Installation problem #764
Comments
|
It seems that there's no |
|
I now tried different distributions: ubuntu-20.04.5 desktop amd64.iso complete fresh install and then followed the following steps: apt-get update && apt-get upgrade Paketlisten werden gelesen... Fertig
Holen:3 http://at.archive.ubuntu.com/ubuntu focal-updates/main amd64 python3-distutils all 3.8.10-0ubuntu1 Holen:5 http://at.archive.ubuntu.com/ubuntu focal-updates/main amd64 libc-dev-bin amd64 2.31-0ubuntu9.9 [71,8 kB] Holen:6 http://at.archive.ubuntu.com/ubuntu focal-updates/main amd64 linux-libc-dev amd64 5.4.0-137.154 [1.120 kB] Holen:7 http://at.archive.ubuntu.com/ubuntu focal/main amd64 libcrypt-dev amd64 1:4.4.10-10ubuntu4 [104 kB] Holen:8 http://at.archive.ubuntu.com/ubuntu focal-updates/main amd64 libc6-dev amd64 2.31-0ubuntu9.9 [2.519 kB] Holen:9 /home/tt/ubuntu_focal_drakvuf-bundle-1.0-git20220222010225+fecea59-1-generic.deb drakvuf-bundle amd64 1.0-git20220222010225+fecea59-1 [46,7 MB] Holen:10 http://at.archive.ubuntu.com/ubuntu focal-updates/main amd64 uuid-dev amd64 2.34-0.1ubuntu9.3 [33,6 kB] Holen:11 http://at.archive.ubuntu.com/ubuntu focal-updates/main amd64 libblkid-dev amd64 2.34-0.1ubuntu9.3 [167 kB] Holen:12 http://at.archive.ubuntu.com/ubuntu focal-updates/main amd64 libmount-dev amd64 2.34-0.1ubuntu9.3 [176 kB] Holen:13 http://at.archive.ubuntu.com/ubuntu focal-updates/main amd64 libpcre16-3 amd64 2:8.39-12ubuntu0.1 [150 kB] Holen:14 http://at.archive.ubuntu.com/ubuntu focal-updates/main amd64 libpcre32-3 amd64 2:8.39-12ubuntu0.1 [140 kB] Holen:15 http://at.archive.ubuntu.com/ubuntu focal-updates/main amd64 libpcrecpp0v5 amd64 2:8.39-12ubuntu0.1 [15,5 kB] Holen:16 http://at.archive.ubuntu.com/ubuntu focal-updates/main amd64 libpcre3-dev amd64 2:8.39-12ubuntu0.1 [540 kB] Holen:17 http://at.archive.ubuntu.com/ubuntu focal-updates/main amd64 libsepol1-dev amd64 3.0-1ubuntu0.1 [325 kB] Holen:18 http://at.archive.ubuntu.com/ubuntu focal-updates/main amd64 libpcre2-16-0 amd64 10.34-7ubuntu0.1 [181 kB] Holen:19 http://at.archive.ubuntu.com/ubuntu focal-updates/main amd64 libpcre2-posix2 amd64 10.34-7ubuntu0.1 [5.988 B] Holen:20 http://at.archive.ubuntu.com/ubuntu focal-updates/main amd64 libpcre2-dev amd64 10.34-7ubuntu0.1 [672 kB] Holen:21 http://at.archive.ubuntu.com/ubuntu focal/main amd64 libselinux1-dev amd64 3.0-1build2 [151 kB] Holen:22 http://at.archive.ubuntu.com/ubuntu focal-updates/main amd64 zlib1g-dev amd64 1:1.2.11.dfsg-2ubuntu1.5 [155 kB] Holen:23 http://at.archive.ubuntu.com/ubuntu focal-updates/main amd64 libglib2.0-dev amd64 2.64.6-1 Entpacken von python3-lib2to3 (3.8.10-0ubuntu1 Entpacken von python3-distutils (3.8.10-0ubuntu1 Entpacken von libglib2.0-dev-bin (2.64.6-1 Entpacken von libglib2.0-dev:amd64 (2.64.6-1 python3-distutils (3.8.10-0ubuntu1 libc6-dev:amd64 (2.31-0ubuntu9.9) wird eingerichtet ... libpcre2-dev:amd64 (10.34-7ubuntu0.1) wird eingerichtet ... libselinux1-dev:amd64 (3.0-1build2) wird eingerichtet ... libpcre3-dev:amd64 (2:8.39-12ubuntu0.1) wird eingerichtet ... uuid-dev:amd64 (2.34-0.1ubuntu9.3) wird eingerichtet ... zlib1g-dev:amd64 (1:1.2.11.dfsg-2ubuntu1.5) wird eingerichtet ... libblkid-dev:amd64 (2.34-0.1ubuntu9.3) wird eingerichtet ... libmount-dev:amd64 (2.34-0.1ubuntu9.3) wird eingerichtet ... libglib2.0-dev:amd64 (2.64.6-1 |
|
|
|
For sure. lscpu from Ubuntu 18.04 Installed Ubuntu 20.04 and got the following output: Reconfirmed the behaviour after reinstalling both OS versions from scratch. First installing Drakvuf according to the procedure at https://drakvuf.com/ results in a compliant Xen, but in package conflicts (Xen is already installed), CPU should be pretty new. Drakvuf can be installed and used perfecly accoring the procedure from 12/29/2022. Therefore hardware issues should not be a cause. Any ideas how to proceed? |
|
I also have the same issue, any guidance? |
|
The CPU should support DRAKVUF-Sandbox. How are you running the project? On bare metal or in nested virtualization? |
|
This is a bare metal machine with directly Ubuntu installed, no nested virtualization is involved. |
What would you like to ask us?
Hi,
I have a fresh install of Ubuntu 20.04 and followed the guide at https://drakvuf-sandbox.readthedocs.io/en/latest/usage/getting_started.html
After installing the packages and installing the gues (windows 10 -2004, x64) everything looks good (including draksetup test).
The last command "draksetup postinstall" causes troubles.
(drakrun) root@KVM:/opt/venvs# draksetup postinstall
[2023-02-04 19:05:17,897][INFO] Cleaning up leftovers(if any)
[2023-02-04 19:05:17,897][INFO] Deleted /var/lib/drakrun/profiles/runtime.json
[2023-02-04 19:05:17,897][INFO] Deleted /var/lib/drakrun/profiles/kernel.json
[2023-02-04 19:05:17,897][INFO] Ejecting installation CDs
[2023-02-04 19:05:18,058][INFO] Determined PDB GUID: 81bc5c377c525081645f9958f209c5271
[2023-02-04 19:05:18,058][INFO] Determined kernel filename: ntkrnlmp.pdb
[2023-02-04 19:05:18,058][INFO] Fetching PDB file...
[2023-02-04 19:05:18,062][DEBUG] Starting new HTTPS connection (1): msdl.microsoft.com:443
[2023-02-04 19:05:18,313][DEBUG] https://msdl.microsoft.com:443 "GET /download/symbols/ntkrnlmp.pdb/81bc5c377c525081645f9958f209c5271/ntkrnlmp.pdb HTTP/1.1" 302 0
[2023-02-04 19:05:18,318][DEBUG] Starting new HTTPS connection (1): vsblobprodscussu5shard7.blob.core.windows.net:443
[2023-02-04 19:05:19,051][DEBUG] https://vsblobprodscussu5shard7.blob.core.windows.net:443 "GET /b-4712e0edc5a240eabf23330d7df68e77/F9658F231805BF03EE49D7392358BEFE8ACBDF2D5143E81D4DE72FC3557F20D700.blob?sv=2019-07-07&sr=b&si=1&sig=1coMBQjnKkzx05L9d1ckLLGXdtImtyKlm5VF2tU6ddU%3D&spr=https&se=2023-02-05T18%3A58%3A25Z&rscl=x-e2eid-6ad7f034-5ebf45e6-a6d80427-0392ac3c-session-b5e7ccaa-8e0649af-ba54cb96-9784c6fe HTTP/1.1" 200 8596480
100%|████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████| 8.60M/8.60M [00:01<00:00, 4.74MiB/s]
[2023-02-04 19:05:20,885][INFO] Generating profile out of PDB file...
[2023-02-04 19:05:25,772][INFO] Saving profile...
[2023-02-04 19:05:25,781][INFO] Deleted /var/lib/drakrun/profiles/ntkrnlmp.pdb
[2023-02-04 19:05:26,673][INFO] Saving runtime profile...
[2023-02-04 19:05:26,674][INFO] Saving VM snapshot...
[2023-02-04 19:05:26,674][INFO] Saving VM vm-0
Saving to /var/lib/drakrun/volumes/snapshot.sav new xl format (info 0x3/0x0/2035)
xc: info: Saving domain 15, type x86 HVM
xc: Frames: 1044480/1044480 100%
xc: End of stream: 0/0 0%
[2023-02-04 19:05:34,995][INFO] Snapshot was saved succesfully.
[2023-02-04 19:05:34,995][INFO] Snapshotting persistent memory...
[2023-02-04 19:05:34,998][DEBUG] Starting new HTTPS connection (1): drakvuf.cert.pl:443
[2023-02-04 19:05:35,227][DEBUG] https://drakvuf.cert.pl:443 "POST /usage/draksetup HTTP/1.1" 200 2
[2023-02-04 19:05:35,325][INFO] Generated VM configuration for vm-1
[2023-02-04 19:05:35,359][INFO] Bridge drak1 already exists.
[2023-02-04 19:05:35,393][INFO] Bridge drak1 is up
[2023-02-04 19:05:35,532][INFO] Destroying vm-1
Formatting '/var/lib/drakrun/volumes/vm-1.img', fmt=qcow2 size=107374182400 backing_file=/var/lib/drakrun/volumes/vm-0.img backing_fmt=qcow2 cluster_size=65536 lazy_refcounts=off refcount_bits=16
[2023-02-04 19:05:37,748][INFO] Restoring VM vm-1
Loading new save file /var/lib/drakrun/volumes/snapshot.sav (new xl fmt info 0x3/0x0/2035)
Savefile contains xl domain config in JSON format
Parsing config from /etc/drakrun/configs/vm-1.cfg
xc: info: Found x86 HVM domain from Xen 4.17
xc: info: Restoring domain
xc: info: Restore successful
xc: info: XenStore: mfn 0xfeffc, dom 0, evt 1
xc: info: Console: mfn 0xfefff, dom 0, evt 2
[2023-02-04 19:05:47,368][INFO] Fetching rekall profile for Windows/System32/ntdll.dll
[2023-02-04 19:05:47,403][INFO] Already deleted /var/lib/drakrun/profiles/amd64_ntdll_profile
Traceback (most recent call last):
File "/opt/venvs/drakrun/lib/python3.8/site-packages/drakrun/draksetup.py", line 586, in create_rekall_profile
cmd = injector.read_file(guest_dll_path, local_dll_path)
File "/opt/venvs/drakrun/lib/python3.8/site-packages/drakrun/injector.py", line 66, in read_file
return subprocess.run(injector_cmd, timeout=timeout, capture_output=True)
File "/usr/lib/python3.8/subprocess.py", line 493, in run
with Popen(*popenargs, **kwargs) as process:
File "/usr/lib/python3.8/subprocess.py", line 858, in init
self._execute_child(args, executable, preexec_fn, close_fds,
File "/usr/lib/python3.8/subprocess.py", line 1704, in _execute_child
raise child_exception_type(errno_num, err_msg, err_filename)
FileNotFoundError: [Errno 2] No such file or directory: 'injector'
The above exception was the direct cause of the following exception:
Traceback (most recent call last):
File "/opt/venvs/drakrun/bin/draksetup", line 5, in
ds.main()
File "/opt/venvs/drakrun/lib/python3.8/site-packages/click/core.py", line 829, in call
return self.main(*args, **kwargs)
File "/opt/venvs/drakrun/lib/python3.8/site-packages/click/core.py", line 782, in main
rv = self.invoke(ctx)
File "/opt/venvs/drakrun/lib/python3.8/site-packages/click/core.py", line 1259, in invoke
return _process_result(sub_ctx.command.invoke(sub_ctx))
File "/opt/venvs/drakrun/lib/python3.8/site-packages/click/core.py", line 1066, in invoke
return ctx.invoke(self.callback, **ctx.params)
File "/opt/venvs/drakrun/lib/python3.8/site-packages/click/core.py", line 610, in invoke
return callback(*args, **kwargs)
File "/opt/venvs/drakrun/lib/python3.8/site-packages/drakrun/draksetup.py", line 817, in postinstall
create_missing_profiles()
File "/opt/venvs/drakrun/lib/python3.8/site-packages/drakrun/draksetup.py", line 864, in create_missing_profiles
create_rekall_profile(injector, profile, True)
File "/opt/venvs/drakrun/lib/python3.8/site-packages/drakrun/draksetup.py", line 625, in create_rekall_profile
on_create_rekall_profile_failure(
File "/opt/venvs/drakrun/lib/python3.8/site-packages/drakrun/draksetup.py", line 570, in on_create_rekall_profile_failure
raise Exception(f"[REQUIRED DLL] {msg}") from exception
Exception: [REQUIRED DLL] Failed to copy file Windows/System32/ntdll.dll
It seems to be some issue between the injector and the rest of the drakvuf sandbox.
Any ideas?
Cheers!
The text was updated successfully, but these errors were encountered: