-
Notifications
You must be signed in to change notification settings - Fork 134
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Pip packaging #5
Changes from 15 commits
4022c9c
592a67d
63343c2
0e65093
b09a1e5
e7d6b61
b40f286
e690cf2
81f80c3
3d1edba
e6509a1
226926c
840b287
2dbbec4
1cd5719
02fc4c8
98c8401
7849387
67a49b5
2fd51ef
129898c
b1f2bc1
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,7 +1,5 @@ | ||
language: python | ||
python: | ||
# disabled since pylint is currently broken on 3.2 | ||
#- "3.2" | ||
- "3.3" | ||
- "3.4" | ||
- "3.5" | ||
|
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,7 @@ | ||
include LICENSE README.adoc TODO.adoc | ||
|
||
# Include the data files | ||
include config-example.json | ||
graft docs | ||
prune docs/presentation/ | ||
graft malboxes |
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,2 +1,5 @@ | ||
test: | ||
pylint malboxes.py | ||
pylint malboxes | ||
|
||
pkg_clean: | ||
rm -r build/ dist/ malboxes.egg-info/ |
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -20,33 +20,46 @@ https://github.com/gosecure/malboxes | |
|
||
== Requirements | ||
|
||
* Python 3 | ||
* Python 3.3+ | ||
* appdirs | ||
* jinja2 | ||
* packer (sometimes called packer-io) | ||
* vagrant | ||
* packer: https://www.packer.io/intro/getting-started/setup.html | ||
* vagrant: https://www.vagrantup.com/downloads.html | ||
|
||
== Installation | ||
|
||
sudo pip install git+https://github.com/GoSecure/malboxes.git@pip-packaging#egg=malboxes | ||
|
||
== Usage | ||
|
||
=== Box creation | ||
|
||
Copy `config-example.json` to `config.json`. Modify it and run: | ||
Run: | ||
|
||
./malboxes.py build <profile> | ||
malboxes build <profile> | ||
|
||
You can also list all supported profiles with: | ||
|
||
./malboxes.py list | ||
malboxes list | ||
|
||
This will build a Vagrant box ready for malware investigation you can now | ||
include it in a Vagrantfile afterwards. | ||
|
||
For example: | ||
|
||
./malboxes.py build win10_64_analyst | ||
malboxes build win10_64_analyst | ||
|
||
If you want to customize your configuration, look at the following location | ||
for a `config.json` file: | ||
|
||
* Linux/Unix: `~/.config/malboxes/` | ||
* Mac OS X: `~/Library/Application Support/malboxes/` | ||
* Win 7+: `C:\Users\<username>\AppData\Local\malboxes\malboxes\` | ||
|
||
|
||
=== Per analysis instances | ||
|
||
./malboxes.py spin win10_64_analyst <name> | ||
malboxes spin win10_64_analyst <name> | ||
|
||
This will create a `Vagrantfile` prepared to use for malware analysis. Move it | ||
into the analysis folder of your choice and issue: | ||
|
@@ -59,7 +72,7 @@ shared in the VM. This can be changed by commenting the relevant part of the | |
|
||
For example: | ||
|
||
./malboxes.py spin win7_32_analyst 20160519.cryptolocker.xyz | ||
malboxes spin win7_32_analyst 20160519.cryptolocker.xyz | ||
|
||
// FIXME | ||
|
||
|
@@ -69,21 +82,27 @@ You can modify (add, modify or delete) registry keys, directories and files like | |
|
||
Registry keys: | ||
|
||
./malboxes.py registry profile modtype key name value valuetype | ||
malboxes registry <profile> <modtype> <key name> <value> <valuetype> | ||
|
||
Ex: ./malboxes registry win10_64_analyst add HKCU:\Software Malboxes IsAwesome String | ||
Example: | ||
|
||
malboxes registry win10_64_analyst add HKCU:\Software "Malboxes IsAwesome" String | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. I'm pretty sure that this isn't the same thing. The first modifies HKCU:\Sofware's Malboxes key with the value IsAwesome as a String. I'm not sure about the behaviour of the second one since we do not provide a value for the "Malboxes IsAwesome" key. There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. I suck at registry... I thought you were missing a quote.
I'll fix it. Good catch!
|
||
|
||
Directories and files: | ||
|
||
./malboxes.py directory profile modtype dirpath | ||
malboxes directory <profile> <modtype> <dirpath> | ||
|
||
Example: | ||
|
||
Ex: ./malboxes.py directory BadAPT57 delete C:\Windows\System32 | ||
malboxes directory BadAPT57 delete C:\Windows\System32 | ||
|
||
You can add packages to install that are specific to the profile: | ||
|
||
./malboxes.py package profile package | ||
malboxes package <profile> <package> | ||
|
||
Example: | ||
|
||
Ex: ./malboxes.py package RansomwareThatINeedRevengeOn chrome | ||
malboxes package RansomwareThatINeedRevengeOn chrome | ||
|
||
== More information | ||
|
||
|
@@ -99,6 +118,12 @@ by link:{twob}[Olivier Bilodeau] and link:{twhg}[Hugo Genesse] | |
(PDF, degraded) | ||
* Video (coming soon) | ||
|
||
== License | ||
|
||
Code is licensed under the GPLv3+, see `LICENSE` for details. Documentation | ||
and presentation material is licensed under the Creative Commons | ||
Attribution-ShareAlike 4.0, see `docs/LICENSE` for details. | ||
|
||
== Credits | ||
|
||
After I had the idea for an improved malware analyst workflow based on what | ||
|
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1 @@ | ||
TODO: https://creativecommons.org/licenses/by-sa/4.0/ |
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,7 @@ | ||
= Development guide | ||
|
||
== Install malboxes in development mode | ||
|
||
From the project's git repository root directory, execute: | ||
|
||
sudo pip install -e . --no-deps |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Have you tried that with a machine that didn't have the dependencies ? It doesn't work for me and the traceback indicates that it cannot import
appdirs
(so that should be the same for all our dependencies) because__version__
is imported from__init__.py
which tries to import the dependencies. I got the same from my server too. Also, if we are py3, shouldn't that bepip3
since pip defaults topip2
in lots of distros (pip --version
points to py2.7 for both of the machines I tested on) ? Official docs doesn't seem to discourage hardcoding the version so couldn't we do that ? Django does something interesting that doesn't involve hardcoding so that would be an option too.There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Good point for pip3! I use arch so pip is a symlink to pip3 but you are right about most distro being pip -> pip2.