diff --git a/core/experiments/weathermonitor/experiment.cc b/core/experiments/weathermonitor/experiment.cc
index a00df6f1..4228b133 100644
--- a/core/experiments/weathermonitor/experiment.cc
+++ b/core/experiments/weathermonitor/experiment.cc
@@ -51,7 +51,54 @@ bool WeathermonitorExperiment::run()
 	assert(sal::simulator.getRegisterManager().getInstructionPointer() == WEATHER_FUNC_MAIN);
 #elif 0
 	// STEP 2: record trace for fault-space pruning
-	// XXX
+	log << "restoring state" << endl;
+	sal::simulator.restore(statename);
+	log << "EIP = " << std::hex << sal::simulator.getRegisterManager().getInstructionPointer() << endl;
+	assert(sal::simulator.getRegisterManager().getInstructionPointer() == WEATHER_FUNC_MAIN);
+
+	log << "enabling tracing" << endl;
+	TracingPlugin tp;
+
+	// restrict memory access logging to injection target
+	MemoryMap mm;
+	mm.add(WEATHER_DATA_START, WEATHER_DATA_END - WEATHER_DATA_START);
+	tp.restrictMemoryAddresses(&mm);
+	//tp.setLogIPOnly(true);
+
+	// record trace
+	Trace trace;
+	tp.setTraceMessage(&trace);
+
+	// this must be done *after* configuring the plugin:
+	sal::simulator.addFlow(&tp);
+
+	bp.setWatchInstructionPointer(fi::ANY_ADDR);
+	bp.setCounter(WEATHER_NUMINSTR);
+	sal::simulator.addEvent(&bp);
+	fi::BPEvent func_temp_measure(WEATHER_FUNC_TEMP_MEASURE);
+	sal::simulator.addEvent(&func_temp_measure);
+
+	int count_temp_measure;
+	for (count_temp_measure = 0; sal::simulator.waitAny() == &func_temp_measure;
+	     ++count_temp_measure) {
+		log << "experiment reached Temperature::measure()" << endl;
+		sal::simulator.addEvent(&func_temp_measure);
+	}
+	log << "experiment finished after " << std::dec << WEATHER_NUMINSTR << " instructions" << endl;
+	log << "Temperature::measure() was called " << count_temp_measure << " times" << endl;
+
+	sal::simulator.removeFlow(&tp);
+
+	// serialize trace to file
+	char const *tracefile = "trace.pb";
+	std::ofstream of(tracefile);
+	if (of.fail()) {
+		log << "failed to write " << tracefile << endl;
+		return false;
+	}
+	trace.SerializeToOstream(&of);
+	of.close();
+	log << "trace written to " << tracefile << endl;
 
 #elif 0
 	// STEP 3: The actual experiment.
diff --git a/core/experiments/weathermonitor/experimentInfo.hpp b/core/experiments/weathermonitor/experimentInfo.hpp
index 3a8d062c..233e6287 100644
--- a/core/experiments/weathermonitor/experimentInfo.hpp
+++ b/core/experiments/weathermonitor/experimentInfo.hpp
@@ -1,7 +1,7 @@
 #ifndef __WEATHERMONITOR_EXPERIMENT_INFO_HPP__
 #define __WEATHERMONITOR_EXPERIMENT_INFO_HPP__
 
-// FIXME autogenerate this
+// autogenerated, don't edit!
 
 #define GUARDED_WEATHERMONITOR 0
 
@@ -9,24 +9,25 @@
 
 // main() address:
 // nm -C vanilla.elf|fgrep main
-#define WEATHER_FUNC_MAIN			0x001010b0
+#define WEATHER_FUNC_MAIN			0x00100f50
 // Temperature::measure() address:
 // nm -C vanilla.elf|fgrep 'Temperature::measure()'
-#define WEATHER_FUNC_TEMP_MEASURE	0x00100f10
+#define WEATHER_FUNC_TEMP_MEASURE	0x001010f0
 // number of instructions we want to observe
-#define WEATHER_NUMINSTR			10000
+// 20k suffices for 4 measure() calls; we can do more later (without really learning more?)
+#define WEATHER_NUMINSTR			20000
 // data/BSS begin:
 // nm -C vanilla.elf|fgrep ___DATA_START__
-#define WEATHER_DATA_START			0x00101c34
+#define WEATHER_DATA_START			0x00102304
 // data/BSS end:
 // nm -C vanilla.elf|fgrep ___BSS_END__
-#define WEATHER_DATA_END			0x00103529
+#define WEATHER_DATA_END			0x00103bf4
 // text begin:
 // nm -C vanilla.elf|fgrep ___TEXT_START__
 #define WEATHER_TEXT_START			0x00100000
 // text end:
 // nm -C vanilla.elf|fgrep ___TEXT_END__
-#define WEATHER_TEXT_END			0x00101a5b
+#define WEATHER_TEXT_END			0x0010212b
 
 #else // with guards
 
diff --git a/core/experiments/weathermonitor/experimentInfo.hpp.sh b/core/experiments/weathermonitor/experimentInfo.hpp.sh
new file mode 100755
index 00000000..eca06630
--- /dev/null
+++ b/core/experiments/weathermonitor/experimentInfo.hpp.sh
@@ -0,0 +1,47 @@
+#!/bin/bash
+set -e
+
+[ ! -e "$1" -o ! -e "$2" ] && echo "usage: $0 vanilla.elf guarded.elf" && exit 1
+
+function addrof() { nm -C $1 | fgrep "$2" | awk '{print $1}'; }
+
+cat >experimentInfo.hpp <<EOF
+#ifndef __WEATHERMONITOR_EXPERIMENT_INFO_HPP__
+#define __WEATHERMONITOR_EXPERIMENT_INFO_HPP__
+
+// autogenerated, don't edit!
+
+#define GUARDED_WEATHERMONITOR 0
+
+#if !GUARDED_WEATHERMONITOR // without vptr guards
+
+// main() address:
+// nm -C vanilla.elf|fgrep main
+#define WEATHER_FUNC_MAIN			0x`addrof $1 main`
+// Temperature::measure() address:
+// nm -C vanilla.elf|fgrep 'Temperature::measure()'
+#define WEATHER_FUNC_TEMP_MEASURE	0x`addrof $1 'Temperature::measure()'`
+// number of instructions we want to observe
+// 20k suffices for 4 measure() calls; we can do more later (without really learning more?)
+#define WEATHER_NUMINSTR			20000
+// data/BSS begin:
+// nm -C vanilla.elf|fgrep ___DATA_START__
+#define WEATHER_DATA_START			0x`addrof $1 ___DATA_START__`
+// data/BSS end:
+// nm -C vanilla.elf|fgrep ___BSS_END__
+#define WEATHER_DATA_END			0x`addrof $1 ___BSS_END__`
+// text begin:
+// nm -C vanilla.elf|fgrep ___TEXT_START__
+#define WEATHER_TEXT_START			0x`addrof $1 ___TEXT_START__`
+// text end:
+// nm -C vanilla.elf|fgrep ___TEXT_END__
+#define WEATHER_TEXT_END			0x`addrof $1 ___TEXT_END__`
+
+#else // with guards
+
+// XXX
+
+#endif
+
+#endif
+EOF