guardicore / monkey

Infection Monkey - An open-source adversary emulation platform
https://www.guardicore.com/infectionmonkey/
GNU General Public License v3.0
6.67k stars 785 forks source link

Remove the agent bootloader #1676

Closed mssalvatore closed 2 years ago

mssalvatore commented 2 years ago

Description

Infection Monkey agents are built with PyInstaller. PyInstaller includes a small binary called a bootloader that's tasked with bootstraping the binary. Infection Monkey has a custom bootloader whose goal is to provide a minimal amount of feedback in the event that it runs on a system that's so old it can't support the PyInstaller binary. This has a few drawbacks:

  1. The bootloader code (written in C) is full of mismanaged memory. Sometimes these memory errors cause bugs that are difficult to diagnose.
  2. We maintain a fork of PyInstaller in order to use the custom bootloader.
  3. The bootloader is an extra step in agent startup that can sometimes cause delays of 1 minute or more per victim.
  4. It exists only to support legacy systems, most of which are no longer supported by the manufacturer.

At this time, the effort to rebuild the bootloader to alleviate some of these issues is not worth the cost. Remove the bootloader; we can add a similar feature back in later if the need arises.

Tasks

Notes

Don't waste any time worrying about the 32-bit binaries, since they will be removed in #1675

mssalvatore commented 2 years ago

Resolving this issue would also resolve #1039.

acepace commented 2 years ago

@mssalvatore if you drop this, do you want the matching feature to detect we're attacking a really old machine that obviously shouldn't be online?

mssalvatore commented 2 years ago

@acepace Nah. There are a couple of approaches to that, and we haven't decided exactly what we'll do yet. My main goal at the moment is to speed up the development process as much as possible, and this feature is more effort to maintain than it's worth. At some future time, we'll reevaluate our approach to supporting legacy systems.