cert-ee / cuckoo3

Cuckoo 3 is a Python 3 open source automated malware analysis system.
European Union Public License 1.2
590 stars 74 forks source link

Cuckoo database (cuckoodb) requires migration(s) #93

Closed HadyElMaageny closed 2 days ago

HadyElMaageny commented 2 weeks ago

I have installed cuckoo 3, but when I call cuckoo command I get this error and I can't fix it: ERROR [cuckoo.common.log]: Failure during Cuckoo startup: Cuckoo database (cuckoodb) requires migration(s). sqlite:////home/hady/.cuckoocwd/cuckoo.db. Found version: 'No version table'. Latest version: ''. Stopping Cuckoo.. Failure during Cuckoo startup: Cuckoo database (cuckoodb) requires migration(s). sqlite:////home/hady/.cuckoocwd/cuckoo.db. Found version: 'No version table'. Latest version: ''.

cert-ee-raidar commented 1 week ago

Seems like your database file is corrupt. Try renaming the database file and Cuckoo will recreate it on startup. When a new database is created on startup and Cuckoo starts after that, then the issue is faulty database. If you need the data from your not working database, you can use sql tools to try to recover the data.

cert-ee-raidar commented 2 days ago

@HadyElMaageny Sorry for the slightly misguided advice on my part. Please run cuckoomigrate database all in your cuckoo3 folder (where install.sh is located). Please do let me know if it worked.

HadyElMaageny commented 2 days ago

thanks it works but I get this error 2024-07-08 18:21:36 INFO [cuckoo.startup]: Starting Cuckoo. cwd=/home/hady/.cuckoocwd 2024-07-08 18:21:36 INFO [cuckoo.startup]: Loading configurations 2024-07-08 18:21:36 INFO [cuckoo.node.resultserver]: Changed maximum file descriptors to hard limit for current process. newmax=1048576 2024-07-08 18:21:36 INFO [cuckoo.node.resultserver]: Started resultserver. listen_ip=169.254.10.50 listen_port=2042 2024-07-08 18:21:36 ERROR [cuckoo.common.log]: Failure during Cuckoo startup: Machinery loading failure: Loading of machinery module qemu failed. QEMU memory snapshot of machine 'example1' is of unknown filetype or compressed with unsupported compression. Snapshot can be uncompressed or compressed with lz4 or gzip. Stopping Cuckoo.. 2024-07-08 18:21:36 INFO [cuckoo.node.resultserver]: Stopping resultserver.. Failure during Cuckoo startup: Machinery loading failure: Loading of machinery module qemu failed. QEMU memory snapshot of machine 'example1' is of unknown filetype or compressed with unsupported compression. Snapshot can be uncompressed or compressed with lz4 or gzip.

the snapshot is found at path /var/lib/libvirt/qemu/snapshot/win10-2/snapshot3.xml

On Mon, Jul 8, 2024 at 3:51 PM rkivistik @.***> wrote:

@HadyElMaageny https://github.com/HadyElMaageny Sorry for the slightly misguided advice on my part. Please run cuckoomigrate database all in your cuckoo3 folder (where install.sh is located). Please do let me know if it worked.

— Reply to this email directly, view it on GitHub https://github.com/cert-ee/cuckoo3/issues/93#issuecomment-2213991687, or unsubscribe https://github.com/notifications/unsubscribe-auth/AUYOQRRU2OS2PHJUVWRJ3BDZLKDLPAVCNFSM6AAAAABJTFTQYOVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDEMJTHE4TCNRYG4 . You are receiving this because you were mentioned.Message ID: @.***>

cert-ee-raidar commented 2 days ago

Follow the Machine adding command in the documentation - https://cuckoo-hatch.cert.ee/static/docs/installation/vmcreation/ and your $CWD/conf/machineries/qemu.yaml should be populated with correct information

HadyElMaageny commented 2 days ago

I have followed it but I can't get The filepath to the machine memory snapshot can you help me, please ?

On Mon, Jul 8, 2024 at 6:45 PM rkivistik @.***> wrote:

Follow the Machine adding command in the documentation - https://cuckoo-hatch.cert.ee/static/docs/installation/vmcreation/ and your $CWD/conf/machineries/qemu.yaml should be populated with correct information

— Reply to this email directly, view it on GitHub https://github.com/cert-ee/cuckoo3/issues/93#issuecomment-2214482350, or unsubscribe https://github.com/notifications/unsubscribe-auth/AUYOQRQYT6M2RI5I5RR23STZLKXX5AVCNFSM6AAAAABJTFTQYOVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDEMJUGQ4DEMZVGA . You are receiving this because you were mentioned.Message ID: @.***>

Cryss76 commented 2 days ago

Cuckoo has two machinery modules regarding qemu:

the snapshot is found at path /var/lib/libvirt/qemu/snapshot/win10-2/snapshot3.xml

@HadyElMaageny This isn't the snapshot. This is a description/config file of the actual snapshot. Because of this I believe you're using libvirt for your VMs. Therefore the problem is that you are trying to use the qemu module for libvirt stuff.

Change cuckoo to use the libvirt module and configure it to fix this.

cert-ee-raidar commented 2 days ago

@Cryss76 I will look into it to resolve the ambiguity, thank you for pointing it out. @HadyElMaageny please open a new issue if the problem persists and above suggestion does not work. This issue has been resolved.

cert-ee-raidar commented 1 day ago

@HadyElMaageny If you need further assistance with your setup, please email us at cuckoo3[at]cert.ee and ask to be added to our Cuckoo3 chat.