rabbitstack / fibratus

Adversary tradecraft detection, protection, and hunting
https://www.fibratus.io
Other
2.21k stars 190 forks source link

Documentantion about dev. environment #308

Closed ablescia closed 2 months ago

ablescia commented 2 months ago

Dear @rabbitstack, I am a software developer who would like to actively contribute to the project.

I request the development of documentation that provides guidance on setting up a development environment.

For example, a suggested code editor, necessary tools, and required configurations.

rabbitstack commented 2 months ago

Hi @ablescia,

Thanks for considering contributing to Fibratus! The documentation describes the steps to build Fibratus binary from source. Tldr; If you're not planning to delve into captures, filaments, or YARA scanner you'll just have to set up the Go toolchain.

Contributing guidelines can be find here. I must admit, they are outdated, but I'll try to sort that out soon.

Hope this helps.

ablescia commented 2 months ago

Dear @rabbitstack, Thanks for your reply.

I want to try to solve this issue myself: https://github.com/rabbitstack/fibratus/issues/307

I use Visual Studio code to debug the issue, but when I run the fibratus replay -k C:\capture.kcap command I received the following error: Error: fibratus was compiled without kcap support. Please compile with the 'kcap' build flag

How I can debug the code? I use Delve as debugger.

Thx

rabbitstack commented 2 months ago

If you followed the documentation link on how to build the binary from the source, you might spotted a stanza about build tags. By default, any code involving cgo is enabled by a specific build tag. For captures, you'll have to build the binary with the kcap tag.

Run this from the Powershell terminal:

$env:TAGS="kcap"

Then, recompile the binary. For the full list of build tags, refer to make.bat.

ablescia commented 2 months ago

Dear @rabbitstack,

I tried to follow the documentation and after I set the TAGS env variable inside the launch.json file as follow:

{
    // Use IntelliSense to learn about possible attributes.
    // Hover to view descriptions of existing attributes.
    // For more information, visit: https://go.microsoft.com/fwlink/?linkid=830387
    "version": "0.2.0",
    "configurations": [
        {
            "env": {"TAGS": "kcap"},
            "name": "Launch Package",
            "type": "go",
            "request": "launch",
            "mode": "auto",
            "program": "${fileDirname}",
            "args": ["replay", "-k", "C:\\events.kcap"]
        }
    ]
}

But the problem persists.

I need to debug the code and not build it.

Thx.

rabbitstack commented 2 months ago

I presume VSC launcher runs the Go compiler as is - the -tags option is not populated with the build tags you specified in the env var. This is why I recommend building via make.bat script as it does the heavy lifting of gluing everything together.

ablescia commented 2 months ago

I presume VSC launcher runs the Go compiler as is - the -tags option is not populated with the build tags you specified in the env var. This is why I recommend building via make.bat script as it does the heavy lifting of gluing everything together.

Thanks for your suggestion. But, how do you debug the code step-by-step?

rabbitstack commented 2 months ago

I use GoLand, which is fantastic and has a built-in debugger. But frankly, I heavily rely on tests/TDD that tremendously streamline bug hunting and identification of edge cases.

ablescia commented 2 months ago

Thanks for your suggestion. I think we need to find a way to configure the debugger to support the yara, filaments and kcap module.

In this way, other new developer like me can debug the code step-by-step.

As you know, I find a bug on the replay command that uses the kcap module and I tried to solve the issue from myself.

Without the debugger, for new developer is very difficult to solve this problem.

rabbitstack commented 2 months ago

I hear you and agree with your concerns. I'll put together instructions on how to configure the debugger, along with other contributing guidelines.

ablescia commented 2 months ago

Sounds great! Thank you so much! Can't wait to get started!