DRAKVUF Sandbox v0.16.0

Installation guide: See Basic installation section in README.md.

Changelog:

• Hubert Jasudowicz - Bump DRAKVUF (#533)
• Hubert Jasudowicz - scripts: Add bump_version.py (#532)
• Konstanty Cieśliński - apply new, more generic analysis format (#503)
• Adam Kliś - Fix procdot graph generation issue (#531)
• Hubert Jasudowicz - Bump version to 0.16.0 (#530)
• Hubert Jasudowicz - drakpdb: Add ImageBase to profiles (#529)
• Hubert Jasudowicz - drakpdb: Add GdiPlus (#527)
• Hubert Jasudowicz - scripts: Add split_log.sh (#525)
• Hubert Jasudowicz - e2e: Depend on drakcore being up when contacting drak-web (#528)
• Hubert Jasudowicz - drakcore: Bump msql to 1.2.2 (#526)
• Hubert Jasudowicz - drakrun: Attach profiles to analyses (#504)
• Hubert Jasudowicz - examples: Remove unused imports from consumer.py (#522)
• Hubert Jasudowicz - drakrun: Sort plugin list (#521)
• Hubert Jasudowicz - draksetup: Cleanup kernel PDB file (#519)
• Hubert Jasudowicz - drakpdb: Fix profile generation for a few PDBs (#518)
• Michał Leszczyński - drakcore: fix drak-gen-ptxed, unregister it from postprocessing (#517)
• Michał Leszczyński - ipt: add missing cmdline option (#516)
• Michał Leszczyński - drakrun: fix IPT support (#512)
• Michał Leszczyński - drakrun: increase injection timeout to 60 seconds (#514)
• Michał Leszczyński - drakvuf: include codemon fix (#513)
• Michał Leszczyński - drakrun: more verbosity (#511)
• Michał Leszczyński - README: Add organization logos (#507)
• Michał Leszczyński - bump DRAKVUF to ipt-enabled version (#506)
• Manorit Chawdhry - drakrun: fix and add network tests (#481)
• Manorit Chawdhry - drakrun: regression docs improvement (#505)
• Manorit Chawdhry - drakrun: LVM backend unit tests (#480)
• Hubert Jasudowicz - drakrun: Dump regression tester (#500)
• Hubert Jasudowicz - Bump karton to 4.2.0 (#501)
• Michał Leszczyński - drakrun: add config.ini option for enabling anti-API hammering (#494)
• Hubert Jasudowicz - drakrun: Fix test mode (#499)
• Manorit Chawdhry - drakrun: usermode profile generation using Injector (#486)
• Hubert Jasudowicz - drakrun: Add missing symlink to drakplayground (#493)
• Hubert Jasudowicz - drakcore: Remove drak-archiver (#491)
• Hubert Jasudowicz - drakrun: Add support for test analyses (#489)
• Hubert Jasudowicz - playground: Fix cleanup call (#488)
• Michał Leszczyński - ci: fix package builds (#487)

DRAKVUF Sandbox v0.16.0-rc2

v0.16.0-rc2

DRAKVUF Sandbox v0.16.0-rc1

Installation guide: See Basic installation section in README.md.

DRAKVUF Sandbox v0.15.0-p2

Installation guide: See Basic installation section in README.md.

Changes:

• DRAKVUF (bump from tklengyel/drakvuf@52db64e to tklengyel/drakvuf@6b1e845), featured patches:
  • (@chivay) libusermode: Cleanup (tklengyel#1112)
  • (@chivay) memdump: Fix double free (tklengyel#1130)
  • (@chivay) injector/win: Don't leak expanded_target (tklengyel#1131)
  • (@chivay) libusermode: Add missing include to printers (tklengyel#1132)
  • (@kscieslinski) Protection against api-hammering (tklengyel#1114)
  • (@Id3aFly, @icedevml) Hyperbee plugin (tklengyel#1133)
  • (@chivay) Validate plugin names passed by user (tklengyel#1146)
  • (@chivay) xen_helper: Fix vmtrace interface (tklengyel#1150)
  • (@chivay) Don't buffer output when printing to terminal (tklengyel#1152)
  • (@chivay) xen_helper: Fix broken IPT shutdown (tklengyel#1153)
• DRAKVUF Sandbox
  • (@chivay) docs: Add a link to karton repo (#417)
  • (@chivay) docs: Fix invalid link (#419)
  • (@chivay) ci: Bump Debian ISO to 10.7 (#421)
  • (@chivay) drakrun/setup: Move basicConfig to main function (#423)
  • (@chivay) Bump reqeusts to 2.25.1 (#424)
  • (@chivay) drakrun: Remove sample_sha256.txt (#426)
  • (@chivay) drakrun: Hoist net_enable into a property (#427)
  • (@chivay) drakrun: Catch OSError in workdir cleanup (#425)
  • (@chivay) drakrun: Clean up unused imports in main.py (#428)
  • (@chivay) drakrun: Add support for custom apimon hooks (#430)
  • (@chivay) drakrun/util: Minor cleanup (#432)
  • (@chivay) drakrun: analysis refactor (#431)
  • (@kscieslinski) Let user select plugins from web interface (#436)
  • (@chivay) drakrun: Add playground (#435)
  • (@chivay) Inform about Apple hardware support (#438)
  • (@chivay) Add docs on snapshot modification (#437)
  • (@techathena) Fix typo in the docs (#442)
  • (@chivay) docs: Add development guide (#440)
  • (@techathena) drakrun: rtf association (#443)
  • (@chivay) drakcore: Add ipt-blocks (#441)
  • (@chivay) drakrun: Make VNC listen on v4 and v6 addresses (#445)
  • (@icedevml) drakrun: adjustments to cfg.template (#452)
  • (@manorit2001) drakrun: improve draksetup log output (#450)
  • (@chivay) drakrun/vm: Don't restore vm-0 storage (#457)
  • (@manorit2001) drakrun/storage: Fix qemu-img deprecation warning (#458)
  • (@icedevml, @chivay) drakrun: add preflight check with XTF (#453)
  • (@manorit2001) drakcore: minor refactor (#461)
  • (@manorit2001) draksetup: LVM backend support (#464)
  • (@manorit2001) draksetup: cleanup command (#459)
  • (@chivay) drakrun/storage: Remove double import (#468)

DRAKVUF Sandbox v0.15.0-p1

Obsolete: See patched release v0.15.0-p2 above.

DRAKVUF Sandbox v0.15.0

Obsolete: See patched release v0.15.0-p2 above.

DRAKVUF Sandbox v0.14.0

Installation guide: See Basic installation section in README.md.

Enhancements:

• Configurable active plugins (per task quality) (#372)
• Karton task is sent after postprocessing drakrun output (#373)
• Added support for exporting and importing local snapshot (#376)
• Added IPT tools (#389)
• Enabled fast single stepping (#390)
• Added TLS keys for Wireshark (#392)
• Upgraded to karton 4 (#398)

Bug fixes:

• Eject CD-ROMs before postinstall (#377)
• Pinned MinIO version (#382)
• Better DLL handling (#383, #384, #385)
• Added missing ntdll WOW profile (#387)
• Fix inconsistent argument parsing in drakpdb, qexpose it as cmdline tool (#386)
• Delete contents of ipt directory when archiving (#388)

DRAKVUF Sandbox v0.13.0

Installation guide: See Basic installation section in README.md.

Breaking changes:

• Converted drak-postprocess.service into a templated unit file, allowing easier scaling (#363)

Enhancements:

• Ensure that Xen parameters are set correctly (#332)
• Added support for PowerShell scripts (#333)
• Added Karton reconfiguration in drakrun (#346)
• Added configurable default analysis timeouts (#350)
• Added analysis ID overrride with use_root_uid (#358)
• Added drakvuf-bundle customization scripts (#366)

Bug fixes:

• Fixed ordering of iptables rules (#329)
• Fixed slow loading of analysis list in web UI (#336)
• Fixed handling of missing key in /status (#348)
• Fixed ProcDOT exception handling (#355)
• Fixed missing dumps/ directory in dumps.zip (#357)

DRAKVUF Sandbox v0.12.0

Installation guide: See Basic installation section in README.md.

When upgrading from older version:

• Please ensure that in /etc/default/grub.d/xen.cfg, option GRUB_CMDLINE_XEN_DEFAULT contains sched=credit. Afterwards, please execute update-grub && reboot.

Enhancements:

• drakrun: support network in installation process (#322)
• Bump DRAKVUF (#323)
• drop --max-vms, generate vm config upon startup (#318)
• don't use cmd.exe wrapper when executing target program (#321)

Bug fixes:

• drakrun: wait for NDB device to appear (#316)
• docs: fix code block with .NET setup (#317)
• fix office (#326)

DRAKVUF Sandbox v0.11.1

Installation guide: See Basic installation section in README.md.

Enhancements:

• drakrun: attach snapshot modification time to analysis reports (#280)
• drakcore: Add local SQLite db for caching analysis data (#298)

Bug fixes:

• drakcore: don't display broken analyses in the web UI (#278)
• fix DRAKVUF log parsing, bump DRAKVUF (#276)
• fix errors in examples/push_sample (#286)
• drakcore: better logging in log postprocessing (#288)
• drakcore: remove empty directory (#289)
• draksetup mount: allow to use relative path, default to vm-0 (#294)
• block plugins introducing instability: dkommon, envmon (#299)
• fix MinIO credential generation on drakcore installation (#290)
• bump DRAKVUF to commit f38258 (#302)
• bump DRAKVUF (change default scheduler to sched=credit) (#311)
• drakrun: Less logs on parse failure (#310)