From 8d192a57f28860fa4144316c7c4ec79e4fcfbbf9 Mon Sep 17 00:00:00 2001 From: xabiugarte Date: Fri, 22 Nov 2019 04:39:22 -0500 Subject: [PATCH 1/6] Fix on slirp module --- .gitignore | 21 --------------------- build.sh | 4 ++-- qemu/slirp | 1 + 3 files changed, 3 insertions(+), 23 deletions(-) create mode 160000 qemu/slirp diff --git a/.gitignore b/.gitignore index 6ee3b939..6bdddf54 100644 --- a/.gitignore +++ b/.gitignore @@ -182,24 +182,3 @@ docker-src.* /qemu/trace-ust-all.h /qemu/trace-ust-all.c /qemu/target/arm/decode-sve.inc.c - - -/qemu/roms/seabios -/qemu/roms/ipxe -/qemu/roms/openbios -/qemu/roms/openhackware -/qemu/roms/qemu-palcode -/qemu/roms/sgabios -/qemu/dtc -/qemu/roms/u-boot -/qemu/roms/skiboot -/qemu/roms/QemuMacDrivers -/qemu/ui/keycodemapdb -/qemu/capstone -/qemu/roms/seabios-hppa -/qemu/roms/u-boot-sam460ex -/qemu/tests/fp/berkeley-testfloat-3 -/qemu/tests/fp/berkeley-softfloat-3 -/qemu/roms/edk2 -/qemu/slirp -/qemu/roms/SLOF diff --git a/build.sh b/build.sh index e9eaa034..f19748fe 100755 --- a/build.sh +++ b/build.sh @@ -86,9 +86,9 @@ if [ x"${reconfigure}" = xyes ] || [ ! -f ${qemu_path}/config-host.mak ] || [ ! echo -e "\n${GREEN}[*] Configuring qemu...${NC}\n" - git submodule deinit . + git submodule deinit -f . git submodule init - git submodule update --recursive + git submodule update -f --recursive cd ${qemu_path} qemu_configure_flags="" if [ x"${debug}" = xyes ] diff --git a/qemu/slirp b/qemu/slirp new file mode 160000 index 00000000..0d337b53 --- /dev/null +++ b/qemu/slirp @@ -0,0 +1 @@ +Subproject commit 0d337b5382f3521216c3dfd30fcde4f5bcdffd02 From 54878e1269cd7cfa4e8257c26b6bc107559470ed Mon Sep 17 00:00:00 2001 From: xabiugarte Date: Thu, 5 Dec 2019 06:04:48 -0500 Subject: [PATCH 2/6] Update readme --- README.rst | 2 ++ 1 file changed, 2 insertions(+) diff --git a/README.rst b/README.rst index 0d9a98ce..75aaa631 100644 --- a/README.rst +++ b/README.rst @@ -45,6 +45,8 @@ active development and new cool features are yet to come! The master branch shou version, while the dev branches contain the latest, work-in progress features. The following announcement list refers to the master branch, and the date when the development changes were merged into master. +- [Dec 5, 2019] **Beta version of PyREBox3, ready on the python3migration branch**. The tool has been ported +to Python3 and Volatility3. Plugins have not been ported yet. - [Jun 21, 2019] **Upgraded QEMU to version 4.0.0, with MTTCG (multi-threaded TCG) support.** Special thanks to @richsurgenor for his valuable contributions to this upgrade. - [Jun 17, 2019] Merge of dev branch (Malware monitor 2). - [Jun 17, 2019] Mouse movement automation. From 4b950b5ad3d2a6c5476ea888f8e3e276509e9e0d Mon Sep 17 00:00:00 2001 From: xabiugarte Date: Thu, 5 Dec 2019 06:06:00 -0500 Subject: [PATCH 3/6] Update readme --- README.rst | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/README.rst b/README.rst index 75aaa631..55b21322 100644 --- a/README.rst +++ b/README.rst @@ -45,8 +45,7 @@ active development and new cool features are yet to come! The master branch shou version, while the dev branches contain the latest, work-in progress features. The following announcement list refers to the master branch, and the date when the development changes were merged into master. -- [Dec 5, 2019] **Beta version of PyREBox3, ready on the python3migration branch**. The tool has been ported -to Python3 and Volatility3. Plugins have not been ported yet. +- [Dec 5, 2019] **Beta version of PyREBox3, ready on the python3migration branch**. The tool has been ported to Python3 and Volatility3. Plugins have not been ported yet. - [Jun 21, 2019] **Upgraded QEMU to version 4.0.0, with MTTCG (multi-threaded TCG) support.** Special thanks to @richsurgenor for his valuable contributions to this upgrade. - [Jun 17, 2019] Merge of dev branch (Malware monitor 2). - [Jun 17, 2019] Mouse movement automation. From 8678fdcfb56ff3714e184c5c02b515ce8e6e8c68 Mon Sep 17 00:00:00 2001 From: Xabier Etxezarreta <35383579+xetxezarreta@users.noreply.github.com> Date: Wed, 18 Mar 2020 13:05:27 +0100 Subject: [PATCH 4/6] Fix Dockerfile build error upgrading pip version (#104) Fix Dockerfile build error upgrading pip version (#104) --- Dockerfile | 3 +++ 1 file changed, 3 insertions(+) diff --git a/Dockerfile b/Dockerfile index b29b5c10..b49406b7 100644 --- a/Dockerfile +++ b/Dockerfile @@ -34,6 +34,9 @@ RUN apt-get install -y build-essential zlib1g-dev pkg-config \ libpython-dev python-pip \ git curl vim +#upgrade pip +RUN pip install --upgrade pip + #clone pybox RUN git clone https://github.com/Cisco-Talos/pyrebox pyrebox WORKDIR pyrebox From 75aca6ee6d9cb3bec32bfaf96ff8205dbba0de3b Mon Sep 17 00:00:00 2001 From: f3rr4nx <44815068+f3rr4nx@users.noreply.github.com> Date: Tue, 28 Jul 2020 17:11:58 +0200 Subject: [PATCH 5/6] if mw_monitor_class (#113) --- mw_monitor/mw_monitor_classes.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mw_monitor/mw_monitor_classes.py b/mw_monitor/mw_monitor_classes.py index f8fe6bb4..3c952dcf 100644 --- a/mw_monitor/mw_monitor_classes.py +++ b/mw_monitor/mw_monitor_classes.py @@ -174,7 +174,7 @@ def find_ep(proc, proc_name): name = m["name"] base = m["base"] # size = m["size"] - if name == proc_name: + if proc_name in name: pe_data = api.r_va(proc.get_pgd(), base, 0x1000) pe = pefile.PE(data=pe_data) ep = pe.OPTIONAL_HEADER.AddressOfEntryPoint From 5bd4cc8b9251f80d59e325705f1ac954a4f033a0 Mon Sep 17 00:00:00 2001 From: xooxo Date: Sat, 22 Jan 2022 05:25:42 +0300 Subject: [PATCH 6/6] some python3 fixes --- Dockerfile | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-) diff --git a/Dockerfile b/Dockerfile index b49406b7..e2082818 100644 --- a/Dockerfile +++ b/Dockerfile @@ -21,28 +21,33 @@ # # ------------------------------------------------------------------------------- -FROM ubuntu:16.04 +FROM ubuntu:18.04 MAINTAINER Jonas Zaddach ENV PREFIX /home - -#Install packages RUN apt-get update -RUN apt-get install -y build-essential zlib1g-dev pkg-config \ +RUN apt-get install -y python3 python3-pip +RUN export python=python3 +#Install packages +RUN apt-get install -y --fix-missing build-essential zlib1g-dev pkg-config \ libglib2.0-dev binutils-dev libboost-all-dev \ autoconf libtool libssl-dev libpixman-1-dev \ libpython-dev python-pip \ git curl vim #upgrade pip -RUN pip install --upgrade pip +RUN python3 -m pip install --upgrade pip + #clone pybox RUN git clone https://github.com/Cisco-Talos/pyrebox pyrebox WORKDIR pyrebox -RUN pip install -r requirements.txt +RUN python3 -m pip install -r requirements.txt RUN ./build.sh -RUN cp /usr/local/lib/python2.7/dist-packages/capstone/lib/libcapstone.so /usr/local/lib +# i don't know why pyrebox-i386 uses python2 still +RUN python2 -m pip install distorm3 ipython capstone +#RUN cp /usr/local/lib/python2.7/dist-packages/capstone/lib/libcapstone.so /usr/local/lib +#RUN cp /usr/local/lib/python3.6/dist-packages/capstone/lib/libcapstone.so /usr/local/lib RUN ldconfig #OPTIONAL: Copy VM in. Left as an example