forked from cuckoosandbox/cuckoo
-
Notifications
You must be signed in to change notification settings - Fork 0
/
undumped.py
101 lines (90 loc) · 2.82 KB
/
undumped.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
import io
import os
import sys
import json
import subprocess
from time import sleep
from shutil import copy
from xattr import getxattr
from binascii import hexlify
# start sector of the C: partition. needed for satana which destroys the partition table.
STARTSECT = 206848
def sudo(*args):
subprocess.check_call(['sudo'] + list(args))
def popen(cmd):
return subprocess.Popen(cmd, shell=True, stdout=subprocess.PIPE).stdout
if len(sys.argv) < 2:
sys.stderr.write('usage: python unpack-vdi.py task-id...\n')
sys.exit(1)
if not os.path.isfile('existing.md5'):
sys.stderr.write('generate existing.md5 by mounting the unmodified VDI and doing:\n')
sys.stderr.write(' find /mnt -type f -print0 | xargs -0 md5sum >existing.md5\n')
sys.exit(1)
existing = set()
with io.open('existing.md5', 'rb') as infile:
for line in infile:
hash = line[0:32]
existing.add(hash)
def dump_missing(analysis, dumped):
undumped = analysis + 'undumped/'
logfile = analysis + 'undumped.json'
sudo('mkdir', '-p', undumped)
sudo('chown', 'cuckoo.cuckoo', undumped)
sudo('chmod', '0775', undumped)
sudo('touch', logfile)
sudo('chown', 'cuckoo.cuckoo', logfile)
sudo('chmod', '0664', logfile)
with io.open(logfile, 'wb') as log:
for line in popen('find /mnt/Users/cuckoo -type f -print0 | xargs -0 md5sum'):
hash = line[0:32]
file = line[34:].rstrip()
if file.startswith('/mnt/Users/cuckoo/AppData'):
continue
filepath = 'C:\\' + file[5:].replace('/', '\\')
if hash in existing:
path = None
elif hash in dumped:
path = dumped[hash]
else:
path = 'undumped/' + hash + '_' + file.decode('utf-8').split('/')[-1][-60:]
copy(file, analysis + path)
dumped[hash] = path
# see https://www.tuxera.com/community/ntfs-3g-advanced/extended-attributes/
times = hexlify(getxattr(file, 'system.ntfs_times_be'))
info = { 'path': path, 'md5': hash, 'filepath': filepath, 'times': times }
json.dump(info, log)
log.write('\n')
for task in sys.argv[1:]:
analysis = '/home/cuckoo/sandbox/storage/analyses/%s/' % task
img = analysis + 'disk.qcow2'
dumped_files = 'cd %s && find files -type f -print0 | xargs -0 md5sum' % analysis
if not os.path.isfile(img):
sys.stderr.write('no image for task %s\n' % task)
continue
print 'task', task
dumped = dict()
for line in popen(dumped_files):
hash = line[0:32]
file = line[34:].rstrip()
dumped[hash] = file
sudo('chown', 'matthias.matthias', img)
sudo('chmod', '0444', img)
sudo('qemu-nbd', '-r', '-c', '/dev/nbd0', '-o', str(STARTSECT * 512), img)
sleep(1)
try:
sudo('mount', '-o', 'ro', '/dev/nbd0', '/mnt')
try:
dump_missing(analysis, dumped)
except Exception as e:
print e
try:
sudo('fuser', '-mvk', '/mnt')
finally:
raise
finally:
sudo('umount', '/mnt')
except Exception as e:
print e
raise
finally:
sudo('qemu-nbd', '-d', '/dev/nbd0')