Skip navigation.
Home

Ether Automation Utility: Ether Bunny

Ether Bunny is a script that I use to automatically startup and run Xen domains, copy files, and then execute them with Ether. It is a quick hack I put together. Most of the variables at the top of the file will need to be changed to match your configuration. This script is made available as-is. If it doesn't work you'll need to debug it on your own. That being said if you find it useful and modify it let me know and I'll be happy to update the public version.

You'll need to get a copy of Winexe as well to remotely run the files. There are some setup instructions at the Winexe page that will help you to configure your host machine.

Here's how I use it:

snoosnoo:/xen# ./eb.py 192.168.0.2 malware.exe
Ether Bunny v0.1 by Danny Quist

Analyzing malware.exe to on VM 192.168.0.50
Destroying old vm image /xen/winxp-sp2-malware-instance/
Restoring vm image...
Starting vm from /etc/xen/ramdisk-winxp-sp2.cfg
Copying malware.exe to VM 1166 at 192.168.0.50
Attempt: 1
Running malware.exe on VM winxp-sp2-ramdisk (1166) 192.168.0.50
Letting program run...
dos charset 'CP850' unavailable - using ASCII
EPOLL_CTL_ADD failed (Operation not permitted) - falling back to select()
Killing ether.
Destroying VM ID: 1166
Aborting...

Download Ether Bunny here.

Danny

Edit Jan 18 2011: The Winexe site seems to have disappeared, so I have linked to my local compiled copy.

The script doesn't appear to

The script doesn't appear to be there. Can you post it again?

Whoops

Sorry about that, it should be there again.

Capture-HPC functionality with Xen? Sounds cool :-)

Hi,

this setup reminds me of what Capture-HPC does with the VMWare VIX protocoll.

Very cool.

I´ll look into it as soon as I got my Xen/Ether setup running.

Cheers,

Emre

create and not restore

I'm curious why you are copying your image over and creating it as opposed to doing a restore. Have you found that to be a more reliable method?

There are a couple of

There are a couple of reasons I'm copying over the image: First I found that the xen restore functionality was either broken or I didn't understand it. The second reason is the time to restore (when it did happen to work correctly) was longer than the copy. Finally the machine I was running on had a *lot* of RAM so I just put the VM images into a ram disk. Including the copy and boot time I can get a Windows XP SP2 VM up and ready to run code in about 8 seconds.

If anyone has a better way to do this I would love to hear about it. I'm probably doing something wrong with the restore method. The ramdisk method is expensive but worth it.

Thanks for the

Thanks for the response.

I've been fooling around with the restore functionality and I've found that, at least on my server, if I don't use the image at the exact time the 'save' was taken then I start to get kernel panics.

I never thought of the ram disk. I'll have to look into that. The only problem is I'm limited in RAM on this server so I don't think I could create one sufficiently large for a disk. If you don't mind answering, how large are the Windows images you typically use?

I have XP installed in a 4G

I have XP installed in a 4G disk image. I had the same problem with the kernel panics, it was really strange.

Checkpoint File and Ram Disk File

Could you please upload your checkpoint file and the ram disk file as mentioned in the python script. Also i would like to have some idea about the same ?...

Why do you always destroy the vm image and restore it.. My vm image is GB and i have around 1000 samples to unpack. This means that 1000 times the image would be restored, which is a time consuming process. Isnt it ?... Will it be the same as doing the unpacking manually???/

Rishi Mehta
National Institute of Technology,India