### Build and Install LibVMI Source: https://drakvuf.com/ Builds and installs the LibVMI library from its source code. This involves running autoreconf, configure, make, and make install commands. ```bash cd ~/drakvuf/libvmi autoreconf -vif ./configure --disable-kvm --disable-bareflank --disable-file make sudo make install sudo echo "export LD_LIBRARY_PATH=\$LD_LIBRARY_PATH:/usr/local/lib" >> ~/.bashrc ``` -------------------------------- ### Run DRAKVUF Tracer (Example) Source: https://drakvuf.com/ An example of running the DRAKVUF tracer with a specific Windows configuration file and domain ID. ```bash sudo ./build/drakvuf -r /root/windows7-sp1.json -d 7 ``` -------------------------------- ### Test LibVMI with Windows VM Source: https://drakvuf.com/ Verify LibVMI installation and configuration by listing processes on a Windows VM. This command should display process information if the setup is successful. ```bash sudo vmi-process-list windows7-sp1 ``` -------------------------------- ### Test LibVMI with Linux VM Source: https://drakvuf.com/ Verify LibVMI installation and configuration by listing processes on a Linux VM. This command should display process information if the setup is successful. ```bash sudo vmi-process-list linux ``` -------------------------------- ### Build and Install Volatility3 Source: https://drakvuf.com/ Builds and installs Volatility3, a memory forensics framework. This is done using Python's setup.py script. ```bash cd ~/drakvuf/volatility3 python3 ./setup.py build sudo python3 ./setup.py install ``` -------------------------------- ### Install Xen and Configure GRUB Source: https://drakvuf.com/ Installs Xen packages, configures GRUB for Xen with specific memory and CPU settings, and updates the system's library path and fstab for XenFS. ```bash sudo su apt-get remove xen* libxen* dpkg -i dist/xen*.deb echo "GRUB_CMDLINE_XEN_DEFAULT=\"dom0_mem=4096M,max:4096M dom0_max_vcpus=4 dom0_vcpus_pin=1 force-ept=1 ept=ad=0 hap_1gb=0 hap_2mb=0 altp2m=1 hpet=legacy-replacement smt=0\"" >> /etc/default/grub echo "/usr/local/lib" > /etc/ld.so.conf.d/xen.conf ldconfig echo "none /proc/xen xenfs defaults,nofail 0 0" >> /etc/fstab echo "xen-evtchn" >> /etc/modules echo "xen-privcmd" >> /etc/modules echo "xen-gntdev" >> /etc/modules systemctl enable xencommons.service systemctl enable xen-qemu-dom0-disk-backend.service systemctl enable xen-init-dom0.service systemctl enable xenconsoled.service update-grub ``` -------------------------------- ### Install Python Packages Source: https://drakvuf.com/ Installs essential Python packages using pip3. Ensure pip3 is available on your system. ```bash sudo pip3 install pefile construct ``` -------------------------------- ### Run DRAKVUF Tracer (Basic) Source: https://drakvuf.com/ Execute the DRAKVUF tracer with a specified JSON configuration file and domain ID. This command starts the system tracing. ```bash sudo ./build/drakvuf -r -d ``` -------------------------------- ### Install DRAKVUF® Dependencies on Debian/Ubuntu Source: https://drakvuf.com/ This command installs the necessary packages for building DRAKVUF® from source on Debian/Ubuntu based Linux distributions. Ensure your system is up-to-date before running. ```bash sudo apt-get install wget git bcc bin86 gawk bridge-utils iproute2 libcurl4-openssl-dev bzip2 libpci-dev build-essential make gcc clang libc6-dev linux-libc-dev zlib1g-dev libncurses5-dev patch libvncserver-dev libssl-dev libsdl-dev iasl libbz2-dev e2fslibs-dev git-core uuid-dev ocaml libx11-dev bison flex ocaml-findlib xz-utils gettext libyajl-dev libpixman-1-dev libaio-dev libfdt-dev cabextract libglib2.0-dev autoconf automake libtool libjson-c-dev libfuse-dev liblzma-dev autoconf-archive kpartx python3-dev python3-pip golang python-dev libsystemd-dev nasm ninja-build llvm lld ``` -------------------------------- ### Generate Windows Symbol Configuration Source: https://drakvuf.com/ Use pdbconv.py to convert Windows PDB files into a JSON configuration for LibVMI. Ensure the kernel GUID and PDB filename are correct for your system. ```bash cd /tmp python3 ~/drakvuf/volatility3/volatility/framework/symbols/windows/pdbconv.py --guid 684da42a30cc450f81c535b4d18944b12 -p ntkrpamp.pdb -o windows7-sp1.json sudo mv windows7-sp1.json /root ``` -------------------------------- ### Install Linux Kernel Debug Symbols Source: https://drakvuf.com/ For Linux systems, install the debug package for the target kernel to obtain DWARF symbols. This is a prerequisite for generating the Linux JSON configuration. ```bash ssh root@linux echo "Kernel version: "$(uname -r) apt-get install linux-image-$(uname -r)-dbg exit ``` -------------------------------- ### Extract PDB GUID and Kernel Filename Source: https://drakvuf.com/ Highlights the PDB GUID and Kernel filename fields from the vmi-win-guid output, which are essential for Volatility3 configuration. ```text PDB GUID: 684da42a30cc450f81c535b4d18944b12 Kernel filename: ntkrpamp.pdb ``` -------------------------------- ### Reboot System Source: https://drakvuf.com/ Reboots the system to apply the Xen configuration changes. This step is necessary after installing and configuring Xen. ```bash sudo reboot ``` -------------------------------- ### Get Windows Kernel Debug Info from Disk Source: https://drakvuf.com/ Provides an alternative method to obtain kernel debug information by examining the ntoskrnl.exe file directly from a mounted VM disk image using kpartx and a Python script. ```bash sudo su kpartx -a /dev/vg/windows7 mount -o ro /dev/mapper/vg-windows7p1 /mnt python3 tools/pdbguid.py /mnt/Windows/System32/ntoskrnl.exe umount /mnt kpartx -d /dev/vg/windows7 ``` -------------------------------- ### Generate DRAKVUF® Usermode Profile for tcpip.sys Source: https://drakvuf.com/ Use these commands to generate a JSON configuration file for the tcpip.sys kernel module. Ensure you have copied tcpip.sys to your working directory. The second command requires the GUID obtained from the first command. ```bash python3 ~/drakvuf/tools/pdbguid.py tcpip.sys ``` ```bash python3 ~/drakvuf/volatility3/volatility/framework/symbols/windows/pdbconv.py --guid abb23d00ee7e4165b6aff66f2df02eb22 -p tcpip.pdb -o tcpip.json ``` -------------------------------- ### Get Windows Kernel Debug Info Source: https://drakvuf.com/ Uses the vmi-win-guid tool to retrieve debug information for a Windows kernel running in a Xen domain. This is crucial for memory analysis. ```bash $ sudo xl list Name ID Mem VCPUs State Time(s) Domain-0 0 4024 4 r----- 848.8 windows7-sp1-x86 7 3000 1 -b---- 94.7 $ sudo vmi-win-guid name windows7-sp1-x86 Windows Kernel found @ 0x2604000 Version: 32-bit Windows 7 PE GUID: 4ce78a09412000 PDB GUID: 684da42a30cc450f81c535b4d18944b12 Kernel filename: ntkrpamp.pdb Multi-processor with PAE (version 5.0 and higher) Signature: 17744. Machine: 332. # of sections: 22. # of symbols: 0. Timestamp: 1290242569. Characteristics: 290. Optional header size: 224. Optional header type: 0x10b Section 1: .text Section 2: _PAGELK Section 3: POOLMI Section 4: POOLCODE Section 5: .data Section 6: ALMOSTRO Section 7: SPINLOCK Section 8: PAGE Section 9: PAGELK Section 10: PAGEKD Section 11: PAGEVRFY Section 12: PAGEHDLS Section 13: PAGEBGFX Section 14: PAGEVRFB Section 15: .edata Section 16: PAGEDATA Section 17: PAGEKDD Section 18: PAGEVRFC Section 19: PAGEVRFD Section 20: INIT Section 21: .rsrc Section 22: .reloc ``` -------------------------------- ### DRAKVUF Help Source: https://drakvuf.com/ Display all available command-line options for the DRAKVUF tracer. This is useful for understanding advanced usage and customization. ```bash ./build/drakvuf --help ``` -------------------------------- ### Build DRAKVUF Source: https://drakvuf.com/ Compile the DRAKVUF tracer using Meson and Ninja build system. This command builds the executable in the 'build' directory. ```bash cd ~/drakvuf meson setup build --native-file llvm.ini ninja -C build ``` -------------------------------- ### List Running Xen Domains Source: https://drakvuf.com/ Displays a list of all running Xen domains, including Domain-0 and any other virtual machines. This helps in verifying Xen's operational status. ```bash xl list ``` -------------------------------- ### Windows 7 VM Configuration Template Source: https://drakvuf.com/ A configuration template for creating a Windows 7 VM using Xen. It specifies hardware settings, boot options, and disk/network configurations. ```xl arch = 'x86_64' name = "windows7-sp1" maxmem = 3000 memory = 3000 vcpus = 2 maxvcpus = 2 builder = "hvm" boot = "cd" hap = 1 on_poweroff = "destroy" on_reboot = "destroy" on_crash = "destroy" vnc = 1 vnclisten = "0.0.0.0" vga = "stdvga" usb = 1 usbdevice = "tablet" audio = 1 soundhw = "hda" viridian = 1 altp2m = 2 shadow_memory = 32 vif = [ 'type=ioemu,model=e1000,bridge=xenbr0' ] disk = [ 'phy:/dev/vg/windows7-sp1,hda,w', 'file:/path/to/your/windows7.iso,hdc:cdrom,r' ] ``` -------------------------------- ### Configure LibVMI for Windows Source: https://drakvuf.com/ Append the generated Windows symbol configuration to the LibVMI configuration file. This step links the symbol information to the LibVMI system. ```bash sudo su printf "windows7-sp1 { volatility_ist = \"/root/windows7-sp1.json\"; }" >> /etc/libvmi.conf exit ``` -------------------------------- ### Clone and Build Drakvuf Source: https://drakvuf.com/ Clones the Drakvuf repository, updates submodules, and builds Xen components. This process involves navigating directories and running configuration and make commands. ```bash cd ~ git clone https://github.com/tklengyel/drakvuf cd drakvuf git submodule update --init cd xen ./configure --enable-githttp --enable-systemd --enable-ovmf --disable-pvshim make -j4 dist-xen make -j4 dist-tools make -j4 debball ``` -------------------------------- ### Verify Xen Detection Source: https://drakvuf.com/ Runs a command to detect if the system is running in a Xen environment. The expected output indicates a successful PV context. ```bash sudo xen-detect ``` -------------------------------- ### Check Kernel Version Source: https://drakvuf.com/ Verifies the currently running kernel version. A minimum kernel version of 5.11+ is required for proper Xen operation. ```bash uname -r ``` -------------------------------- ### Create LVM Volume Group for VMs Source: https://drakvuf.com/ Creates a Logical Volume Manager (LVM) volume group named 'windows7-sp1' with a size of 20GB to store virtual machine disks. ```bash lvcreate -L20G -n windows7-sp1 vg ``` -------------------------------- ### Configure LibVMI for Linux Source: https://drakvuf.com/ Add the generated Linux symbol configuration to the LibVMI configuration file. This step enables LibVMI to use the Linux kernel symbols. ```bash printf "linux { volatility_ist = \"/root/linux.json\"; }" >> /etc/libvmi.conf ``` -------------------------------- ### Generate Linux Symbol Configuration Source: https://drakvuf.com/ Use the dwarf2json tool to convert Linux kernel debug symbols into a JSON configuration file for LibVMI. Ensure the System.map and vmlinux paths match your kernel version. ```bash cd ~/drakvuf/dwarf2json go build sudo su kpartx -a /dev/vg/linux mount -o ro /dev/mapper/vg-linux1 /mnt ./dwarf2json linux --system-map /mnt/boot/System.map-5.3.0-0.bpo.2-amd64 --elf /mnt/usr/lib/debug/vmlinux-5.3.0-0.bpo.2-amd64 > /root/linux.json umount /mnt kpartx -d /dev/vg/linux ``` -------------------------------- ### DRAKVUF® Citation Source: https://drakvuf.com/ This is the bibtex entry to cite DRAKVUF® in academic projects. ```bibtex @inproceedings{lengyel2014drakvuf, author = {Lengyel, Tamas K. and Maresca, Steve and Payne, Bryan D. and Webster, George D. and Vogl, Sebastian and Kiayias, Aggelos}, title = {Scalability, Fidelity and Stealth in the DRAKVUF Dynamic Malware Analysis System}, booktitle = {Proceedings of the 30th Annual Computer Security Applications Conference}, year = {2014} } ``` === COMPLETE CONTENT === This response contains all available snippets from this library. No additional content exists. Do not make further requests.