glacierw / mba Goto Github PK

Malware Behavior Analyzer

License: Other

Makefile 1.75% C 87.34% C++ 5.36% Objective-C 0.26% Haxe 0.47% Assembly 0.36% Python 1.24% NSIS 0.01% Shell 1.15% Perl 0.25% GLSL 0.01% HTML 0.08% Java 0.60% M4 1.00% PowerShell 0.02% GDB 0.01% CMake 0.03% Batchfile 0.01% Yacc 0.04% Lex 0.02%

malware qemu sandbox virtual-machine-introspection forensics taint-analysis program-analysis dynamic-binary-analysis

mba's People

Contributors

Stargazers

Watchers

mba's Issues

Is it possible to support Windows 32-bit guest OS?

Thanks for the great project. I wonder is it possible to support Windows 32-bit guest OS? What should I do if I want to implement it?

Code offset between QEMU host code and DIFT pre-generated code exceed 32 bits value

DIFT instrument the QEMU TCG host code generation to call DIFT pre-generated binary code on demands. However, the call instruction used in the instrumentation only supports a 32 bits value as the relative offset. Thereby, when the offset exceed 4G, a segfault fatal error occurs.

libcfile errors due to "error Missing file remove function"

The compilation of libqcow fails, due to the new feature of sub-component libcfile.

libcfile_support.c:742:2: error: #error Missing file remove function
#error Missing file remove function
  ^ 
make[2]: *** [libcfile_support.lo] Error 1 
make[2]: Leaving directory `/tmp/MBA/ext/tsk/sleuthkit/libqcow/libcfile'
make[1]: *** [all-recursive] Error 1
make[1]: Leaving directory `/tmp/MBA/ext/tsk/sleuthkit/libqcow' 
make: *** [ext/tsk/sleuthkit/libqcow/libqcow/.libs/libqcow.a] Error 2

A Dockerfile for MBA?

I think a Dockerfile will be nice
Even nicer if we can pull the latest docker image of MBA from dockerhub :)
What do you guys think ?

Fix dift_contaminate_memory_and() and dift_contaminate_memory_or() to support contaminate memory more than 4G

dift_contaminate_memory_* functions have a while loop to process taint contaminate for each len_pt_max size.
But the base address addr never added in the while loop, so the taint contaminate will not work when len > len_pt_max.
https://github.com/GlacierW/MBA/commit/93ac6367739cba848e6f2c6a59bf21c958b85030#diff-1af4ba10d419d9b4c994b320c09e4e87R1022

while( len > 0 ) {

        len_pt = (len > len_pt_max)? len_pt_max : len;

        *((uint64_t*)&rec) |= ((0x00000000000000ff & tag)    << 8);
        *((uint64_t*)&rec) |= ((0x00000000ffffffff & len_pt) << 16);

        dift_rec_enqueue( *((uint64_t*)&rec) );
        dift_rec_enqueue( addr );

        len -= len_pt;
    }

remove `(len == 0)?` check in `dift_contaminate_memory_or()`, `dift_contaminate_memory_and()`

Here is the structure of the code,

int dift_contaminate_memory_or( ..., uint64_t len, ... ) {
    ...
    while( len > 0 ) {
        ...
    }

    return (len == 0)? DIFT_SUCCESS : DIFT_ERR_FAIL;
}

The check is not needed, because len must be 0 after the program leaves the loop.

fix is_valid_mem_range() and is_valid_disk_range()

Here is the code,

static int is_valid_mem_range( uint64_t addr, uint64_t len ) {

    if( phys_ram_size - addr < len )
        return false;
    return true;
}

When addr is larger than phys_ram_size,
the function returns true, whether it should return false.

There is a same problem in is_valid_disk_range() too.

[Bug] The connection to the agent server is broken while reading

Expected behavior

I was about to use mba_wexec cmd.exe to check the Dekstop in the guest OS (Win10) after I imported an img to the guest OS by using the following command :
mba_wimpo /home/bruce30262/MBA-workspace/test-sample/789.PNG C:\Users\dsns\Desktop\789.PNG

I was expecting MBA will give me a shell to interact with the guest OS.

Actual behavior

It print out the following error message:

The connection to the agent server is broken while reading

Then the whole sandbox was stuck at the (agent-exec) prompt. The only thing I can do is kill the MBA process and restart the whole sandbox.

Steps to reproduce the problem

$ cat run_mba.sh 
#!/bin/bash
$HOME/MBA/x86_64-softmmu/qemu-system-x86_64 -vnc :2 -monitor stdio -m 2048 -netdev user,id=mynet -device rtl8139,netdev=mynet $HOME/MBA-workspace/win10.qcow2 -loadvm ready  

$ ./run_mba.sh
QEMU 2.3.50 monitor - type 'help' for more information
(qemu) mba_load_structures type_definition
(qemu) KPCR found fffff801a9173000

(qemu) mba_load_structures network_type_definition
(qemu) mba_load_global_variable global_type_definition
(qemu) mba_winit
Agent thread starting
(qemu) mba_wexec cmd.exe
(agent-exec) Microsoft Windows [Version 10.0.10240]
(c) 2015 Microsoft Corporation. All rights reserved.

C:\Users\dsns>
(agent-exec) 
C:\Users\dsns>dir
(agent-exec) dir
 Volume in drive C has no label.
 Volume Serial Number is 3E03-29AC

 Directory of C:\Users\dsns

2016/11/12  �W�06:09    <DIR>          .
2016/11/12  �W�06:09    <DIR>          ..
2016/06/30  �W�04:19    <DIR>          Contacts
2016/06/30  �W�04:19    <DIR>          Desktop
2016/07/14  �W�04:52    <DIR>          Documents
2016/06/30  �W�04:19    <DIR>          Downloads
2016/06/30  �W�04:19    <DIR>          Favorites
2016/06/30  �W�04:19    <DIR>          Links
2016/06/30  �W�04:19    <DIR>          Music
2016/11/05  �W�06:10    <DIR>          OneDrive
2016/06/30  �W�04:19    <DIR>          Pictures
2016/06/30  �W�04:19    <DIR>          Saved Games
2016/06/30  �W�04:19    <DIR>          Searches
2016/06/30  �W�04:19    <DIR>          Videos
2016/11/12  �W�06:07           159,454 win_agent.exe
               1 File(s)        159,454 bytes
              14 Dir(s)   4,785,410,048 bytes free

C:\Users\dsns>
(agent-exec) 
C:\Users\dsns>exit
(agent-exec) exit
System Receive : exec cmd.exe

(qemu) mba_wimpo /home/bruce30262/MBA-workspace/test-sample/789.PNG C:\Users\dsns\Desktop\789.PNG
(qemu) System Receive : impo C:\Users\dsns\Desktop\789.PNG
(qemu) mba_wexec cmd.exe
(agent-exec) The connection to the agent server is broken while reading

(agent-exec) exit
(agent-exec) 
(agent-exec) 
(agent-exec) ./run_mba.sh: line 2:  3192 Killed                  $HOME/MBA/x86_64-softmmu/qemu-system-x86_64 -vnc :2 -monitor stdio -m 2048 -netdev user,id=mynet -device rtl8139,netdev=mynet $HOME/MBA-work
space/win10.qcow2 -loadvm ready

I've used RealVNC to make sure that the image has been imported to the guest OS:

Specification on the environment

I'm running a Linux VM (Ubuntu 14.04 64 bit) on a Windows 10 x64 OS

$ uname -a
Linux ubuntu 4.4.0-31-generic #50~14.04.1-Ubuntu SMP Wed Jul 13 01:07:32 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux

$ lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description:    Ubuntu 14.04.5 LTS
Release:        14.04
Codename:       trusty

Inside the VM I run the MBA sandbox, which was built with the latest version of source code:

$ git clone https://github.com/GlacierW/MBA.git
$ ./configure --enable-mba-all --target-list=x86_64-softmmu
$ make -j8