cisco-talos/pyreboxPython scriptable Reverse Engineering Sandbox, a Virtual Machine instrumentation and inspection framework based on QEMU
THIS PROJECT HAS BEEN ARCHIVED AND ITS ISSUE QUEUE IS LOCKED. THE PROJECT WILL BE KEPT PUBLIC ONLY FOR REFERENCE PURPORSES.
.. image:: docs/media/pyrebox_logo_light_bg.png
.. _QEMU: http://qemu.org/ .. _DECAF: https://github.com/sycurelab/DECAF .. _S2E: https://github.com/dslab-epfl/s2e .. _AVATAR: https://github.com/avatartwo .. _PANDA: https://github.com/panda-re/panda .. _Volatility: http://www.volatilityfoundation.org/ .. _BUILD: BUILD.rst .. _here: https://github.com/Cisco-Talos/pyrebox/issues .. _slides: https://github.com/Cisco-Talos/pyrebox/tree/master/docs/pyrebox_hitb_ams.pdf .. _available: https://github.com/Cisco-Talos/pyrebox/tree/master/docs/pyrebox_euskalhack.pdf .. _scripts: https://github.com/Cisco-Talos/pyrebox/tree/master/scripts .. _readthedocs.io: https://pyrebox.readthedocs.io/en/latest/ .. _questions: https://github.com/Cisco-Talos/pyrebox/issues?utf8=%E2%9C%93&q=is%3Aissue%20label%3Aquestion%20 .. _presentation: https://www.youtube.com/watch?v=F2voG87obzM .. _Contest: https://volatility-labs.blogspot.com/2017/11/results-from-5th-annual-2017-volatility.html
PyREBox is a Python scriptable Reverse Engineering sandbox. It is based on QEMU, and its goal is to aid reverse engineering by providing dynamic analysis and debugging capabilities from a different perspective. PyREBox allows to inspect a running QEMU VM, modify its memory or registers, and to instrument its execution, by creating simple scripts in python to automate any kind of analysis. QEMU (when working as a whole-system-emulator) emulates a complete system (CPU, memory, devices...). By using VMI techniques, it does not require to perform any modification into the guest operating system, as it transparently retrieves information from its memory at run-time.
Several academic projects such as DECAF_, PANDA_, S2E_, or AVATAR_, have previously leveraged QEMU based instrumentation to overcome reverse engineering tasks. These projects allow to write plugins in C/C++, and implement several advanced features such as dynamic taint analysis, symbolic execution, or even record and replay of execution traces. With PyREBox, we aim to apply this technology focusing on keeping the design simple, and on the usability of the system for threat analysts.
PyREBox won the Volatility Plugin Contest_ in 2017!
This tool was presented at HITB Amsterdam 2018. You can see the slides_, or watch the presentation_. It was also presented at the third edition of EuskalHack Security Congress (slides available_).
Remember to pull the latest version of PyREBox in order to enjoy its latest features. PyREBox is under active development and new cool features are yet to come! The master branch should always contain an stable version, while the dev branches contain the latest, work-in progress features. The following announcement list refers to the master branch, and the date when the development changes were merged into master.
A build script is provided. For specific details about dependencies, please see BUILD_. We also provide a Dockerfile.
The documentation of this project is hosted at readthedocs.io_.
If you think you've found a bug, please report it here_.
Before creating a new issue, please go through the questions_ opened by other users before.
This program is provided "AS IS", and no support is guaranteed. That said, in order to help us solve your issues, please include as much information as possible in order to reproduce the bug:
PyREBox is based on QEMU, so in order to start a VM withing PyREBox, you need to run it exactly as you
were booting up a QEMU VM. A couple of example scripts are provided: start_i386.sh, start_x86_64.sh,
you can use them as an example.
The only QEMU monitor option supported currently is stdio (-monitor stdio).
