DRAKVUF™

Black-box Binary Analysis System

View on GitHub Wiki Documentation Download as .tar.gz

Introduction

DRAKVUF is a virtualization based agentless black-box binary analysis system. DRAKVUF allows for in-depth execution tracing of arbitrary binaries (including operating systems), all without having to install any special software within the virtual machine used for analysis.

Hardware requirements

DRAKVUF uses hardware virtualization extensions found in Intel CPUs. You will need an Intel CPU with virtualization support (VT-x) and with Extended Page Tables (EPT). DRAKVUF is not going to work on any other CPUs (such as AMD) or on Intel CPUs without the required virtualization extensions.

Supported guests

DRAKVUF currently supports Windows 7, both 32 and 64-bit versions.

Malware analysis

DRAKVUF provides a perfect platform for stealthy malware analysis as its footprint is nearly undectebable from the malware's perspective. While DRAKVUF has been mainly developed with malware analysis in mind, it is certainly not limited to that task as it can be used to monitor the execution of arbitrary binaries.

Demos

Using DRAKVUF to trace Windows internal kernel functions, including heap allocations.

This demo shows the process injection component of DRAKVUF that can start arbitrary executables within the guest, without the aid of any in-guest helper. In the demo we hijack the execution of the standard Windows Task Manager to initiate the execution of our tasks.

Extracting deleted files from memory before they are actually discarded by the operating system. Many files created by malware droppes are only present in memory and never show up on disk.

Presentations

This is a presentation describing the system at the Annual Computer Security Applications Conference (ACSAC) 2014

This presentation also describes some of the features of DRAKVUF, showcased at Hacktivity 2014

Current status

Currently the following core features are available:

Be advised that DRAKVUF is still in its early development stage and lacks features other binary analyzers may have. There are many opportunities to improve and extend DRAKVUF. Just to name a few:

As DRAKVUF is an open-source project, patches and bug reports are always welcome on the Github page! More information can be found in the DRAKVUF Wiki about working with the project.

Installation guide

UPDATED 6/23/2016 If you have a previous version of DRAKVUF installed, pay attention to the updated instructions for Xen 4.7, which requires a fresh pull of LibVMI as well!

UPDATED 12/31/2015 If you have a previous version of DRAKVUF installed, pay attention to the updated instructions to enable Xen altp2m on your system!

The following packages are normally required to build Xen and DRAKVUF on Debian based Linux distros. The system has been mainly tested on Debian Jessie and Ubuntu 14.04 LTS.

sudo apt-get install wget git bcc bin86 gawk bridge-utils iproute libcurl3 libcurl4-openssl-dev bzip2 module-init-tools pciutils-dev build-essential make gcc clang libc6-dev libc6-dev-i386 linux-libc-dev zlib1g-dev python python-dev python-twisted python-gevent python-setuptools libncurses5-dev patch libvncserver-dev libssl-dev libsdl-dev iasl libbz2-dev e2fslibs-dev git-core uuid-dev ocaml libx11-dev bison flex ocaml-findlib xz-utils gettext libyajl-dev libpixman-1-dev libaio-dev libfdt-dev cabextract libglib2.0-dev autoconf automake libtool check libjson-c-dev libfuse-dev libsystemd-daemon-dev
We will be installing a slightly modified version of Xen 4.7 that includes critical bugfixes which are not backported.
cd ~
git clone https://github.com/tklengyel/drakvuf
cd drakvuf
git submodule init
git submodule update
cd xen
./configure --enable-githttp
make -j4 dist-xen
make -j4 dist-tools
To install Xen with dom0 getting 4GB RAM assigned and two dedicated CPU cores (tune it as preferred):
sudo su
make -j4 install-xen
make -j4 install-tools
echo "GRUB_CMDLINE_XEN_DEFAULT=\"dom0_mem=4096M,max:4096M dom0_max_vcpus=4 dom0_vcpus_pin=true hap_1gb=false hap_2mb=false altp2m=1 flask_enforcing=1\"" >> /etc/default/grub
echo "/usr/local/lib" > /etc/ld.so.conf.d/xen.conf
ldconfig
echo "none /proc/xen xenfs defaults,nofail 0 0" >> /etc/fstab
echo "xen-evtchn" >> /etc/modules
echo "xen-privcmd" >> /etc/modules
update-rc.d xencommons defaults 19 18
update-rc.d xendomains defaults 21 20
update-rc.d xen-watchdog defaults 22 23
To enable the loading of the Xen XSM module required for DRAKVUF you will need to edit your GRUB Xen discovery rule script, usually found at /etc/grub.d/20_linux_xen, and add the following line after the multiboot entry
module ${rel_dirname}/xenpolicy-4.7.0
Once you are done with these steps, you can finalize your setup:
update-grub
reboot

Also make sure you are running a relatively recent kernel (anything above 3.8 should just work).

uname -r
Once you are booted into Xen, verify that everything works as such:
sudo xen-detect
The output should be: Running in PV context on Xen v4.7
xl list
The output should be something similar:
Name                                        ID   Mem VCPUs	State	Time(s)
Domain-0                                     0  4096     2     r-----     614.0
Setup an LVM Volume Group to hold your VMs disks, then create a volume:
lvcreate -L20G -n windows7-sp1 vg
Install Windows 7 from your ISO using the following template (tune it as needed):
arch = 'x86_64'
name = "windows7-sp1"
seclabel='normal:vm_r:drakvuf_domU_t'
maxmem = 3000
memory = 3000
vcpus = 1
maxcpus = 1
builder = "hvm"
boot = "cd"
hap = 1
acpi = 1
on_poweroff = "destroy"
on_reboot = "destroy"
on_crash = "destroy"
vnc=1
vnclisten="0.0.0.0"
usb = 1
usbdevice = "tablet"
altp2mhvm = 1
shadow_memory = 16
audio=1
soundhw='hda'
vif = [ 'type=ioemu,model=e1000,bridge=xenbr0,mac=00:06:5B:BA:7C:01' ]
disk = [ 'phy:/dev/vg/windows7-sp1,hda,w', 'file:/path/to/your/windows7.iso,hdc:cdrom,r' ]
Enter the LibVMI folder in the drakvuf folder and build it:
cd ~/drakvuf/libvmi
./autogen.sh
./configure
Make sure the output is like the following:
Feature      | Option                    | Reason
-------------|---------------------------|----------------------------
Xen Support  | --enable-xen=yes          | yes
Xen Events   | --enable-xen-events=yes   | yes
KVM Support  | --enable-kvm=no           | libvirt missing
File Support | --enable-file=yes         | yes
Shm-snapshot | --enable-shm-snapshot=no  | no
-------------|---------------------------|----------------------------

Tools        | Option                    | Reason
-------------|---------------------------|----------------------------
Examples     | --enable-examples=yes     | yes
VMIFS        | --enable-vmifs=yes        | yes

Extra features
----------------------------------------------------------------------
Support of Rekall profiles: yes
Build and install LibVMI:
make
sudo make install
sudo echo "export LD_LIBRARY_PATH=\$LD_LIBRARY_PATH:/usr/local/lib" >> ~/.bashrc
cd tools/pyvmi
python setup.py build
sudo python setup.py install
Download Volatility:
cd ~
git clone https://github.com/volatilityfoundation/volatility
cd volatility
cp ~/drakvuf/libvmi/tools/pyvmi/pyvmiaddressspace.py volatility/plugins/addrspaces
python setup.py build
sudo python setup.py install
Download Rekall and install it:
cd ~
git clone --branch v1.4.1 https://github.com/google/rekall
cd rekall/rekall-core
python setup.py build
sudo python setup.py install
Now we will create the Rekall profile for the Windows domain. First, we need to get the debug information for the Windows kernel via the LibVMI win-guid tool. For example, in the following my domain is named windows7-sp1-x86:
$ sudo xl list
Name                                        ID   Mem VCPUs	State	Time(s)
Domain-0                                     0  4024     4     r-----     848.8
windows7-sp1-x86                             7  3000     1     -b----      94.7
$ sudo win-guid name windows7-sp1-x86
Windows Kernel found @ 0x2604000
	Version: 32-bit Windows 7
	PE GUID: 4ce78a09412000
	PDB GUID: 684da42a30cc450f81c535b4d18944b12
	Kernel filename: ntkrpamp.pdb
	Multi-processor with PAE (version 5.0 and higher)
	Signature: 17744.
	Machine: 332.
	# of sections: 22.
	# of symbols: 0.
	Timestamp: 1290242569.
	Characteristics: 290.
	Optional header size: 224.
	Optional header type: 0x10b
	Section 1: .text
	Section 2: _PAGELK
	Section 3: POOLMI
	Section 4: POOLCODE
	Section 5: .data
	Section 6: ALMOSTRO
	Section 7: SPINLOCK
	Section 8: PAGE
	Section 9: PAGELK
	Section 10: PAGEKD
	Section 11: PAGEVRFY
	Section 12: PAGEHDLS
	Section 13: PAGEBGFX
	Section 14: PAGEVRFB
	Section 15: .edata
	Section 16: PAGEDATA
	Section 17: PAGEKDD
	Section 18: PAGEVRFC
	Section 19: PAGEVRFD
	Section 20: INIT
	Section 21: .rsrc
	Section 22: .reloc
The important fields are:
PDB GUID: 684da42a30cc450f81c535b4d18944b12
Kernel filename: ntkrpamp.pdb
Now generate the Rekall profile:
cd /tmp
rekall fetch_pdb --pdb_filename ntkrpamp.pdb --guid 684da42a30cc450f81c535b4d18944b12
rekall parse_pdb ntkrpamp.pdb > windows7-sp1.rekall.json
sudo mv windows7-sp1.rekall.json /root
With this profile ready we can create the LibVMI config:
sudo su
printf "windows7-sp1 { \n\
    ostype = \"Windows\"; \n\
    rekall_profile = \"/root/windows7-sp1.rekall.json\"; \n\
}" > /etc/libvmi.conf
exit
Test if LibVMI is working by running process-list:
sudo process-list windows7-sp1
Output should be something similar:
Process listing for VM windows7-sp1-x86 (id=7)
[    4] System (struct addr:84aba980)
[  220] smss.exe (struct addr:85a44020)
[  300] csrss.exe (struct addr:85f67a68)
[  336] wininit.exe (struct addr:8601e030)
[  348] csrss.exe (struct addr:84ba4030)
[  384] winlogon.exe (struct addr:85966d40)
[  444] services.exe (struct addr:8614c030)
[  460] lsass.exe (struct addr:86171030)
[  468] lsm.exe (struct addr:8617b4f8)
[  564] svchost.exe (struct addr:861d9bc8)
[  628] svchost.exe (struct addr:863fb8a8)
[  816] sppsvc.exe (struct addr:86426838)
[  856] svchost.exe (struct addr:854abd40)
[  880] svchost.exe (struct addr:854c5030)
[  916] svchost.exe (struct addr:854d7a70)
[ 1240] svchost.exe (struct addr:8614cb80)
[ 1280] svchost.exe (struct addr:854f7d40)
[ 1608] spoolsv.exe (struct addr:85578660)
[ 1636] svchost.exe (struct addr:85554af0)
[  792] SearchIndexer. (struct addr:8562ac08)
[ 1128] taskhost.exe (struct addr:858d9d40)
[ 1524] dwm.exe (struct addr:857f3a60)
[ 1728] explorer.exe (struct addr:858d9180)
[ 1720] regsvr32.exe (struct addr:8605f398)
[  248] svchost.exe (struct addr:863ed030)
[ 1024] svchost.exe (struct addr:86420390)
[  256] WmiPrvSE.exe (struct addr:854014a0)
Now we are ready to build and install DRAKVUF:
cd ~/drakvuf
autoreconf -vi
./configure
make
To simply trace the execution of the system:
sudo ./src/drakvuf -r <rekall profile> -d <domid>
For example:
sudo ./src/drakvuf -r /root/windows7-sp1.rekall.json -d 7
To see all available options:
./src/drakvuf

Citation

If you use DRAKVUF in an academic project, please cite using the following bibtex key:
@inproceedings{lengyel2014drakvuf,
  author = {Lengyel, Tamas K. and Maresca, Steve and Payne, Bryan D. and Webster, George D. and Vogl, Sebastian and Kiayias, Aggelos},
  title = {Scalability, Fidelity and Stealth in the DRAKVUF Dynamic Malware Analysis System},
  booktitle = {Proceedings of the 30th Annual Computer Security Applications Conference},
  year = {2014}
}