cuckoosandbox/cuckoo
1
0
Fork 0
mirror of https://github.com/cuckoosandbox/cuckoo.git synced 2026-10-11 21:59:53 +00:00
Code Issues Packages Projects Releases Wiki Activity

various minor tweaks

Browse Source
This commit is contained in:
Jurriaan Bremer
2017-07-12 16:35:52 +02:00
parent ecfb4db363
commit d39076b2cf
10 changed files with 128 additions and 110 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cuckoo/compat/config.py
+3 -7
View File
@@ -683,13 +683,9 @@ def _201_202(c):
return c
def _203_204(c):
machineries = (
"qemu",
)
for machinery in machineries:
for machine in c[machinery][machinery]["machines"]:
c[machinery][machine]["snapshot"] = None
c[machinery][machine]["enable_kvm"] = False
for machine in c["qemu"]["qemu"]["machines"]:
c["qemu"][machine]["snapshot"] = None
c["qemu"][machine]["enable_kvm"] = False
return c
migrations = {
cuckoo/core/guest.py
+6 -2
View File
@@ -349,10 +349,14 @@ class GuestManager(object):
self.analyzer_path = r.json()["dirpath"]
def determine_system_drive(self):
return "%s/" % self.environ["SYSTEMDRIVE"] if self.platform == "windows" else "/"
if self.platform == "windows":
return "%s/" % self.environ["SYSTEMDRIVE"]
return "/"
def determine_temp_path(self):
return self.environ["TEMP"] if self.platform == "windows" else "/tmp"
if self.platform == "windows":
return self.environ["TEMP"]
return "/tmp"
def upload_analyzer(self, monitor):
"""Upload the analyzer to the Virtual Machine."""
cuckoo/data/analyzer/linux/analyzer.py
+17 -9
View File
@@ -1,4 +1,4 @@
# Copyright (C) 2014-2016 Cuckoo Foundation.
# Copyright (C) 2015-2017 Cuckoo Foundation.
# This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
# See the file 'docs/LICENSE' for copying permission.
@@ -35,12 +35,13 @@ PPID = Process(pid=PID).get_parent_pid()
def add_pids(pids):
"""Add PID."""
if not isinstance(pids, (tuple, list, set)):
pids = [pids,]
pids = [pids]
for pid in pids:
log.info("Added new process to list with pid: %s", pid)
pid = int(pid)
if not pid in SEEN_LIST: PROCESS_LIST.add(pid)
if pid not in SEEN_LIST:
PROCESS_LIST.add(pid)
SEEN_LIST.add(pid)
def dump_files():
@@ -283,17 +284,19 @@ class Analyzer:
except Exception as e:
log.warning("The package \"%s\" finish function raised an "
"exception: %s", package_name, e)
try:
# Upload files the package created to package_files in the results folder
package_files = pack.package_files()
if package_files != None:
if package_files is not None:
for package in package_files:
upload_to_host(package[0], os.path.join("package_files", package[1]));
upload_to_host(
package[0], os.path.join("package_files", package[1])
)
except Exception as e:
log.warning("The package \"%s\" package_files function raised an "
"exception: %s", package_name, e)
# Terminate the Auxiliary modules.
for aux in sorted(aux_enabled, key=lambda x: x.priority):
try:
@@ -370,5 +373,10 @@ if __name__ == "__main__":
server.complete(success, error, PATHS["root"])
except xmlrpclib.ProtocolError:
# new agent
data = { "status": "complete", "description": success }
urllib2.urlopen("http://127.0.0.1:8000/status", urllib.urlencode(data))
data = {
"status": "complete",
"description": success
}
urllib2.urlopen(
"http://127.0.0.1:8000/status", urllib.urlencode(data)
)
cuckoo/machinery/qemu.py
+13 -6
View File
@@ -145,20 +145,27 @@ class QEMU(Machinery):
if vm_options.snapshot:
snapshot_path = vm_options.image
else:
snapshot_name = "snapshot_" + vm_info.name
snapshot_path = "%s/%s" % (os.path.dirname(vm_options.image), os.path.basename(snapshot_name)) + ".qcow2"
snapshot_path = os.path.join(
os.path.dirname(vm_options.image),
"snapshot_%s.qcow2" % vm_info.name
)
if os.path.exists(snapshot_path):
os.remove(snapshot_path)
# make sure we use a new harddisk layer by creating a new qcow2 with backing file
# make sure we use a new harddisk layer by creating a new
# qcow2 with backing file
try:
proc = subprocess.Popen([self.qemu_img, "create", "-f", "qcow2", "-b", vm_options.image, snapshot_path],
stdout=subprocess.PIPE, stderr=subprocess.PIPE)
proc = subprocess.Popen([
self.qemu_img, "create", "-f", "qcow2",
"-b", vm_options.image, snapshot_path
], stdout=subprocess.PIPE, stderr=subprocess.PIPE)
output, err = proc.communicate()
if err:
raise OSError(err)
except OSError as e:
raise CuckooMachineError("QEMU failed starting the machine: %s" % e)
raise CuckooMachineError(
"QEMU failed starting the machine: %s" % e
)
vm_arch = getattr(vm_options, "arch", "default")
arch_config = dict(QEMU_ARGS[vm_arch])
cuckoo/processing/platform/linux.py
+7 -8
View File
@@ -1,15 +1,13 @@
# Copyright (C) 2010-2013 Claudio Guarnieri.
# Copyright (C) 2014-2016 Cuckoo Foundation.
# Copyright (C) 2015-2017 Cuckoo Foundation.
# This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
# See the file 'docs/LICENSE' for copying permission.
import datetime
import dateutil.parser
import os
import logging
import datetime
import re
import dateutil.parser
from cuckoo.common.abstracts import BehaviorHandler
log = logging.getLogger(__name__)
@@ -32,7 +30,8 @@ class FilteredProcessLog(list):
return True
class LinuxSystemTap(BehaviorHandler):
"""Parses systemtap generated plaintext logs (see stuff/systemtap/strace.stp)."""
"""Parses systemtap generated plaintext logs (see
stuff/systemtap/strace.stp)."""
key = "processes"
@@ -112,7 +111,7 @@ class StapParser(object):
dtms = datetime.timedelta(0, 0, int(datetimepart.split(".", 1)[1]))
dt = dateutil.parser.parse(datetimepart.split(".", 1)[0]) + dtms
parts = list()
parts = []
for delim in ("@", "[", "]", "(", ")", "= ", " (", ")"):
part, _, r = r.strip().partition(delim)
parts.append(part)
@@ -162,4 +161,4 @@ class StapParser(object):
return arg.startswith("[") and not arg.startswith("[/*")
def is_string(self, arg):
return arg.startswith("\"") and arg.endswith("\"")
return arg.startswith("\"") and arg.endswith("\"")
cuckoo/processing/static.py
+34 -25
View File
@@ -37,13 +37,7 @@ from cuckoo.common.utils import convert_to_printable, to_unicode, jsbeautify
from cuckoo.compat import magic
from cuckoo.misc import cwd, dispatch, Structure
from elftools.elf.elffile import ELFFile
from elftools.elf.constants import E_FLAGS
from elftools.elf.enums import ENUM_D_TAG
from elftools.elf.dynamic import DynamicSection
from elftools.elf.relocation import RelocationSection
from elftools.elf.sections import SymbolTableSection
from elftools.elf.segments import NoteSegment
from elftools.elf.descriptions import (
describe_ei_class, describe_ei_data, describe_ei_version,
describe_ei_osabi, describe_e_type, describe_e_machine,
@@ -51,6 +45,12 @@ from elftools.elf.descriptions import (
describe_sh_type, describe_dyn_tag, describe_symbol_type,
describe_symbol_bind, describe_note, describe_reloc_type
)
from elftools.elf.dynamic import DynamicSection
from elftools.elf.elffile import ELFFile
from elftools.elf.enums import ENUM_D_TAG
from elftools.elf.relocation import RelocationSection
from elftools.elf.sections import SymbolTableSection
from elftools.elf.segments import NoteSegment
log = logging.getLogger(__name__)
@@ -752,10 +752,6 @@ class LnkShortcut(object):
extra, ret["icon"] = self.read_string16(extra)
return ret
def _pdf_worker(filepath):
return PdfDocument(filepath).run()
class ELF(object):
def __init__(self, file_path):
self.file_path = file_path
@@ -772,8 +768,7 @@ class ELF(object):
self.result["symbol_tables"] = self._get_symbol_tables()
self.result["relocations"] = self._get_relocations()
self.result["notes"] = self._get_notes()
# TODO: add library name per import
# https://github.com/cuckoosandbox/cuckoo/pull/807/files#diff-033aeda7c00b458591305630264df6d3R604
# TODO: add library name per import (see #807)
except Exception as e:
log.exception(e)
@@ -802,7 +797,7 @@ class ELF(object):
"number_of_program_headers": self.elf.header["e_phnum"],
"size_of_section_headers": self.elf.header["e_shentsize"],
"number_of_section_headers": self.elf.header["e_shnum"],
"section_header_string_table_index": self.elf.header["e_shstrndx"]
"section_header_string_table_index": self.elf.header["e_shstrndx"],
}
def _get_section_headers(self):
@@ -812,7 +807,7 @@ class ELF(object):
"name": section.name,
"type": describe_sh_type(section["sh_type"]),
"addr": self._print_addr(section["sh_addr"]),
"size": section["sh_size"]
"size": section["sh_size"],
})
return section_headers
@@ -823,36 +818,44 @@ class ELF(object):
"type": describe_p_type(segment["p_type"]),
"addr": self._print_addr(segment["p_vaddr"]),
"flags": describe_p_flags(segment["p_flags"]).strip(),
"size": segment["p_memsz"]
"size": segment["p_memsz"],
})
return program_headers
def _get_dynamic_tags(self):
dynamic_tags = []
for section in [section for section in self.elf.iter_sections() if isinstance(section, DynamicSection)]:
for section in self.elf.iter_sections():
if not isinstance(section, DynamicSection):
continue
for tag in section.iter_tags():
dynamic_tags.append({
"tag": self._print_addr(ENUM_D_TAG.get(tag.entry.d_tag, tag.entry.d_tag)),
"tag": self._print_addr(
ENUM_D_TAG.get(tag.entry.d_tag, tag.entry.d_tag)
),
"type": tag.entry.d_tag[3:],
"value": self._parse_tag(tag)
"value": self._parse_tag(tag),
})
return dynamic_tags
def _get_symbol_tables(self):
symbol_tables = []
for section in [section for section in self.elf.iter_sections() if isinstance(section, SymbolTableSection)]:
for section in self.elf.iter_sections():
if not isinstance(section, SymbolTableSection):
continue
for nsym, symbol in enumerate(section.iter_symbols()):
symbol_tables.append({
"value": self._print_addr(symbol["st_value"]),
"type": describe_symbol_type(symbol["st_info"]["type"]),
"bind": describe_symbol_bind(symbol["st_info"]["bind"]),
"ndx_name": symbol.name
"ndx_name": symbol.name,
})
return symbol_tables
def _get_relocations(self):
relocations = []
for section in [section for section in self.elf.iter_sections() if isinstance(section, RelocationSection)]:
for section in self.elf.iter_sections():
if not isinstance(section, RelocationSection):
continue
section_relocations = []
for rel in section.iter_relocations():
relocation = {
@@ -880,19 +883,23 @@ class ELF(object):
if relocation not in section_relocations:
section_relocations.append(relocation)
relocations.append({"name": section.name, "entries": section_relocations})
relocations.append({
"name": section.name,
"entries": section_relocations,
})
return relocations
def _get_notes(self):
notes = []
for segment in [segment for segment in self.elf.iter_segments() if isinstance(segment, NoteSegment)]:
for segment in self.elf.iter_segments():
if not isinstance(segment, NoteSegment):
continue
for note in segment.iter_notes():
notes.append({
"owner": note["n_name"],
"size": self._print_addr(note["n_descsz"]),
"note": describe_note(note),
"name": note["n_name"]
"name": note["n_name"],
})
return notes
@@ -944,6 +951,8 @@ class ELF(object):
return parsed
def _pdf_worker(filepath):
return PdfDocument(filepath).run()
class Static(Processing):
"""Static analysis."""
tests/test_config.py
+3 -4
View File
@@ -1104,13 +1104,12 @@ arch = x64
)
for machinery in machineries:
Files.create(
cwd("conf"), "%s.conf" % machinery,
"[%s]\nmachines =" % machinery
cwd("conf"), "%s.conf" % machinery, "[%s]\nmachines =" % machinery
)
cfg = Config.from_confdir(cwd("conf"), loose=True)
cfg = migrate(cfg, "2.0.3", "2.0.4")
assert cfg['qemu']['ubuntu32']['enable_kvm'] is False
assert cfg['qemu']['ubuntu32']['snapshot'] is None
assert cfg["qemu"]["ubuntu32"]["enable_kvm"] is False
assert cfg["qemu"]["ubuntu32"]["snapshot"] is None
class FullMigration(object):
DIRPATH = None
tests/test_elf.py
+10 -14
View File
@@ -4,7 +4,6 @@
from cuckoo.processing.static import ELF
def test_elf_static_info():
assert ELF("tests/files/busybox-i686.elf").run() == {
"file_header": {
@@ -26,12 +25,12 @@ def test_elf_static_info():
"start_of_program_headers": 52,
"start_of_section_headers": 898052,
"type": "EXEC (Executable file)",
"version": "0x1"
"version": "0x1",
},
"program_headers": [
{"addr": "0x08048000", "flags": "R E", "size": 896994, "type": "LOAD"},
{"addr": "0x08123000", "flags": "RW", "size": 19012, "type": "LOAD"},
{"addr": "0x00000000", "flags": "RW", "size": 0, "type": "GNU_STACK"}
{"addr": "0x00000000", "flags": "RW", "size": 0, "type": "GNU_STACK"},
],
"section_headers": [
{"addr": "0x00000000", "name": "", "size": 0, "type": "NULL"},
@@ -46,15 +45,14 @@ def test_elf_static_info():
{"addr": "0x08123018", "name": ".got.plt", "size": 12, "type": "PROGBITS"},
{"addr": "0x08123024", "name": ".data", "size": 904, "type": "PROGBITS"},
{"addr": "0x081233b0", "name": ".bss", "size": 18068, "type": "NOBITS"},
{"addr": "0x00000000", "name": ".shstrtab", "size": 86, "type": "STRTAB"}
{"addr": "0x00000000", "name": ".shstrtab", "size": 86, "type": "STRTAB"},
],
"dynamic_tags": [],
"notes": [],
"relocations": [],
"symbol_tables": []
"symbol_tables": [],
}
def test_elf_static_info_tags():
assert ELF("tests/files/ls-x86_64.elf").run()["dynamic_tags"] == [
{"tag": "0x0000000000000001", "type": "NEEDED", "value": "Shared library: [libselinux.so.1]"},
@@ -81,10 +79,9 @@ def test_elf_static_info_tags():
{"tag": "0x000000006ffffffe", "type": "VERNEED", "value": "0x0000000000401720"},
{"tag": "0x000000006fffffff", "type": "VERNEEDNUM", "value": "1"},
{"tag": "0x000000006ffffff0", "type": "VERSYM", "value": "0x000000000040160c"},
{"tag": "0x0000000000000000", "type": "NULL", "value": "0x0000000000000000"}
{"tag": "0x0000000000000000", "type": "NULL", "value": "0x0000000000000000"},
]
def test_elf_static_info_symbols():
assert ELF("tests/files/ls-x86_64.elf").run()["symbol_tables"] == [
{"bind": "LOCAL", "ndx_name": "", "type": "NOTYPE", "value": "0x0000000000000000"},
@@ -223,10 +220,9 @@ def test_elf_static_info_symbols():
{"bind": "GLOBAL", "ndx_name": "_obstack_begin_1", "type": "FUNC", "value": "0x00000000004127a0"},
{"bind": "GLOBAL", "ndx_name": "_obstack_newchunk", "type": "FUNC", "value": "0x00000000004127c0"},
{"bind": "GLOBAL", "ndx_name": "malloc", "type": "FUNC", "value": "0x0000000000402790"},
{"bind": "GLOBAL", "ndx_name": "stdout", "type": "OBJECT", "value": "0x000000000061e608"}
{"bind": "GLOBAL", "ndx_name": "stdout", "type": "OBJECT", "value": "0x000000000061e608"},
]
def test_elf_static_info_notes():
assert ELF("tests/files/ls-x86_64.elf").run()["notes"] == [
{
@@ -241,10 +237,10 @@ def test_elf_static_info_notes():
"note": "NT_GNU_BUILD_ID (unique build ID bitstring)\n" +
" Build ID: eca98eeadafddff44caf37ae3d4b227132861218",
"owner": "GNU",
"size": "0x0000000000000014"}
"size": "0x0000000000000014",
},
]
def test_elf_static_info_relocations():
assert ELF("tests/files/ls-x86_64.elf").run()["relocations"] == [
{
@@ -1087,7 +1083,7 @@ def test_elf_static_info_relocations():
"offset": "0x000000000061e390",
"type": "R_X86_64_JUMP_SLOT",
"value": "0x0000000000000000"
}
},
],
}
},
]
tests/test_qemu.py
+1 -2
View File
@@ -1,4 +1,4 @@
# Copyright (C) 2016-2017 Cuckoo Foundation.
# Copyright (C) 2017 Cuckoo Foundation.
# This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
# See the file 'docs/LICENSE' for copying permission.
@@ -13,7 +13,6 @@ from cuckoo.core.init import write_cuckoo_conf
from cuckoo.machinery.qemu import QEMU
from cuckoo.misc import set_cwd, cwd
class TestQemu(object):
def setup(self):
set_cwd(tempfile.mkdtemp())
tests/test_stap.py
+34 -33
View File
@@ -2,9 +2,9 @@
# This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
# See the file "docs/LICENSE" for copying permission.
from cuckoo.processing.platform.linux import StapParser
import datetime
from cuckoo.processing.platform.linux import StapParser
def test_staplog():
with open("tests/files/stap.log") as fd:
@@ -22,7 +22,7 @@ def test_staplog():
"LANG=en_US.UTF-8",
"SHELL=/bin/sh",
"PWD=/root"
]
],
},
"instruction_pointer": "b774dcf9",
"pid": 680,
@@ -31,7 +31,7 @@ def test_staplog():
"return_value": "-2",
"status": "ENOENT",
"time": datetime.datetime(2017, 6, 19, 16, 58, 31, 445170),
"type": "apicall"
"type": "apicall",
},
{
"api": "brk",
@@ -45,7 +45,7 @@ def test_staplog():
"return_value": "-2118402048",
"status": "",
"time": datetime.datetime(2017, 6, 19, 16, 58, 31, 517266),
"type": "apicall"
"type": "apicall",
},
{
"api": "access",
@@ -60,7 +60,8 @@ def test_staplog():
"return_value": "-2",
"status": "ENOENT",
"time": datetime.datetime(2017, 6, 19, 16, 58, 31, 521264),
"type": "apicall"},
"type": "apicall",
},
{
"api": "mmap2",
"arguments": {
@@ -69,7 +70,7 @@ def test_staplog():
"p2": "PROT_READ|PROT_WRITE",
"p3": "MAP_PRIVATE|MAP_ANONYMOUS",
"p4": "-1",
"p5": "0"
"p5": "0",
},
"instruction_pointer": "b7783970",
"pid": 680,
@@ -78,14 +79,14 @@ def test_staplog():
"return_value": "0xb7764000",
"status": "",
"time": datetime.datetime(2017, 6, 19, 16, 58, 31, 550890),
"type": "apicall"
"type": "apicall",
},
{
"api": "write",
"arguments": {
"p0": "1",
"p1": "h3ll0 w0rld!\n",
"p2": "13"
"p2": "13",
},
"instruction_pointer": "b7768cf9",
"pid": 681,
@@ -94,14 +95,14 @@ def test_staplog():
"return_value": "13",
"status": "",
"time": datetime.datetime(2017, 6, 19, 16, 58, 32, 36988),
"type": "apicall"
"type": "apicall",
},
{
"api": "read",
"arguments": {
"p0": "10",
"p1": "0x800665c0",
"p2": "8192"
"p2": "8192",
},
"instruction_pointer": "b7768cf9",
"pid": 681,
@@ -110,7 +111,7 @@ def test_staplog():
"return_value": "0",
"status": "",
"time": datetime.datetime(2017, 6, 19, 16, 58, 32, 37596),
"type": "apicall"
"type": "apicall",
},
{
"api": "exit_group",
@@ -124,7 +125,7 @@ def test_staplog():
"return_value": "",
"status": "",
"time": datetime.datetime(2017, 6, 19, 16, 58, 32, 37898),
"type": "apicall"
"type": "apicall",
},
{
"api": "wait4",
@@ -132,7 +133,7 @@ def test_staplog():
"p0": "-1",
"p1": "0xbfd4a134",
"p2": "0x0",
"p3": "0x0"
"p3": "0x0",
},
"instruction_pointer": "b7769cf9",
"pid": 680,
@@ -141,19 +142,19 @@ def test_staplog():
"return_value": "681",
"status": "",
"time": datetime.datetime(2017, 6, 19, 16, 58, 31, 850098),
"type": "apicall"
"type": "apicall",
},
{
"api": "sigreturn",
"arguments": { },
"instruction_pointer": "b7769cf9",
"pid": 680,
"process_name": "sh",
"raw": "Mon Jun 19 16:58:32 2017.051317 sh@b7769cf9[680] sigreturn() = 681\n",
"return_value": "681",
"status": "",
"time": datetime.datetime(2017, 6, 19, 16, 58, 32, 51317),
"type": "apicall"
"arguments": {},
"instruction_pointer": "b7769cf9",
"pid": 680,
"process_name": "sh",
"raw": "Mon Jun 19 16:58:32 2017.051317 sh@b7769cf9[680] sigreturn() = 681\n",
"return_value": "681",
"status": "",
"time": datetime.datetime(2017, 6, 19, 16, 58, 32, 51317),
"type": "apicall",
},
{
"api": "exit_group",
@@ -167,14 +168,14 @@ def test_staplog():
"return_value": "",
"status": "",
"time": datetime.datetime(2017, 6, 19, 16, 58, 32, 51973),
"type": "apicall"
"type": "apicall",
},
{
"api": "write",
"arguments": {
"p0": "2",
"p1": "BusyBox v1.16.0 (2010-02-06 04:51:36 CST)",
"p2": "41"
"p2": "41",
},
"instruction_pointer": "80dbdde",
"pid": 704,
@@ -183,14 +184,14 @@ def test_staplog():
"return_value": "41",
"status": "",
"time": datetime.datetime(2017, 6, 20, 15, 39, 30, 141870),
"type": "apicall"
"type": "apicall",
},
{
"api": "write",
"arguments": {
"p0": "2",
"p1": "Copyright (C) 1998-2009 Erik Andersen, Rob La",
"p2": "480"
"p2": "480",
},
"instruction_pointer": "80dbdde",
"pid": 668,
@@ -199,14 +200,14 @@ def test_staplog():
"return_value": "480",
"status": "",
"time": datetime.datetime(2017, 6, 22, 10, 22, 6, 766807),
"type": "apicall"
"type": "apicall",
},
{
"api": "execve",
"arguments": {
"p0": "/usr/bin/sh",
"p1": ["sh", "-c", "/tmp/comma,sh"],
"p2": ["COMMA_IN_ARRAY=it,works", "HOME=/root"]
"p2": ["COMMA_IN_ARRAY=it,works", "HOME=/root"],
},
"instruction_pointer": "b774dcf9",
"pid": 680,
@@ -215,14 +216,14 @@ def test_staplog():
"return_value": "-2",
"status": "ENOENT",
"time": datetime.datetime(2017, 6, 19, 16, 58, 31, 445170),
"type": "apicall"
"type": "apicall",
},
{
"api": "execve",
"arguments": {
"p0": "/usr/bin/sh",
"p1": ["sh", "-c", "/tmp/bracket]sh"],
"p2": ["LANGUAGE=en_US:en", "HOME=/root"]
"p2": ["LANGUAGE=en_US:en", "HOME=/root"],
},
"instruction_pointer": "b774dcf9",
"pid": 680,
@@ -231,6 +232,6 @@ def test_staplog():
"return_value": "-2",
"status": "ENOENT",
"time": datetime.datetime(2017, 6, 19, 16, 58, 31, 445170),
"type": "apicall"
}
"type": "apicall",
},
]