-
Notifications
You must be signed in to change notification settings - Fork 1
/
Dockerfile
223 lines (183 loc) · 8.27 KB
/
Dockerfile
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
# syntax=docker/dockerfile:latest
ARG UBUNTU_VERSION=jammy
ARG AFLPP_VERSION=4.05c
ARG MUSL_TOOLCHAIN=arm-linux-musleabi-native
ARG GHIDRA_VERSION=10.1.5_PUBLIC
ARG GHIDRA_SHA=17db4ba7d411d11b00d1638f163ab5d61ef38712cd68e462eb8c855ec5cfb5ed
ARG GHIDRA_URL=https://github.com/NationalSecurityAgency/ghidra/releases/download/Ghidra_10.1.5_build/ghidra_10.1.5_PUBLIC_20220726.zip
ARG GHIDRATHON_SHA=18ad5fe7adc940009f15de5219b3de1ffe6b6f571fc1e95318d45f074d21fbcc
ARG GHIDRATHON_URL=https://codeload.github.com/mandiant/Ghidrathon/tar.gz/refs/tags/v1.0.0
################################################################################
# Download and decompress musl toolchain for use in the final SURGEON image #
################################################################################
FROM alpine:latest as musl-toolchain-downloader
ARG MUSL_TOOLCHAIN
# Download and decompression step because ADD cannot (yet) do both at once
ADD --link https://musl.cc/$MUSL_TOOLCHAIN.tgz /
RUN tar -xf /$MUSL_TOOLCHAIN.tgz
################################################################################
# Create the Python venv for use in the final image #
# Using a different target allows us to make use of the Docker build cache for #
# the final venv, avoiding the frequent rebuild of keystone-engine #
################################################################################
FROM --platform=linux/arm64 ubuntu:$UBUNTU_VERSION as python-builder
# Enable APT package caching
RUN rm -f /etc/apt/apt.conf.d/docker-clean && \
echo 'Binary::apt::APT::Keep-Downloaded-Packages "true";' > /etc/apt/apt.conf.d/keep-cache
# Install base packages (including arm32 libraries and headers)
RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
--mount=type=cache,target=/var/lib/apt,sharing=locked \
apt-get update && \
apt-get install -y --no-install-recommends \
build-essential \
gcc \
make \
cmake \
python3-minimal \
python3-pip \
python3-venv
# Install Python dependencies for all modules into the venv (see wildcard below)
RUN --mount=type=bind,source=src,target=/src \
--mount=type=cache,target=/root/.cache/pip,sharing=locked \
python3 -m venv /root/.venv && \
. /root/.venv/bin/activate && \
pip3 install -U \
wheel \
meson && \
for req in /src/*/requirements.txt; do \
pip3 install -r $req; \
done
################################################################################
# Final SURGEON debugger image #
################################################################################
FROM ubuntu:$UBUNTU_VERSION as debugger
# Enable APT package caching
RUN rm -f /etc/apt/apt.conf.d/docker-clean && \
echo 'Binary::apt::APT::Keep-Downloaded-Packages "true";' > /etc/apt/apt.conf.d/keep-cache
# Install base packages
RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
--mount=type=cache,target=/var/lib/apt,sharing=locked \
apt-get update && \
apt-get install -y --no-install-recommends \
python3-minimal \
binutils \
gdb-multiarch && \
if [ "$(uname -m)" = "aarch64" ]; then \
apt-get install -y --no-install-recommends gdbserver; \
else \
apt-get install -y --no-install-recommends qemu-user; \
fi
# Copy entrypoint in
COPY --link --chmod=0755 docker/debugger-entrypoint.sh /debugger-entrypoint.sh
COPY --link --chmod=0755 docker/trace-entrypoint.sh /trace-entrypoint.sh
# Expose port for the debugger to connect to
EXPOSE 1234
ENTRYPOINT ["/bin/bash", "-c"]
CMD ["/debugger-entrypoint.sh"]
################################################################################
# Final SURGEON runner image #
################################################################################
FROM --platform=linux/arm64 ubuntu:$UBUNTU_VERSION as runner
ARG MUSL_TOOLCHAIN
# Configure APT and DPKG for multiarch and package caching
RUN rm -f /etc/apt/apt.conf.d/docker-clean && \
echo 'Binary::apt::APT::Keep-Downloaded-Packages "true";' > /etc/apt/apt.conf.d/keep-cache && \
dpkg --add-architecture armhf
# Install base packages (including arm32 libraries and headers)
RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
--mount=type=cache,target=/var/lib/apt,sharing=locked \
apt-get update && \
apt-get install -y --no-install-recommends \
gcc \
make \
pkg-config \
binutils-arm-linux-gnueabihf \
gcc-arm-linux-gnueabihf \
python3-minimal \
python3-pip \
python3-venv \
libpython3.10 \
libpython3-dev:armhf \
ninja-build
# Add musl toolchain
COPY --from=musl-toolchain-downloader --link /$MUSL_TOOLCHAIN /opt/$MUSL_TOOLCHAIN
ENV PATH=$PATH:/opt/$MUSL_TOOLCHAIN/bin
# Add Python venv => set up in different container for better caching
COPY --from=python-builder --link /root/.venv /root/.venv
COPY --from=aflplusplus/aflplusplus@sha256:18b15d4c9602390139523c6bc528fcc95baf959df014134cacfa6cf889a8fafe --link /usr/local/bin /opt/afl
ENV PATH=$PATH:/opt/afl
# Copy entrypoint in
COPY --link --chmod=0755 docker/runner-entrypoint.sh /runner-entrypoint.sh
ENTRYPOINT ["/bin/bash", "-c"]
CMD ["/runner-entrypoint.sh"]
################################################################################
# Download and decompress ghidra(thon) for use in the final ghidrathon image #
################################################################################
FROM alpine:latest as ghidra-ghidrathon-downloader
ARG GHIDRA_VERSION
ARG GHIDRA_SHA
ARG GHIDRA_URL
ARG GHIDRATHON_SHA
ARG GHIDRATHON_URL
# Download and decompress ghidra because ADD cannot (yet) do both at once
ADD --link $GHIDRA_URL /ghidra.zip
RUN echo "$GHIDRA_SHA /ghidra.zip" | sha256sum -c - && \
unzip /ghidra.zip && \
mv ghidra_${GHIDRA_VERSION} /ghidra && \
chmod +x /ghidra/ghidraRun
# Download and decompress ghidrathon because ADD cannot (yet) do both at once
ADD --link $GHIDRATHON_URL /ghidrathon.tar.gz
RUN echo "$GHIDRATHON_SHA /ghidrathon.tar.gz" | sha256sum -c - && \
tar -xzf /ghidrathon.tar.gz && \
mv Ghidrathon* /ghidrathon
################################################################################
# Ghidrathon image #
################################################################################
FROM ubuntu:$UBUNTU_VERSION as ghidrathon
ARG GHIDRA_VERSION
# Enable APT package caching
RUN rm -f /etc/apt/apt.conf.d/docker-clean && \
echo 'Binary::apt::APT::Keep-Downloaded-Packages "true";' > /etc/apt/apt.conf.d/keep-cache
# Install prerequisites
RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
--mount=type=cache,target=/var/lib/apt,sharing=locked \
apt-get update && \
apt-get install -y --no-install-recommends \
vim \
wget \
unzip \
build-essential \
libssl-dev \
libffi-dev \
python3-dev \
python3-requests \
python3-ipdb \
python3-ipython \
python3-pip \
python-is-python3 \
openjdk-18-jdk-headless \
apt-transport-https \
software-properties-common \
gpg-agent \
dirmngr && \
add-apt-repository -y ppa:cwchien/gradle && \
apt-get update && \
apt-get install -y --no-install-recommends \
gradle
# Install Python dependencies
RUN --mount=type=bind,source=src/ghidrathon/requirements.txt,target=/requirements.txt \
--mount=type=cache,target=/root/.cache/pip,sharing=locked \
pip3 install -r /requirements.txt
# Add ghidra
COPY --from=ghidra-ghidrathon-downloader --link /ghidra /ghidra
# Build ghidrathon
RUN --mount=type=bind,from=ghidra-ghidrathon-downloader,source=/ghidrathon,target=/ghidrathon,readwrite \
cd /ghidrathon && \
gradle -PGHIDRA_INSTALL_DIR=/ghidra && \
(/ghidra/support/analyzeHeadless --help || mkdir -p ~/.ghidra/.ghidra_${GHIDRA_VERSION}/Extensions) && \
cd ~/.ghidra/.ghidra_${GHIDRA_VERSION}/Extensions && \
unzip /ghidrathon/dist/ghidra_${GHIDRA_VERSION}_*_ghidrathon.zip
# Copy entrypoint in
COPY --link --chmod=0755 docker/ghidrathon-entrypoint.sh /ghidrathon-entrypoint.sh
ENTRYPOINT ["/bin/bash", "-c"]
CMD ["/ghidrathon-entrypoint.sh"]