Cuckoo: How to continue run a program in the virtual machine, even the virtual machine of the sandbox is restarted.

[PointerWild]

My issue is:
I want to continue run a program in the virtual machine, even the virtual machine of the sandbox is restarted. How should I do it?

My Cuckoo version and operating system are:
Ubuntu 16.0.4 / Cuckoo 2.0.5

This can be reproduced by:

The log, error, files etc can be found at:

[RicoVZ]

Hi PointerWild,

To be sure we are talking about the same thing. Do you mean to keep software running in a vm while Cuckoo restarts? Or to keep a Cuckoo analysis running while a vm restarts? If yes, for what kind of duration would the vm be shut down?

[PointerWild]

Hi RicoVZ :
I want to keep software running in a vm while Cuckoo restarts.

[RicoVZ]

That can be tricky, as an analysis is managed by different parts of Cuckoo that keep track of the state of an analysis.
When Cuckoo starts, it starts be checking what vms are available and restores the snapshot for each vm.

If you want to keep your vms running during a Cuckoo restart, you will have to edit the startup of Cuckoo to do this in another way. And, if you want to 'reattach' an analysis to a running vm, you will have to edit the analysis manager, scheduler, guest manager, and startup to add the logic to make this possible.

What is the reason you need to restart Cuckoo during an analysis? I would suggest editing Cuckoo so that you will not have to restart it.

[PointerWild]

My English is poor , I can not explain myself fluently.
Describe my application scene.
I want to continue run a program A in the virtual box, even if the virtual machine of the sandbox is restarted , I hope the program A can restart. How should I do it?
PS: The program A is not to be analysised. It is a assistant to the program which needed analysis to execute and run. Such as clicking on some buttons autoly of the program which needed analysis。

[RicoVZ]

Alright, so if I understand correctly: you want a program to run something in the same vm as the software being analyzed. This to support the running analysis. And, you want this for each analysis.

You can accomplish this by implementing an analyzer Auxiliary module, and starting it in a new thread.
Implement this abstract class: https://github.com/cuckoosandbox/cuckoo/blob/master/cuckoo/data/analyzer/windows/lib/common/abstracts.py#L189.

Have this do what you want. When you are done implementing, place your new Auxiliary module in this folder: https://github.com/cuckoosandbox/cuckoo/tree/master/cuckoo/data/analyzer/windows/modules/auxiliary.

An example of such a module is: https://github.com/cuckoosandbox/cuckoo/blob/master/cuckoo/data/analyzer/windows/modules/auxiliary/human.py.

You said you want your software to click some buttons. The human module already does this. If you add buttons to this list: https://github.com/cuckoosandbox/cuckoo/blob/master/cuckoo/data/analyzer/windows/modules/auxiliary/human.py, this module will attempt to find and click them.

[PointerWild]

Thank you very much !!! It help me a lot!

[RicoVZ]

@PointerWild Great to hear! :smile:

Could you close the issues that have been resolved?

[PointerWild]

Yes ! sure!!