Feat: add 64 bit .NET clr.dll profile (#1197)

* add 64bit clr.dll profile

* Add compatibility check if current Drakvuf version supports --json-clr-64

---------

Co-authored-by: Pawel Solowiej <[email protected]>
Co-authored-by: psrok1 <[email protected]>

drakrun/analyzer/analyzer.py

@@ -381,12 +381,13 @@ def analyze_file(
                     enabled=(not options.no_screenshotter),
                 ),
                 run_drakvuf(
-                    vm.vm_name,
-                    vmi_info,
-                    kernel_profile_path,
-                    drakmon_file,
-                    drakvuf_err_file,
-                    drakvuf_args,
+                    vm_name=vm.vm_name,
+                    vmi_info=vmi_info,
+                    kernel_profile_path=kernel_profile_path,
+                    output_file=drakmon_file,
+                    output_err_file=drakvuf_err_file,
+                    drakvuf_args=drakvuf_args,
+                    drakvuf_version_info=drakvuf_version_info,
                     exec_parameters=exec_parameters,
                     drakvuf_cwd=output_dir,
                 ) as drakvuf,

drakrun/analyzer/run_tools.py

@@ -14,6 +14,7 @@ from drakrun.lib.install_info import InstallInfo
 from drakrun.lib.libvmi import VmiInfo
 from drakrun.lib.network_info import NetworkInfo
 from drakrun.lib.networking import start_tcpdump_collector
+from drakrun.lib.version_detection import DrakvufVersionInfo
 from drakrun.lib.vm import VirtualMachine
 
 logger = logging.getLogger(__name__)
@@ -76,13 +77,15 @@ def run_drakvuf(
     output_file: pathlib.Path,
     output_err_file: pathlib.Path,
     drakvuf_args: List[str],
+    drakvuf_version_info: DrakvufVersionInfo,
     exec_parameters: Optional[ExecParameters] = None,
     drakvuf_cwd: Optional[pathlib.Path] = None,
 ):
     drakvuf_cmdline = get_base_drakvuf_cmdline(
         vm_name,
         kernel_profile_path,
-        vmi_info,
+        vmi_info=vmi_info,
+        drakvuf_version_info=drakvuf_version_info,
         extra_args=drakvuf_args,
         **(
             dict(

drakrun/cli/drakvuf_cmdline.py

@@ -44,9 +44,9 @@ def drakvuf_cmdline(vm_id, cmd, method, working_dir):
 
     vm = VirtualMachine(vm_id, install_info, config.network)
     vmi_info = VmiInfo.load(VMI_INFO_PATH)
+    drakvuf_version_info = get_drakvuf_version()
     if cmd is not None:
-        drakvuf_version = get_drakvuf_version()
-        supports_shellexec = drakvuf_version.supports_shellexec_verb
+        supports_shellexec = drakvuf_version_info.supports_shellexec_verb
         exec_parameters = make_exec_parameters(
             cmd, method, working_dir, supports_shellexec
         )
@@ -58,6 +58,7 @@ def drakvuf_cmdline(vm_id, cmd, method, working_dir):
                 vm.vm_name,
                 VMI_KERNEL_PROFILE_PATH.as_posix(),
                 vmi_info=vmi_info,
+                drakvuf_version_info=drakvuf_version_info,
                 **(
                     dict(
                         exec_cmd=exec_parameters.command,

drakrun/cli/version.py

@@ -26,6 +26,7 @@ def version():
     log.info(
         " - ShellExecute verb support: %s", drakvuf_version.supports_shellexec_verb
     )
+    log.info(" - 64-bit clr.dll profile support: %s", drakvuf_version.supports_clr64)
 
     if not is_drakvuf_supported(drakvuf_version):
         log.warning(

drakrun/lib/drakvuf_cmdline.py

@@ -1,12 +1,14 @@
 from typing import List, Optional
 
 from .libvmi import VmiInfo, get_dll_cmdline_args
+from .version_detection import DrakvufVersionInfo
 
 
 def get_base_drakvuf_cmdline(
     vm_name: str,
     kernel_profile_path: str,
     vmi_info: VmiInfo,
+    drakvuf_version_info: DrakvufVersionInfo,
     exec_cmd: Optional[str] = None,
     shellexec_args: Optional[str] = None,
     start_method: Optional[str] = None,
@@ -26,7 +28,7 @@ def get_base_drakvuf_cmdline(
         "-d",
         vm_name,
     ]
-    args.extend(get_dll_cmdline_args())
+    args.extend(get_dll_cmdline_args(drakvuf_version_info))
     if exec_cmd is not None:
         if start_method == "createproc":
             exec_args = ["-m", "createproc", "-e", exec_cmd]

drakrun/lib/libvmi/dlls.py

@@ -1,6 +1,7 @@
 from typing import NamedTuple, Optional
 
 from ..paths import VMI_PROFILES_DIR
+from ..version_detection import DrakvufVersionInfo
 
 DLL = NamedTuple("DLL", [("path", str), ("dest", str), ("arg", Optional[str])])
 
@@ -35,6 +36,11 @@ optional_dll_file_list = [
         "native_clr_profile",
         "--json-clr",
     ),
+    DLL(
+        "Windows/Microsoft.NET/Framework64/v4.0.30319/clr.dll",
+        "native_clr_profile_64",
+        "--json-clr-64",
+    ),
     DLL(
         "Windows/Microsoft.NET/Framework/v2.0.50727/mscorwks.dll",
         "native_mscorwks_profile",
@@ -45,10 +51,14 @@ optional_dll_file_list = [
 dll_file_list = required_dll_file_list + optional_dll_file_list
 
 
-def get_dll_cmdline_args():
+def get_dll_cmdline_args(drakvuf_version_info: DrakvufVersionInfo | None = None):
     args = []
     for dll in dll_file_list:
         dll_profile_path = VMI_PROFILES_DIR / f"{dll.dest}.json"
         if dll_profile_path.exists():
+            if dll.arg == "--json-clr-64" and (
+                not drakvuf_version_info or not drakvuf_version_info.supports_clr64
+            ):
+                continue
             args.extend([dll.arg, dll_profile_path.as_posix()])
     return args

drakrun/lib/version_detection.py

@@ -13,6 +13,8 @@ class DrakvufVersionInfo:
 
     # https://github.com/tklengyel/drakvuf/commit/51aef99281e5abc43a7d24b7e548b68b1bdcaf32
     supports_shellexec_verb: bool
+    # https://github.com/tklengyel/drakvuf/commit/8107f115d35311d483e314f48c3b172e094ec6e9
+    supports_clr64: bool
     debug_build: bool
 
 
@@ -43,12 +45,14 @@ def get_drakvuf_version() -> DrakvufVersionInfo:
         )
 
     supports_shellexec_verb = "-V <shellexec verb>" in help_string
+    supports_clr64 = "--json-clr-64 <path to json>" in help_string
     debug_build = "-v, --verbose" in help_string
     return DrakvufVersionInfo(
         major=major,
         minor=minor,
         build=build,
         supports_shellexec_verb=supports_shellexec_verb,
+        supports_clr64=supports_clr64,
         debug_build=debug_build,
     )