def create_missing_profiles():
"""
Creates usermode profiles by restoring vm-1 and extracting the DLLs.
Assumes that injector is configured properly, i.e. kernel and runtime
profiles exist and that vm-1 is free to use.
"""
# Prepare injector
with open(os.path.join(PROFILE_DIR, "runtime.json"), "r") as runtime_f:
runtime_info = RuntimeInfo.load(runtime_f)
kernel_profile = os.path.join(PROFILE_DIR, "kernel.json")
injector = Injector("vm-1", runtime_info, kernel_profile)
# restore vm-1
out_interface = conf["drakrun"].get("out_interface", "")
dns_server = conf["drakrun"].get("dns_server", "")
backend = get_storage_backend(InstallInfo.load())
setup_vm_network(
vm_id=1, net_enable=False, out_interface=out_interface, dns_server=dns_server
)
vm = VirtualMachine(backend, 1)
vm.restore()
# Ensure that all declared usermode profiles exist
# This is important when upgrade defines new entries in dll_file_list and compulsory_dll_file_list
for profile in compulsory_dll_file_list:
if not profile_exists(profile):
create_rekall_profile(injector, profile, True)
for profile in dll_file_list:
if not profile_exists(profile):
try:
create_rekall_profile(injector, profile)
except Exception:
# silence per-dll errors
pass
vm.destroy()
delete_vm_network(
vm_id=1, net_enable=False, out_interface=out_interface, dns_server=dns_server
)
def __init__(self, config: Config, instance_id: int):
super().__init__(config)
self.instance_id = instance_id
self.install_info = InstallInfo.load()
self.default_timeout = int(
self.config.config['drakrun'].get('analysis_timeout') or 60 * 10)
with open(os.path.join(PROFILE_DIR, "runtime.json"), 'r') as runtime_f:
self.runtime_info = RuntimeInfo.load(runtime_f)
self.active_plugins = {}
self.active_plugins["_all_"] = [
'apimon', 'bsodmon', 'clipboardmon', 'cpuidmon', 'crashmon',
'debugmon', 'delaymon', 'exmon', 'filedelete', 'filetracer',
'librarymon', 'memdump', 'procdump', 'procmon', 'regmon', 'rpcmon',
'ssdtmon', 'syscalls', 'tlsmon', 'windowmon', 'wmimon'
]
for quality, list_str in self.config.config.items('drakvuf_plugins'):
plugins = [x for x in list_str.split(',') if x.strip()]
self.active_plugins[quality] = plugins
def mount_vm0():
# a mount fixture to unmount incase any error occurs
install_info = InstallInfo.load()
device = (
subprocess.check_output(
[
"losetup",
"-f",
"--partscan",
"--show",
f"/dev/{install_info.lvm_volume_group}/vm-0",
]
)
.decode("ascii")
.strip("\n")
.strip()
)
yield device
subprocess.run(f"losetup -d {device}", shell=True)
def do_export_minimal(mc, bucket, name):
""" Perform minimal snapshot export, symmetric to do_import_minimal """
logging.info("Uploading installation info")
install_info = InstallInfo.load()
install_data = json.dumps(install_info.to_dict()).encode()
mc.put_object(
bucket, f"{name}/install.json", io.BytesIO(install_data), len(install_data)
)
logging.info("Uploading VM template")
mc.fput_object(
bucket, f"{name}/cfg.template", os.path.join(ETC_DIR, "scripts", "cfg.template")
)
with tempfile.NamedTemporaryFile() as disk_image:
logging.info("Exporting VM hard drive")
storage = get_storage_backend(install_info)
storage.export_vm0(disk_image.name)
logging.info("Uploading disk.img")
mc.fput_object(bucket, f"{name}/disk.img", disk_image.name)
def __init__(self, vm_id: int, dns: str):
self.cleanup(vm_id)
install_info = InstallInfo.load()
backend = get_storage_backend(install_info)
generate_vm_conf(install_info, vm_id)
self.vm = VirtualMachine(backend, vm_id)
self._dns = dns
with open(Path(PROFILE_DIR) / "runtime.json", "r") as f:
self.runtime_info = RuntimeInfo.load(f)
self.desktop = WinPath(r"%USERPROFILE%") / "Desktop"
self.kernel_profile = Path(PROFILE_DIR) / "kernel.json"
self.injector = Injector(
self.vm.vm_name,
self.runtime_info,
self.kernel_profile,
)
setup_vm_network(vm_id, True, find_default_interface(), dns)
def postinstall(report, generate_usermode):
if os.path.exists(os.path.join(ETC_DIR, "no_usage_reports")):
report = False
install_info = InstallInfo.load()
max_vms = install_info.max_vms
output = subprocess.check_output(['vmi-win-guid', 'name', 'vm-0'],
timeout=30).decode('utf-8')
try:
version = re.search(r'Version: (.*)', output).group(1)
pdb = re.search(r'PDB GUID: ([0-9a-f]+)', output).group(1)
fn = re.search(r'Kernel filename: ([a-z]+\.[a-z]+)', output).group(1)
except AttributeError:
logging.error("Failed to obtain kernel PDB GUID/Kernel filename.")
return
logging.info("Determined PDB GUID: {}".format(pdb))
logging.info("Determined kernel filename: {}".format(fn))
logging.info("Fetching PDB file...")
dest = fetch_pdb(fn, pdb, destdir=os.path.join(LIB_DIR, 'profiles/'))
logging.info("Generating profile out of PDB file...")
profile = make_pdb_profile(dest)
logging.info("Saving profile...")
kernel_profile = os.path.join(LIB_DIR, 'profiles', 'kernel.json')
with open(kernel_profile, 'w') as f:
f.write(profile)
output = subprocess.check_output(
['vmi-win-offsets', '--name', 'vm-0', '--json-kernel', kernel_profile],
timeout=30).decode('utf-8')
offsets = re.findall(r'^([a-z_]+):(0x[0-9a-f]+)$', output, re.MULTILINE)
if not offsets:
logging.error("Failed to parse output of vmi-win-offsets.")
return
offsets_dict = {k: v for k, v in offsets}
if 'kpgd' not in offsets_dict:
logging.error("Failed to obtain KPGD value.")
return
module_dir = os.path.dirname(os.path.realpath(__file__))
pid_tool = os.path.join(module_dir, "tools", "get-explorer-pid")
explorer_pid_s = subprocess.check_output(
[pid_tool, "vm-0", kernel_profile, offsets_dict['kpgd']],
timeout=30).decode('ascii', 'ignore')
m = re.search(r'explorer\.exe:([0-9]+)', explorer_pid_s)
explorer_pid = m.group(1)
runtime_profile = {"vmi_offsets": offsets_dict, "inject_pid": explorer_pid}
logging.info("Saving runtime profile...")
with open(os.path.join(LIB_DIR, 'profiles', 'runtime.json'), 'w') as f:
f.write(json.dumps(runtime_profile, indent=4))
logging.info("Saving VM snapshot...")
subprocess.check_output('xl save vm-0 ' +
os.path.join(LIB_DIR, "volumes", "snapshot.sav"),
shell=True)
storage_backend = get_storage_backend(install_info)
storage_backend.snapshot_vm0_volume()
logging.info("Snapshot was saved succesfully.")
if generate_usermode:
try:
create_rekall_profiles(install_info)
except RuntimeError as e:
logging.warning("Generating usermode profiles failed")
logging.exception(e)
for vm_id in range(max_vms + 1):
# we treat vm_id=0 as special internal one
generate_vm_conf(install_info, vm_id)
if report:
send_usage_report({
"kernel": {
"guid": pdb,
"filename": fn,
"version": version
},
"install_iso": {
"sha256": install_info.iso_sha256
}
})
reenable_services()
logging.info("All right, drakrun setup is done.")
def backend(setup):
yield LvmStorageBackend(InstallInfo.load())
def postinstall(report, generate_usermode):
if not check_root():
return
if os.path.exists(os.path.join(ETC_DIR, "no_usage_reports")):
report = False
install_info = InstallInfo.load()
logging.info("Cleaning up leftovers(if any)")
cleanup_postinstall_files()
logging.info("Ejecting installation CDs")
eject_cd("vm-0", FIRST_CDROM_DRIVE)
if install_info.enable_unattended:
# If unattended install is enabled, we have an additional CD-ROM drive
eject_cd("vm-0", SECOND_CDROM_DRIVE)
output = subprocess.check_output(['vmi-win-guid', 'name', 'vm-0'],
timeout=30).decode('utf-8')
try:
version = re.search(r'Version: (.*)', output).group(1)
pdb = re.search(r'PDB GUID: ([0-9a-f]+)', output).group(1)
fn = re.search(r'Kernel filename: ([a-z]+\.[a-z]+)', output).group(1)
except AttributeError:
logging.error("Failed to obtain kernel PDB GUID/Kernel filename.")
return
logging.info("Determined PDB GUID: {}".format(pdb))
logging.info("Determined kernel filename: {}".format(fn))
logging.info("Fetching PDB file...")
dest = fetch_pdb(fn, pdb, destdir=PROFILE_DIR)
logging.info("Generating profile out of PDB file...")
profile = make_pdb_profile(dest)
logging.info("Saving profile...")
kernel_profile = os.path.join(PROFILE_DIR, 'kernel.json')
with open(kernel_profile, 'w') as f:
f.write(profile)
vmi_offsets = extract_vmi_offsets('vm-0', kernel_profile)
explorer_pid = extract_explorer_pid('vm-0', kernel_profile, vmi_offsets)
runtime_info = RuntimeInfo(vmi_offsets=vmi_offsets,
inject_pid=explorer_pid)
logging.info("Saving runtime profile...")
with open(os.path.join(PROFILE_DIR, 'runtime.json'), 'w') as f:
f.write(runtime_info.to_json(indent=4))
logging.info("Saving VM snapshot...")
subprocess.check_output('xl save vm-0 ' +
os.path.join(VOLUME_DIR, "snapshot.sav"),
shell=True)
storage_backend = get_storage_backend(install_info)
storage_backend.snapshot_vm0_volume()
logging.info("Snapshot was saved succesfully.")
if generate_usermode:
try:
create_rekall_profiles(install_info)
except RuntimeError as e:
logging.warning("Generating usermode profiles failed")
logging.exception(e)
if report:
send_usage_report({
"kernel": {
"guid": pdb,
"filename": fn,
"version": version
},
"install_iso": {
"sha256": install_info.iso_sha256
}
})
logging.info("All right, drakrun setup is done.")
logging.info("First instance of drakrun will be enabled automatically...")
subprocess.check_output('systemctl enable drakrun@1', shell=True)
subprocess.check_output('systemctl start drakrun@1', shell=True)
logging.info("If you want to have more parallel instances, execute:")
logging.info(" # draksetup scale <number of instances>")
def run_vm(vm_id):
install_info = InstallInfo.load()
try:
subprocess.check_output(
["xl", "destroy", "vm-{vm_id}".format(vm_id=vm_id)],
stderr=subprocess.STDOUT)
except subprocess.CalledProcessError:
pass
try:
os.unlink(
os.path.join(LIB_DIR,
"volumes/vm-{vm_id}.img".format(vm_id=vm_id)))
except FileNotFoundError:
pass
if install_info.storage_backend == 'qcow2':
subprocess.run([
"qemu-img", "create", "-f", "qcow2", "-o", "backing_file=vm-0.img",
os.path.join(LIB_DIR, "volumes/vm-{vm_id}.img".format(vm_id=vm_id))
],
check=True)
elif install_info.storage_backend == 'zfs':
vm_zvol = os.path.join('/dev/zvol', install_info.zfs_tank_name,
f'vm-{vm_id}')
vm_snap = os.path.join(install_info.zfs_tank_name,
f'vm-{vm_id}@booted')
if not os.path.exists(vm_zvol):
subprocess.run([
"zfs", "clone", "-p",
os.path.join(install_info.zfs_tank_name, 'vm-0@booted'),
os.path.join(install_info.zfs_tank_name, f'vm-{vm_id}')
],
check=True)
for _ in range(120):
if not os.path.exists(vm_zvol):
time.sleep(0.1)
else:
break
else:
logging.error(
f'Failed to see {vm_zvol} created after executing zfs clone command.'
)
return
subprocess.run(["zfs", "snapshot", vm_snap], check=True)
subprocess.run(["zfs", "rollback", vm_snap], check=True)
else:
raise RuntimeError("Unknown storage backend")
try:
subprocess.run([
"xl", "-vvv", "restore",
os.path.join(ETC_DIR,
"configs/vm-{vm_id}.cfg".format(vm_id=vm_id)),
os.path.join(LIB_DIR, "volumes/snapshot.sav")
],
check=True)
except subprocess.CalledProcessError:
logging.exception("Failed to restore VM {vm_id}".format(vm_id=vm_id))
with open("/var/log/xen/qemu-dm-vm-{vm_id}.log".format(vm_id=vm_id),
"rb") as f:
logging.error(f.read())
subprocess.run([
"xl", "qemu-monitor-command", "vm-{vm_id}".format(vm_id=vm_id),
"change ide-5632 /tmp/drakrun/vm-{vm_id}/malwar.iso".format(
vm_id=vm_id)
],
check=True)
def postinstall(report, generate_usermode):
if not check_root():
return
if os.path.exists(os.path.join(ETC_DIR, "no_usage_reports")):
report = False
install_info = InstallInfo.load()
storage_backend = get_storage_backend(install_info)
vm0 = VirtualMachine(storage_backend, 0)
if vm0.is_running is False:
logging.exception("vm-0 is not running")
return
logging.info("Cleaning up leftovers(if any)")
cleanup_postinstall_files()
logging.info("Ejecting installation CDs")
eject_cd("vm-0", FIRST_CDROM_DRIVE)
if install_info.enable_unattended:
# If unattended install is enabled, we have an additional CD-ROM drive
eject_cd("vm-0", SECOND_CDROM_DRIVE)
kernel_info = vmi_win_guid("vm-0")
logging.info(f"Determined PDB GUID: {kernel_info.guid}")
logging.info(f"Determined kernel filename: {kernel_info.filename}")
logging.info("Fetching PDB file...")
dest = fetch_pdb(kernel_info.filename,
kernel_info.guid,
destdir=PROFILE_DIR)
logging.info("Generating profile out of PDB file...")
profile = make_pdb_profile(dest)
logging.info("Saving profile...")
kernel_profile = os.path.join(PROFILE_DIR, "kernel.json")
with open(kernel_profile, "w") as f:
f.write(profile)
safe_delete(dest)
vmi_offsets = extract_vmi_offsets("vm-0", kernel_profile)
explorer_pid = extract_explorer_pid("vm-0", kernel_profile, vmi_offsets)
runtime_info = RuntimeInfo(vmi_offsets=vmi_offsets,
inject_pid=explorer_pid)
logging.info("Saving runtime profile...")
with open(os.path.join(PROFILE_DIR, "runtime.json"), "w") as f:
f.write(runtime_info.to_json(indent=4))
logging.info("Saving VM snapshot...")
# Create vm-0 snapshot, and destroy it
# WARNING: qcow2 snapshot method is a noop. fresh images are created on the fly
# so we can't keep the vm-0 running
vm0.save(os.path.join(VOLUME_DIR, "snapshot.sav"))
logging.info("Snapshot was saved succesfully.")
# Memory state is frozen, we can't do any writes to persistent storage
logging.info("Snapshotting persistent memory...")
storage_backend.snapshot_vm0_volume()
if report:
send_usage_report({
"kernel": {
"guid": kernel_info.guid,
"filename": kernel_info.filename,
"version": kernel_info.version,
},
"install_iso": {
"sha256": install_info.iso_sha256
},
})
if generate_usermode:
# Restore a VM and create usermode profiles
create_missing_profiles()
logging.info("All right, drakrun setup is done.")
logging.info("First instance of drakrun will be enabled automatically...")
subprocess.check_output("systemctl enable drakrun@1", shell=True)
subprocess.check_output("systemctl start drakrun@1", shell=True)
logging.info("If you want to have more parallel instances, execute:")
logging.info(" # draksetup scale <number of instances>")
def snapshot_import(name, bucket, full, zpool):
local_install = InstallInfo.try_load()
if local_install is not None:
click.confirm("Detected local snapshot. It will be REMOVED. Continue?",
abort=True)
mc = get_minio_client(conf)
if not mc.bucket_exists(bucket):
logging.error("Bucket %s doesn't exist", bucket)
return
ensure_dirs()
try:
if full:
logging.warning(
"Importing full snapshot. This may not work if hardware is different"
)
do_import_full(mc, name, bucket, zpool)
else:
do_import_minimal(mc, name, bucket, zpool)
# This could probably use some refactoring
# We're duplicating quite a lot of code from install function
install_info = InstallInfo.load()
generate_vm_conf(install_info, 0)
backend = get_storage_backend(install_info)
backend.rollback_vm_storage(0)
net_enable = int(conf["drakrun"].get("net_enable", "0"))
out_interface = conf["drakrun"].get("out_interface", "")
dns_server = conf["drakrun"].get("dns_server", "")
setup_vm_network(
vm_id=0,
net_enable=net_enable,
out_interface=out_interface,
dns_server=dns_server,
)
if net_enable:
start_dnsmasq(vm_id=0, dns_server=dns_server, background=True)
cfg_path = os.path.join(VM_CONFIG_DIR, "vm-0.cfg")
try:
subprocess.run(["xl" "create", cfg_path], check=True)
except subprocess.CalledProcessError:
logging.exception("Failed to launch VM vm-0")
return
logging.info(
"Minimal snapshots require postinstall to work correctly")
logging.info(
"Please VNC to the port 5900 to ensure the OS booted correctly"
)
logging.info(
"After that, execute this command to finish the setup")
logging.info("# draksetup postinstall")
except NoSuchKey:
logging.error("Import failed. Missing files in bucket.")