DRAKVUF

https://drakvuf.com
Admin
DRAKVUF is a virtualization-based agentless black-box binary analysis system for in-depth execution...
Tokens:4,319
Snippets:50
Trust Score:7.8
Update:3 months ago
Show doc for...
Tokens:
Raw
### Build and Install LibVMI

Source: https://drakvuf.com/

Builds and installs the LibVMI library from its source code. This involves running autoreconf, configure, make, and make install commands.

```bash
cd ~/drakvuf/libvmi
autoreconf -vif
./configure --disable-kvm --disable-bareflank --disable-file
make
sudo make install
sudo echo "export LD_LIBRARY_PATH=\$LD_LIBRARY_PATH:/usr/local/lib" >> ~/.bashrc

```

--------------------------------

### Run DRAKVUF Tracer (Example)

Source: https://drakvuf.com/

An example of running the DRAKVUF tracer with a specific Windows configuration file and domain ID.

```bash
sudo ./build/drakvuf -r /root/windows7-sp1.json -d 7
```

--------------------------------

### Test LibVMI with Windows VM

Source: https://drakvuf.com/

Verify LibVMI installation and configuration by listing processes on a Windows VM. This command should display process information if the setup is successful.

```bash
sudo vmi-process-list windows7-sp1
```

--------------------------------

### Test LibVMI with Linux VM

Source: https://drakvuf.com/

Verify LibVMI installation and configuration by listing processes on a Linux VM. This command should display process information if the setup is successful.

```bash
sudo vmi-process-list linux
```

--------------------------------

### Build and Install Volatility3

Source: https://drakvuf.com/

Builds and installs Volatility3, a memory forensics framework. This is done using Python's setup.py script.

```bash
cd ~/drakvuf/volatility3
python3 ./setup.py build
sudo python3 ./setup.py install

```

--------------------------------

### Install Xen and Configure GRUB

Source: https://drakvuf.com/

Installs Xen packages, configures GRUB for Xen with specific memory and CPU settings, and updates the system's library path and fstab for XenFS.

```bash
sudo su
apt-get remove xen* libxen*
dpkg -i dist/xen*.deb
echo "GRUB_CMDLINE_XEN_DEFAULT=\"dom0_mem=4096M,max:4096M dom0_max_vcpus=4 dom0_vcpus_pin=1 force-ept=1 ept=ad=0 hap_1gb=0 hap_2mb=0 altp2m=1 hpet=legacy-replacement smt=0\"" >> /etc/default/grub
echo "/usr/local/lib" > /etc/ld.so.conf.d/xen.conf
ldconfig
echo "none /proc/xen xenfs defaults,nofail 0 0" >> /etc/fstab
echo "xen-evtchn" >> /etc/modules
echo "xen-privcmd" >> /etc/modules
echo "xen-gntdev" >> /etc/modules
systemctl enable xencommons.service
systemctl enable xen-qemu-dom0-disk-backend.service
systemctl enable xen-init-dom0.service
systemctl enable xenconsoled.service
update-grub

```

--------------------------------

### Install Python Packages

Source: https://drakvuf.com/

Installs essential Python packages using pip3. Ensure pip3 is available on your system.

```bash
sudo pip3 install pefile construct

```

--------------------------------

### Run DRAKVUF Tracer (Basic)

Source: https://drakvuf.com/

Execute the DRAKVUF tracer with a specified JSON configuration file and domain ID. This command starts the system tracing.

```bash
sudo ./build/drakvuf -r <path to json config file> -d <domid>
```

--------------------------------

### Install DRAKVUF® Dependencies on Debian/Ubuntu

Source: https://drakvuf.com/

This command installs the necessary packages for building DRAKVUF® from source on Debian/Ubuntu based Linux distributions. Ensure your system is up-to-date before running.

```bash
sudo apt-get install wget git bcc bin86 gawk bridge-utils iproute2 libcurl4-openssl-dev bzip2 libpci-dev build-essential make gcc clang libc6-dev linux-libc-dev zlib1g-dev libncurses5-dev patch libvncserver-dev libssl-dev libsdl-dev iasl libbz2-dev e2fslibs-dev git-core uuid-dev ocaml libx11-dev bison flex ocaml-findlib xz-utils gettext libyajl-dev libpixman-1-dev libaio-dev libfdt-dev cabextract libglib2.0-dev autoconf automake libtool libjson-c-dev libfuse-dev liblzma-dev autoconf-archive kpartx python3-dev python3-pip golang python-dev libsystemd-dev nasm ninja-build llvm lld

```

--------------------------------

### Generate Windows Symbol Configuration

Source: https://drakvuf.com/

Use pdbconv.py to convert Windows PDB files into a JSON configuration for LibVMI. Ensure the kernel GUID and PDB filename are correct for your system.

```bash
cd /tmp
python3 ~/drakvuf/volatility3/volatility/framework/symbols/windows/pdbconv.py --guid 684da42a30cc450f81c535b4d18944b12 -p ntkrpamp.pdb -o windows7-sp1.json
sudo mv windows7-sp1.json /root
```

--------------------------------

### Install Linux Kernel Debug Symbols

Source: https://drakvuf.com/

For Linux systems, install the debug package for the target kernel to obtain DWARF symbols. This is a prerequisite for generating the Linux JSON configuration.

```bash
ssh root@linux
echo "Kernel version: "$(uname -r)
apt-get install linux-image-$(uname -r)-dbg
exit
```

--------------------------------

### Extract PDB GUID and Kernel Filename

Source: https://drakvuf.com/

Highlights the PDB GUID and Kernel filename fields from the vmi-win-guid output, which are essential for Volatility3 configuration.

```text
PDB GUID: 684da42a30cc450f81c535b4d18944b12
Kernel filename: ntkrpamp.pdb


```

--------------------------------

### Reboot System

Source: https://drakvuf.com/

Reboots the system to apply the Xen configuration changes. This step is necessary after installing and configuring Xen.

```bash
sudo reboot

```

--------------------------------

### Get Windows Kernel Debug Info from Disk

Source: https://drakvuf.com/

Provides an alternative method to obtain kernel debug information by examining the ntoskrnl.exe file directly from a mounted VM disk image using kpartx and a Python script.

```bash
sudo su
kpartx -a /dev/vg/windows7
mount -o ro /dev/mapper/vg-windows7p1 /mnt
python3 tools/pdbguid.py /mnt/Windows/System32/ntoskrnl.exe
umount /mnt
kpartx -d /dev/vg/windows7

```

--------------------------------

### Generate DRAKVUF® Usermode Profile for tcpip.sys

Source: https://drakvuf.com/

Use these commands to generate a JSON configuration file for the tcpip.sys kernel module. Ensure you have copied tcpip.sys to your working directory. The second command requires the GUID obtained from the first command.

```bash
python3 ~/drakvuf/tools/pdbguid.py tcpip.sys
```

```bash
python3 ~/drakvuf/volatility3/volatility/framework/symbols/windows/pdbconv.py --guid abb23d00ee7e4165b6aff66f2df02eb22 -p tcpip.pdb -o tcpip.json
```

--------------------------------

### Get Windows Kernel Debug Info

Source: https://drakvuf.com/

Uses the vmi-win-guid tool to retrieve debug information for a Windows kernel running in a Xen domain. This is crucial for memory analysis.

```bash
$ sudo xl list
Name                                        ID   Mem VCPUs	State	Time(s)
Domain-0                                     0  4024     4     r-----	     848.8
windows7-sp1-x86                             7  3000     1     -b----	      94.7
$ sudo vmi-win-guid name windows7-sp1-x86
Windows Kernel found @ 0x2604000
	Version: 32-bit Windows 7
	PE GUID: 4ce78a09412000
	PDB GUID: 684da42a30cc450f81c535b4d18944b12
	Kernel filename: ntkrpamp.pdb
	Multi-processor with PAE (version 5.0 and higher)
	Signature: 17744.
	Machine: 332.
	# of sections: 22.
	# of symbols: 0.
	Timestamp: 1290242569.
	Characteristics: 290.
	Optional header size: 224.
	Optional header type: 0x10b
	Section 1: .text
	Section 2: _PAGELK
	Section 3: POOLMI
	Section 4: POOLCODE
	Section 5: .data
	Section 6: ALMOSTRO
	Section 7: SPINLOCK
	Section 8: PAGE
	Section 9: PAGELK
	Section 10: PAGEKD
	Section 11: PAGEVRFY
	Section 12: PAGEHDLS
	Section 13: PAGEBGFX
	Section 14: PAGEVRFB
	Section 15: .edata
	Section 16: PAGEDATA
	Section 17: PAGEKDD
	Section 18: PAGEVRFC
	Section 19: PAGEVRFD
	Section 20: INIT
	Section 21: .rsrc
	Section 22: .reloc


```

--------------------------------

### DRAKVUF Help

Source: https://drakvuf.com/

Display all available command-line options for the DRAKVUF tracer. This is useful for understanding advanced usage and customization.

```bash
./build/drakvuf --help
```

--------------------------------

### Build DRAKVUF

Source: https://drakvuf.com/

Compile the DRAKVUF tracer using Meson and Ninja build system. This command builds the executable in the 'build' directory.

```bash
cd ~/drakvuf
meson setup build --native-file llvm.ini
ninja -C build
```

--------------------------------

### List Running Xen Domains

Source: https://drakvuf.com/

Displays a list of all running Xen domains, including Domain-0 and any other virtual machines. This helps in verifying Xen's operational status.

```bash
xl list

```

--------------------------------

### Windows 7 VM Configuration Template

Source: https://drakvuf.com/

A configuration template for creating a Windows 7 VM using Xen. It specifies hardware settings, boot options, and disk/network configurations.

```xl
arch = 'x86_64'
name = "windows7-sp1"
maxmem = 3000
memory = 3000
vcpus = 2
maxvcpus = 2
builder = "hvm"
boot = "cd"
hap = 1
on_poweroff = "destroy"
on_reboot = "destroy"
on_crash = "destroy"
vnc = 1
vnclisten = "0.0.0.0"
vga = "stdvga"
usb = 1
usbdevice = "tablet"
audio = 1
soundhw = "hda"
viridian = 1
altp2m = 2
shadow_memory = 32
vif = [ 'type=ioemu,model=e1000,bridge=xenbr0' ]
disk = [ 'phy:/dev/vg/windows7-sp1,hda,w', 'file:/path/to/your/windows7.iso,hdc:cdrom,r' ]


```

--------------------------------

### Configure LibVMI for Windows

Source: https://drakvuf.com/

Append the generated Windows symbol configuration to the LibVMI configuration file. This step links the symbol information to the LibVMI system.

```bash
sudo su
printf "windows7-sp1 {
	volatility_ist = \"/root/windows7-sp1.json\";
}" >> /etc/libvmi.conf
exit
```

--------------------------------

### Clone and Build Drakvuf

Source: https://drakvuf.com/

Clones the Drakvuf repository, updates submodules, and builds Xen components. This process involves navigating directories and running configuration and make commands.

```bash
cd ~
git clone https://github.com/tklengyel/drakvuf
cd drakvuf
git submodule update --init
cd xen
./configure --enable-githttp --enable-systemd --enable-ovmf --disable-pvshim
make -j4 dist-xen
make -j4 dist-tools
make -j4 debball

```

--------------------------------

### Verify Xen Detection

Source: https://drakvuf.com/

Runs a command to detect if the system is running in a Xen environment. The expected output indicates a successful PV context.

```bash
sudo xen-detect

```

--------------------------------

### Check Kernel Version

Source: https://drakvuf.com/

Verifies the currently running kernel version. A minimum kernel version of 5.11+ is required for proper Xen operation.

```bash
uname -r

```

--------------------------------

### Create LVM Volume Group for VMs

Source: https://drakvuf.com/

Creates a Logical Volume Manager (LVM) volume group named 'windows7-sp1' with a size of 20GB to store virtual machine disks.

```bash
lvcreate -L20G -n windows7-sp1 vg

```

--------------------------------

### Configure LibVMI for Linux

Source: https://drakvuf.com/

Add the generated Linux symbol configuration to the LibVMI configuration file. This step enables LibVMI to use the Linux kernel symbols.

```bash
printf "linux {
	volatility_ist = \"/root/linux.json\";
}" >> /etc/libvmi.conf
```

--------------------------------

### Generate Linux Symbol Configuration

Source: https://drakvuf.com/

Use the dwarf2json tool to convert Linux kernel debug symbols into a JSON configuration file for LibVMI. Ensure the System.map and vmlinux paths match your kernel version.

```bash
cd ~/drakvuf/dwarf2json
go build
sudo su
kpartx -a /dev/vg/linux
mount -o ro /dev/mapper/vg-linux1 /mnt
./dwarf2json linux --system-map /mnt/boot/System.map-5.3.0-0.bpo.2-amd64 --elf /mnt/usr/lib/debug/vmlinux-5.3.0-0.bpo.2-amd64 > /root/linux.json
umount /mnt
kpartx -d /dev/vg/linux
```

--------------------------------

### DRAKVUF® Citation

Source: https://drakvuf.com/

This is the bibtex entry to cite DRAKVUF® in academic projects.

```bibtex
@inproceedings{lengyel2014drakvuf,
  author = {Lengyel, Tamas K. and Maresca, Steve and Payne, Bryan D. and Webster, George D. and Vogl, Sebastian and Kiayias, Aggelos},
  title = {Scalability, Fidelity and Stealth in the DRAKVUF Dynamic Malware Analysis System},
  booktitle = {Proceedings of the 30th Annual Computer Security Applications Conference},
  year = {2014}
}

```
Tokens:
Raw