diff --git a/internal/prettylog/prettylog.go b/internal/prettylog/prettylog.go
index b642138..961da03 100644
--- a/internal/prettylog/prettylog.go
+++ b/internal/prettylog/prettylog.go
@@ -25,6 +25,7 @@ package prettylog
 
 import (
 	"bytes"
+	"encoding/base64"
 	"encoding/json"
 	"fmt"
 	"io"
@@ -225,6 +226,12 @@ func (w Writer) writeFields(evt map[string]interface{}, buf *bytes.Buffer) {
 
 		switch value := evt[field].(type) {
 		case string:
+			if strings.HasPrefix(value, "base64:") {
+				bytes, err := base64.StdEncoding.AppendDecode(nil, []byte(value[len("base64:"):]))
+				if err == nil {
+					value = string(bytes)
+				}
+			}
 			if needsQuote(value) {
 				buf.WriteString(w.formatter.fieldValue(field, strconv.Quote(value)))
 			} else {
diff --git a/internal/simulation/os_linux.go b/internal/simulation/os_linux.go
index f028dc4..b5859a5 100644
--- a/internal/simulation/os_linux.go
+++ b/internal/simulation/os_linux.go
@@ -169,7 +169,6 @@ func RawSyscall6(trap, a1, a2, a3, a4, a5, a6 uintptr) (r1, r2 uintptr, err sysc
 		panic("syscall should have been rewritten somewhere")
 	}
 
-	// TODO: test this
 	logf("unsupported syscall %s (%d) %d %d %d %d %d %d", SyscallName(trap), trap, a1, a2, a3, a4, a5, a6)
 
 	return 0, 0, syscall.ENOSYS
diff --git a/internal/tests/behavior/log_meta_test.go b/internal/tests/behavior/log_meta_test.go
index 5d1467e..7c13cec 100644
--- a/internal/tests/behavior/log_meta_test.go
+++ b/internal/tests/behavior/log_meta_test.go
@@ -5,6 +5,7 @@ package behavior_test
 import (
 	"bytes"
 	"encoding/json"
+	"fmt"
 	"strings"
 	"testing"
 
@@ -124,6 +125,19 @@ func TestLogDuringInit(t *testing.T) {
 	}
 }
 
+func formatLogsWithExtra(logs []*gosimlog.Log) []string {
+	// TODO: share this code with prettylog somehow?
+	var lines []string
+	for _, log := range logs {
+		line := fmt.Sprintf("%d %s/%d %s %s", log.Step, log.Machine, log.Goroutine, log.Level, log.Msg)
+		for _, kv := range log.Unknown {
+			line += fmt.Sprintf(" %s=%s", kv.Key, kv.Value)
+		}
+		lines = append(lines, line)
+	}
+	return lines
+}
+
 func TestLogTraceSyscall(t *testing.T) {
 	if race.Enabled {
 		// TODO: repair, which will need a reasonable plan for printing data
@@ -155,20 +169,17 @@ func TestLogTraceSyscall(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	// TODO: make sure we check traceKind?
 	// TODO: support snapshotting these logs?
-	// TODO: include machine etc.?
-	if diff := cmp.Diff(metatesting.SimplifyParsedLog(metatesting.ParseLog(run.LogOutput)), []string{
-		"INFO unsupported syscall unknown (9999) 0 0 0 0 0 0",
-		// TODO: check flags
-		"INFO call SysOpenat",
-		"INFO ret  SysOpenat",
-		"INFO call SysFcntl",
-		"INFO ret  SysFcntl",
-		"INFO call SysWrite",
-		"INFO ret  SysWrite",
-		"INFO call SysClose",
-		"INFO ret  SysClose",
+	if diff := cmp.Diff(formatLogsWithExtra(gosimlog.ParseLog(run.LogOutput)), []string{
+		"1 main/4 INFO unsupported syscall unknown (9999) 0 0 0 0 0 0",
+		`2 main/4 INFO call SysOpenat dirfd="AT_FDCWD" path="hello" flags="O_WRONLY|O_TRUNC|O_CREAT|O_CLOEXEC" mode="0o644"`,
+		"3 main/4 INFO ret  SysOpenat fd=5 err=null",
+		"4 main/4 INFO call SysFcntl",
+		"5 main/4 INFO ret  SysFcntl",
+		`6 main/4 INFO call SysWrite fd=5 p="world"`,
+		"7 main/4 INFO ret  SysWrite n=5 err=null",
+		"8 main/4 INFO call SysClose fd=5",
+		"9 main/4 INFO ret  SysClose err=null",
 	}); diff != "" {
 		t.Error("diff", diff)
 	}
diff --git a/internal/tests/behavior/log_test.go b/internal/tests/behavior/log_test.go
index 57412da..9aa6f05 100644
--- a/internal/tests/behavior/log_test.go
+++ b/internal/tests/behavior/log_test.go
@@ -92,6 +92,7 @@ func TestLogDuringInit(t *testing.T) {
 
 func TestLogTraceSyscall(t *testing.T) {
 	// should print ENOSYS
+	// TODO: test this with a known number and make it work both on arm64 and amd64
 	syscall.Syscall(9999, 0, 0, 0)
 
 	// should print open, write, close