Cuckoo: auxiliary module (guest side) that adds events

[Tigzy]

Hello,
I'm trying to gather some additional custom data from guest machine by writing an auxiliary module (/analyzer/windows/modules/auxiliary).

The only examples I have don't add any data to the .bson logs, so I have no idea how to achieve this. The only code doing that is located into cuckoo monitor (C code), I have no idea how to send messages to the PipeEvent Logs from the python scripts.

Is it even possible?
Thoughts?

[jbremer]

What kind of information would you like to return to the host? As an Auxiliary module you can access the Analyzer instance through self.analyzer which in turn allows access to a couple of features.
Alternatively you could upload any content you like through the lib.common.results's NetlogFile - this way naturally the content will be accessible as a file.

[Tigzy]

The information is still to be determined, but consider anything that is accessible from the guest.
What do you mean accessible as a file, is there a way to specify file name? Do you have an example?

[jbremer]

Something like the following should do the trick.

nf = NetlogFile("hello.txt")
nf.send("test")

[Tigzy]

I'll try that, thanks that helps!
Maybe you could document auxiliary for guest in customization wiki?

[Tigzy]

To be noted that the exact code should be:

nf = NetlogFile("<some_folder>/hello.txt")
nf.send("test")

otherwise there's an exception of banned path.

[jbremer]

Closing this as resolved, thanks!

[Tigzy]

Hey, reopening since it looks like NetLogFile has been removed? What's the alternate way now?