Over the past months, we have been reworking our Time Travel Debugging technology in depth. This was not simply an interface refresh or an incremental update to our existing engine. We revisited how execution environments are prepared, how traces are recorded, how analysts navigate billions of instructions, and how AI agents can interact directly with runtime data.

The result is Epoch, our new application for managing and analysing Time Travel Debugging traces.

Available within the esReverse platform, Epoch provides a tool for conducting full-system Time Travel Debugging across multiple types of targets, including Windows, Linux, Android and IoT systems.

Its purpose is straightforward: make advanced dynamic analysis for security analyses easier to operate, more efficient for human analysts, and naturally accessible to agentic AI.

Why create a new tool?

Our previous Time Travel Debugging technology, Reven, demonstrated what becomes possible when an analyst can record a complete system and navigate its execution both forwards and backwards. While this technology has proven its capabilities in complex scenarios like malware analysis, kernel investigation, and driver vulnerability testing, it remains an advanced tool that demands significant expertise, particularly when working across different operating systems.

The changes we wanted to introduce went far beyond an ordinary product update.

We wanted to redesign the complete workflow, from preparing the target environment and recording an execution to exploring the resulting trace with a modern interface or an AI agent. We also wanted the technology to support a broader range of operating systems and architectures, while integrating naturally into collaborative security investigations. All of these modifications were made to simplify the overall analysis workflow and better align with the new era of AI-driven reverse engineering.

The transformation was significant enough to require a new foundation and a new identity.

That foundation is Epoch.

One application, three ambitions

The development of Epoch was driven by three complementary objectives:

1. Make Time Travel Debugging environments easier to prepare and operate.
2. Provide a modern and more efficient interface for analysing execution traces.
3. Turn recorded execution into a resource that AI agents can investigate autonomously.

These ambitions have resulted in several closely integrated components.

Epoch Studio: making recording more accessible

Full-system Time Travel Debugging requires more than attaching a debugger to a process.

The complete environment must be prepared, the target operating system must be configured, and the recording conditions must be controlled. Analysts may need to create several machine states, reproduce a particular scenario or return to a known configuration before starting another experiment.

Epoch Studio provides the interface for managing this part of the workflow.

From Epoch Studio, analysts can manage virtual machines running systems such as Windows or Linux, prepare target environments, create snapshots and control the recording process. We took a specific care to unify the user experience regardless the system, either Windows, Linux or Android.

This reduces the operational complexity surrounding Time Travel Debugging. Instead of assembling and maintaining a fragmented collection of virtualisation, instrumentation and recording tools, the analyst can manage the experiment from a single environment.

The objective is not to hide the technical depth of full-system analysis. It is to make it as easy as possible.

Epoch Analysis: navigating execution more efficiently

Once an execution has been recorded, the challenge changes.

A full-system trace can contain billions of executed instructions, covering application code, shared libraries, system services and kernel activity. The analyst needs an efficient way to move through this data, inspect machine states and identify the events that matter.

Epoch Analysis is the new interface designed for this work.

It provides a modern environment for navigating execution forwards and backwards, inspecting instructions, registers and memory, and following the behaviour of the system throughout the recording.

Its architecture is designed to remain flexible. Time Travel Debugging investigations rarely follow a fixed sequence of steps. Analysts move between hypotheses, search for runtime artefacts, inspect different processes and correlate events occurring at different levels of the system.

Epoch Analysis supports this exploratory workflow while providing a clearer and more efficient way to interact with large traces. In addition to core features that established REVEN's success, such as memory history, taint analysis, full trace memory search, scripting, etc. several new capabilities have been introduced or are in development, including register history, an optimized API, simplified extraction of API calls and network packets, etc. All of these features are just a small portion of the new ones that will be released in the coming months; the most exciting, however, is its new integration with AI.

Turning dynamic analysis into an AI problem

The third ambition behind Epoch is perhaps the most transformative: making Time Travel Debugging available to AI agents.

Dynamic analysis is traditionally difficult to automate with AI. A live system constantly changes, execution may not be deterministic, and the volume of runtime information grows rapidly. This leads to overwhelm the agent context, which quickly finds limitations. An agent must control an experiment while simultaneously deciding what information to collect and interpret.

Time Travel Debugging changes the nature of the problem.

Once the execution has been recorded, it becomes a persistent and reproducible dataset. The agent no longer needs to reproduce the behaviour or anticipate where to place a breakpoint. It can query what actually happened, inspect the system at any point in time and revisit earlier states whenever necessary. The huge amount of information was previously a drawback, it is now an asset.

We discussed this approach in Turning Dynamic Analysis into an AI Problem. By converting runtime execution into structured, stable data, Time Travel Debugging makes dynamic behaviour significantly more accessible to agentic exploration.

Epoch exposes its analysis capabilities through MCP tools. An AI agent can search runtime strings, inspect executed instructions, examine register states, read memory and follow accesses to specific data throughout the trace. We could experiment by solving our internal challenge in only 6 mns with the AI agent exploring our TTD trace, while the best experts solved it in approximately 2 hours.

The agent is not merely commenting on results produced by the analyst. It interacts directly with the execution data and progressively builds its own investigation. And soon, the agent will be able to automate the whole workflow.

From billions of instructions to meaningful events

Our recent experiments demonstrate how far this approach can go. Epoch provides the technical bridge between the AI agent and the recorded execution.

In one investigation, an AI agent explored a seven-billion-instruction ARM64 trace of Telegram running on Android. Starting with no detailed knowledge of the recorded scenario, the agent identified the application’s different activities, including encrypted message processing, notification handling, database operations and image conversion.

The analysis is described in Navigating a 7-Billion-Instruction Telegram TTD Trace with an AI Agent.

The important point is not only that the agent found a cryptographic operation. It was able to navigate an extremely large full-system trace, construct hypotheses, gather evidence and associate low-level events with the application’s observable behaviour.

Once the trace available, there is no limit in the investigations, like finding root detections in a mobile applications or exploring all calls of cryptographics operations in a process:

Exploring a binary does no longer require deep reverse engineering skills. This lowers the bar for many analysis. And on the other side, experts may feel a more powerful tool, since the large amount of information is present in the trace, which lets them many possibilities for investigations.  

Enriching traces with symbols and contextual information

The quality of an AI analysis depends heavily on the information available to the agent.

The more context the trace contains, the more efficiently the agent can reason about the execution. Raw instructions and memory states already provide strong evidence, but symbols and additional metadata considerably accelerate the investigation.

Epoch now supports symbol information, enriching traces with names and contextual elements that help both human analysts and AI agents understand what they are observing.

This does not replace the underlying execution evidence. Instead, it gives the agent more meaningful reference points from which to explore the trace, correlate events and explain its findings.

As Epoch evolves, we intend to continue increasing the amount of structured information that can be made available during an investigation.

Annotating the execution timeline

Epoch also introduces the ability to tag points of interest within a trace.

A tag can mark an important transition, identify the beginning of a particular activity, record a hypothesis or associate an observation with an exact point in the execution timeline.

This creates a particularly useful interaction between analysts and AI agents.

An agent can identify an event and tag its location in the trace. Another agent can then use that tag as the starting point for a separate investigation. A human analyst can review the marked event, challenge the interpretation or add additional context.

The trace progressively becomes more than a recording. It becomes a shared investigation space enriched by both human and machine contributions.

Tags can help divide complex analyses into specialised tasks. One agent may identify cryptographic operations, another may follow memory accesses, while a third investigates interactions with the operating system. Their findings remain connected to precise and reproducible execution points.

Support for modern operating systems and diverse targets

The technology underlying Epoch has also been significantly improved.

Epoch is designed to support recent Windows and Linux environments, together with Android and more constrained IoT targets. This reflects the reality of modern security investigations, where the relevant behaviour rarely remains confined to a single application or execution layer. It works well on the Windows11 system as well as on the latest Debian distributions.

A vulnerability may involve userland code, a shared library, a system service and the kernel. Malware may interact with several processes before reaching its objective. An Android application may cross Java, native and operating-system boundaries during a single operation.

Full-system recording makes it possible to follow these interactions without losing context as execution moves between components.

Our ambition is to offer the same fundamental Time Travel Debugging workflow across these different environments: prepare the system, record what happened, then investigate the complete execution.

From Reven to Epoch

Epoch succeeds Reven, our previous Time Travel Debugging application.

All customers who currently have access to Reven will automatically receive Epoch through their esReverse platform. This transition preserves access to our Time Travel Debugging capabilities while introducing the new recording, analysis and agentic workflows.

Reven established our expertise in full-system execution recording and timeless analysis. Epoch builds on that foundation while opening a new phase for the technology.

A new foundation for dynamic investigations

Epoch represents an important evolution of our approach to software security analysis.

It makes full-system recording easier to manage through Epoch Studio. It provides a modern environment for exploring traces through Epoch Analysis. Most importantly, it transforms execution traces into datasets that human analysts and AI agents can investigate together.

Time Travel Debugging already allowed analysts to record first and ask questions later.

With Epoch, those questions can now be asked by an entire team of analysts and specialised AI agents, all working from the same reproducible execution evidence.

This is not simply a new way to use a debugger.

It is a new foundation for dynamic security investigations.

‍

Interested in having a first flavor? Try it for free and without sharing your ID on https://ttd.eshard.com/

‍

Naturally integrated into esReverse

Epoch is not an isolated debugger. It is naturally integrated into the esReverse software security investigation platform.

Each investigation can be organised as an esReverse project containing its traces, datasets, tools, notebooks, configurations and findings. Epoch can therefore be combined with other reverse engineering and security analysis tools without forcing the analyst into a closed workflow.

A project may combine Time Travel Debugging with static analysis, binary emulation, scripting, custom utilities or organisation-specific tools. Analysts can preserve the complete investigation environment and share it with other members of the team.

This integration also makes agentic analysis a natural part of the workflow. AI agents can operate within the same project environment, access the tools made available to them and contribute their findings alongside human analysts.

There is no fixed limit to how Epoch can be integrated into an investigation. Its role can range from answering a precise runtime question to becoming the central source of evidence for a complete security assessment.

On-premises and private AI deployments

Security investigations frequently involve sensitive binaries, proprietary software, malware samples or confidential customer data.

For these situations, esReverse and Epoch can be deployed on premises. The analysis environment, execution traces and investigation data remain within the organisation’s own infrastructure.

Agentic capabilities can also be connected to private language models. Organisations can therefore take advantage of AI-assisted Time Travel Debugging without transferring their investigation data to an external service.

This is an essential part of our approach. Agentic analysis should not require teams to compromise the confidentiality of the software they are investigating.

More information about the platform and its deployment options is available on the esReverse page.