Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fail analysing samples #985

Open
julie-nga opened this issue Nov 26, 2024 · 0 comments
Open

Fail analysing samples #985

julie-nga opened this issue Nov 26, 2024 · 0 comments
Labels
bug Something isn't working

Comments

@julie-nga
Copy link

Describe the bug

Hello,
I followed the setup for drakvuf-sandbox. Until step 16 everything works but at step 16 (Test your installation by navigating to the web interface ( http://localhost:6300/ ) and uploading some samples. The default analysis time is 10 minutes.), I have analysis crashes (I tried uploading calc.exe and notepad.exe as samples) :
image

In the report I have :
image

When I click on drakrun, I have a lot of errors :

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/home/ju/Downloads/venv/lib/python3.9/site-packages/drakrun/main.py", line 333, in process_task
    analysis_metadata = analyze_sample(analysis_options)
  File "/home/ju/Downloads/venv/lib/python3.9/site-packages/drakrun/analyzer.py", line 295, in analyze_sample
    with run_vm(vm, options) as vm:
  File "/usr/lib/python3.9/contextlib.py", line 117, in __enter__
    return next(self.gen)
  File "/home/ju/Downloads/venv/lib/python3.9/site-packages/drakrun/analyzer.py", line 130, in run_vm
    vm.vm.restore()
  File "/home/ju/Downloads/venv/lib/python3.9/site-packages/drakrun/lib/vm.py", line 126, in restore
    xen_restore_vm(self.vm_name, self._cfg_path, snapshot_path, pause=pause)
  File "/home/ju/Downloads/venv/lib/python3.9/site-packages/drakrun/lib/bindings/xen.py", line 57, in xen_restore_vm
    raise RuntimeError(f"Failed to restore VM {vm_name}")
RuntimeError: Failed to restore VM vm-1
Trying to analyze sample (attempt 3/3)
Analysis attempt failed. Retrying...
Traceback (most recent call last):
  File "/home/ju/Downloads/venv/lib/python3.9/site-packages/drakrun/lib/bindings/xen.py", line 52, in xen_restore_vm
    subprocess.run(
  File "/usr/lib/python3.9/subprocess.py", line 528, in run
    raise CalledProcessError(retcode, process.args,
subprocess.CalledProcessError: Command '['xl', 'restore', PosixPath('/etc/drakrun/configs/vm-1.cfg'), PosixPath('/var/lib/drakrun/volumes/snapshot.sav')]' returned non-zero exit status 1.

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/home/ju/Downloads/venv/lib/python3.9/site-packages/drakrun/main.py", line 333, in process_task
    analysis_metadata = analyze_sample(analysis_options)
  File "/home/ju/Downloads/venv/lib/python3.9/site-packages/drakrun/analyzer.py", line 295, in analyze_sample
    with run_vm(vm, options) as vm:
  File "/usr/lib/python3.9/contextlib.py", line 117, in __enter__
    return next(self.gen)
  File "/home/ju/Downloads/venv/lib/python3.9/site-packages/drakrun/analyzer.py", line 130, in run_vm
    vm.vm.restore()
  File "/home/ju/Downloads/venv/lib/python3.9/site-packages/drakrun/lib/vm.py", line 126, in restore
    xen_restore_vm(self.vm_name, self._cfg_path, snapshot_path, pause=pause)
  File "/home/ju/Downloads/venv/lib/python3.9/site-packages/drakrun/lib/bindings/xen.py", line 57, in xen_restore_vm
    raise RuntimeError(f"Failed to restore VM {vm_name}")
RuntimeError: Failed to restore VM vm-1

My guest VM (Windows 7) works as expected. I don't understand what could be wrong.
What could I do to make it work?

Setup
Host OS: Windows 11
Host VM: Debian 11
Virtualization of Host VM: with VMware Workstation
Guest VM: Windows 7
Drakvuf: DRAKVUF Sandbox v0.19.0-alpha1

@julie-nga julie-nga added the bug Something isn't working label Nov 26, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

1 participant