On: F-Secure has open-sourced its Sandboxed Execution ...

[vill1]

Maybe the biggest advantage is the plugin system and how those can be hooked to the execution. Developer focuses on writing a LEGO brick that can be used as a part of execution. Also different plugins do not need to care about existence of other plugins, but on the other hand those plugins can be chained by firing and listening to events.

[eugenekolo → vill1]

Cuckoo supports plugins too, I wrote up a summary of them here: https://www.eugenekolo.com/blog/cuckoo-sandbox-notes/#div_cu.... Can also edit the Analyzer/monitor part to add in new function hooks.