sizeof(target_ptr_t) is the address of the nth pointer that we need to read
+    OG_printf("(struct files_struct*) files at " TARGET_FMT_lx \
+           ", (struct file *(*)[32])fds at " TARGET_FMT_lx "\n", files, fds);
+
     auto err = struct_get(env, &fd_file, fds, fd*sizeof(target_ptr_t));
     if (err != struct_get_ret_t::SUCCESS) {
       LOG_ERROR("Unable to load file descriptor details");
@@ -116,6 +122,7 @@ static target_ptr_t get_file_struct_ptr(CPUState *env, target_ptr_t task_struct,
 static char *get_fd_name(CPUState *env, target_ptr_t task_struct, int fd) {
     target_ptr_t fd_file = get_file_struct_ptr(env, task_struct, fd);
     if (fd_file == (target_ptr_t)NULL) return NULL;
+    OG_printf("Get FDs[%d] name from " TARGET_FMT_lx "\n", fd, fd_file);
     return get_file_name(env, fd_file);
 }
 
diff --git a/panda/plugins/osi_linux/osi_linux.h b/panda/plugins/osi_linux/osi_linux.h
index 4af763b3182..a3ddc66ccb6 100644
--- a/panda/plugins/osi_linux/osi_linux.h
+++ b/panda/plugins/osi_linux/osi_linux.h
@@ -395,6 +395,7 @@ static inline target_ptr_t get_fd_file(CPUState *env, target_ptr_t fd_file_array
 static inline char *read_dentry_name(CPUState *env, target_ptr_t dentry) {
     char *name = NULL;
 
+    OG_printf("\nread_dentry name for (struct dentry*)0x" TARGET_FMT_lx "\n", dentry);
     // current path component
     char *pcomp = NULL;
     uint32_t pcomp_length = 0;
@@ -414,18 +415,19 @@ static inline char *read_dentry_name(CPUState *env, target_ptr_t dentry) {
     while (current_dentry_parent != current_dentry) {
         int og_err1, og_err2;
         current_dentry = current_dentry_parent;
-        //printf("1#%lx\n", (uintptr_t)(current_dentry + ki.path.d_name_offset));
+        OG_printf("Dentry loop: current_dentry(struct dentry*)0x" TARGET_FMT_lx "\n",  current_dentry);
+        // First calculate the parent that we'll use in the next loop iteration
+        og_err2 = get_dentry_parent(env, current_dentry, &current_dentry_parent);
+        fixupendian(current_dentry_parent);
 
-        // read dentry d_parent and d_name
+
+        // Now process the current dentry to get the d_name
+        // Note we don't `fixendian` on it because it's > 4 bytes, instead
+        // we'll fix it just before use (in guest_addr)
         memset(d_name, 0, ki.qstr.size * sizeof(uint8_t));
         og_err1 = get_dentry_name(env, current_dentry, d_name);
-        og_err2 = get_dentry_parent(env, current_dentry, &current_dentry_parent);
 
-        // Note we don't fix endian of dentry name because it's a large(r than 4)
-        // byte buffer. Instead we'll fix it just before use (in guest_addr)
-        fixupendian(current_dentry_parent);
-
-        //HEXDUMP(d_name, ki.path.qstr_size, current_dentry + ki.path.d_name_offset);
+        //HEXDUMP(d_name, ki.qstr.size, current_dentry + ki.path.d_name_offset);
         if (OG_SUCCESS != og_err1 || OG_SUCCESS != og_err2) {
             break;
         }
@@ -438,9 +440,31 @@ static inline char *read_dentry_name(CPUState *env, target_ptr_t dentry) {
             d_dname = (target_ptr_t)NULL;
         }
 
-        // read component
+        // We want to parse a `struct qstr` https://elixir.bootlin.com/linux/latest/source/include/linux/dcache.h#L48
+        // and get the unsigned int `len` field. then, skip past the `len` and `hash` field to read the `char* name` field.
+
+        // Prior to linux kernel 3.5, the len was always the 2nd entry in this structure.
+        // From kernel 3.5 and up, `len` and `hash` are stored using the HASH_LEN_DECLARE macro which will
+        // place `len` first if the guest is big-endian.
+        // See the HASH_LEN_DECLARE macro definiton here: https://elixir.bootlin.com/linux/latest/source/include/linux/dcache.h#L32
+        //
+        // This change was introduced to the linux kernel for version 3.5 in this commit:
+        // https://github.com/torvalds/linux/commit/26fe575028703948880fce4355a210c76bb0536e#diff-b11f554b3424c2d794e935f9d5839994f57fc241249928acd57103e2574eb5ccR42-R48
+        //
+        // For little endian guests, we skip always read `len` at offset 8. For big endian guests we read at offset 0 if kernel >=3.15, else offset 8.
+
+#if defined (TARGET_WORDS_BIGENDIAN)
+        // Big endian, if kernel >= 3.5 then pcomp length is first field so offset=0. Otherwise it will be second so offset=8
+        if (ki.version.a > 3 || (ki.version.a == 3 && ki.version.b > 5)) {
+          pcomp_length = *(uint32_t *)(d_name);
+        } else {
+          pcomp_length = *(uint32_t *)(d_name + sizeof(uint32_t));
+        }
+#else
+        // Little endian: kernel version doesn't matter, len will always be second after an unsigned int
         pcomp_length = *(uint32_t *)(d_name + sizeof(uint32_t));
-        fixupendian(pcomp_length);
+#endif
+        OG_printf("Pcomp length %d\n", pcomp_length);
         if (pcomp_length == (uint32_t)-1) { // Not sure why this happens, but it does
               printf("Warning: OSI_linux Unhandled pcomp value, ignoring\n");
               break;
@@ -456,14 +480,16 @@ static inline char *read_dentry_name(CPUState *env, target_ptr_t dentry) {
             }
         }
 
+        // read component
         target_ptr_t guest_addr = *(target_ptr_t *)(d_name + ki.qstr.name_offset);
         fixupendian(guest_addr);
+        OG_printf("Reading name from guest 0x" TARGET_FMT_lx "\n", guest_addr);
         og_err1 = panda_virtual_memory_rw(env, guest_addr, (uint8_t *)pcomp, pcomp_length*sizeof(char), 0);
 
     // I think this aims to be a re-implementation of the Linux kernel function
     // __dentry_path but the logic seems pretty different.
-        //printf("2#%lx\n", (uintptr_t)*(target_ptr_t *)(d_name + 2*sizeof(uint32_t)));
-        //printf("3#%s\n", pcomp);
+        OG_printf("2#%lx\n", (uintptr_t)*(target_ptr_t *)(d_name + 2*sizeof(uint32_t)));
+        OG_printf("3#%s\n", pcomp);
         if (-1 == og_err1) {
             break;
         }
@@ -535,20 +561,16 @@ static inline char *read_vfsmount_name(CPUState *env, target_ptr_t vfsmount) {
     while(current_vfsmount != current_vfsmount_parent) {
         int og_err0, og_err1;
         target_ptr_t current_vfsmount_dentry;
-        //int og_err2;
-        //target_ptr_t root_dentry;
         current_vfsmount = current_vfsmount_parent;
 
         // retrieve vfsmount members
         og_err0 = get_vfsmount_dentry(env, current_vfsmount, &current_vfsmount_dentry);
-        og_err1 = get_vfsmount_parent(env, current_vfsmount, &current_vfsmount_parent);
         fixupendian(current_vfsmount_dentry);
-        fixupendian(current_vfsmount_parent);
+        OG_printf("###get_dentry returns %d with (struct vfsmount *)0x" TARGET_PTR_FMT " -> (struct dentry *)0x" TARGET_PTR_FMT "\n", og_err0, current_vfsmount, current_vfsmount_dentry);
 
-        //printf("###D:%d:" TARGET_PTR_FMT ":" TARGET_PTR_FMT "\n", og_err0, current_vfsmount, current_vfsmount_dentry);
-        //printf("###R:%d:" TARGET_PTR_FMT ":" TARGET_PTR_FMT "\n", og_err2, current_vfsmount, root_dentry);
-        //og_err2 = get_vfsmount_root_dentry(env, current_vfsmount, &root_dentry);
-        //printf("###P:%d:" TARGET_PTR_FMT ":" TARGET_PTR_FMT "\n", og_err1, current_vfsmount, current_vfsmount_parent);
+        og_err1 = get_vfsmount_parent(env, current_vfsmount, &current_vfsmount_parent);
+        fixupendian(current_vfsmount_parent);
+        OG_printf("###get_vsfmount_parent returns %d with (struct vfsmount *)0x" TARGET_PTR_FMT " -> (struct vfsmount *)0x" TARGET_PTR_FMT "\n", og_err1, current_vfsmount, current_vfsmount_parent);
 
         // check whether we should break out
         if (OG_SUCCESS != og_err0 || OG_SUCCESS != og_err1) {
@@ -560,7 +582,7 @@ static inline char *read_vfsmount_name(CPUState *env, target_ptr_t vfsmount) {
 
         // read and copy component
         pcomp = read_dentry_name(env, current_vfsmount_dentry);
-        //printf("###S:%s\n", pcomp);
+        OG_printf("###Read dentry name from (struct dentry *)0x" TARGET_FMT_lx " to get '%s'\n", current_vfsmount_dentry, pcomp);
 
         // this may hapen it seems
         if (pcomp == NULL) {
@@ -590,7 +612,7 @@ static inline char *read_vfsmount_name(CPUState *env, target_ptr_t vfsmount) {
         g_strfreev(pcomps);
     }
 
-    //printf("###F:%s\n", name);
+    OG_printf("###F:%s\n", name);
     return name;
 }
 

From 7dd3fdaec065f989795a6bda007439c88d73aac7 Mon Sep 17 00:00:00 2001
From: "Laura L. Mann" <laura.mann@ngc.com>
Date: Wed, 9 Nov 2022 09:34:49 -0500
Subject: [PATCH 130/140] ACE-67:  compress labels

---
 panda/plugins/ida_taint2/ida_taint2.py | 125 ++++++++++++++++++++++++-
 1 file changed, 124 insertions(+), 1 deletion(-)

diff --git a/panda/plugins/ida_taint2/ida_taint2.py b/panda/plugins/ida_taint2/ida_taint2.py
index 5dc26ef5c8b..b0715d1d58b 100644
--- a/panda/plugins/ida_taint2/ida_taint2.py
+++ b/panda/plugins/ida_taint2/ida_taint2.py
@@ -76,6 +76,127 @@ def selectProcess(cls, processes):
             return psd.selectedProcess()
         return None
 
+class LabelsCompressor:
+    def __init__(self, have_semantic_labels):
+        self._have_semantic_labels = have_semantic_labels
+        
+    def _semantic_label_sorter(self, item):
+        # semantic labels are formatted <packet number>-<byte offset>
+        # we want to sort first by packet number, then by byte offset
+        parts = item.split("-")
+        packet_num = int(parts[0])
+        offset = int(parts[1])
+        return (packet_num, offset)
+    
+    def _append_semantic_label(self, labels, first):
+        if (len(labels) > 0):
+            groupsep = ", "
+            lastlf = labels.rfind("\n")
+            # lastlf will be -1 if none found, but that won't mess up the formatting
+            if ((len(labels) - lastlf) > 50):
+                groupsep = ",\n"
+            updated_labels = labels + groupsep + str(first[0]) + ":" + str(first[1])
+        else:
+            updated_labels = str(first[0]) + ":" + str(first[1])
+        return updated_labels
+    
+    def _append_semantic_label_range(self, labels, first, last):
+        if (len(labels) > 0):
+            groupsep = ", "
+            lastlf = labels.rfind("\n")
+            if ((len(labels) - lastlf) > 50):
+                groupsep = ",\n"
+            updated_labels = labels + groupsep + str(first[0]) + ":" + str(first[1]) + "-" + str(last[1])
+        else:
+            updated_labels = str(first[0]) + ":" + str(first[1]) + "-" + str(last[1])
+        return updated_labels
+        
+    def _compress_sorted_semantic_labels(self, labels):
+        clabels = ""
+        first = None
+        last = None
+        for item in labels:
+            itemparts = self._semantic_label_sorter(item)
+            if (None == first):
+                first = itemparts
+            elif (None == last):
+                if (first[0] == itemparts[0]):
+                    if ((first[1]+1) == itemparts[1]):
+                        last = itemparts
+                    else:
+                        clabels = self._append_semantic_label(clabels, first)
+                        first = itemparts
+                else:
+                    clabels = self._append_semantic_label(clabels, first)
+                    first = itemparts
+            elif (last[0] == itemparts[0]):
+                if ((last[1]+1) == itemparts[1]):
+                    last = itemparts
+                else:
+                    clabels = self._append_semantic_label_range(clabels, first, last)
+                    first = itemparts
+                    last = None
+            else:
+                clabels = self._append_semantic_label_range(clabels, first, last)
+                first = itemparts
+                last = None
+        if (None == last):
+            clabels = self._append_semantic_label(clabels, first)
+        else:
+            clabels = self._append_semantic_label_range(clabels, first, last)
+        return clabels
+        
+    def _compress_sorted_standard_labels(self, labels):
+        clabels = ""
+        lastline = ""
+        first = None
+        last = None
+        for item in labels:
+            if (0 == len(clabels)):
+                # very first label
+                clabels = str(item)
+                lastline = str(item)
+                first = item
+            elif (None == last):
+                if ((first + 1) == item):
+                    # part of a consecutive sequence starting at first
+                    last = item
+                else:
+                    # first did not start a consecutive sequence
+                    if (len(lastline) > 50):
+                        clabels = clabels + ",\n" + str(item)
+                        lastline = str(item)
+                    else:
+                        clabels = clabels + ", " + str(item)
+                        lastline = lastline + ", " + str(item)
+                    first = item
+            elif ((last + 1) == item):
+                # item extends the consecutive sequence from last
+                last = item
+            else:
+                # the previous last ended a consecutive sequence
+                if (len(lastline) > 50):
+                    clabels = clabels + "-" + str(last) + ",\n" + str(item)
+                    lastline = str(item)
+                else:
+                    clabels = clabels + "-" + str(last) + ", " + str(item)
+                    lastline = lastline + "-" + str(last) + ", " + str(item)
+                first = item
+                last = None
+        if (last is not None):
+            # last label ends a consecutive sequence
+            clabels = clabels + "-" + str(last)
+        return clabels
+        
+    def compress_labels(self, labels):
+        if (self._have_semantic_labels):
+            sorted_labels = sorted(labels, key=self._semantic_label_sorter)
+            compressed_labels = self._compress_sorted_semantic_labels(sorted_labels)
+        else:
+            sorted_labels = sorted(labels, key=int)
+            compressed_labels = self._compress_sorted_standard_labels(sorted_labels)
+        return compressed_labels
+        
 def read_semantic_labels(filename):
     semantic_labels = dict()
     try:
@@ -155,11 +276,13 @@ def main():
         labels_for_pc[pc].add(label)
     input_file.close()
 
+    labels_compressor = LabelsCompressor(len(semantic_labels)>0)
     for pc, labels in labels_for_pc.items():
         comment = ida_bytes.get_cmt(pc, 0)
         if not comment:
             comment = ""
-        label_portion = "taint labels = {}".format(list(labels))
+        compressed_labels = labels_compressor.compress_labels(labels)
+        label_portion = "taint labels = " + compressed_labels
         if comment == "":
             comment = label_portion
         else:

From 9f653d666381891aba7ea975f944f792d6aeaae1 Mon Sep 17 00:00:00 2001
From: "Laura L. Mann" <laura.mann@ngc.com>
Date: Wed, 9 Nov 2022 10:06:02 -0500
Subject: [PATCH 131/140] ACE-67:  fix typo

---
 panda/plugins/ida_taint2/README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/panda/plugins/ida_taint2/README.md b/panda/plugins/ida_taint2/README.md
index 1b956075793..a375d0342ed 100644
--- a/panda/plugins/ida_taint2/README.md
+++ b/panda/plugins/ida_taint2/README.md
@@ -3,7 +3,7 @@ Plugin: ida_taint2
 
 Summary
 -------
-This plugin is intended to be used with either the `ida_taint2.py`script or `ida_taint2_plugin.py` plugin in IDAPython.  (Both of these IDAPython files are included.)  These IDAPython files use different techniiques to indicate tainted functions and instructions in IDA based on the output CSV file from this plugin. This plugin produces a CSV file of process IDs and program counter values. There are also two informational lines at the top of the file:  the first provides the PANDA build date, and the second provides the timestamp for when this CSV file was produced. There should be no duplicate rows in the file. An entry in the CSV file indicates that the instruction at the PC manipulated tainted data. The PID is needed because the reported addresses are virtual addresses and so one address may be in two different processes. A process ID of 0 indicates the system is in kernel mode.
+This plugin is intended to be used with either the `ida_taint2.py`script or `ida_taint2_plugin.py` plugin in IDAPython.  (Both of these IDAPython files are included.)  These IDAPython files use different techniques to indicate tainted functions and instructions in IDA based on the output CSV file from this plugin. This plugin produces a CSV file of process IDs and program counter values. There are also two informational lines at the top of the file:  the first provides the PANDA build date, and the second provides the timestamp for when this CSV file was produced. There should be no duplicate rows in the file. An entry in the CSV file indicates that the instruction at the PC manipulated tainted data. The PID is needed because the reported addresses are virtual addresses and so one address may be in two different processes. A process ID of 0 indicates the system is in kernel mode.
 
 The `ida_taint2.py` script reads the CSV file and highlights functions and instructions that manipulate tainted data. Functions are highlighted green and individual instructions are highlighted in orange. Additionally, function names are updated with a prefix of "TAINTED_" so that it becomes possible to search for functions that manipulated tainted data.  Note that both the colorization and function renaming make changes to the IDA database.  This makes the taint indications awkward to undo if you have made other changes in the database that should be kept, although the `undo_ida_taint2.py` script described below attempts to do so.  (Use the `ida_taint2_plugin.py` IDAPython plugin if it is desired to indicate tainted instructions without modifying the database.)
 

From 6061a139a86218ecfb979c7886c7b6d041cd64b4 Mon Sep 17 00:00:00 2001
From: "Laura L. Mann" <laura.mann@ngc.com>
Date: Wed, 9 Nov 2022 15:46:25 -0500
Subject: [PATCH 132/140] ACE-67:  update documentation

The libosi work gotrid of some plugins that asidstory and osi_test still referred to.  The osi_linux plugin has a new dependency someone added some time ago.  Someone also udpated tainted_instr and tainted_branch to report tainted instructions instead of tainted blocks, but the documentation was not changed to match.  Hopefully making the documentation match the behavior will be less confusing to future users.
---
 panda/plugins/asidstory/README.md      |  2 +-
 panda/plugins/osi_linux/README.md      |  2 +-
 panda/plugins/osi_test/README.md       | 80 ++++++++++++++++----------
 panda/plugins/tainted_branch/README.md | 18 +++---
 panda/plugins/tainted_instr/README.md  |  2 +-
 5 files changed, 62 insertions(+), 42 deletions(-)

diff --git a/panda/plugins/asidstory/README.md b/panda/plugins/asidstory/README.md
index f63201d8113..ee87cd9efa3 100644
--- a/panda/plugins/asidstory/README.md
+++ b/panda/plugins/asidstory/README.md
@@ -260,4 +260,4 @@ Example
 
 To run `asidstory` on a Windows XP 32-bit recording with a 180 character wide diagram:
 
-`$PANDA_PATH/i386-softmmu/panda-system-i386 -replay foo -os windows-32-xpsp3 -panda osi -panda winxpx86intro -panda asidstory:width=180`
+`$PANDA_PATH/i386-softmmu/panda-system-i386 -replay foo -os windows-32-xpsp3 -panda asidstory:width=180`
diff --git a/panda/plugins/osi_linux/README.md b/panda/plugins/osi_linux/README.md
index 07449839214..dd5834b8dd1 100644
--- a/panda/plugins/osi_linux/README.md
+++ b/panda/plugins/osi_linux/README.md
@@ -129,7 +129,7 @@ Arguments
 Dependencies
 ------------
 
-`osi_linux` is an introspection provider for the `osi` plugin.
+`osi_linux` is an introspection provider for the `osi` plugin.  It also uses the `hw_proc_id` plugin.
 
 APIs and Callbacks
 ------------------
diff --git a/panda/plugins/osi_test/README.md b/panda/plugins/osi_test/README.md
index 95421658fa6..9d47c5bacbf 100644
--- a/panda/plugins/osi_test/README.md
+++ b/panda/plugins/osi_test/README.md
@@ -5,10 +5,10 @@ Summary
 ------------------------
 This plugin is meant to test the functionality of the [PANDA OS introspection framework][osi].
 
-By default, the `osi_test` plugin invokes the OSI code every time that the Page
-Directory register is written to.
+By default, the `osi_test` plugin invokes the OSI code every time that the
+address space identifier (ASID) changes.
 Invocation frequency can be increased by commenting out the definition of the
-`INVOKE_FREQ_PGD` macro in the code. Then, OSI code will be invoked before the
+`OSI_TEST_ON_ASID_CHANGED` macro in the code. Then, OSI code will be invoked before the
 execution of each basic block. Be warned that this may be too frequent and even
 small traces will take a long time to be replayed.
 
@@ -19,7 +19,7 @@ None.
 Dependencies
 ------------------------
 Depends on the `osi` plugin to access the introspection API, and also a
-particular introspection provider (e.g., `osi_linux` or `win7x86intro`).
+particular introspection provider (e.g., `osi_linux` or `wintrospection`).
 
 APIs and Callbacks
 ------------------------
@@ -34,36 +34,56 @@ guest-os-specific plugin.
 E.g. to run `osi_test` on an Windows 7 32-bit replay:
 
 ```sh
-  $PANDA_PATH/x86_64-softmmu/panda-system-x86_64 -replay mytrace \
-    -panda osi -panda win7x86intro -panda osi_test
+  $PANDA_PATH/i386-softmmu/panda-system-i386 -replay mytrace \
+    -os windows-32-7sp1 -panda osi_test
 ```
+The os-specific plugin is loaded implicitly by specifying `-os windows-32-7sp1`.
 
 ### output
 
-    Current process: svchost.exe PID:876 PPID:452
-    Dynamic libraries list (68 libs):
-            0x00000000003d0000      32768   svchost.exe              C:\Windows\System32\svchost.exe
-            0x0000000077a80000      1294336 ntdll.dll                C:\Windows\SYSTEM32\ntdll.dll
-            0x0000000076810000      868352  kernel32.dll             C:\Windows\system32\kernel32.dll
-            0x0000000075cd0000      303104  KERNELBASE.dll           C:\Windows\system32\KERNELBASE.dll
-            0x0000000076300000      704512  msvcrt.dll               C:\Windows\system32\msvcrt.dll
-            0x0000000077a60000      102400  sechost.dll              C:\Windows\SYSTEM32\sechost.dll
-            0x0000000076250000      659456  RPCRT4.dll               C:\Windows\system32\RPCRT4.dll
-    [...]
-    Process list (29 procs):
-      svchost.exe           876     452
-      svchost.exe           964     452
-      svchost.exe           1076    452
-      spoolsv.exe           1172    452
-      svchost.exe           1208    452
-      svchost.exe           1308    452
-      sppsvc.exe            264     452
-      svchost.exe           284     452
-      GoogleCrashHan        532     260
-      SearchIndexer.        912     452
-      taskhost.exe          524     452
-      dwm.exe               1136    832
-    [...]
+```
+Current process: csrss.exe PID:348 PPID:328
+
+Process list (27 procs):
+  smss.exe        	200	4
+  csrss.exe       	288	280
+  wininit.exe     	336	280
+  csrss.exe       	348	328
+  winlogon.exe    	376	328
+  services.exe    	436	336
+  lsass.exe       	448	336
+  lsm.exe         	456	336
+  svchost.exe     	544	436
+[...]
+  conhost.exe     	760	348
+  System          	4	0
+
+-------------------------------------------------
+
+Dynamic libraries list (18 libs):
+	0x49cb0000	20480	csrss.exe                C:\Windows\system32\csrss.exe
+	0x76f50000	1318912	ntdll.dll                C:\Windows\SYSTEM32\ntdll.dll
+	0x74e50000	53248	CSRSRV.dll               C:\Windows\system32\CSRSRV.dll
+	0x74e40000	57344	basesrv.DLL              C:\Windows\system32\basesrv.DLL
+[...]
+	0x770a0000	659456	ADVAPI32.dll             C:\Windows\system32\ADVAPI32.dll
+	0x75fb0000	102400	sechost.dll              C:\Windows\SYSTEM32\sechost.dll
+
+Kernel module list (136 modules):
+	0x82818000	4251648	ntoskrnl.exe             \SystemRoot\system32\ntoskrnl.exe
+	0x82c26000	225280	hal.dll                  \SystemRoot\system32\halmacpi.dll
+	0x80b9b000	32768	kdcom.dll                \SystemRoot\system32\kdcom.dll
+	0x8b405000	544768	mcupdate.dll             \SystemRoot\system32\mcupdate_GenuineIntel.dll
+	0x8b48a000	69632	PSHED.dll                \SystemRoot\system32\PSHED.dll
+	0x8b49b000	32768	BOOTVID.dll              \SystemRoot\system32\BOOTVID.dll
+	[...]
+	0x98e2a000	57344	tssecsrv.sys             \SystemRoot\System32\DRIVERS\tssecsrv.sys
+	0x98e38000	204800	RDPWD.SYS                \SystemRoot\System32\Drivers\RDPWD.SYS
+	0x00000000	0	                         
+
+-------------------------------------------------
+[...]	
+```
 
 ### output normalizer
 Script [osi_test_normalize.py][osi_test_normalize] can be used to make
diff --git a/panda/plugins/tainted_branch/README.md b/panda/plugins/tainted_branch/README.md
index 9745d92f735..6c0be973c25 100644
--- a/panda/plugins/tainted_branch/README.md
+++ b/panda/plugins/tainted_branch/README.md
@@ -8,11 +8,12 @@ The `tainted_branch` plugin produces a report in PANDA log or Comma Separated Va
 
 Output in PANDA log format can be done in "summary" or default mode. The PANDA log file name is specified using the "-pandalog" option to PANDA.  Note that all numbers in the PANDA log are in decimal.
 
-The PANDA log format default mode reports the guest address of the block including the tainted branch, the callstack, information on each taint found, and the instruction count of the tainted branch or its block.  Each taint report found reports its Taint Compute Number (i.e. how many computations on the tainted item are involved between when the taint was introduced and the time of the report), the native address of where the taint labels are, the taint labels, and the offset into the buffer in the guest of the item whose taint is being reported on. Note that each taint label set is only reported the first time it is encountered.  The label set address can be used to find the label set for subsequent instances.  Following is a copy of part of a PANDA log.  The section labeled "uniqueLabelSet" is what is omitted from subsequent reports for the same label set.
+The PANDA log format default mode reports the guest address of the tainted branch instruction, the callstack, information on each taint found, and the instruction count of the tainted branch.  Each taint report found reports its Taint Compute Number (i.e. how many computations on the tainted item are involved between when the taint was introduced and the time of the report), the native address of where the taint labels are, the taint labels, and the offset into the buffer in the guest of the item whose taint is being reported on. Note that each taint label set is only reported the first time it is encountered.  The label set address can be used to find the label set for subsequent instances.  Following is a copy of part of a PANDA log.  The section labeled "uniqueLabelSet" is what is omitted from subsequent reports for the same label set.
 
 ```
 {
-  "pc": "4196548",     <===== the guest address of the block containing the tainted branch
+  "pc": "4196548",     <===== the guest address of tainted branch instruction
+  "instr": "21191791"  <===== guest instruction count
   "taintedBranch": {
     "callStack": {
       "addr": [
@@ -24,7 +25,9 @@ The PANDA log format default mode reports the guest address of the block includi
     }, 
     "taintQuery": [
       {
-        "tcn": 1,     <===== Taint Compute Number
+        "ptr": "140192956884936",    <===== address of this label set
+        "tcn": 1,      <===== Taint Compute Number
+        "offset": 0,   <===== offset into buffer in guest of thing whose taint is being queried
         "uniqueLabelSet": {
           "ptr": "140192956884936",     <===== address of this label set
           "label": [
@@ -33,13 +36,10 @@ The PANDA log format default mode reports the guest address of the block includi
             10, 
             11
           ]
-        }, 
-        "ptr": "140192956884936",     <===== address of this label set
-        "offset": 0     <===== offset into buffer in guest of thing whose taint is being queried
+        }
       }
     ]
-  }, 
-  "instr": "21191791"     <===== guest instruction count
+  }
 }
 ```
 
@@ -49,7 +49,7 @@ In either PANDA log mode, the liveness option can be used to include a list of t
 
 The "ignore_helpers" option can be used to omit taint reports that are generated from within LLVM helper functions.  This can be useful if the output will be processed by analysis tools that cannot process helper functions.
 
-Output in CSV format can also be done in "summary" or default mode.  The "summary" output lists the same information as seen in the PANDA log summary output.  The default mode lists for each tainted branch the guest address of the block including the tainted branch, the instruction count, and a space-separated list of labels.  Note that the liveness option cannot be used with CSV output.  It is also not possible to produce PANDA log and CSV output at the same time.
+Output in CSV format can also be done in "summary" or default mode.  The "summary" output lists the same information as seen in the PANDA log summary output.  The default mode lists for each tainted branch the guest address of the tainted branch instruction, the instruction count, and a space-separated list of labels.  Note that the liveness option cannot be used with CSV output.  It is also not possible to produce PANDA log and CSV output at the same time.
 
 Arguments
 ---------
diff --git a/panda/plugins/tainted_instr/README.md b/panda/plugins/tainted_instr/README.md
index 47a34485440..a0109747f3f 100644
--- a/panda/plugins/tainted_instr/README.md
+++ b/panda/plugins/tainted_instr/README.md
@@ -10,7 +10,7 @@ Arguments
 ---------
 
 * `summary`: boolean. Determines whether full or summary information will be produced. In summary mode, `tainted_instr` just produces information about what instructions were tainted in each address space seen. In full mode, a log entry is written every time an instruction handling tainted data is executed, along with the callstack at that point. The logs for full mode can get rather large.
-* `num`: uint64.  Number of tainted instructions to log or summarize.  The default (0) means there is no limit.  Note that if `tainted_instr` sees the same tainted block reported mutiple times in a row, that this is counted as only one 'instruction'.  For example, if taint change reports come in five times for tainted data in block 1, then three times for tainted data in block 2, then seven times for tainted data in block 1 again, and then four times for tainted data in block 3, then the number of tainted 'instructions' seen will be 4, as there were four distinct runs.
+* `num`: uint64.  Number of tainted instructions to log or summarize.  The default (0) means there is no limit.  Note that if `tainted_instr` sees the same tainted instruction reported mutiple times in a row, that this is counted as only one instruction.  For example, if taint change reports come in five times for tainted data on instruction 1, then three times for tainted data on instruction 2, then seven times for tainted data on instruction 1 again, and then four times for tainted data in instruction 3, then the number of tainted instructions seen will be 4, as there were four distinct runs.
 
 Dependencies
 ------------

From 46560f5d579ba171d392b91cb820ddbd87add683 Mon Sep 17 00:00:00 2001
From: Tim Leek <trleek@gmail.com>
Date: Fri, 28 Oct 2022 07:23:05 -0400
Subject: [PATCH 133/140] dont have to say softmmu over and over when
 configuring build

---
 build.sh | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/build.sh b/build.sh
index 866c784caee..eb83f7ec96d 100755
--- a/build.sh
+++ b/build.sh
@@ -35,7 +35,11 @@ fi
 if [ $# -ge 1 ]; then if [ "$1" = "small" ]; then
         TARGET_LIST="i386-softmmu"
     else
-        TARGET_LIST="$1"
+        if [[ "$1" == *"-softmmu" ]]; then
+            TARGET_LIST="$1"
+        else
+            TARGET_LIST="$1-softmmu"
+        fi
     fi
     echo "Building PANDA for target(s): $TARGET_LIST"
     shift

From 475f855f8fa57964e7bad795d6c03f6a21b4389c Mon Sep 17 00:00:00 2001
From: Tim Leek <trleek@gmail.com>
Date: Fri, 4 Nov 2022 11:05:39 -0400
Subject: [PATCH 134/140] Added lots of comments to what appear to be panda api
 functions.

---
 panda/include/panda/checkpoint.h |  36 ++
 panda/include/panda/common.h     | 297 ++++++++++++---
 panda/include/panda/panda_api.h  | 403 +++++++++++++++++++-
 panda/include/panda/plog.h       |  89 ++++-
 panda/include/panda/plugin.h     | 629 +++++++++++++++++++++++++++++--
 5 files changed, 1353 insertions(+), 101 deletions(-)

diff --git a/panda/include/panda/checkpoint.h b/panda/include/panda/checkpoint.h
index de474d3054b..3f7150ad738 100644
--- a/panda/include/panda/checkpoint.h
+++ b/panda/include/panda/checkpoint.h
@@ -21,9 +21,45 @@ typedef struct Checkpoint {
 extern Checkpoint* checkpoints[MAX_CHECKPOINTS];
 
 /*void* search_checkpoints(uint64_t target_instr);*/
+
+/**
+ * get_num_checkpoints() - Get number of checkpoints in current checkpointed recording.
+ * 
+ * Return: Number of checkpoints.
+ */
 size_t get_num_checkpoints(void);
+
+/**
+ * get_closest_checkpoint_num() - Determine checkpoint closest to this instruction count.
+ * @instr_count: Instruction count we'd like to get closest to.
+ *
+ * Return: Checkpoint number.
+ */
 int get_closest_checkpoint_num(uint64_t instr_count);
+
+/**
+ * get_checkpoint() - Get this checkpoint, by number.
+ * @num: The number.
+ *
+ * Return: Pointer to the checkpoint.
+ */
 Checkpoint* get_checkpoint(int num);
+
+/** 
+ * panda_checkpoint() - Take a checkpoint.
+ *
+ * This has to happen whilst we are in replay.  Take a checkpoint
+ * we'll later be able to return to using panda_restore_by_num.
+ */
 void* panda_checkpoint(void);
+
+/**
+ * panda_restore_by_num() - Restore to a particular checkpoint
+ * @num: Checkpoint number.
+ *
+ * Restore to this numbered checkpoint. 
+ */
 void panda_restore_by_num(int num);
+
+// Not an API fn I think.
 void panda_restore(void *opaque);
diff --git a/panda/include/panda/common.h b/panda/include/panda/common.h
index fe7038e56b8..848c76f4558 100644
--- a/panda/include/panda/common.h
+++ b/panda/include/panda/common.h
@@ -18,7 +18,7 @@
 #include "exec/address-spaces.h"
 #include "panda/types.h"
 
-/**
+/*
  * @brief Branch predition hint macros.
  */
 #if !defined(likely)
@@ -31,11 +31,11 @@
 #ifdef __cplusplus
 extern "C" {
 #endif
-
+    
 #if defined(TARGET_MIPS)
 #define MIPS_HFLAG_KSU    0x00003 /* kernel/supervisor/user mode mask   */
 #define MIPS_HFLAG_KM     0x00000 /* kernel mode flag                   */
-/**
+/*
  *  Register values from: http://www.cs.uwm.edu/classes/cs315/Bacon/Lecture/HTML/ch05s03.html
  */
 #define MIPS_SP           29      /* value for MIPS stack pointer offset into GPR */
@@ -53,32 +53,67 @@ void panda_before_find_fast(void);
 void panda_disas(FILE *out, void *code, unsigned long size);
 void panda_break_main_loop(void);
 MemoryRegion* panda_find_ram(void);
-
+    
 extern bool panda_exit_loop;
 extern bool panda_break_vl_loop_req;
 
 
-/*
- * @brief Returns the guest address space identifier.
- */
+/**
+ * panda_current_asid() - Obtain guest ASID.
+ * @env: Pointer to cpu state.
+ * 
+ * This function figures out and returns the ASID (address space
+ * identifier) for a number of archiectures (e.g., cr3 for x86). In
+ * many cases, this can be used to distinguish between processes.
+ * 
+ * Return: A guest pointer is returned, the ASID.
+*/
 target_ulong panda_current_asid(CPUState *env);
-
+    
 /**
- * @brief Returns the guest program counter.
+ * panda_current_pc() - Get current program counter.
+ * @cpu: Cpu state.
+ *
+ * Note that Qemu typically only updates the pc after executing each
+ * basic block of code. If you want this value to be more accurate,
+ * you will have to call panda_enable_precise_pc.
+ * 
+ * Return: Program counter is returned.
  */
 target_ulong panda_current_pc(CPUState *cpu);
 
 // END_PYPANDA_NEEDS_THIS -- do not delete this comment!
 
 /**
- * @brief Return the max address of system memory that maps to RAM.
+ * panda_find_max_ram_address() - Get max guest ram address.
+ *
+ * Computes the maximum address of guest system memory that maps to
+ * RAM.
+ * 
+ * Return: The max ram address is returned.
  */
 Int128 panda_find_max_ram_address(void);
 
-/**
- * @brief Reads/writes data into/from \p buf from/to guest physical address \p addr.
- */
 
+/* (not kernel-doc)
+ * panda_physical_memory_rw() - Copy data between host and guest.
+ * @addr: Guest physical addr of start of read or write.
+ * @buf: Host pointer to a buffer either containing the data to be
+ *    written to guest memory, or into which data will be copied
+ *    from guest memory.
+ * @len: The number of bytes to copy
+ * @is_write: If true, then buf will be copied into guest
+ *    memory, else buf will be copied out of guest memory.
+ *
+ * Either reads memory out of the guest into a buffer if
+ * (is_write==false), or writes data from a buffer into guest memory
+ * (is_write==true). Note that buf has to be big enough for read or
+ * write indicated by len.
+ *
+ * Return:
+ * * MEMTX_OK      - Read/write succeeded
+ * * MEMTX_ERROR   - An error 
+ */
 static inline int panda_physical_memory_rw(hwaddr addr, uint8_t *buf, int len,
                                            bool is_write) {
     hwaddr l = len;
@@ -100,16 +135,32 @@ static inline int panda_physical_memory_rw(hwaddr addr, uint8_t *buf, int len,
     return MEMTX_OK;
 }
 
-/**
- * @brief Reads data into \p buf from guest physical address \p addr.
+
+/* (not kernel-doc)
+ * panda_physical_memory_read() - Copy data from guest memory into host buffer.
+ * @addr: Guest physical address of start of read.
+ * @buf: Host pointer to a buffer into which data will be copied from guest.
+ * @len: Number of bytes to copy.
+ * 
+ * Return: 
+ * * MEMTX_OK      - Read succeeded
+ * * MEMTX_ERROR   - An error
  */
 static inline int panda_physical_memory_read(hwaddr addr,
                                             uint8_t *buf, int len) {
     return panda_physical_memory_rw(addr, buf, len, 0);
 }
 
-/**
- * @brief Writes data from \p buf data to guest physical address \p addr.
+
+/* (not kernel-doc)
+ * panda_physical_memory_write() - Copy data from host buffer into guest memory.
+ * @addr: Guest physical address of start of desired write.
+ * @buf: Host pointer to a buffer from which data will be copied into guest.
+ * @len: Number of bytes to copy.
+ * 
+ * Return: 
+ * * MEMTX_OK      - Write succeeded
+ * * MEMTX_ERROR   - An error
  */
 static inline int panda_physical_memory_write(hwaddr addr,
                                              uint8_t *buf, int len) {
@@ -118,7 +169,14 @@ static inline int panda_physical_memory_write(hwaddr addr,
 
 
 /**
- * @brief Translates guest virtual addres \p addr to a guest physical address.
+ * panda_virt_to_phys() - Translate guest virtual to physical address.
+ * @env: Cpu state.
+ * @addr: Guest virtual address.
+ *
+ * This conversion will fail if asked about a virtual address that is
+ * not currently mapped to a physical one in the guest. Good luck on MIPS.
+ *
+ * Return: A guest physical address.
  */
 static inline hwaddr panda_virt_to_phys(CPUState *env, target_ulong addr) {
     target_ulong page;
@@ -133,25 +191,55 @@ static inline hwaddr panda_virt_to_phys(CPUState *env, target_ulong addr) {
     return phys_addr;
 }
 
+
 /**
- * @brief If required for the target architecture, enter into a high-privilege mode in
- * order to conduct some memory access. Returns true if a switch into high-privilege
- * mode has been made. A NO-OP on systems where such changes are unnecessary.
+ * enter_priv() - Enter privileged mode.
+ * @cpu: Cpu state.
+ * 
+ * Enter into a higher-privileged mode, e.g., in order to conduct some
+ * memory access. This is a NO-OP on systems without different
+ * privilege modes.
+ * 
+ * Return: 
+ * * True      -  Switch into high-privilege happened.
+ * * False     -  Switch did not happen.
  */
 bool enter_priv(CPUState* cpu);
 
+
 /**
- * @brief Revert the guest to the privilege mode it was in prior to the last call
+ * exit_priv() - Exit privileged mode.
+ * @cpu: Cpu state. 
+ *
+ * Revert the guest to the privilege mode it was in prior to the last call
  * to enter_priv(). A NO-OP for architectures where enter_priv() is a NO-OP.
  */
 void exit_priv(CPUState* cpu);
 
-
-/**
- * @brief Reads/writes data into/from \p buf from/to guest virtual address \p addr.
+    
+/* (not kernel-doc)
+ * panda_virtual_memory_rw() - Copy data between host and guest.
+ * @env: Cpu sate.
+ * @addr: Guest virtual addr of start of read or write.
+ * @buf: Host pointer to a buffer either containing the data to be
+ *    written to guest memory, or into which data will be copied
+ *    from guest memory.
+ * @len: The number of bytes to copy
+ * @is_write: If true, then buf will be copied into guest
+ *    memory, else buf will be copied out of guest memory.
+ *
+ * Either reads memory out of the guest into a buffer if
+ * (is_write==false), or writes data from a buffer into guest memory
+ * (is_write==true). Note that buf has to be big enough for read or
+ * write indicated by len. Also note that if the virtual address is
+ * not mapped, then the read or write will fail.
  *
- * For ARM/MIPS we switch into privileged mode if the access fails. The mode is always reset
+ * We switch into privileged mode if the access fails. The mode is always reset
  * before we return.
+ * 
+ * Return:
+ * * 0      - Read/write succeeded
+ * * -1     - An error 
  */
 static inline int panda_virtual_memory_rw(CPUState *env, target_ulong addr,
                                           uint8_t *buf, int len, bool is_write) {
@@ -202,24 +290,51 @@ static inline int panda_virtual_memory_rw(CPUState *env, target_ulong addr,
     return 0;
 }
 
-/**
- * @brief Reads data into \p buf from guest virtual address \p addr.
- */
+
+/* (not kernel-doc)
+ * panda_virtual_memory_read() - Copy data from guest memory into host buffer.
+ * @env: Cpu sate.
+ * @addr: Guest virtual address of start of desired read
+ * @buf: Host pointer to a buffer into which data will be copied from guest.
+ * @len: Number of bytes to copy.
+ * 
+ * Return:
+ * * 0      - Read succeeded
+ * * -1     - An error 
+ */ 
 static inline int panda_virtual_memory_read(CPUState *env, target_ulong addr,
                                             uint8_t *buf, int len) {
     return panda_virtual_memory_rw(env, addr, buf, len, 0);
 }
 
-/**
- * @brief Writes data from \p buf data to guest virtual address \p addr.
- */
+    
+/* (not kernel-doc)
+ * panda_virtual_memory_write() - Copy data from host buffer into guest memory.
+ * @env: Cpu sate.
+ * @addr: Guest virtual address of start of desired write.
+ * @buf: Host pointer to a buffer from which data will be copied into guest.
+ * @len: Number of bytes to copy.
+ * 
+ * Return:
+ * * 0      - Write succeeded
+ * * -1     - An error 
+ */ 
 static inline int panda_virtual_memory_write(CPUState *env, target_ulong addr,
                                              uint8_t *buf, int len) {
     return panda_virtual_memory_rw(env, addr, buf, len, 1);
 }
 
+    
 /**
- * @brief Obtains a host pointer for the given virtual address.
+ * panda_map_virt_to_host() - Map guest virtual addresses into host.
+ * @env: Cpu state.
+ * @addr: Guest virtual address start of range.
+ * @len: Length of address range.
+ * 
+ * Returns a pointer to host memory that is an alias for a range of
+ * guest virtual addresses.
+ *
+ * Return: A host pointer.
  */
 static inline void *panda_map_virt_to_host(CPUState *env, target_ulong addr,
                                            int len)
@@ -237,9 +352,21 @@ static inline void *panda_map_virt_to_host(CPUState *env, target_ulong addr,
     return qemu_map_ram_ptr(mr->ram_block, addr1);
 }
 
+
 /**
- * @brief Translate a physical address to a RAM Offset (needed for the taint system)
- * Returns MEMTX_OK on success.
+ * PandaPhysicalAddressToRamOffset() - Translate guest physical address to ram offset.
+ * @out: A pointer to the ram_offset_t, which will be written by this function.
+ * @addr: The guest physical address.
+ * @is_write: Is this mapping for ultimate read or write.
+ *  
+ * This function is useful for callers needing to know not merely the
+ * size of physical memory, but the actual largest physical address
+ * that might arise given non-contiguous ram map.  Panda's taint
+ * system needs it to set up its shadow ram, e.g..
+ * 
+ * Return: The desired return value is pointed to by out.
+ * * MEMTX_OK      - Read succeeded
+ * * MEMTX_ERROR   - An error
  */
 static inline MemTxResult PandaPhysicalAddressToRamOffset(ram_addr_t* out, hwaddr addr, bool is_write)
 {
@@ -298,9 +425,22 @@ static inline MemTxResult PandaPhysicalAddressToRamOffset(ram_addr_t* out, hwadd
     return MEMTX_OK;
 }
 
+
 /**
- * @brief Translate a virtual address to a RAM Offset (needed for the taint system)
- * Returns MEMTX_OK on success.
+ * PandaVirtualAddressToRamOffset() - Translate guest virtual address to ram offset,
+ * @out: A pointer to the ram_offset_t, which will be written by this function.
+ * @cpu: Cpu state.
+ * @addr: The guest virtual address.
+ * @is_write: Is this mapping for ultimate read or write.
+ *  
+ * This function is useful for callers needing to know not merely the
+ * size of virtual memory, but the actual largest virtual address that
+ * might arise given non-contiguous ram map.  Panda's taint system
+ * needs it to set up its shadow ram.
+ * 
+ * Return: The desired return value is pointed to by out.
+ * * MEMTX_OK      - Read succeeded
+ * * MEMTX_ERROR   - An error
  */
 static inline MemTxResult PandaVirtualAddressToRamOffset(ram_addr_t* out, CPUState* cpu, target_ulong addr, bool is_write)
 {
@@ -310,8 +450,14 @@ static inline MemTxResult PandaVirtualAddressToRamOffset(ram_addr_t* out, CPUSta
     return PandaPhysicalAddressToRamOffset(out, PhysicalAddress, is_write);
 }
 
-/**
- * @brief Determines if guest is currently executing in kernel mode, e.g. execution privilege level.
+
+/* (not kernel-doc)
+ * panda_in_kernel_mode() - Determine if guest is in kernel.
+ * @cpu: Cpu state.
+ *
+ * Determines if guest is currently executing in kernel mode, e.g. execution privilege level.
+ *
+ * Return: True if in kernel, false otherwise.
  */
 static inline bool panda_in_kernel_mode(const CPUState *cpu) {
     CPUArchState *env = (CPUArchState *)cpu->env_ptr;
@@ -335,17 +481,30 @@ static inline bool panda_in_kernel_mode(const CPUState *cpu) {
 #endif
 }
 
-/**
- * @brief Determines if guest is currently executing in kernel mode. Old API name for panda_in_kernel_mode().
+
+/* (not kernel-doc)
+ * panda_in_kernel() - Determine if guest is in kernel.
+ * @cpu: Cpu state.
+ *
+ * Determines if guest is currently executing in kernel mode, e.g. execution privilege level.
+ * DEPRECATED.
+ * 
+ * Return: True if in kernel, false otherwise.
  */
 static inline bool panda_in_kernel(const CPUState *cpu) {
     return panda_in_kernel_mode(cpu);
 }
 
-/**
- * @brief Checks the top bit of the address to determine if the address
- * is in kernel space.
- * Checking the MSB means this should work even if KASLR is enabled.
+
+/* (not kernel-doc)
+ * address_in_kernel_code_linux() - Determine if virtual address is in kernel.                                                                           *                                                                                                                       
+ * @addr: Virtual address to check.
+ *
+ * Checks the top bit of the address to determine if the address is in
+ * kernel space. Checking the MSB means this should work even if KASLR
+ * is enabled.
+ *
+ * Return: True if address is in kernel, false otherwise.
  */
 static inline bool address_in_kernel_code_linux(target_ulong addr){
     // https://www.kernel.org/doc/html/latest/vm/highmem.html
@@ -360,17 +519,29 @@ static inline bool address_in_kernel_code_linux(target_ulong addr){
     }
 }
 
-/**
- * @brief Determines if guest is currently executing kernelspace code, regardless of privilege level.
- * Necessary because there's a small bit of kernelspace code that runs AFTER a switch to usermode privileges.
- * Therefore, certain analysis logic can't rely on panda_in_kernel_mode() alone.
+
+/* (not kernel-doc)
+ * panda_in_kernel_code_linux() - Determine if current pc is kernel code.
+ * @cpu: Cpu state.
+ *
+ * Determines if guest is currently executing kernelspace code,
+ * regardless of privilege level.  Necessary because there's a small
+ * bit of kernelspace code that runs AFTER a switch to usermode
+ * privileges.  Therefore, certain analysis logic can't rely on
+ * panda_in_kernel_mode() alone. 
+ *
+ * Return: true if pc is in kernel, false otherwise.
  */
 static inline bool panda_in_kernel_code_linux(CPUState *cpu) {
     return address_in_kernel_code_linux(panda_current_pc(cpu));
 }
 
-/**
- * @brief Returns the guest kernel stack pointer.
+
+/* (not kernel-doc)
+ * panda_current_ksp() - Get guest kernel stack pointer.
+ * @cpu: Cpu state.
+ * 
+ * Return: Guest pointer value.
  */
 static inline target_ulong panda_current_ksp(CPUState *cpu) {
     CPUArchState *env = (CPUArchState *)cpu->env_ptr;
@@ -411,8 +582,12 @@ static inline target_ulong panda_current_ksp(CPUState *cpu) {
 #endif
 }
 
-/**
- * @brief Returns the guest stack pointer.
+
+/* (not kernel-doc)
+ * panda_current_sp() - Get current guest stack pointer.
+ * @cpu: Cpu state.
+ * 
+ * Return: Returns guest pointer.
  */
 static inline target_ulong panda_current_sp(const CPUState *cpu) {
     CPUArchState *env = (CPUArchState *)cpu->env_ptr;
@@ -433,11 +608,17 @@ static inline target_ulong panda_current_sp(const CPUState *cpu) {
 #endif
 }
 
-/**
- * @brief Returns the return value of the guest.
- * The function is only meant to provide a platform-independent
- * abstraction for retrieving a call return value. It still has to
- * be used in the proper context to retrieve a meaningful value.
+
+/* (not kernel-doc)
+ * panda_get_retval() - Get return value for function.
+ * @cpu: Cpu state.
+ *
+ * This function provides a platform-independent abstraction for
+ * retrieving a call return value. It still has to be used in the
+ * proper context to retrieve a meaningful value, such as just after a
+ * RET instruction under x86.
+ *
+ * Return: Guest ulong value.
  */
 static inline target_ulong panda_get_retval(const CPUState *cpu) {
     CPUArchState *env = (CPUArchState *)cpu->env_ptr;
diff --git a/panda/include/panda/panda_api.h b/panda/include/panda/panda_api.h
index dddca0270d0..a459fb3ecb2 100644
--- a/panda/include/panda/panda_api.h
+++ b/panda/include/panda/panda_api.h
@@ -10,64 +10,443 @@
 // files in this directory that contain subsections like this one.
 
 // from panda_api.c
+
+/**
+ * panda_init() - Initialize panda guest.
+ * @argc: number of command line args
+ * @argv: command line args
+ * @envp: environment variables
+ * 
+ * Initialize panda emulator with command line and environment
+ * variables.  These may have come from running cmd-line panda or may
+ * have been crafted by something using panda as a library, e.g., 
+ * by the PYTHON panda interface.
+ * 
+ * Return: always 0
+ */
 int panda_init(int argc, char **argv, char **envp);
+
+
+/**
+ * panda_run() - Give control to panda to emulate guest.
+ *
+ * Allow panda to emulate guest, executing any registered callbacks as
+ * well as loaded plugin code. This will return when panda emulation
+ * exits its "main loop" and would normally end as a program.
+ *
+ * Return: always 0
+ */
 int panda_run(void);
+
+
+/**
+ * panda_stop() - Pauses the guest being emulated.
+ * @code: New state to assign to guest cpu.
+ * 
+ * This is only used to pause emulation, with code=4.
+ * XXX: Perhaps rename and un-expose code arg?
+ */
 void panda_stop(int code);
+
+
+/** 
+ * panda_cont() - Continue guest after pause.
+ * 
+ * Resume after panda_stop.
+ */
 void panda_cont(void);
+
+
+// Not an API function.
 void _panda_set_library_mode(const bool);
-int panda_delvm(char *snapshot_name);
+
+
+/**
+ * panda_start_pandalog() - Turn on pandalogging.
+ * @name: Filename for logging.
+ * 
+ * Pandalogging will be enabled from this point on and will be output
+ * to the file indicated.
+ */
 void panda_start_pandalog(const char *name);
-int panda_revert(char *snapshot_name);
+
+
+/**
+ * panda_snap() - Take a guest snapshot.
+ * @name: Name that will be assigned to the snapshot.
+ * 
+ * Take a snapshot of guest state which includes RAM, registers, and
+ * some device state including hard drive and assign it the name
+ * provided, storing all this in the current qcow.
+ * 
+ * Return: The value returned by the internal Qemu snapshot taking
+ * function, which returns 0 on success.
+ */
+int panda_snap(char *name);
+
+
+/**
+ * panda_delvm() - Delete a guest snapshot.
+ * @name: Name of snapshot to delete.
+ * 
+ * Delete a guest snapshot by name from the current qcow.
+ *
+ * Return: not used
+ */
+int panda_delvm(char *name);
+
+
+/**
+ * panda_revert() - Revert to a guest snapshot.
+ * @name: The name of the snapshot to revert to.
+ *
+ * Pause emulation and restore to a snapshot. 
+ * 
+ * Return: The value returned by internal Qemu revert function which
+ * is 0 on success but otherwise ... there are various errors.
+ */
+int panda_revert(char *name);
+
+
+/**
+ * panda_reset() - Request reboot of guest.
+ * 
+ * Think ctrl-alt-delete. This is a request, so it won't happen
+ * immediately.
+ */
 void panda_reset(void);
-int panda_snap(char *snapshot_name);
+
+
+/**
+ * panda_finish() - Stop emulating guest and end analysis.
+ *
+ * XXX This doesnt appear to be used by pypanda. Perhaps it is vestigal?
+ */
 int panda_finish(void);
+
+
+/**
+ * panda_was_aborted() - Returns true if abort requested.
+ *
+ * This will be true, e.g., if someone hit ctrl-c or called
+ * `panda_reset` to kill analysis but that is still pending.
+ *
+ * Return: true/false
+ */
 bool panda_was_aborted(void);
 
+
+/**
+ * panda_set_qemu_path() - Sets path to "qemu" binary, needed internally.
+ * @filepath: Full path to qemu (actually panda).
+ * 
+ * XXX this looks like its not actually used anywhere?
+ */  
 void panda_set_qemu_path(char* filepath);
 
+
+/**
+ * panda_init_plugin() - Initialize a plugin by name.
+ * @plugin_name: The name of the plugin.
+ * @plugin_args: The array of string arguments.
+ * @num_args: The number of arguments.
+ * 
+ * Initialize this plugin with these arguments, which sets the
+ * arguments as if they had come in on the panda commandline and then
+ * loads the plugin. 
+ * 
+ * XXX: Rename to load_plugin ? 
+ */
 int panda_init_plugin(char *plugin_name, char **plugin_args, uint32_t num_args);
 
+
+/**
+ * panda_register_callback_helper() - Register a callback function.
+ * @plugin: Pointer to plugin.
+ * @type: Type of callback, indicating when cb function will run.
+ * @cb: The callback function itself and other info.
+ *
+ * This function can be used to register a callback to run in
+ * panda. To call it, you will need a pointer to a plugin as well as a
+ * pointer to a fully-formed panda_cb object. The plugin
+ * pointer can be fake but should be a handle that uniquely distinguishes plugins.
+ * 
+ * type is a number. See typedef panda_cb_type.
+ * cb is a pointer to a struct. See typedef panda_cb.
+ */
 void panda_register_callback_helper(void* plugin, panda_cb_type type, panda_cb* cb);
-void panda_enable_callback_helper(void *plugin, panda_cb_type, panda_cb* cb);
-void panda_disable_callback_helper(void *plugin, panda_cb_type, panda_cb* cb);
 
+
+/**
+ * panda_enable_callback_helper() - Enable a callback.
+ * @plugin: Pointer to plugin to which the callback belongs.
+ * @type: Type of callback, indicating when cb function will run.
+ * @cb: The callback function itself and other info.
+ * 
+ * This function can be used to enable a previously registered
+ * callback to run in panda. To call it, you will need a pointer to
+ * the plugin that owns the callback as well as a pointer to the
+ * panda_cb object which contains the callback. 
+ *  
+ * type is a number. See typedef panda_cb_type.
+ * cb is a pointer to a struct. See typedef panda_cb.
+ */
+void panda_enable_callback_helper(void *plugin, panda_cb_type type, panda_cb* cb);
+
+
+/**
+ * panda_disable_callback_helper() - Disable a callback.
+ * @plugin: Pointer to plugin to which the callback belongs.
+ * @type: Type of callback, indicating when cb function will run.
+ * @cb: The callback function itself and other info.
+ * 
+ * This function can be used to disable a previously registered
+ * callback to run in panda. To call it, you will need a pointer to
+ * the plugin that owns the callback as well as a pointer to the
+ * panda_cb object which contains the callback. 
+ *  
+ * type is a number. See typedef panda_cb_type.
+ * cb is a pointer to a struct. See typedef panda_cb.
+ */
+void panda_disable_callback_helper(void *plugin, panda_cb_type type, panda_cb* cb);
+
+
+/**
+ * rr_get_guest_instr_count_external() - Get instruction count for replay.
+ * 
+ * This will only return the number of guest instruction emulated
+ * since replay began.
+ *
+ * Unclear what this returns if not in replay mode.
+ *
+ *
+ * Return: a uint64_t, the instruction count.
+*/
 uint64_t rr_get_guest_instr_count_external(void);
 
-int panda_virtual_memory_read_external(CPUState *env, target_ulong addr, char *buf, int len);
-int panda_virtual_memory_write_external(CPUState *env, target_ulong addr, char *buf, int len);
+
+/**
+ * panda_virtual_memory_read_external() - Copy data from guest (virtual) memory into host buffer.
+ * @cpu: Cpu state.
+ * @addr: Guest virtual address of start of desired read.
+ * @buf: Host pointer to a buffer into which data will be copied from guest.
+ * @len: Number of bytes to copy.
+ * 
+ * Return:
+ * * 0      - Read succeeded
+ * * -1     - An error 
+ */ 
+int panda_virtual_memory_read_external(CPUState *cpu, target_ulong addr, char *buf, int len);
+
+/**
+ * panda_virtual_memory_write_external() - Copy data from host buffer into guest (virtual) memory.
+ * @cpu: Cpu state.
+ * @addr: Guest virtual address of start of desired write.
+ * @buf: Host pointer to a buffer from which data will be copied into guest.
+ * @len: Number of bytes to copy.
+ * 
+ * Return:
+ * * 0      - Write succeeded
+ * * -1     - An error 
+ */ 
+int panda_virtual_memory_write_external(CPUState *cpu, target_ulong addr, char *buf, int len);
+
+
+/**
+ * panda_physical_memory_read_external() - Copy data from guest (physical) memory into host buffer.
+ * @addr: Guest physical address of start of read.
+ * @buf: Host pointer to a buffer into which data will be copied from guest.
+ * @len: Number of bytes to copy.
+ * 
+ * Return: 
+ * * MEMTX_OK      - Read succeeded
+ * * MEMTX_ERROR   - An error
+ */
 int panda_physical_memory_read_external(hwaddr addr, uint8_t *buf, int len);
+
+
+/**
+ * panda_physical_memory_write_external() - Copy data from host buffer into guest (physical)memory.
+ * @addr: Guest physical address of start of desired write.
+ * @buf: Host pointer to a buffer from which data will be copied into guest.
+ * @len: Number of bytes to copy.
+ * 
+ * Return: 
+ * * MEMTX_OK      - Write succeeded
+ * * MEMTX_ERROR   - An error
+ */
 int panda_physical_memory_write_external(hwaddr addr, uint8_t *buf, int len);
 
+
+/**
+ * panda_get_retval_external() - Get return value for function.
+ * @cpu: Cpu state.
+ *
+ * Platform-independent abstraction for retrieving a call return
+ * value. This function still has to be called in the proper context
+ * to retrieve a meaningful value, such as just after a RET
+ * instruction under x86.
+ *
+ * Return: Guest return value.
+ */
 target_ulong panda_get_retval_external(const CPUState *cpu);
 
+
+/**
+ * panda_in_kernel_external() - Determine if guest is in kernel.
+ * @cpu: Cpu state.
+ *
+ * Determines if guest is currently executing in kernel mode, e.g. execution privilege level.
+ * 
+ * Return: True if in kernel, false otherwise.
+ */
 bool panda_in_kernel_external(const CPUState *cpu);
+
+
+/**
+ * panda_in_kernel_mode_external() - Determine if guest is in kernel.
+ * @cpu: Cpu state.
+ *
+ * Determines if guest is currently executing in kernel mode, e.g. execution privilege level.
+ *
+ * XXX Duplicate of panda_in_kernel_external? 
+ *
+ * Return: True if in kernel, false otherwise.
+ */
 bool panda_in_kernel_mode_external(const CPUState *cpu);
+
+
+/**
+ * panda_in_kernel_code_linux_external() - Determine if current pc is kernel code.
+ * @cpu: Cpu state.
+ *
+ * Determines if guest is currently executing kernelspace code,
+ * regardless of privilege level.  Necessary because there's a small
+ * bit of kernelspace code that runs AFTER a switch to usermode
+ * privileges. Therefore, certain analysis logic can't rely on
+ * panda_in_kernel_mode() alone. 
+ *
+ * Return: true if pc is in kernel, false otherwise.
+ */
 bool panda_in_kernel_code_linux_external(CPUState *cpu);
+
+
+/**
+ * panda_current_ksp_external() - Get guest kernel stack pointer.
+ * @cpu: Cpu state.
+ * 
+ * Return: Guest kernel stack pointer value.
+ */
 target_ulong panda_current_ksp_external(CPUState *cpu);
+
+
+/**
+ * panda_current_sp_external() - Get current guest stack pointer.
+ * @cpu: Cpu state.
+ * 
+ * Return: Returns guest stack pointer.
+ */
 target_ulong panda_current_sp_external(const CPUState *cpu);
+
+
+/* not kernel-doc.  This doesnt seem like an API fn.
+ * 
+ * panda_current_sp_masked_pagesize_external() - Get current sp masked somehow.
+ * @cpu: Cpu state.
+ * @pagesize: Page size.
+ *
+ * A little mysterious.  We ask panda to get current sp and do some dodgy math with it. 
+ *
+ * Return: Some weird number.
+ */
 target_ulong panda_current_sp_masked_pagesize_external(const CPUState *cpu, target_ulong pagesize);
-target_ulong panda_virt_to_phys_external(CPUState *cpu, target_ulong virt_addr);
 
-void panda_setup_signal_handling(void (*f) (int, void*, void *));
 
+/**
+ * panda_virt_to_phys_external() - Translate guest virtual to physical address.
+ * @cpu: Cpu state.
+ * @addr: Guest virtual address.
+ *
+ * This conversion will fail if asked about a virtual address that is
+ * not currently mapped to a physical one in the guest.
+ *
+ * Return: A guest physical address.
+ */
+target_ulong panda_virt_to_phys_external(CPUState *cpu, target_ulong addr);
+
+
+/**
+ * panda_setup_signal_handling() - Provide panda with a function to be called on certain signals.
+ * @sigfun: The function to call on signal.
+ * 
+ * This function will be called on any of {SIGINT, SIGHUP, SIGTERM}.
+ */
+void panda_setup_signal_handling(void (*sigfun) (int, void*, void *));
+
+
+/**
+ * map_memory() - Add a region to the memory map.
+ * @name: The name of the region.
+ * @size: Size of the region, in bytes.
+ * @address: Start of the region.
+ *
+ * If setting up an environment to run code or rehost some embedded
+ * system, this function can be used to set up regions in the
+ * machine's memory map.  RAM only, at present.
+ *
+ * XXX: Rename as panda_map_memory? 
+ */
 void map_memory(char* name, uint64_t size, uint64_t address);
 
 // REDEFINITIONS below here from monitor.h
 
-// Create a monitor for panda
+/**
+ * panda_init_monitor() - Create a monitor for panda.
+ *
+ * Creates a monitor panda can easily interact with.
+ */
 void panda_init_monitor(void); // Redefinition from monitor.h
 
-// Pass a message via the panda monitor. Create monitor if necessary'
-// returns output string from monitor. Some commands may cause spinloops
+/**
+ * panda_monitor_run() - Run a command in the panda monitor and collect response.
+ * @buf: The command.
+ * 
+ * Run this command as if it were typed into the qemu monitor, and
+ * return what output would have been printed to the monitor.
+ *
+ * NB: Some commands may cause spinloops.
+ *
+ * Return: A string, the output of the command.
+ */
 char* panda_monitor_run(char* buf);// Redefinition from monitor.h
 
+
 // Map a region of memory in the guest. WIP
 //int panda_map_physical_mem(target_ulong addr, int len);
 
+
+/**
+ * get_cpu() - Get cpu state object.
+ *
+ * Use this to obtain a pointer to a cpu object needed for other API functions.
+ * 
+ * Return: host pointer to cpu.
+ */
 CPUState* get_cpu(void);
 
+
 unsigned long garray_len(GArray *list);
+
+/**
+ * panda_cleanup_record() - End recording.
+ * 
+ * This function ends recording, if that is currently in progress.
+ *
+ * XXX: Rename to something more like panda_end_record?  Also, where is begin_record then?
+ */
 void panda_cleanup_record(void);
+
+
 // END_PYPANDA_NEEDS_THIS -- do not delete this comment!
 
 // don't expose to API  because we don't want to add siginfo_t understanding
diff --git a/panda/include/panda/plog.h b/panda/include/panda/plog.h
index 331551d5a34..811c3b47b09 100644
--- a/panda/include/panda/plog.h
+++ b/panda/include/panda/plog.h
@@ -5,6 +5,10 @@
  *
  * 8/30/17 Ray Wang
  *
+ *
+ * NOTE: There is only ONE pandalog open for read / write at a time.
+ *       which is why closing does not need to have a handle, since
+ *       that is in a global.
  */
 
 #ifndef __PANDALOG_H_
@@ -15,6 +19,14 @@
 #include <zlib.h>
 #include "plog.pb-c.h"
 
+/**
+ * typedef enum PLMode - The pandalog mode.
+ * @PL_MODE_WRITE: open for write.
+ * @PL_MODE_READ_FWD: open for read, forwards direction
+ * @PL_MODE_READ_BWD: open for read, backwards direction
+ * @PL_MODE_UNKNOWN: not sure
+*/
+
 typedef enum {
     PL_MODE_WRITE,
     PL_MODE_READ_FWD,
@@ -22,28 +34,89 @@ typedef enum {
     PL_MODE_UNKNOWN
 } PlMode;
 
-// open pandalog for write with this uncompressed chunk size
-void pandalog_open_write(const char *path, uint32_t chunk_size);
+/**
+ * pandalog_open_write() - Open the pandalog for write.
+ * @filename: Filename for pandalog that will be created.
+ * @chunk_size: Chunk size in bytes.
+ * 
+ * Open the pandalog for writing, using this filename and chunk
+ * size. Chunk size might be changed to improve performance.
+ */
+void pandalog_open_write(const char *filename, uint32_t chunk_size);
 
-// open pandalog for reading in forward direction
-void pandalog_open_read_fwd(const char *path);
+/**  
+ * pandalog_open_read_fwd() - Open the pandalog for reading forwards.
+ * @filename: Filename for pandalog that we will be reading.
+ *
+ * Open the pandalog for reading in forwards direction. This is the
+ * same direction as time flows.
+ */
+void pandalog_open_read_fwd(const char *filename);
 
-// open pandalog for reading in backward direction
-void pandalog_open_read_bwd(const char *path);
+/** 
+ * pandalog_open_read_bwd() - Open the pandalog for reading backwards.
+ * @filename: Filename for pandalog that we will be reading.
+ *
+ * Pandalog opened for reading in backwards direction. This is the
+ * opposite direction as time flows, and so can be useful for analyses
+ * that work backwards from the end of an execution trace, such as a
+ * backwards dynamic slice.
+ *
+ */
+void pandalog_open_read_bwd(const char *filename);
+
+
+/**
+ * pandalog_open() - Open the pandalog for read or write.
+ * @filename: Filename for the pandalog.
+ * @mode: Either "r" or "w".
+ *
+ * Pandalog opened for reading or writing (thus in forwards
+ * direction, i.e., the same direction as time flows).
+ */ 
+void pandalog_open(const char *filename, const char *mode);
 
-void pandalog_open(const char *path, const char *mode);
 
-// close pandalog (all modes)
+/**
+ * pandalog_close() - Close the pandalog for read or write.
+ *
+ * Pandalog flushed and closed (regardless of direction or read/write
+ * mode). 
+ */ 
 void pandalog_close(void);
 
+/**
+ * pandalog_write_entry() - Write an entry to the pandalog.
+ * @entry: Pointer to the entry. 
+ *
+ * XXX: Tell reader where to look to know what Panda__LogEntry looks like.
+ */
 void pandalog_write_entry(Panda__LogEntry *entry);
 
+/**
+ * pandalog_read_entry() - Read an entry from the pandalog.
+ * 
+ * Return: pointer to allocated and populated pandalog entry.
+ */
 Panda__LogEntry *pandalog_read_entry(void);
 
+/**
+ * pandalog_seek() - Fast forward or rewind to instruction in pandalog.
+ * @instr: The instruction count to seek to.
+ * 
+ */
 void pandalog_seek(uint64_t instr);
 
+/**
+ * pandalog_free_entry() - Free memory for this entry.
+ * @entry: Pointer to the entry.
+ * 
+ * Since pandalog_read_entry allocates, caller will need to free the
+ * memory for the entry.
+ */
 void pandalog_free_entry(Panda__LogEntry *entry);
 
+
 extern int pandalog;
 
 #endif
diff --git a/panda/include/panda/plugin.h b/panda/include/panda/plugin.h
index e3b79f895a9..671533f71a0 100644
--- a/panda/include/panda/plugin.h
+++ b/panda/include/panda/plugin.h
@@ -45,33 +45,189 @@ struct _panda_cb_list {
     void* context;
 };
 panda_cb_list *panda_cb_list_next(panda_cb_list *plist);
+
+
+/**
+ * panda_enable_plugin() - Enable this plugin.
+ * @plugin: Pointer to the plugin (handle).
+ *
+ * Mark plugin as enabled so that its callbacks will run in future.
+ */
 void panda_enable_plugin(void *plugin);
+
+
+/**
+ * panda_disable_plugin() - Disable this plugin.
+ * @plugin: Pointer to the plugin (handle).
+ *
+ * Mark plugin as disabled so that its callbacks will NOT run in future.
+ */
 void panda_disable_plugin(void *plugin);
 
+
 // Structure to store metadata about a plugin
 typedef struct panda_plugin {
     char name[256];     // Currently basename(filename)
     void *plugin;       // Handle to the plugin (for use with dlsym())
 } panda_plugin;
 
+
+// XXX Not sure what this is exactly or howt to doc.  Is it really an API fn?
+// If so, that's concerning...
 panda_cb_with_context panda_get_cb_trampoline(panda_cb_type type);
-void   panda_register_callback(void *plugin, panda_cb_type type, panda_cb cb);
-void   panda_register_callback_with_context(void *plugin, panda_cb_type type, panda_cb_with_context cb, void* context);
-void   panda_disable_callback(void *plugin, panda_cb_type type, panda_cb cb);
-void   panda_enable_callback(void *plugin, panda_cb_type type, panda_cb cb);
-void   panda_disable_callback_with_context(void *plugin, panda_cb_type type, panda_cb_with_context cb, void* context);
-void   panda_enable_callback_with_context(void *plugin, panda_cb_type type, panda_cb_with_context cb, void* context);
-void   panda_unregister_callbacks(void *plugin);
-bool   panda_load_plugin(const char *filename, const char *plugin_name);
-bool   _panda_load_plugin(const char *filename, const char *plugin_name, bool library_mode);
-bool   panda_add_arg(const char *plugin_name, const char *plugin_arg);
-bool   panda_load_external_plugin(const char *filename, const char *plugin_name, void *plugin_uuid, void *init_fn_ptr);
+
+
+/**
+ * panda_register_callback() - Register a callback for a plugin, and enable it.
+ * @plugin: Pointer to plugin.
+ * @type: Type of callback, indicating when cb function will run.
+ * @cb: The callback function itself and other info.
+ *
+ * This function will register a callback to run in panda and is
+ * typically called from plugin code.  
+ *
+ * The order of callback registration will determine the order in which
+ * callbacks of the same type will be invoked.
+ *
+ * NB: Registering a callback function twice from the same plugin will
+ * trigger an assertion error.
+ * 
+ * type is number. See typedef panda_cb_type.
+ * cb is a pointer to a struct. See typedef panda_cb.
+ */
+void panda_register_callback(void *plugin, panda_cb_type type, panda_cb cb);
+
+
+/**
+ * panda_register_callback_with_context() - Register a callback for a plugin with context.
+ * @plugin: Pointer to plugin.
+ * @type: Type of callback, indicating when cb function will run.
+ * @cb: The callback function itself and other info.
+ * @context: Pointer to context.
+ *
+ * Same as panda_register_callback, but with context.
+ */
+void panda_register_callback_with_context(void *plugin, panda_cb_type type, panda_cb_with_context cb, void* context);
+
+
+/**
+ * panda_disable_callback() - Disable callback for this plugin from running.
+ * @plugin: Pointer to plugin.
+ * @type: Type of callback, indicating when cb function will run.
+ * @cb: The callback function itself and other info.
+ * 
+ * Mark this callback as disabled so that it stops running. 
+ * 
+ * NB: enable/disable are faster than register/unregister since they
+ * set a flag rather than adding/removing something from a list.
+ */
+void panda_disable_callback(void *plugin, panda_cb_type type, panda_cb cb);
+
+
+/**
+ * panda_disable_callback_with_context() - Disable callback for this plugin from running (with context).
+ * @plugin: Pointer to plugin.
+ * @type: Type of callback, indicating when cb function will run.
+ * @cb: The callback function itself and other info.
+ * @context: Pointer to context.
+ * 
+ * Same as padna_disable_callback, but with context.
+ */
+void panda_disable_callback_with_context(void *plugin, panda_cb_type type, panda_cb_with_context cb, void* context);
+
+
+/**
+ * panda_enable_callback() - Enable callback for this plugin so that it can run.
+ * @plugin: Pointer to plugin.
+ * @type: Type of callback, indicating when cb function will run.
+ * @cb: The callback function itself and other info.
+ * 
+ * Mark this callback as enabled so that it will run from now on. 
+ *
+ * NB: enable/disable are faster than register/unregister since they
+ * set a flag rather than adding/removing something from a list.
+ */
+void panda_enable_callback(void *plugin, panda_cb_type type, panda_cb cb);
+
+
+/**
+ * panda_enable_callback_with_context() - Enable this callback for this plugin so that it can run (with context)/
+ * @plugin: Pointer to plugin.
+ * @type: Type of callback, indicating when cb function will run.
+ * @cb: The callback function itself and other info.
+ * @context: Pointer to context.
+ * 
+ * Same as panda_enable_callback, but with context.
+ */
+void panda_enable_callback_with_context(void *plugin, panda_cb_type type, panda_cb_with_context cb, void* context);
+
+
+/**
+ * panda_unregister_callbacks() - Unregister all callbacks for this plugin.
+ * @plugin: Pointer to plugin.
+ * 
+ */
+void panda_unregister_callbacks(void *plugin);
+
+
+/**
+ * panda_load_plugin() - Load this plugin into panda.
+ * @filename: The path to the shared object plugin code.
+ * @plugin_name: The name of the plugin.
+ *
+ * This will load the code for this plugin and run its init_plugin function.
+ *
+ * Return: True if success, False otherwise.
+ */
+bool panda_load_plugin(const char *filename, const char *plugin_name);
+
+
+bool _panda_load_plugin(const char *filename, const char *plugin_name, bool library_mode);
+
+
+/**
+ * panda_add_arg() - Add an argument to those for a plugin.
+ * @plugin_name: The name of the plugin.
+ * @plugin_arg: The plugin argument, unparsed.
+ * 
+ * Return: Always returns True
+ */
+bool panda_add_arg(const char *plugin_name, const char *plugin_arg);
+
+
+// I think this is not used anywhere?
+bool panda_load_external_plugin(const char *filename, const char *plugin_name, void *plugin_uuid, void *init_fn_ptr);
+
+/**
+ * panda_get_plugin_by_name() - Returns pointer to the plugin of this name.
+ * @name: The name of the desired plugin.
+ *
+ * Return: Pointer to plugin (handle)
+ */
 void * panda_get_plugin_by_name(const char *name);
-void   panda_unload_plugin_by_name(const char* name);
-void   panda_do_unload_plugin(int index);
-void   panda_unload_plugin(void *plugin);
-void   panda_unload_plugin_idx(int idx);
-void   panda_unload_plugins(void);
+
+/**
+ * panda_unload_plugin_by_name() - Unload plugin.
+ * @name: The name of the plugin to unload.
+ */
+void panda_unload_plugin_by_name(const char* name);
+
+// Not an API function.
+void panda_do_unload_plugin(int index);
+
+/**
+ * panda_unload_plugin() - Unload plugin.
+ * @plugin: Pointer to the plugin (handle) to unload.
+ */
+void panda_unload_plugin(void *plugin);
+
+// Not an API function
+void panda_unload_plugin_idx(int idx);
+
+/**
+ * panda_unload_plugins() - Unload all the plugins currently loaded.
+ */
+void panda_unload_plugins(void);
 
 extern bool panda_update_pc;
 extern bool panda_use_memcb;
@@ -97,22 +253,128 @@ bool panda_break_exec(void);
 bool panda_flush_tb(void);
 
 /* Regular functions plugins should use */
+
+/**
+ * panda_do_flush_tb() - Request flush of translation block cache.
+ *
+ * Qemu's emulation operates on basic blocks of translated code (a
+ * basic block is a sequence of instructions without control flow).
+ * These blocks are cached which means if an analysis wants to change
+ * how translation injects instrumentation, then the cache should be
+ * flushed so that new instrumentation can appear.
+ */
 void panda_do_flush_tb(void);
+
+/**
+ * panda_do_break_exec() - Request break out of emulation loop.
+ *
+ * Qemu emulates using a cache (see panda_do_flush_tb) but also tends
+ * to mostly sit in a tight loop executing basic blocks in succession.
+ * Sometimes an anlysis will want to force an exit from that loop,
+ * which causes interrupts and device housekeeping code to run.
+ */   
 void panda_do_break_exec(void);
+
+/**
+ * panda_enable_precise_pc() - Turn on accurate PC mode.
+ *
+ * Qemu does not update the program counter in the middle of a basic
+ * block. However, for many analyses, we might want to know the PC at
+ * the instruction level, accurately. This enables a mode in which
+ * panda updates a shadow PC to serve that purpose.
+ */
 void panda_enable_precise_pc(void);
+
+/**
+ * panda_disable_precise_pc() - Turn off accurate PC mode.
+ */
 void panda_disable_precise_pc(void);
+
+/** 
+ * panda_enable_memcb() - Turn on memory callbacks.
+ *
+ * Callbacks on LD/ST are expensive in panda. If required, they must
+ * be enabled explicitly using this function which swaps out the
+ * helper functions used by qemu for loads and stores.
+ */
 void panda_enable_memcb(void);
+
+/** 
+ * panda_disable_memcb() - Turn on memory callbacks.
+ */
 void panda_disable_memcb(void);
+
+/**
+ * panda_enable_llvm() - Turn on LLVM translation-mediated emulation.
+ *
+ * Analyses involving all or most machine instructions on many
+ * architectures are well served by translating emulated code to a
+ * simple, common intermediate language first. This function enables a
+ * mode in which every basic block of emualted code is translated from
+ * TCG to LLVM which can be analyzed or instrumented via LLVM passes.
+ * In addition, a benefit of using LLVM, even C-implementations of
+ * functionality in "helpers" can additionally be subject to analysis
+ * if they compiled with CLANG and thus their code made available for
+ * analysis as LLVM.
+ * 
+ * NB: Beware that LLVM emulation mode is slow. The resulting object
+ * code is highly un-optimized.
+ */
 void panda_enable_llvm(void);
+
+/**
+ * panda_enable_llvm_no_exec() - Turn on LLVM translation for inspection.
+ *
+ * Enable translation of basic blocks to LLVM and make this available
+ * for perusal via `-d llvm_ir`.  Whole-system emulation will continue
+ * to use its normal faster emultion.
+ */
 void panda_enable_llvm_no_exec(void);
+
+/**
+ * panda_disable_llvm() - Turn off LLVM translation-mediated emulation.
+ */
 void panda_disable_llvm(void);
+
+// Not API functions.
 void panda_enable_llvm_helpers(void);
 void panda_disable_llvm_helpers(void);
 int panda_write_current_llvm_bitcode_to_file(const char* path);
 uintptr_t panda_get_current_llvm_module(void);
-void panda_enable_tb_chaining(void);
+
+/**
+ * panda_disable_tb_chaining() - Turn off translation block chaining.
+ * 
+ * Qemu typically emulates by *chaining* the execution of emulated
+ * basic blocks of guest code, meaning the execution of one follows
+ * another without returning control to the emulation loop. This is
+ * fast because qemu just lets translated code execute, one block
+ * after another.
+ * 
+ * For some analyses this is problematic and so this function disables
+ * the behavior, meaning that emulation of a basic block of guest code
+ * always returns control to the main emulation loop after it is done.
+ */
 void panda_disable_tb_chaining(void);
-void panda_memsavep(FILE *f);
+
+/**
+ * panda_enable_tb_chaining() - Turn on translation block chaining.
+ *
+ * Turns on the chaining behavior described in panda_disable_tb_chaining. 
+ */
+void panda_enable_tb_chaining(void);
+
+/**
+ * panda_memsavep() - Save RAM to a file.
+ * @file: An open and writeable file pointer.
+ *
+ * This function should simply copy the contents of RAM to the
+ * provided file pointer. One possible use is to provide this file to
+ * memory forensic tools like Volatility.
+ */
+void panda_memsavep(FILE *file);
+
+// Not and API function.
 char* panda_get_rr_name(void);
 
 // Struct for holding a parsed key/value pair from
@@ -129,41 +391,362 @@ typedef struct panda_arg_list {
     char *plugin_name;
 } panda_arg_list;
 
-// Parse out arguments and return them to caller
+
+/**
+ * panda_get_args() - Parse arguments for a plugin into panda_arg_list.
+ * @plugin_name: The plugin name.
+ *
+ * This function is used in a plugin's initialization to parse
+ * arguments to a plugin into a panda_arg_list. Arguments are
+ * key/value string pairs.
+ *
+ * Return: pointer to panda_arg_list.
+ */
 panda_arg_list *panda_get_args(const char *plugin_name);
-// Free a list of parsed arguments
+
+/** 
+ * panda_free_args() - Free plugin arguments from a panda_arg_list.
+ * @args: Pointer to panda_arg_list struct.
+ *
+ * Use this to free the memory allocated by panda_get_args.
+ */
 void panda_free_args(panda_arg_list *args);
 
+/** 
+ * panda_parse_ulong() - Get value corresponding to this plugin arg as a ulong, with default.
+ * @args: The previously parsed panda_arg_list.
+ * @argname: The name of the argument in args.
+ * @defval: A default value.
+ *
+ * Look through the arguments in args, and if any have name argname,
+ * translate the associated value into a ulong and return it.  If no
+ * such name is found, use the provided default.
+ *
+ * Return: a ulong from args or default.
+ */
 target_ulong panda_parse_ulong(panda_arg_list *args, const char *argname, target_ulong defval);
+
+/** 
+ * panda_parse_ulong_req() - Get required value corresponding to this plugin arg as a ulong.
+ * @args: The previously parsed panda_arg_list.
+ * @argname: The name of the argument in args.
+ * @help: Help text.
+ *
+ * Look through the arguments in args, and if any have name argname,
+ * translate the associated value into a ulong and return it. As this
+ * argument is required, if no such name is found, plugin load should
+ * fail. 
+ *
+ * Return: a ulong from args.
+ */
 target_ulong panda_parse_ulong_req(panda_arg_list *args, const char *argname, const char *help);
+
+/** 
+ * panda_parse_ulong_opt() - Get optional value corresponding to this plugin arg as a ulong.
+ * @args: The previously parsed panda_arg_list.
+ * @argname: The name of the argument in args.
+ * @defval: A default value.
+ * @help: Help text.
+ *
+ * Look through the arguments in args, and if any have name argname,
+ * translate the associated value into a ulong and return it.  If no
+ * such name is found, use the default.
+ *
+ * Return: a ulong from args.
+ */
 target_ulong panda_parse_ulong_opt(panda_arg_list *args, const char *argname, target_ulong defval, const char *help);
+
+/** 
+ * panda_parse_uint32() - Get value corresponding to this plugin arg as a uint32, with default.
+ * @args: The previously parsed panda_arg_list.
+ * @argname: The name of the argument in args.
+ * @defval: A default value.
+ *
+ * Look through the arguments in args, and if any have name argname,
+ * translate the associated value into a uint32 and return it.  If no
+ * such name is found, use the provided default.
+ *
+ * Return: a uint32 from args or default.
+ */                     
 uint32_t panda_parse_uint32(panda_arg_list *args, const char *argname, uint32_t defval);
+
+/** 
+ * panda_parse_uint32_req() - Get required value corresponding to this plugin arg as a uint32.
+ * @args: The previously parsed panda_arg_list.
+ * @argname: The name of the argument in args.
+ * @help: Help text.
+ *
+ * Look through the arguments in args, and if any have name argname,
+ * translate the associated value into a uint32 and return it. As this
+ * argument is required, if no such name is found, plugin load should
+ * fail.
+ *
+ * Return: a uint32 from args.
+ */
 uint32_t panda_parse_uint32_req(panda_arg_list *args, const char *argname, const char *help);
+
+/** 
+ * panda_parse_uint32_opt() - Get optional value corresponding to this plugin arg as a uint32.
+ * @args: The previously parsed panda_arg_list.
+ * @argname: The name of the argument in args.
+ * @defval: A default value.
+ * @help: Help text.
+ *
+ * Look through the arguments in args, and if any have name argname,
+ * translate the associated value into a uint32 and return it.  If no
+ * such name is found, use the default.
+ *
+ * Return: a uint32 from args.
+ */
 uint32_t panda_parse_uint32_opt(panda_arg_list *args, const char *argname, uint32_t defval, const char *help);
+
+/** 
+ * panda_parse_uint64() - Get value corresponding to this plugin arg as a uint64, with default.
+ * @args: The previously parsed panda_arg_list.
+ * @argname: The name of the argument in args.
+ * @defval: A default value.
+ *
+ * Look through the arguments in args, and if any have name argname,
+ * translate the associated value into a uint64 and return it.  If no
+ * such name is found, use the provided default.
+ *
+ * Return: a uint64 from args or default.
+ */                     
 uint64_t panda_parse_uint64(panda_arg_list *args, const char *argname, uint64_t defval);
+
+/** 
+ * panda_parse_uint64_req() - Get required value corresponding to this plugin arg as a uint64.
+ * @args: The previously parsed panda_arg_list.
+ * @argname: The name of the argument in args.
+ * @help: Help text.
+ *
+ * Look through the arguments in args, and if any have name argname,
+ * translate the associated value into a uint64 and return it. As this
+ * argument is required, if no such name is found, plugin load should
+ * fail.
+ *
+ * Return: a uint64 from args.
+ */
 uint64_t panda_parse_uint64_req(panda_arg_list *args, const char *argname, const char *help);
+
+/** 
+ * panda_parse_uint64_opt() - Get optional value corresponding to this plugin arg as a uint64.
+ * @args: The previously parsed panda_arg_list.
+ * @argname: The name of the argument in args.
+ * @defval: A default value.
+ * @help: Help text.
+ *
+ * Look through the arguments in args, and if any have name argname,
+ * translate the associated value into a uint64 and return it.  If no
+ * such name is found, use the default.
+ *
+ * Return: a uint64 from args.
+ */
 uint64_t panda_parse_uint64_opt(panda_arg_list *args, const char *argname, uint64_t defval, const char *help);
+
+/** 
+ * panda_parse_double() - Get value corresponding to this plugin arg as a double, with default.
+ * @args: The previously parsed panda_arg_list.
+ * @argname: The name of the argument in args.
+ * @defval: A default value.
+ *
+ * Look through the arguments in args, and if any have name argname,
+ * translate the associated value into a double and return it.  If no
+ * such name is found, use the provided default.
+ *
+ * Return: a double from args or default.
+ */                     
 double panda_parse_double(panda_arg_list *args, const char *argname, double defval);
+
+/** 
+ * panda_parse_double_req() - Get required value corresponding to this plugin arg as a double.
+ * @args: The previously parsed panda_arg_list.
+ * @argname: The name of the argument in args.
+ * @help: Help text.
+ *
+ * Look through the arguments in args, and if any have name argname,
+ * translate the associated value into a double and return it. As this
+ * argument is required, if no such name is found, plugin load should
+ * fail.
+ *
+ * Return: a double from args.
+ */
 double panda_parse_double_req(panda_arg_list *args, const char *argname, const char *help);
+
+/** 
+ * panda_parse_double_opt() - Get optional value corresponding to this plugin arg as a double.
+ * @args: The previously parsed panda_arg_list.
+ * @argname: The name of the argument in args.
+ * @defval: A default value.
+ * @help: Help text.
+ *
+ * Look through the arguments in args, and if any have name argname,
+ * translate the associated value into a double and return it.  If no
+ * such name is found, use the default.
+ *
+ * Return: a double from args.
+ */
 double panda_parse_double_opt(panda_arg_list *args, const char *argname, double defval, const char *help);
-// Returns true if arg present, unless arg=false or arg=no exists.
+
+/** 
+ * panda_parse_bool() - Determine if this boolean argument is set for this plugin.
+ * @args: The previously parsed panda_arg_list.
+ * @argname: The name of the argument in args.
+ *
+ * Look through the arguments in args, and if any have name argname,
+ * compare the associated value with a set of strings that likely mean
+ * "true" and another set that likely mean "false" in order to
+ * determine the boolean setting for that argument, which is returned.
+ * Note: This means to set a boolean argument for a panda plugin you
+ * need something like '-panda taint2:opt=true'.
+ *
+ * NB: If the argument is missing, false will be returned.
+ * 
+ * Return: the boolean setting, true/false.
+ */                     
 bool panda_parse_bool(panda_arg_list *args, const char *argname);
+
+/** 
+ * panda_parse_bool_req() - Determine if this required boolean argument is set for this plugin.
+ * @args: The previously parsed panda_arg_list.
+ * @argname: The name of the argument in args.
+ * @help: Help text.
+ *
+ * Look through the arguments in args, and if any have name argname,
+ * compare the associated value with a set of strings that likely mean
+ * "true" and another set that likely mean "false" in order to
+ * determine the boolean setting for that argument, which is returned.
+ * Note: This means to set a boolean argument for a panda plugin you
+ * need something like '-panda taint2:opt=true'.
+ *
+ * As this argument is required, if it is not found, plugin load
+ * should fail.
+ *
+ * Return: the boolean setting, true/false.
+ */
 bool panda_parse_bool_req(panda_arg_list *args, const char *argname, const char *help);
+
+/** 
+ * panda_parse_bool_opt() - Determine if this optional boolean argument is set for this plugin.
+ * @args: The previously parsed panda_arg_list.
+ * @argname: The name of the argument in args.
+ * @help: Help text.
+ * 
+ * Same behavior as panda_parse_bool.
+ *
+ * Return: the boolean setting, true/false.
+ */
 bool panda_parse_bool_opt(panda_arg_list *args, const char *argname, const char *help);
+
+/** 
+ * panda_parse_string() - Get required value corresponding to this plugin arg as a string.
+ * @args: The previously parsed panda_arg_list.
+ * @argname: The name of the argument in args.
+ * @defval: A default value.
+ *
+ * Look through the arguments in args, and if any have name argname,
+ * return the associated string value.  If the arg is not found, the
+ * default will be returned.
+ *
+ * Return: a string value.
+ */
 const char *panda_parse_string(panda_arg_list *args, const char *argname, const char *defval);
+
+/** 
+ * panda_parse_string_req() - Get value corresponding to this plugin arg as a string.
+ * @args: The previously parsed panda_arg_list.
+ * @argname: The name of the argument in args.
+ * @help: Help text.
+ *
+ * Look through the arguments in args, and if any have name argname,
+ * return the associated string value.
+ *
+ * As this argument is required, if it is not found, plugin load
+ * should fail.
+ *
+ * Return: a string value.
+ */
 const char *panda_parse_string_req(panda_arg_list *args, const char *argname, const char *help);
+
+/** 
+ * panda_parse_string_opt() - Look for optional string value corresponding to this plugin arg.
+ * @args: The previously parsed panda_arg_list.
+ * @argname: The name of the argument in args.
+ * @defval: A default value.
+ * @help: Help text.
+ * *
+ * Look through the arguments in args, and if any have name argname,
+ * return the associated string value.  If the arg is not found, the
+ * default will be returned.
+ *
+ * Return: a string value.
+ */
 const char *panda_parse_string_opt(panda_arg_list *args, const char *argname, const char *defval, const char *help);
 
-char** str_split(char *a_str, const char a_delim);
 
 extern gchar *panda_argv[MAX_PANDA_PLUGIN_ARGS];
 extern int panda_argc;
 
+
+// Not API functions
+char** str_split(char *a_str, const char a_delim);
 char* resolve_file_from_plugin_directory(const char* file_name_fmt, const char* name);
+
+/**
+ * panda_plugin_path() - Get path to plugin shared object.
+ * @name: Plugin name.
+ *
+ * Python magic needs this. Returns full path to shared object for this plugin. 
+ * For example, "taint2" might resolve to /path/to/build/x86_64-softmmu/panda/plugins/panda_taint2.so
+ *
+ * Return: A filesystem path.
+ */
 char *panda_plugin_path(const char *name);
+
+/**
+ * panda_shared_library_path() - Get path for plugin shared library.
+ * @name: Plugin name.
+ * 
+ * Find full path to shared library (not plugin .so).
+ * For example, "libso.so" might resolve to 
+ * /path/to/build/x86_64-softmmu/panda/plugins/libso.so
+ */
 char* panda_shared_library_path(const char* name);
+
+
+/**
+ * panda_require() - Require (import) a plugin by name, library mode.
+ * @name: Plugin name.
+ * Load this plugin bc caller requires (depends upon) it.
+ */
+void panda_require(const char *name);
+
+/**
+ * panda_require_from_library() - Require (import) a plugin by name, library mode.
+ * @plugin_name: Plugin name.
+ * @plugin_args: Plugin args.
+ * @num_args: Number of args.
+ * 
+ * Same as panda_require but in library mode we have to pass plugin args manually.
+ */
 void panda_require_from_library(const char *plugin_name, char **plugin_args, uint32_t num_args);
-void panda_require(const char *plugin_name);
+
+/**
+ * panda_is_callback_enabled() - Determine if this plugin is loaded and enabled.
+ * @plugin: Pointer to plugin (handle).
+ * @type: Type of callback
+ * @cb: The callback fn.
+ *
+ * Oddly, this function requires not the name of the plugin but
+ * handle. Given that and callback type and fn, search the list of
+ * callbacks and return true iff that one is both registered and
+ * enabled.
+ * 
+ * See panda_cb_type. 
+ * See panda_cb. 
+ *
+ * Return: True if enabled, false otherwise. 
+*/
 bool panda_is_callback_enabled(void *plugin, panda_cb_type type, panda_cb cb);
 
 // END_PYPANDA_NEEDS_THIS -- do not delete this comment!

From 10f51f9c00823fa7a468543e32c92f3a91cbfded Mon Sep 17 00:00:00 2001
From: Luke Craig <lacraig3@gmail.com>
Date: Wed, 16 Nov 2022 21:08:13 +0100
Subject: [PATCH 135/140] Add QEMU Helpers (#1252)

* add qemu helpers

* remove newline to trigger CI
---
 panda/python/core/create_panda_datatypes.py      | 8 +++-----
 panda/python/core/pandare/include/qemu_helpers.h | 6 ++++++
 2 files changed, 9 insertions(+), 5 deletions(-)
 create mode 100644 panda/python/core/pandare/include/qemu_helpers.h

diff --git a/panda/python/core/create_panda_datatypes.py b/panda/python/core/create_panda_datatypes.py
index 5dbe7e01e88..3e4a3bae158 100755
--- a/panda/python/core/create_panda_datatypes.py
+++ b/panda/python/core/create_panda_datatypes.py
@@ -231,11 +231,6 @@ def expand_ppp_def(line):
     ffi.cdef("typedef uint"+str(bits)+"_t target_ulong;")
     ffi.cdef("typedef int"+str(bits)+"_t target_long;")
 
-    # For direct access to -d logging flags
-    # unsigned is a lie. but it's the way QEMU treats it.
-    ffi.cdef("extern unsigned int qemu_loglevel;")
-    ffi.cdef("extern FILE* qemu_logfile;")
-
     # PPP Headers
     # Syscalls - load architecture-specific headers
     if arch == "i386":
@@ -270,6 +265,9 @@ def expand_ppp_def(line):
     else:
         print("PANDA_DATATYPES: Architecture not supported")
 
+    # Define some common QEMU types
+    define_clean_header(ffi, include_dir + "/qemu_helpers.h")
+
     # Define some common panda datatypes
     define_clean_header(ffi, include_dir + "/panda_datatypes.h")
 
diff --git a/panda/python/core/pandare/include/qemu_helpers.h b/panda/python/core/pandare/include/qemu_helpers.h
new file mode 100644
index 00000000000..a99048f2b84
--- /dev/null
+++ b/panda/python/core/pandare/include/qemu_helpers.h
@@ -0,0 +1,6 @@
+// for direct access to -d logginf flags
+// unsigned is a lie, but it's the way QEMU treats it
+extern unsigned int qemu_loglevel;
+extern FILE* qemu_logfile;
+
+MemoryRegion *get_system_memory(void);
\ No newline at end of file

From ea75241639de811c72ce5ce0413c1589b39c75be Mon Sep 17 00:00:00 2001
From: jamcleod <Jordan.McLeod@ll.mit.edu>
Date: Tue, 6 Dec 2022 16:33:00 -0500
Subject: [PATCH 136/140] Move generic qcows to json file

---
 panda/python/core/pandare/qcows.json        | 307 ++++++++++++++++++++
 panda/python/core/pandare/qcows_internal.py | 169 +----------
 2 files changed, 315 insertions(+), 161 deletions(-)
 create mode 100644 panda/python/core/pandare/qcows.json

diff --git a/panda/python/core/pandare/qcows.json b/panda/python/core/pandare/qcows.json
new file mode 100644
index 00000000000..a0fbd6dfbad
--- /dev/null
+++ b/panda/python/core/pandare/qcows.json
@@ -0,0 +1,307 @@
+{
+    "i386_wheezy": {
+        "arch": "i386",
+        "os": "linux-32-debian:3.2.0-4-686-pae",
+        "prompt": "root@debian-i386:.*# ",
+        "cdrom": "ide1-cd0",
+        "snapshot": "root",
+        "url": "https://panda-re.mit.edu/qcows/linux/debian/7.3/x86/debian_7.3_x86.qcow",
+        "alternate_urls": null,
+        "extra_files": null,
+        "qcow": "wheezy_panda2.qcow2",
+        "default_mem": "128M",
+        "extra_args": "-display none",
+        "hashes": null
+    },
+    "x86_64_wheezy": {
+        "arch": "x86_64",
+        "os": "linux-64-debian:3.2.0-4-amd64",
+        "prompt": "root@debian-amd64:.*# ",
+        "cdrom": "ide1-cd0",
+        "snapshot": "root",
+        "url": "https://panda-re.mit.edu/qcows/linux/debian/7.3/x86_64/debian_7.3_x86_64.qcow",
+        "alternate_urls": null,
+        "extra_files": null,
+        "qcow": "wheezy_x64.qcow2",
+        "default_mem": "128M",
+        "extra_args": "-display none",
+        "hashes": null
+    },
+    "ppc_wheezy": {
+        "arch": "ppc",
+        "os": "linux-64-debian:3.2.0-4-ppc-pae",
+        "prompt": "root@debian-powerpc:.*# ",
+        "cdrom": "ide1-cd0",
+        "snapshot": "root",
+        "url": "https://panda-re.mit.edu/qcows/linux/debian/7.3/ppc/debian_7.3_ppc.qcow",
+        "alternate_urls": null,
+        "extra_files": null,
+        "qcow": "ppc_wheezy.qcow2",
+        "default_mem": "128M",
+        "extra_args": "-display none",
+        "hashes": null
+    },
+    "arm_wheezy": {
+        "arch": "arm",
+        "os": "linux-32-debian:3.2.0-4-versatile-arm",
+        "prompt": "root@debian-armel:.*# ",
+        "cdrom": "scsi0-cd2",
+        "snapshot": "root",
+        "url": "https://panda-re.mit.edu/qcows/linux/debian/7.3/arm/debian_7.3_arm.qcow",
+        "alternate_urls": null,
+        "extra_files": [
+            "vmlinuz-3.2.0-4-versatile",
+            "initrd.img-3.2.0-4-versatile"
+        ],
+        "qcow": "arm_wheezy.qcow",
+        "default_mem": "128M",
+        "extra_args": "-display none -M versatilepb -append \"root=/dev/sda1\" -kernel /home/jmcleod/.panda/vmlinuz-3.2.0-4-versatile -initrd /home/jmcleod/.panda/initrd.img-3.2.0-4-versatile",
+        "hashes": null
+    },
+    "aarch64_focal": {
+        "arch": "aarch64",
+        "os": "linux-64-ubuntu:5.4.0-58-generic-arm64",
+        "prompt": "root@ubuntu-panda:.*# ",
+        "cdrom": null,
+        "snapshot": "root",
+        "url": "https://panda-re.mit.edu/qcows/linux/ubuntu/2004/aarch64/ubuntu20_04-aarch64.qcow",
+        "alternate_urls": null,
+        "extra_files": [
+            "ubuntu20_04-aarch64-flash0.qcow"
+        ],
+        "qcow": null,
+        "default_mem": "1G",
+        "extra_args": "-nographic -machine virt -cpu cortex-a57 -drive file=/home/jmcleod/.panda/ubuntu20_04-aarch64-flash0.qcow,if=pflash,readonly=on",
+        "hashes": null
+    },
+    "mips64": {
+        "arch": "mips64",
+        "os": "linux-64-debian:4.14.0-3-5kc-malta",
+        "prompt": "root@debian-buster-mips:.*# ",
+        "cdrom": "ide1-cd0",
+        "snapshot": "root",
+        "url": "https://panda-re.mit.edu/qcows/linux/debian/10/mips64/debian-buster-mips.qcow2",
+        "alternate_urls": null,
+        "extra_files": [
+            "vmlinux-4.14.0-3-5kc-malta.mips.buster",
+            "initrd.img-4.14.0-3-5kc-malta.mips.buster"
+        ],
+        "qcow": null,
+        "default_mem": "2g",
+        "extra_args": "-M malta -cpu MIPS64R2-generic -append \"root=/dev/vda console=ttyS0 mem=2048m net.ifnames=0 nokaslr\" -netdev user,id=user.0 -device virtio-net,netdev=user.0 -device usb-kbd -device usb-tablet -kernel /home/jmcleod/.panda/vmlinux-4.14.0-3-5kc-malta.mips.buster -initrd /home/jmcleod/.panda/initrd.img-4.14.0-3-5kc-malta.mips.buster -nographic",
+        "hashes": null
+    },
+    "mips_wheezy": {
+        "arch": "mips",
+        "os": "linux-32-debian:3.2.0-4-4kc-malta",
+        "prompt": "root@debian-mips:.*# ",
+        "cdrom": "ide1-cd0",
+        "snapshot": "root",
+        "url": "https://panda-re.mit.edu/qcows/linux/debian/7.3/mips/debian_7.3_mips.qcow",
+        "alternate_urls": null,
+        "extra_files": [
+            "vmlinux-3.2.0-4-4kc-malta"
+        ],
+        "qcow": null,
+        "default_mem": "1g",
+        "extra_args": "-M malta -kernel /home/jmcleod/.panda/vmlinux-3.2.0-4-4kc-malta -append \"root=/dev/sda1\" -nographic",
+        "hashes": null
+    },
+    "mipsel_wheezy": {
+        "arch": "mipsel",
+        "os": "linux-32-debian:3.2.0-4-4kc-malta",
+        "prompt": "root@debian-mipsel:.*# ",
+        "cdrom": "ide1-cd0",
+        "snapshot": "root",
+        "url": "https://panda-re.mit.edu/qcows/linux/debian/7.3/mipsel/debian_7.3_mipsel.qcow",
+        "alternate_urls": null,
+        "extra_files": [
+            "vmlinux-3.2.0-4-4kc-malta.mipsel"
+        ],
+        "qcow": null,
+        "default_mem": "1g",
+        "extra_args": "-M malta -kernel /home/jmcleod/.panda/vmlinux-3.2.0-4-4kc-malta.mipsel -append \"root=/dev/sda1\" -nographic",
+        "hashes": {
+            "vmlinux-3.2.0-4-4kc-malta": "592e384a4edc16dade52a6cd5c785c637bcbc9ad",
+            "debian_7.3_mipsel.qcow": "eeb5de0128a95c5f0d76c4f2161afd1bb320d85b"
+        }
+    },
+    "mips_buildroot5": {
+        "arch": "mips",
+        "os": "linux-32-buildroot:5.10.7-4kc-malta",
+        "prompt": "# ",
+        "cdrom": "ide1-cd0",
+        "snapshot": "root",
+        "url": "https://panda-re.mit.edu/qcows/linux/buildroot/5.10/mips/mips32_buildroot.qcow",
+        "alternate_urls": null,
+        "extra_files": [
+            "mips32_vmlinux-5.10.7-4kc-malta"
+        ],
+        "qcow": null,
+        "default_mem": "1g",
+        "extra_args": "-M malta -kernel /home/jmcleod/.panda/mips32_vmlinux-5.10.7-4kc-malta -net nic,model=pcnet -net user -append \"root=/dev/hda\" -nographic",
+        "hashes": null
+    },
+    "mipsel_buildroot5": {
+        "arch": "mipsel",
+        "os": "linux-32-buildroot:5.10.7-4kc-malta-el",
+        "prompt": "# ",
+        "cdrom": "ide1-cd0",
+        "snapshot": "root",
+        "url": "https://panda-re.mit.edu/qcows/linux/buildroot/5.10/mipsel/mipsel32_buildroot.qcow",
+        "alternate_urls": null,
+        "extra_files": [
+            "mipsel32_vmlinux-5.10.7-4kc-malta-el"
+        ],
+        "qcow": null,
+        "default_mem": "1g",
+        "extra_args": "-M malta -kernel /home/jmcleod/.panda/mipsel32_vmlinux-5.10.7-4kc-malta-el -net nic,model=pcnet -net user -append \"root=/dev/hda\" -nographic",
+        "hashes": null
+    },
+    "i386_ubuntu_1604": {
+        "arch": "i386",
+        "os": "linux-32-ubuntu:4.4.200-170-generic",
+        "prompt": "root@instance-1:.*#",
+        "cdrom": "ide1-cd0",
+        "snapshot": "root",
+        "url": "https://panda-re.mit.edu/qcows/linux/ubuntu/1604/x86/ubuntu_1604_x86.qcow",
+        "alternate_urls": null,
+        "extra_files": null,
+        "qcow": null,
+        "default_mem": "1024",
+        "extra_args": "-display none",
+        "hashes": null
+    },
+    "x86_64_ubuntu_1804": {
+        "arch": "x86_64",
+        "os": "linux-64-ubuntu:4.15.0-72-generic-noaslr-nokaslr",
+        "prompt": "root@ubuntu:.*#",
+        "cdrom": "ide1-cd0",
+        "snapshot": "root",
+        "url": "https://panda-re.mit.edu/qcows/linux/ubuntu/1804/x86_64/bionic-server-cloudimg-amd64-noaslr-nokaslr.qcow2",
+        "alternate_urls": [
+            "https://www.dropbox.com/s/4avqfxqemd29i5j/bionic-server-cloudimg-amd64-noaslr-nokaslr.qcow2?dl=1"
+        ],
+        "extra_files": null,
+        "qcow": null,
+        "default_mem": "1024",
+        "extra_args": "-display none",
+        "hashes": {
+            "bionic-server-cloudimg-amd64-noaslr-nokaslr.qcow2": "556305921c8250537bbbfbb57cb56f9ef07f4d63"
+        }
+    },
+    "x86_64": {
+        "arch": "x86_64",
+        "os": "linux-64-ubuntu:4.15.0-72-generic-noaslr-nokaslr",
+        "prompt": "root@ubuntu:.*#",
+        "cdrom": "ide1-cd0",
+        "snapshot": "root",
+        "url": "https://panda-re.mit.edu/qcows/linux/ubuntu/1804/x86_64/bionic-server-cloudimg-amd64-noaslr-nokaslr.qcow2",
+        "alternate_urls": [
+            "https://www.dropbox.com/s/4avqfxqemd29i5j/bionic-server-cloudimg-amd64-noaslr-nokaslr.qcow2?dl=1"
+        ],
+        "extra_files": null,
+        "qcow": null,
+        "default_mem": "1024",
+        "extra_args": "-display none",
+        "hashes": {
+            "bionic-server-cloudimg-amd64-noaslr-nokaslr.qcow2": "556305921c8250537bbbfbb57cb56f9ef07f4d63"
+        }
+    },
+    "i386": {
+        "arch": "i386",
+        "os": "linux-32-ubuntu:4.4.200-170-generic",
+        "prompt": "root@instance-1:.*#",
+        "cdrom": "ide1-cd0",
+        "snapshot": "root",
+        "url": "https://panda-re.mit.edu/qcows/linux/ubuntu/1604/x86/ubuntu_1604_x86.qcow",
+        "alternate_urls": null,
+        "extra_files": null,
+        "qcow": null,
+        "default_mem": "1024",
+        "extra_args": "-display none",
+        "hashes": null
+    },
+    "ppc": {
+        "arch": "ppc",
+        "os": "linux-64-debian:3.2.0-4-ppc-pae",
+        "prompt": "root@debian-powerpc:.*# ",
+        "cdrom": "ide1-cd0",
+        "snapshot": "root",
+        "url": "https://panda-re.mit.edu/qcows/linux/debian/7.3/ppc/debian_7.3_ppc.qcow",
+        "alternate_urls": null,
+        "extra_files": null,
+        "qcow": "ppc_wheezy.qcow2",
+        "default_mem": "128M",
+        "extra_args": "-display none",
+        "hashes": null
+    },
+    "arm": {
+        "arch": "arm",
+        "os": "linux-32-debian:3.2.0-4-versatile-arm",
+        "prompt": "root@debian-armel:.*# ",
+        "cdrom": "scsi0-cd2",
+        "snapshot": "root",
+        "url": "https://panda-re.mit.edu/qcows/linux/debian/7.3/arm/debian_7.3_arm.qcow",
+        "alternate_urls": null,
+        "extra_files": [
+            "vmlinuz-3.2.0-4-versatile",
+            "initrd.img-3.2.0-4-versatile"
+        ],
+        "qcow": "arm_wheezy.qcow",
+        "default_mem": "128M",
+        "extra_args": "-display none -M versatilepb -append \"root=/dev/sda1\" -kernel /home/jmcleod/.panda/vmlinuz-3.2.0-4-versatile -initrd /home/jmcleod/.panda/initrd.img-3.2.0-4-versatile",
+        "hashes": null
+    },
+    "aarch64": {
+        "arch": "aarch64",
+        "os": "linux-64-ubuntu:5.4.0-58-generic-arm64",
+        "prompt": "root@ubuntu-panda:.*# ",
+        "cdrom": null,
+        "snapshot": "root",
+        "url": "https://panda-re.mit.edu/qcows/linux/ubuntu/2004/aarch64/ubuntu20_04-aarch64.qcow",
+        "alternate_urls": null,
+        "extra_files": [
+            "ubuntu20_04-aarch64-flash0.qcow"
+        ],
+        "qcow": null,
+        "default_mem": "1G",
+        "extra_args": "-nographic -machine virt -cpu cortex-a57 -drive file=/home/jmcleod/.panda/ubuntu20_04-aarch64-flash0.qcow,if=pflash,readonly=on",
+        "hashes": null
+    },
+    "mips": {
+        "arch": "mips",
+        "os": "linux-32-debian:3.2.0-4-4kc-malta",
+        "prompt": "root@debian-mips:.*# ",
+        "cdrom": "ide1-cd0",
+        "snapshot": "root",
+        "url": "https://panda-re.mit.edu/qcows/linux/debian/7.3/mips/debian_7.3_mips.qcow",
+        "alternate_urls": null,
+        "extra_files": [
+            "vmlinux-3.2.0-4-4kc-malta"
+        ],
+        "qcow": null,
+        "default_mem": "1g",
+        "extra_args": "-M malta -kernel /home/jmcleod/.panda/vmlinux-3.2.0-4-4kc-malta -append \"root=/dev/sda1\" -nographic",
+        "hashes": null
+    },
+    "mipsel": {
+        "arch": "mipsel",
+        "os": "linux-32-debian:3.2.0-4-4kc-malta",
+        "prompt": "root@debian-mipsel:.*# ",
+        "cdrom": "ide1-cd0",
+        "snapshot": "root",
+        "url": "https://panda-re.mit.edu/qcows/linux/debian/7.3/mipsel/debian_7.3_mipsel.qcow",
+        "alternate_urls": null,
+        "extra_files": [
+            "vmlinux-3.2.0-4-4kc-malta.mipsel"
+        ],
+        "qcow": null,
+        "default_mem": "1g",
+        "extra_args": "-M malta -kernel /home/jmcleod/.panda/vmlinux-3.2.0-4-4kc-malta.mipsel -append \"root=/dev/sda1\" -nographic",
+        "hashes": {
+            "vmlinux-3.2.0-4-4kc-malta": "592e384a4edc16dade52a6cd5c785c637bcbc9ad",
+            "debian_7.3_mipsel.qcow": "eeb5de0128a95c5f0d76c4f2161afd1bb320d85b"
+        }
+    }
+}
\ No newline at end of file
diff --git a/panda/python/core/pandare/qcows_internal.py b/panda/python/core/pandare/qcows_internal.py
index b319be9d046..4f7f1b9b5be 100644
--- a/panda/python/core/pandare/qcows_internal.py
+++ b/panda/python/core/pandare/qcows_internal.py
@@ -6,6 +6,7 @@
 import logging
 import random
 import hashlib
+import json
 from os import path, remove, makedirs
 from subprocess import Popen, PIPE, CalledProcessError
 from collections import namedtuple
@@ -37,157 +38,13 @@ class Image(namedtuple('Image', ['arch', 'os', 'prompt', 'cdrom', 'snapshot', 'u
 
 Image.__new__.__defaults__ = (None,) * len(Image._fields)
 
-SUPPORTED_IMAGES = {
-    # Debian: support for 4 arches on Wheezy
-    'i386_wheezy': Image(
-            arch = 'i386',
-            os="linux-32-debian:3.2.0-4-686-pae",
-            prompt=rb"root@debian-i386:.*# ",
-            qcow="wheezy_panda2.qcow2", # Backwards compatability
-            cdrom="ide1-cd0",
-            snapshot="root",
-            default_mem='128M',
-            url="https://panda-re.mit.edu/qcows/linux/debian/7.3/x86/debian_7.3_x86.qcow",
-            extra_args="-display none"),
-
-    'x86_64_wheezy': Image(
-            arch='x86_64',
-            os="linux-64-debian:3.2.0-4-amd64",
-            prompt=rb"root@debian-amd64:.*# ",
-            qcow="wheezy_x64.qcow2",# Backwards compatability 
-            cdrom="ide1-cd0",
-            snapshot="root",
-            default_mem='128M',
-            url="https://panda-re.mit.edu/qcows/linux/debian/7.3/x86_64/debian_7.3_x86_64.qcow",
-            extra_args="-display none"),
-
-    'ppc_wheezy': Image(
-            arch='ppc',
-            os="linux-64-debian:3.2.0-4-ppc-pae",
-            prompt=rb"root@debian-powerpc:.*# ",
-            qcow="ppc_wheezy.qcow2",# Backwards compatability 
-            cdrom="ide1-cd0",
-            default_mem='128M',
-            snapshot="root",
-            url="https://panda-re.mit.edu/qcows/linux/debian/7.3/ppc/debian_7.3_ppc.qcow",
-            extra_args="-display none"),
-
-    'arm_wheezy': Image(
-            arch='arm',
-            os="linux-32-debian:3.2.0-4-versatile-arm",
-            prompt=rb"root@debian-armel:.*# ",
-            qcow="arm_wheezy.qcow",# Backwards compatability 
-            cdrom="scsi0-cd2",
-            default_mem='128M',
-            snapshot="root",
-            url="https://panda-re.mit.edu/qcows/linux/debian/7.3/arm/debian_7.3_arm.qcow",
-            extra_files=['vmlinuz-3.2.0-4-versatile', 'initrd.img-3.2.0-4-versatile'],
-            extra_args='-display none -M versatilepb -append "root=/dev/sda1" -kernel {DOT_DIR}/vmlinuz-3.2.0-4-versatile -initrd {DOT_DIR}/initrd.img-3.2.0-4-versatile'.format(DOT_DIR=VM_DIR)),
-
-    'aarch64_focal': Image(
-            arch='aarch64',
-            os="linux-64-ubuntu:5.4.0-58-generic-arm64",
-            prompt=rb"root@ubuntu-panda:.*# ",
-            #cdrom="scsi0-cd2", # No idea what this should be
-            default_mem='1G',
-            snapshot="root",
-            url="https://panda-re.mit.edu/qcows/linux/ubuntu/2004/aarch64/ubuntu20_04-aarch64.qcow",
-            extra_files=['ubuntu20_04-aarch64-flash0.qcow'],
-            extra_args='-nographic -machine virt -cpu cortex-a57 -drive file={DOT_DIR}/ubuntu20_04-aarch64-flash0.qcow,if=pflash,readonly=on'.format(DOT_DIR=VM_DIR)),
-
-    'mips64': Image(
-            arch='mips64',
-            os="linux-64-debian:4.14.0-3-5kc-malta", # XXX: NO OSI
-            prompt=rb"root@debian-buster-mips:.*# ",
-            cdrom="ide1-cd0", # not sure
-            snapshot="root",
-            url="https://panda-re.mit.edu/qcows/linux/debian/10/mips64/debian-buster-mips.qcow2",
-            default_mem='2g',
-            extra_files=['vmlinux-4.14.0-3-5kc-malta.mips.buster', 'initrd.img-4.14.0-3-5kc-malta.mips.buster'],
-            extra_args='-M malta -cpu MIPS64R2-generic -append "root=/dev/vda console=ttyS0 mem=2048m net.ifnames=0 nokaslr" -netdev user,id=user.0 -device virtio-net,netdev=user.0 -device usb-kbd -device usb-tablet -kernel {DOT_DIR}/vmlinux-4.14.0-3-5kc-malta.mips.buster -initrd {DOT_DIR}/initrd.img-4.14.0-3-5kc-malta.mips.buster -nographic'.format(DOT_DIR=VM_DIR)),
-
-    'mips_wheezy': Image(
-            arch='mips',
-            os="linux-32-debian:3.2.0-4-4kc-malta",
-            prompt=rb"root@debian-mips:.*# ",
-            cdrom="ide1-cd0",
-            snapshot="root",
-            url="https://panda-re.mit.edu/qcows/linux/debian/7.3/mips/debian_7.3_mips.qcow",
-            default_mem='1g',
-            extra_files=['vmlinux-3.2.0-4-4kc-malta'],
-            extra_args='-M malta -kernel {DOT_DIR}/vmlinux-3.2.0-4-4kc-malta -append "root=/dev/sda1" -nographic'.format(DOT_DIR=VM_DIR)),
-
-    'mipsel_wheezy':  Image(
-            arch='mipsel',
-            os = "linux-32-debian:3.2.0-4-4kc-malta",
-            prompt=rb"root@debian-mipsel:.*# ",
-            cdrom="ide1-cd0",
-            snapshot="root",
-            default_mem='1g',
-            url="https://panda-re.mit.edu/qcows/linux/debian/7.3/mipsel/debian_7.3_mipsel.qcow",
-            extra_files=['vmlinux-3.2.0-4-4kc-malta.mipsel',],
-            extra_args='-M malta -kernel {DOT_DIR}/vmlinux-3.2.0-4-4kc-malta.mipsel -append "root=/dev/sda1" -nographic'.format(DOT_DIR=VM_DIR),
-            hashes={'vmlinux-3.2.0-4-4kc-malta': '592e384a4edc16dade52a6cd5c785c637bcbc9ad',
-                    'debian_7.3_mipsel.qcow': 'eeb5de0128a95c5f0d76c4f2161afd1bb320d85b'}),
-
-    'mips_buildroot5':  Image(
-            arch='mips',
-            os = "linux-32-buildroot:5.10.7-4kc-malta",
-            prompt=rb"# ",
-            cdrom="ide1-cd0",
-            snapshot="root",
-            default_mem='1g',
-            url="https://panda-re.mit.edu/qcows/linux/buildroot/5.10/mips/mips32_buildroot.qcow",
-            extra_files=['mips32_vmlinux-5.10.7-4kc-malta',],
-            extra_args='-M malta -kernel {DOT_DIR}/mips32_vmlinux-5.10.7-4kc-malta -net nic,model=pcnet -net user -append "root=/dev/hda" -nographic'.format(DOT_DIR=VM_DIR)),
-
-
-    'mipsel_buildroot5':  Image(
-            arch='mipsel',
-            os = "linux-32-buildroot:5.10.7-4kc-malta-el",
-            prompt=rb"# ",
-            cdrom="ide1-cd0",
-            snapshot="root",
-            default_mem='1g',
-            url="https://panda-re.mit.edu/qcows/linux/buildroot/5.10/mipsel/mipsel32_buildroot.qcow",
-            extra_files=['mipsel32_vmlinux-5.10.7-4kc-malta-el',],
-            extra_args='-M malta -kernel {DOT_DIR}/mipsel32_vmlinux-5.10.7-4kc-malta-el -net nic,model=pcnet -net user -append "root=/dev/hda" -nographic'.format(DOT_DIR=VM_DIR)),
-
-
-    # Ubuntu: x86/x86_64 support for 16.04, x86_64 support for 18.04
-    'i386_ubuntu_1604': Image(
-            arch = 'i386',
-            os="linux-32-ubuntu:4.4.200-170-generic", # Version.c is 200 but name is 4.4.0. Not sure why
-            prompt=rb"root@instance-1:.*#",
-            cdrom="ide1-cd0",
-            snapshot="root",
-            default_mem='1024',
-            url="https://panda-re.mit.edu/qcows/linux/ubuntu/1604/x86/ubuntu_1604_x86.qcow",
-            extra_args="-display none"),
-
-    #'x86_64_ubuntu_1604': Image( # XXX: This one is broken
-    #        arch='x86_64',
-    #        os="linux-64-ubuntu:4.4.0-180-pae",
-    #        prompt=rb"root@instance-1:.*#",
-    #        cdrom="ide1-cd0",
-    #        snapshot="root",
-    #        default_mem='1024',
-    #        url="https://panda-re.mit.edu/qcows/linux/ubuntu/1604/x86_64/ubuntu_1604_x86_64.qcow",
-    #        extra_files=['xenial-server-cloudimg-amd64-disk1.img',],
-    #        extra_args="-display none"),
-
-    'x86_64_ubuntu_1804': Image(
-            arch='x86_64',
-            os="linux-64-ubuntu:4.15.0-72-generic-noaslr-nokaslr",
-            prompt=rb"root@ubuntu:.*#",
-            cdrom="ide1-cd0",
-            snapshot="root",
-            default_mem='1024',
-            url="https://panda-re.mit.edu/qcows/linux/ubuntu/1804/x86_64/bionic-server-cloudimg-amd64-noaslr-nokaslr.qcow2",
-            alternate_urls=["https://www.dropbox.com/s/4avqfxqemd29i5j/bionic-server-cloudimg-amd64-noaslr-nokaslr.qcow2?dl=1"],
-            extra_args="-display none",
-            hashes={"bionic-server-cloudimg-amd64-noaslr-nokaslr.qcow2": "556305921c8250537bbbfbb57cb56f9ef07f4d63"}),
-}
+json_path = path.join(*[path.dirname(__file__), "qcows.json"])
+with open(json_path, 'r') as f:
+    images = json.load(f)
+
+SUPPORTED_IMAGES = dict([
+    (k, Image(**v)) for k, v in images.items()
+])
 """
 Dictionary of `Image` objects by name.
 Generic values (underlying OS version may change) include:
@@ -213,16 +70,6 @@ class Image(namedtuple('Image', ['arch', 'os', 'prompt', 'cdrom', 'snapshot', 'u
     mips64
 """ # TODO: autogenerate values here
 
-# Default values
-SUPPORTED_IMAGES['x86_64']  = SUPPORTED_IMAGES['x86_64_ubuntu_1804']
-SUPPORTED_IMAGES['i386']    = SUPPORTED_IMAGES['i386_ubuntu_1604']
-SUPPORTED_IMAGES['ppc']     = SUPPORTED_IMAGES['ppc_wheezy']
-SUPPORTED_IMAGES['arm']     = SUPPORTED_IMAGES['arm_wheezy']
-SUPPORTED_IMAGES['aarch64'] = SUPPORTED_IMAGES['aarch64_focal']
-SUPPORTED_IMAGES['mips']    = SUPPORTED_IMAGES['mips_wheezy']
-SUPPORTED_IMAGES['mipsel']  = SUPPORTED_IMAGES['mipsel_wheezy']
-SUPPORTED_IMAGES['mips64']    = SUPPORTED_IMAGES['mips64']
-
 class Qcows():
     '''
     Helper library for managing qcows on your filesystem.

From f590a83aa78c5e1f3c9a80aa265e59509270adce Mon Sep 17 00:00:00 2001
From: Jordan McLeod <Jordan.McLeod@ll.mit.edu>
Date: Fri, 9 Dec 2022 14:30:32 -0500
Subject: [PATCH 137/140] Move generic qcows to json file (#1257)

* Move generic qcows to json file

* Fix qcow.json not being copied in all situations
---
 panda/python/core/pandare/qcows.json        | 307 ++++++++++++++++++++
 panda/python/core/pandare/qcows_internal.py | 169 +----------
 panda/python/core/setup.py                  |   1 +
 3 files changed, 316 insertions(+), 161 deletions(-)
 create mode 100644 panda/python/core/pandare/qcows.json

diff --git a/panda/python/core/pandare/qcows.json b/panda/python/core/pandare/qcows.json
new file mode 100644
index 00000000000..a0fbd6dfbad
--- /dev/null
+++ b/panda/python/core/pandare/qcows.json
@@ -0,0 +1,307 @@
+{
+    "i386_wheezy": {
+        "arch": "i386",
+        "os": "linux-32-debian:3.2.0-4-686-pae",
+        "prompt": "root@debian-i386:.*# ",
+        "cdrom": "ide1-cd0",
+        "snapshot": "root",
+        "url": "https://panda-re.mit.edu/qcows/linux/debian/7.3/x86/debian_7.3_x86.qcow",
+        "alternate_urls": null,
+        "extra_files": null,
+        "qcow": "wheezy_panda2.qcow2",
+        "default_mem": "128M",
+        "extra_args": "-display none",
+        "hashes": null
+    },
+    "x86_64_wheezy": {
+        "arch": "x86_64",
+        "os": "linux-64-debian:3.2.0-4-amd64",
+        "prompt": "root@debian-amd64:.*# ",
+        "cdrom": "ide1-cd0",
+        "snapshot": "root",
+        "url": "https://panda-re.mit.edu/qcows/linux/debian/7.3/x86_64/debian_7.3_x86_64.qcow",
+        "alternate_urls": null,
+        "extra_files": null,
+        "qcow": "wheezy_x64.qcow2",
+        "default_mem": "128M",
+        "extra_args": "-display none",
+        "hashes": null
+    },
+    "ppc_wheezy": {
+        "arch": "ppc",
+        "os": "linux-64-debian:3.2.0-4-ppc-pae",
+        "prompt": "root@debian-powerpc:.*# ",
+        "cdrom": "ide1-cd0",
+        "snapshot": "root",
+        "url": "https://panda-re.mit.edu/qcows/linux/debian/7.3/ppc/debian_7.3_ppc.qcow",
+        "alternate_urls": null,
+        "extra_files": null,
+        "qcow": "ppc_wheezy.qcow2",
+        "default_mem": "128M",
+        "extra_args": "-display none",
+        "hashes": null
+    },
+    "arm_wheezy": {
+        "arch": "arm",
+        "os": "linux-32-debian:3.2.0-4-versatile-arm",
+        "prompt": "root@debian-armel:.*# ",
+        "cdrom": "scsi0-cd2",
+        "snapshot": "root",
+        "url": "https://panda-re.mit.edu/qcows/linux/debian/7.3/arm/debian_7.3_arm.qcow",
+        "alternate_urls": null,
+        "extra_files": [
+            "vmlinuz-3.2.0-4-versatile",
+            "initrd.img-3.2.0-4-versatile"
+        ],
+        "qcow": "arm_wheezy.qcow",
+        "default_mem": "128M",
+        "extra_args": "-display none -M versatilepb -append \"root=/dev/sda1\" -kernel /home/jmcleod/.panda/vmlinuz-3.2.0-4-versatile -initrd /home/jmcleod/.panda/initrd.img-3.2.0-4-versatile",
+        "hashes": null
+    },
+    "aarch64_focal": {
+        "arch": "aarch64",
+        "os": "linux-64-ubuntu:5.4.0-58-generic-arm64",
+        "prompt": "root@ubuntu-panda:.*# ",
+        "cdrom": null,
+        "snapshot": "root",
+        "url": "https://panda-re.mit.edu/qcows/linux/ubuntu/2004/aarch64/ubuntu20_04-aarch64.qcow",
+        "alternate_urls": null,
+        "extra_files": [
+            "ubuntu20_04-aarch64-flash0.qcow"
+        ],
+        "qcow": null,
+        "default_mem": "1G",
+        "extra_args": "-nographic -machine virt -cpu cortex-a57 -drive file=/home/jmcleod/.panda/ubuntu20_04-aarch64-flash0.qcow,if=pflash,readonly=on",
+        "hashes": null
+    },
+    "mips64": {
+        "arch": "mips64",
+        "os": "linux-64-debian:4.14.0-3-5kc-malta",
+        "prompt": "root@debian-buster-mips:.*# ",
+        "cdrom": "ide1-cd0",
+        "snapshot": "root",
+        "url": "https://panda-re.mit.edu/qcows/linux/debian/10/mips64/debian-buster-mips.qcow2",
+        "alternate_urls": null,
+        "extra_files": [
+            "vmlinux-4.14.0-3-5kc-malta.mips.buster",
+            "initrd.img-4.14.0-3-5kc-malta.mips.buster"
+        ],
+        "qcow": null,
+        "default_mem": "2g",
+        "extra_args": "-M malta -cpu MIPS64R2-generic -append \"root=/dev/vda console=ttyS0 mem=2048m net.ifnames=0 nokaslr\" -netdev user,id=user.0 -device virtio-net,netdev=user.0 -device usb-kbd -device usb-tablet -kernel /home/jmcleod/.panda/vmlinux-4.14.0-3-5kc-malta.mips.buster -initrd /home/jmcleod/.panda/initrd.img-4.14.0-3-5kc-malta.mips.buster -nographic",
+        "hashes": null
+    },
+    "mips_wheezy": {
+        "arch": "mips",
+        "os": "linux-32-debian:3.2.0-4-4kc-malta",
+        "prompt": "root@debian-mips:.*# ",
+        "cdrom": "ide1-cd0",
+        "snapshot": "root",
+        "url": "https://panda-re.mit.edu/qcows/linux/debian/7.3/mips/debian_7.3_mips.qcow",
+        "alternate_urls": null,
+        "extra_files": [
+            "vmlinux-3.2.0-4-4kc-malta"
+        ],
+        "qcow": null,
+        "default_mem": "1g",
+        "extra_args": "-M malta -kernel /home/jmcleod/.panda/vmlinux-3.2.0-4-4kc-malta -append \"root=/dev/sda1\" -nographic",
+        "hashes": null
+    },
+    "mipsel_wheezy": {
+        "arch": "mipsel",
+        "os": "linux-32-debian:3.2.0-4-4kc-malta",
+        "prompt": "root@debian-mipsel:.*# ",
+        "cdrom": "ide1-cd0",
+        "snapshot": "root",
+        "url": "https://panda-re.mit.edu/qcows/linux/debian/7.3/mipsel/debian_7.3_mipsel.qcow",
+        "alternate_urls": null,
+        "extra_files": [
+            "vmlinux-3.2.0-4-4kc-malta.mipsel"
+        ],
+        "qcow": null,
+        "default_mem": "1g",
+        "extra_args": "-M malta -kernel /home/jmcleod/.panda/vmlinux-3.2.0-4-4kc-malta.mipsel -append \"root=/dev/sda1\" -nographic",
+        "hashes": {
+            "vmlinux-3.2.0-4-4kc-malta": "592e384a4edc16dade52a6cd5c785c637bcbc9ad",
+            "debian_7.3_mipsel.qcow": "eeb5de0128a95c5f0d76c4f2161afd1bb320d85b"
+        }
+    },
+    "mips_buildroot5": {
+        "arch": "mips",
+        "os": "linux-32-buildroot:5.10.7-4kc-malta",
+        "prompt": "# ",
+        "cdrom": "ide1-cd0",
+        "snapshot": "root",
+        "url": "https://panda-re.mit.edu/qcows/linux/buildroot/5.10/mips/mips32_buildroot.qcow",
+        "alternate_urls": null,
+        "extra_files": [
+            "mips32_vmlinux-5.10.7-4kc-malta"
+        ],
+        "qcow": null,
+        "default_mem": "1g",
+        "extra_args": "-M malta -kernel /home/jmcleod/.panda/mips32_vmlinux-5.10.7-4kc-malta -net nic,model=pcnet -net user -append \"root=/dev/hda\" -nographic",
+        "hashes": null
+    },
+    "mipsel_buildroot5": {
+        "arch": "mipsel",
+        "os": "linux-32-buildroot:5.10.7-4kc-malta-el",
+        "prompt": "# ",
+        "cdrom": "ide1-cd0",
+        "snapshot": "root",
+        "url": "https://panda-re.mit.edu/qcows/linux/buildroot/5.10/mipsel/mipsel32_buildroot.qcow",
+        "alternate_urls": null,
+        "extra_files": [
+            "mipsel32_vmlinux-5.10.7-4kc-malta-el"
+        ],
+        "qcow": null,
+        "default_mem": "1g",
+        "extra_args": "-M malta -kernel /home/jmcleod/.panda/mipsel32_vmlinux-5.10.7-4kc-malta-el -net nic,model=pcnet -net user -append \"root=/dev/hda\" -nographic",
+        "hashes": null
+    },
+    "i386_ubuntu_1604": {
+        "arch": "i386",
+        "os": "linux-32-ubuntu:4.4.200-170-generic",
+        "prompt": "root@instance-1:.*#",
+        "cdrom": "ide1-cd0",
+        "snapshot": "root",
+        "url": "https://panda-re.mit.edu/qcows/linux/ubuntu/1604/x86/ubuntu_1604_x86.qcow",
+        "alternate_urls": null,
+        "extra_files": null,
+        "qcow": null,
+        "default_mem": "1024",
+        "extra_args": "-display none",
+        "hashes": null
+    },
+    "x86_64_ubuntu_1804": {
+        "arch": "x86_64",
+        "os": "linux-64-ubuntu:4.15.0-72-generic-noaslr-nokaslr",
+        "prompt": "root@ubuntu:.*#",
+        "cdrom": "ide1-cd0",
+        "snapshot": "root",
+        "url": "https://panda-re.mit.edu/qcows/linux/ubuntu/1804/x86_64/bionic-server-cloudimg-amd64-noaslr-nokaslr.qcow2",
+        "alternate_urls": [
+            "https://www.dropbox.com/s/4avqfxqemd29i5j/bionic-server-cloudimg-amd64-noaslr-nokaslr.qcow2?dl=1"
+        ],
+        "extra_files": null,
+        "qcow": null,
+        "default_mem": "1024",
+        "extra_args": "-display none",
+        "hashes": {
+            "bionic-server-cloudimg-amd64-noaslr-nokaslr.qcow2": "556305921c8250537bbbfbb57cb56f9ef07f4d63"
+        }
+    },
+    "x86_64": {
+        "arch": "x86_64",
+        "os": "linux-64-ubuntu:4.15.0-72-generic-noaslr-nokaslr",
+        "prompt": "root@ubuntu:.*#",
+        "cdrom": "ide1-cd0",
+        "snapshot": "root",
+        "url": "https://panda-re.mit.edu/qcows/linux/ubuntu/1804/x86_64/bionic-server-cloudimg-amd64-noaslr-nokaslr.qcow2",
+        "alternate_urls": [
+            "https://www.dropbox.com/s/4avqfxqemd29i5j/bionic-server-cloudimg-amd64-noaslr-nokaslr.qcow2?dl=1"
+        ],
+        "extra_files": null,
+        "qcow": null,
+        "default_mem": "1024",
+        "extra_args": "-display none",
+        "hashes": {
+            "bionic-server-cloudimg-amd64-noaslr-nokaslr.qcow2": "556305921c8250537bbbfbb57cb56f9ef07f4d63"
+        }
+    },
+    "i386": {
+        "arch": "i386",
+        "os": "linux-32-ubuntu:4.4.200-170-generic",
+        "prompt": "root@instance-1:.*#",
+        "cdrom": "ide1-cd0",
+        "snapshot": "root",
+        "url": "https://panda-re.mit.edu/qcows/linux/ubuntu/1604/x86/ubuntu_1604_x86.qcow",
+        "alternate_urls": null,
+        "extra_files": null,
+        "qcow": null,
+        "default_mem": "1024",
+        "extra_args": "-display none",
+        "hashes": null
+    },
+    "ppc": {
+        "arch": "ppc",
+        "os": "linux-64-debian:3.2.0-4-ppc-pae",
+        "prompt": "root@debian-powerpc:.*# ",
+        "cdrom": "ide1-cd0",
+        "snapshot": "root",
+        "url": "https://panda-re.mit.edu/qcows/linux/debian/7.3/ppc/debian_7.3_ppc.qcow",
+        "alternate_urls": null,
+        "extra_files": null,
+        "qcow": "ppc_wheezy.qcow2",
+        "default_mem": "128M",
+        "extra_args": "-display none",
+        "hashes": null
+    },
+    "arm": {
+        "arch": "arm",
+        "os": "linux-32-debian:3.2.0-4-versatile-arm",
+        "prompt": "root@debian-armel:.*# ",
+        "cdrom": "scsi0-cd2",
+        "snapshot": "root",
+        "url": "https://panda-re.mit.edu/qcows/linux/debian/7.3/arm/debian_7.3_arm.qcow",
+        "alternate_urls": null,
+        "extra_files": [
+            "vmlinuz-3.2.0-4-versatile",
+            "initrd.img-3.2.0-4-versatile"
+        ],
+        "qcow": "arm_wheezy.qcow",
+        "default_mem": "128M",
+        "extra_args": "-display none -M versatilepb -append \"root=/dev/sda1\" -kernel /home/jmcleod/.panda/vmlinuz-3.2.0-4-versatile -initrd /home/jmcleod/.panda/initrd.img-3.2.0-4-versatile",
+        "hashes": null
+    },
+    "aarch64": {
+        "arch": "aarch64",
+        "os": "linux-64-ubuntu:5.4.0-58-generic-arm64",
+        "prompt": "root@ubuntu-panda:.*# ",
+        "cdrom": null,
+        "snapshot": "root",
+        "url": "https://panda-re.mit.edu/qcows/linux/ubuntu/2004/aarch64/ubuntu20_04-aarch64.qcow",
+        "alternate_urls": null,
+        "extra_files": [
+            "ubuntu20_04-aarch64-flash0.qcow"
+        ],
+        "qcow": null,
+        "default_mem": "1G",
+        "extra_args": "-nographic -machine virt -cpu cortex-a57 -drive file=/home/jmcleod/.panda/ubuntu20_04-aarch64-flash0.qcow,if=pflash,readonly=on",
+        "hashes": null
+    },
+    "mips": {
+        "arch": "mips",
+        "os": "linux-32-debian:3.2.0-4-4kc-malta",
+        "prompt": "root@debian-mips:.*# ",
+        "cdrom": "ide1-cd0",
+        "snapshot": "root",
+        "url": "https://panda-re.mit.edu/qcows/linux/debian/7.3/mips/debian_7.3_mips.qcow",
+        "alternate_urls": null,
+        "extra_files": [
+            "vmlinux-3.2.0-4-4kc-malta"
+        ],
+        "qcow": null,
+        "default_mem": "1g",
+        "extra_args": "-M malta -kernel /home/jmcleod/.panda/vmlinux-3.2.0-4-4kc-malta -append \"root=/dev/sda1\" -nographic",
+        "hashes": null
+    },
+    "mipsel": {
+        "arch": "mipsel",
+        "os": "linux-32-debian:3.2.0-4-4kc-malta",
+        "prompt": "root@debian-mipsel:.*# ",
+        "cdrom": "ide1-cd0",
+        "snapshot": "root",
+        "url": "https://panda-re.mit.edu/qcows/linux/debian/7.3/mipsel/debian_7.3_mipsel.qcow",
+        "alternate_urls": null,
+        "extra_files": [
+            "vmlinux-3.2.0-4-4kc-malta.mipsel"
+        ],
+        "qcow": null,
+        "default_mem": "1g",
+        "extra_args": "-M malta -kernel /home/jmcleod/.panda/vmlinux-3.2.0-4-4kc-malta.mipsel -append \"root=/dev/sda1\" -nographic",
+        "hashes": {
+            "vmlinux-3.2.0-4-4kc-malta": "592e384a4edc16dade52a6cd5c785c637bcbc9ad",
+            "debian_7.3_mipsel.qcow": "eeb5de0128a95c5f0d76c4f2161afd1bb320d85b"
+        }
+    }
+}
\ No newline at end of file
diff --git a/panda/python/core/pandare/qcows_internal.py b/panda/python/core/pandare/qcows_internal.py
index b319be9d046..4f7f1b9b5be 100644
--- a/panda/python/core/pandare/qcows_internal.py
+++ b/panda/python/core/pandare/qcows_internal.py
@@ -6,6 +6,7 @@
 import logging
 import random
 import hashlib
+import json
 from os import path, remove, makedirs
 from subprocess import Popen, PIPE, CalledProcessError
 from collections import namedtuple
@@ -37,157 +38,13 @@ class Image(namedtuple('Image', ['arch', 'os', 'prompt', 'cdrom', 'snapshot', 'u
 
 Image.__new__.__defaults__ = (None,) * len(Image._fields)
 
-SUPPORTED_IMAGES = {
-    # Debian: support for 4 arches on Wheezy
-    'i386_wheezy': Image(
-            arch = 'i386',
-            os="linux-32-debian:3.2.0-4-686-pae",
-            prompt=rb"root@debian-i386:.*# ",
-            qcow="wheezy_panda2.qcow2", # Backwards compatability
-            cdrom="ide1-cd0",
-            snapshot="root",
-            default_mem='128M',
-            url="https://panda-re.mit.edu/qcows/linux/debian/7.3/x86/debian_7.3_x86.qcow",
-            extra_args="-display none"),
-
-    'x86_64_wheezy': Image(
-            arch='x86_64',
-            os="linux-64-debian:3.2.0-4-amd64",
-            prompt=rb"root@debian-amd64:.*# ",
-            qcow="wheezy_x64.qcow2",# Backwards compatability 
-            cdrom="ide1-cd0",
-            snapshot="root",
-            default_mem='128M',
-            url="https://panda-re.mit.edu/qcows/linux/debian/7.3/x86_64/debian_7.3_x86_64.qcow",
-            extra_args="-display none"),
-
-    'ppc_wheezy': Image(
-            arch='ppc',
-            os="linux-64-debian:3.2.0-4-ppc-pae",
-            prompt=rb"root@debian-powerpc:.*# ",
-            qcow="ppc_wheezy.qcow2",# Backwards compatability 
-            cdrom="ide1-cd0",
-            default_mem='128M',
-            snapshot="root",
-            url="https://panda-re.mit.edu/qcows/linux/debian/7.3/ppc/debian_7.3_ppc.qcow",
-            extra_args="-display none"),
-
-    'arm_wheezy': Image(
-            arch='arm',
-            os="linux-32-debian:3.2.0-4-versatile-arm",
-            prompt=rb"root@debian-armel:.*# ",
-            qcow="arm_wheezy.qcow",# Backwards compatability 
-            cdrom="scsi0-cd2",
-            default_mem='128M',
-            snapshot="root",
-            url="https://panda-re.mit.edu/qcows/linux/debian/7.3/arm/debian_7.3_arm.qcow",
-            extra_files=['vmlinuz-3.2.0-4-versatile', 'initrd.img-3.2.0-4-versatile'],
-            extra_args='-display none -M versatilepb -append "root=/dev/sda1" -kernel {DOT_DIR}/vmlinuz-3.2.0-4-versatile -initrd {DOT_DIR}/initrd.img-3.2.0-4-versatile'.format(DOT_DIR=VM_DIR)),
-
-    'aarch64_focal': Image(
-            arch='aarch64',
-            os="linux-64-ubuntu:5.4.0-58-generic-arm64",
-            prompt=rb"root@ubuntu-panda:.*# ",
-            #cdrom="scsi0-cd2", # No idea what this should be
-            default_mem='1G',
-            snapshot="root",
-            url="https://panda-re.mit.edu/qcows/linux/ubuntu/2004/aarch64/ubuntu20_04-aarch64.qcow",
-            extra_files=['ubuntu20_04-aarch64-flash0.qcow'],
-            extra_args='-nographic -machine virt -cpu cortex-a57 -drive file={DOT_DIR}/ubuntu20_04-aarch64-flash0.qcow,if=pflash,readonly=on'.format(DOT_DIR=VM_DIR)),
-
-    'mips64': Image(
-            arch='mips64',
-            os="linux-64-debian:4.14.0-3-5kc-malta", # XXX: NO OSI
-            prompt=rb"root@debian-buster-mips:.*# ",
-            cdrom="ide1-cd0", # not sure
-            snapshot="root",
-            url="https://panda-re.mit.edu/qcows/linux/debian/10/mips64/debian-buster-mips.qcow2",
-            default_mem='2g',
-            extra_files=['vmlinux-4.14.0-3-5kc-malta.mips.buster', 'initrd.img-4.14.0-3-5kc-malta.mips.buster'],
-            extra_args='-M malta -cpu MIPS64R2-generic -append "root=/dev/vda console=ttyS0 mem=2048m net.ifnames=0 nokaslr" -netdev user,id=user.0 -device virtio-net,netdev=user.0 -device usb-kbd -device usb-tablet -kernel {DOT_DIR}/vmlinux-4.14.0-3-5kc-malta.mips.buster -initrd {DOT_DIR}/initrd.img-4.14.0-3-5kc-malta.mips.buster -nographic'.format(DOT_DIR=VM_DIR)),
-
-    'mips_wheezy': Image(
-            arch='mips',
-            os="linux-32-debian:3.2.0-4-4kc-malta",
-            prompt=rb"root@debian-mips:.*# ",
-            cdrom="ide1-cd0",
-            snapshot="root",
-            url="https://panda-re.mit.edu/qcows/linux/debian/7.3/mips/debian_7.3_mips.qcow",
-            default_mem='1g',
-            extra_files=['vmlinux-3.2.0-4-4kc-malta'],
-            extra_args='-M malta -kernel {DOT_DIR}/vmlinux-3.2.0-4-4kc-malta -append "root=/dev/sda1" -nographic'.format(DOT_DIR=VM_DIR)),
-
-    'mipsel_wheezy':  Image(
-            arch='mipsel',
-            os = "linux-32-debian:3.2.0-4-4kc-malta",
-            prompt=rb"root@debian-mipsel:.*# ",
-            cdrom="ide1-cd0",
-            snapshot="root",
-            default_mem='1g',
-            url="https://panda-re.mit.edu/qcows/linux/debian/7.3/mipsel/debian_7.3_mipsel.qcow",
-            extra_files=['vmlinux-3.2.0-4-4kc-malta.mipsel',],
-            extra_args='-M malta -kernel {DOT_DIR}/vmlinux-3.2.0-4-4kc-malta.mipsel -append "root=/dev/sda1" -nographic'.format(DOT_DIR=VM_DIR),
-            hashes={'vmlinux-3.2.0-4-4kc-malta': '592e384a4edc16dade52a6cd5c785c637bcbc9ad',
-                    'debian_7.3_mipsel.qcow': 'eeb5de0128a95c5f0d76c4f2161afd1bb320d85b'}),
-
-    'mips_buildroot5':  Image(
-            arch='mips',
-            os = "linux-32-buildroot:5.10.7-4kc-malta",
-            prompt=rb"# ",
-            cdrom="ide1-cd0",
-            snapshot="root",
-            default_mem='1g',
-            url="https://panda-re.mit.edu/qcows/linux/buildroot/5.10/mips/mips32_buildroot.qcow",
-            extra_files=['mips32_vmlinux-5.10.7-4kc-malta',],
-            extra_args='-M malta -kernel {DOT_DIR}/mips32_vmlinux-5.10.7-4kc-malta -net nic,model=pcnet -net user -append "root=/dev/hda" -nographic'.format(DOT_DIR=VM_DIR)),
-
-
-    'mipsel_buildroot5':  Image(
-            arch='mipsel',
-            os = "linux-32-buildroot:5.10.7-4kc-malta-el",
-            prompt=rb"# ",
-            cdrom="ide1-cd0",
-            snapshot="root",
-            default_mem='1g',
-            url="https://panda-re.mit.edu/qcows/linux/buildroot/5.10/mipsel/mipsel32_buildroot.qcow",
-            extra_files=['mipsel32_vmlinux-5.10.7-4kc-malta-el',],
-            extra_args='-M malta -kernel {DOT_DIR}/mipsel32_vmlinux-5.10.7-4kc-malta-el -net nic,model=pcnet -net user -append "root=/dev/hda" -nographic'.format(DOT_DIR=VM_DIR)),
-
-
-    # Ubuntu: x86/x86_64 support for 16.04, x86_64 support for 18.04
-    'i386_ubuntu_1604': Image(
-            arch = 'i386',
-            os="linux-32-ubuntu:4.4.200-170-generic", # Version.c is 200 but name is 4.4.0. Not sure why
-            prompt=rb"root@instance-1:.*#",
-            cdrom="ide1-cd0",
-            snapshot="root",
-            default_mem='1024',
-            url="https://panda-re.mit.edu/qcows/linux/ubuntu/1604/x86/ubuntu_1604_x86.qcow",
-            extra_args="-display none"),
-
-    #'x86_64_ubuntu_1604': Image( # XXX: This one is broken
-    #        arch='x86_64',
-    #        os="linux-64-ubuntu:4.4.0-180-pae",
-    #        prompt=rb"root@instance-1:.*#",
-    #        cdrom="ide1-cd0",
-    #        snapshot="root",
-    #        default_mem='1024',
-    #        url="https://panda-re.mit.edu/qcows/linux/ubuntu/1604/x86_64/ubuntu_1604_x86_64.qcow",
-    #        extra_files=['xenial-server-cloudimg-amd64-disk1.img',],
-    #        extra_args="-display none"),
-
-    'x86_64_ubuntu_1804': Image(
-            arch='x86_64',
-            os="linux-64-ubuntu:4.15.0-72-generic-noaslr-nokaslr",
-            prompt=rb"root@ubuntu:.*#",
-            cdrom="ide1-cd0",
-            snapshot="root",
-            default_mem='1024',
-            url="https://panda-re.mit.edu/qcows/linux/ubuntu/1804/x86_64/bionic-server-cloudimg-amd64-noaslr-nokaslr.qcow2",
-            alternate_urls=["https://www.dropbox.com/s/4avqfxqemd29i5j/bionic-server-cloudimg-amd64-noaslr-nokaslr.qcow2?dl=1"],
-            extra_args="-display none",
-            hashes={"bionic-server-cloudimg-amd64-noaslr-nokaslr.qcow2": "556305921c8250537bbbfbb57cb56f9ef07f4d63"}),
-}
+json_path = path.join(*[path.dirname(__file__), "qcows.json"])
+with open(json_path, 'r') as f:
+    images = json.load(f)
+
+SUPPORTED_IMAGES = dict([
+    (k, Image(**v)) for k, v in images.items()
+])
 """
 Dictionary of `Image` objects by name.
 Generic values (underlying OS version may change) include:
@@ -213,16 +70,6 @@ class Image(namedtuple('Image', ['arch', 'os', 'prompt', 'cdrom', 'snapshot', 'u
     mips64
 """ # TODO: autogenerate values here
 
-# Default values
-SUPPORTED_IMAGES['x86_64']  = SUPPORTED_IMAGES['x86_64_ubuntu_1804']
-SUPPORTED_IMAGES['i386']    = SUPPORTED_IMAGES['i386_ubuntu_1604']
-SUPPORTED_IMAGES['ppc']     = SUPPORTED_IMAGES['ppc_wheezy']
-SUPPORTED_IMAGES['arm']     = SUPPORTED_IMAGES['arm_wheezy']
-SUPPORTED_IMAGES['aarch64'] = SUPPORTED_IMAGES['aarch64_focal']
-SUPPORTED_IMAGES['mips']    = SUPPORTED_IMAGES['mips_wheezy']
-SUPPORTED_IMAGES['mipsel']  = SUPPORTED_IMAGES['mipsel_wheezy']
-SUPPORTED_IMAGES['mips64']    = SUPPORTED_IMAGES['mips64']
-
 class Qcows():
     '''
     Helper library for managing qcows on your filesystem.
diff --git a/panda/python/core/setup.py b/panda/python/core/setup.py
index a4cecede530..df6e8be03f0 100644
--- a/panda/python/core/setup.py
+++ b/panda/python/core/setup.py
@@ -166,6 +166,7 @@ def run(self):
           'data/pypanda/include/*.h',         # Includes files
           'data/pc-bios/*',                   # BIOSes
           'data/pc-bios/**/*',                # Keymaps
+          'qcows.json'                        # Generic Images
           ]},
       install_requires=[ 'cffi>=1.14.3', 'colorama', 'protobuf=='+pc_version],
       python_requires='>=3.6',

From e9defc45c5d46776a338b56564c48e897f133160 Mon Sep 17 00:00:00 2001
From: "Laura L. Mann" <laura.mann@ngc.com>
Date: Wed, 14 Dec 2022 11:43:56 -0500
Subject: [PATCH 138/140] ACE-533:  include qemupciserial.inf in installed
 files

---
 Makefile.target | 1 +
 1 file changed, 1 insertion(+)

diff --git a/Makefile.target b/Makefile.target
index 06d4b820bf1..7f42e9c42a5 100644
--- a/Makefile.target
+++ b/Makefile.target
@@ -276,6 +276,7 @@ endif
 		echo $$f; \
 		$(INSTALL_PROG) $$f "$(DESTDIR)$(qemu_datadir)/scripts"; \
 	done
+	$(INSTALL_DATA) $(SRC_PATH)/docs/qemupciserial.inf "$(DESTDIR)$(qemu_datadir)/qemupciserial.inf"
 # N.B. the new rpath must not be longer than the old rpath or chrpath will fail
 	for p in $(PANDA_PLUGINS) $(EXTRA_PANDA_PLUGINS); do \
 		echo $$p; \

From 6990cb8d147a35748c40032d5acb301009f769bf Mon Sep 17 00:00:00 2001
From: "Laura L. Mann" <laura.mann@ngc.com>
Date: Wed, 14 Dec 2022 11:44:37 -0500
Subject: [PATCH 139/140] ACE-533:  remove reference to deleted plugin

---
 panda/plugins/osi/README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/panda/plugins/osi/README.md b/panda/plugins/osi/README.md
index 58aa4f1542c..ecda70a0703 100644
--- a/panda/plugins/osi/README.md
+++ b/panda/plugins/osi/README.md
@@ -10,7 +10,7 @@ Expressed graphically, this arrangement looks like:
     +-------------------+  +-------------------+
     |        osi        |  |        osi        |
     +-------------------+  +-------------------+
-    |     osi_linux     |  |    win7x86intro   |
+    |     osi_linux     |  |  wintrospection   |
     +-------------------+  +-------------------+
 
 The key is that you can swap out the bottom layer to support a new operating system without needing to modify your plugin.

From 9619da14dea92c0e9eb5dc72fc9cbe694404dbd6 Mon Sep 17 00:00:00 2001
From: jamcleod <Jordan.McLeod@ll.mit.edu>
Date: Wed, 21 Dec 2022 15:35:30 -0500
Subject: [PATCH 140/140] Fix hardcoded home directory in qcows.json

---
 panda/python/core/pandare/qcows.json        | 24 ++++++++++-----------
 panda/python/core/pandare/qcows_internal.py |  9 ++++++++
 2 files changed, 21 insertions(+), 12 deletions(-)

diff --git a/panda/python/core/pandare/qcows.json b/panda/python/core/pandare/qcows.json
index a0fbd6dfbad..f8658cd7347 100644
--- a/panda/python/core/pandare/qcows.json
+++ b/panda/python/core/pandare/qcows.json
@@ -55,7 +55,7 @@
         ],
         "qcow": "arm_wheezy.qcow",
         "default_mem": "128M",
-        "extra_args": "-display none -M versatilepb -append \"root=/dev/sda1\" -kernel /home/jmcleod/.panda/vmlinuz-3.2.0-4-versatile -initrd /home/jmcleod/.panda/initrd.img-3.2.0-4-versatile",
+        "extra_args": "-display none -M versatilepb -append \"root=/dev/sda1\" -kernel ~/.panda/vmlinuz-3.2.0-4-versatile -initrd ~/.panda/initrd.img-3.2.0-4-versatile",
         "hashes": null
     },
     "aarch64_focal": {
@@ -71,7 +71,7 @@
         ],
         "qcow": null,
         "default_mem": "1G",
-        "extra_args": "-nographic -machine virt -cpu cortex-a57 -drive file=/home/jmcleod/.panda/ubuntu20_04-aarch64-flash0.qcow,if=pflash,readonly=on",
+        "extra_args": "-nographic -machine virt -cpu cortex-a57 -drive file=~/.panda/ubuntu20_04-aarch64-flash0.qcow,if=pflash,readonly=on",
         "hashes": null
     },
     "mips64": {
@@ -88,7 +88,7 @@
         ],
         "qcow": null,
         "default_mem": "2g",
-        "extra_args": "-M malta -cpu MIPS64R2-generic -append \"root=/dev/vda console=ttyS0 mem=2048m net.ifnames=0 nokaslr\" -netdev user,id=user.0 -device virtio-net,netdev=user.0 -device usb-kbd -device usb-tablet -kernel /home/jmcleod/.panda/vmlinux-4.14.0-3-5kc-malta.mips.buster -initrd /home/jmcleod/.panda/initrd.img-4.14.0-3-5kc-malta.mips.buster -nographic",
+        "extra_args": "-M malta -cpu MIPS64R2-generic -append \"root=/dev/vda console=ttyS0 mem=2048m net.ifnames=0 nokaslr\" -netdev user,id=user.0 -device virtio-net,netdev=user.0 -device usb-kbd -device usb-tablet -kernel ~/.panda/vmlinux-4.14.0-3-5kc-malta.mips.buster -initrd ~/.panda/initrd.img-4.14.0-3-5kc-malta.mips.buster -nographic",
         "hashes": null
     },
     "mips_wheezy": {
@@ -104,7 +104,7 @@
         ],
         "qcow": null,
         "default_mem": "1g",
-        "extra_args": "-M malta -kernel /home/jmcleod/.panda/vmlinux-3.2.0-4-4kc-malta -append \"root=/dev/sda1\" -nographic",
+        "extra_args": "-M malta -kernel ~/.panda/vmlinux-3.2.0-4-4kc-malta -append \"root=/dev/sda1\" -nographic",
         "hashes": null
     },
     "mipsel_wheezy": {
@@ -120,7 +120,7 @@
         ],
         "qcow": null,
         "default_mem": "1g",
-        "extra_args": "-M malta -kernel /home/jmcleod/.panda/vmlinux-3.2.0-4-4kc-malta.mipsel -append \"root=/dev/sda1\" -nographic",
+        "extra_args": "-M malta -kernel ~/.panda/vmlinux-3.2.0-4-4kc-malta.mipsel -append \"root=/dev/sda1\" -nographic",
         "hashes": {
             "vmlinux-3.2.0-4-4kc-malta": "592e384a4edc16dade52a6cd5c785c637bcbc9ad",
             "debian_7.3_mipsel.qcow": "eeb5de0128a95c5f0d76c4f2161afd1bb320d85b"
@@ -139,7 +139,7 @@
         ],
         "qcow": null,
         "default_mem": "1g",
-        "extra_args": "-M malta -kernel /home/jmcleod/.panda/mips32_vmlinux-5.10.7-4kc-malta -net nic,model=pcnet -net user -append \"root=/dev/hda\" -nographic",
+        "extra_args": "-M malta -kernel ~/.panda/mips32_vmlinux-5.10.7-4kc-malta -net nic,model=pcnet -net user -append \"root=/dev/hda\" -nographic",
         "hashes": null
     },
     "mipsel_buildroot5": {
@@ -155,7 +155,7 @@
         ],
         "qcow": null,
         "default_mem": "1g",
-        "extra_args": "-M malta -kernel /home/jmcleod/.panda/mipsel32_vmlinux-5.10.7-4kc-malta-el -net nic,model=pcnet -net user -append \"root=/dev/hda\" -nographic",
+        "extra_args": "-M malta -kernel ~/.panda/mipsel32_vmlinux-5.10.7-4kc-malta-el -net nic,model=pcnet -net user -append \"root=/dev/hda\" -nographic",
         "hashes": null
     },
     "i386_ubuntu_1604": {
@@ -250,7 +250,7 @@
         ],
         "qcow": "arm_wheezy.qcow",
         "default_mem": "128M",
-        "extra_args": "-display none -M versatilepb -append \"root=/dev/sda1\" -kernel /home/jmcleod/.panda/vmlinuz-3.2.0-4-versatile -initrd /home/jmcleod/.panda/initrd.img-3.2.0-4-versatile",
+        "extra_args": "-display none -M versatilepb -append \"root=/dev/sda1\" -kernel ~/.panda/vmlinuz-3.2.0-4-versatile -initrd ~/.panda/initrd.img-3.2.0-4-versatile",
         "hashes": null
     },
     "aarch64": {
@@ -266,7 +266,7 @@
         ],
         "qcow": null,
         "default_mem": "1G",
-        "extra_args": "-nographic -machine virt -cpu cortex-a57 -drive file=/home/jmcleod/.panda/ubuntu20_04-aarch64-flash0.qcow,if=pflash,readonly=on",
+        "extra_args": "-nographic -machine virt -cpu cortex-a57 -drive file=~/.panda/ubuntu20_04-aarch64-flash0.qcow,if=pflash,readonly=on",
         "hashes": null
     },
     "mips": {
@@ -282,7 +282,7 @@
         ],
         "qcow": null,
         "default_mem": "1g",
-        "extra_args": "-M malta -kernel /home/jmcleod/.panda/vmlinux-3.2.0-4-4kc-malta -append \"root=/dev/sda1\" -nographic",
+        "extra_args": "-M malta -kernel ~/.panda/vmlinux-3.2.0-4-4kc-malta -append \"root=/dev/sda1\" -nographic",
         "hashes": null
     },
     "mipsel": {
@@ -298,10 +298,10 @@
         ],
         "qcow": null,
         "default_mem": "1g",
-        "extra_args": "-M malta -kernel /home/jmcleod/.panda/vmlinux-3.2.0-4-4kc-malta.mipsel -append \"root=/dev/sda1\" -nographic",
+        "extra_args": "-M malta -kernel ~/.panda/vmlinux-3.2.0-4-4kc-malta.mipsel -append \"root=/dev/sda1\" -nographic",
         "hashes": {
             "vmlinux-3.2.0-4-4kc-malta": "592e384a4edc16dade52a6cd5c785c637bcbc9ad",
             "debian_7.3_mipsel.qcow": "eeb5de0128a95c5f0d76c4f2161afd1bb320d85b"
         }
     }
-}
\ No newline at end of file
+}
diff --git a/panda/python/core/pandare/qcows_internal.py b/panda/python/core/pandare/qcows_internal.py
index 4f7f1b9b5be..e6f091a8149 100644
--- a/panda/python/core/pandare/qcows_internal.py
+++ b/panda/python/core/pandare/qcows_internal.py
@@ -70,6 +70,15 @@ class Image(namedtuple('Image', ['arch', 'os', 'prompt', 'cdrom', 'snapshot', 'u
     mips64
 """ # TODO: autogenerate values here
 
+home_dir = path.expanduser('~')
+for image in SUPPORTED_IMAGES:
+    SUPPORTED_IMAGES[image] = (
+        SUPPORTED_IMAGES[image]
+            ._replace(
+                extra_args=SUPPORTED_IMAGES[image].extra_args.replace('~', home_dir)
+            )
+    )
+
 class Qcows():
     '''
     Helper library for managing qcows on your filesystem.