Open albertososa95 opened 2 days ago
Try to disable capa in processing and reprocess a job just as test
CAPA disabled in processing and submited new sample with default options. Now it has a timeout:
I think that CAPA is not the problem, since my sample is a .doc, so this error message is correct from CAPA. Anyway, I'm working with snapshots (CAPE-host is a VM) and I notice that this error starts since I installed Volatility3 and flare-floss via poetry:
$ sudo -u cape poetry run pip install -U volatility3 flare-floss
Will be it related?
could be, i don't use capa, floss neither volatility integrations so idk in which state those plugins are
So, if I understand the memory analysis with Volatility should be done outside CAPE-host, right?
well you can use that in cape, but the thing here is that i don't maintain things that i don't use, is just unreal, so sometime community or other people must help support updated version of those libraries, it should works with the versions that is in pyproject, but if you install newer, then that's not ensured by us.
Ok perfect. I confirm that if I install Volatility, the cape-processor crashes.
Hi again! I setup tmpfs for memory dump analysis with Volatility and it doesn't crash due to timeout now.
News... I check that some Volatility modules configured in memory.conf are crashing MongoDB reports (first log error in this issue).
what modules crashing it? yes tmpfs speedup a lot processing of memdumps, but bear in mind as much plugins you enable, you might need to consider increase timeout from 900 to higher value
malfind is the first module that causes the crash. If you see the first screenshot in the issue, the exception is throwed at deepcopy
function. Maybe there is a mismatch between libraries versions and expected data structures (?)
Probably it returns something that wasn't converted to json
Mm, not sure about that. I tried to replace the deepcopy
with a JSON dump and load (only for test purposes) and it doesn't throw exceptions - errors. I've all modules enabled in memory.conf
and it shows all information in web interface.
That's interesting, hm would need to investigate once I have some spare time
El jue, 27 jun 2024, 14:35, Alberto Sosa @.***> escribió:
Mm, not sure about that. I tried to replace the deepcopy with a JSON dump and load (only for test purposes) and it doesn't throw exceptions - errors. I've all modules enabled in memory.conf and it shows all information in web interface.
— Reply to this email directly, view it on GitHub https://github.com/kevoreilly/CAPEv2/issues/2188#issuecomment-2194565285, or unsubscribe https://github.com/notifications/unsubscribe-auth/AAOFH3YYYGPLGMAVSWL47CTZJQBHTAVCNFSM6AAAAABJ5XJYRSVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDCOJUGU3DKMRYGU . You are receiving this because you commented.Message ID: @.***>
Prerequisites
Please answer the following questions for yourself before submitting an issue.
Expected Behavior
Finished analysis with reports.
Current Behavior
When I submit a sample to analize, an unhandled exception is throwed. See Failure Logs section. I've installed Volatility3 to full memory dump analysis.
Steps to Reproduce
Please provide detailed steps for reproducing the issue.
Context
Config files:
cuckoo.conf
auxiliary.conf
kvm.conf
memory.conf
processing.conf
reporting.conf
web.conf
Failure Logs