Configuration

Since VMCloak 0.3 it no longer uses configuration files for simply creating VMs. However, a couple of things remain necessary to be performed before invoking VMCloak.

Mounting the ISO Image

In order to mount a Windows Installer ISO image a directory should be created with root, and then the image should be mounted on that directory, with root as well. The following bash snippet depicts how to setup an ISO mount on a Ubuntu/Debian system.

mkdir /mnt/winxp
mount -o loop,ro winxp.iso /mnt/winxp

In order to mount an image under BSD the following commands might be required.

mkdir /mnt/winxp
vnconfig /dev/vnd0d winxp.iso
mount -t cd9660 /dev/vnd0d /mnt/winxp

Serial Key

--serial-key specifies the serial key to be used to install Windows in the Virtual Machine. Although it is possible to randomize the serial key after the installation has been finished, a valid serial key is required during installation, and often times there is no one serial key to rule them all, thus make sure to have a valid serial key at hand.

VM Name

The Virtual Machine name represents the unique identifier for this VM. This value is the extra argument on the command line, e.g., cuckoo1 in vmcloak -s conf.ini cuckoo1.

Semi-required configuration entries

A few configuration entries are not required, but should in most cases be provided.

Guest hostonly IP address

The IP address to assign to the Guest is set by --hostonly-ip. It defaults to 192.168.56.101, which is perfectly fine when one only intends to create one VM. However, if one wants to create multiple VMs, then the static IP addresses should be unique. Normally one would start counting at 192.168.56.101 to 192.168.56.102, 192.168.56.103, etc.

Guest hostonly Gateway

The Gateway IP for the Guest to use. Set by --hostonly-gateway

Guest hostonly network mask

The Network mask for the Guest to use. Set by --hostonly-mask

Guest hostonly MAC address

The MAC address for the guest to use. Set by --hostonly-macaddr

Host host-ip

The IP address of the vboxnet interface for communication between guest and host. The communication is relevant for the installation process to finish. Set by --host-ip

Suggested configuration entries

Following are various configuration entries that are not necessary, but allow one to do some custom modifications on the guest VM, which can be quite useful if one needs to make a special VM for a custom analysis.

RAM Size

With --ramsize one can specify the required RAM size of the VM in megabytes. By default this value will be set to 1024 (which results to 1 GB of RAM).

Resolution

--resolution sets the resolution of the VM. By default the resolution will be set to 1024x768, a not too uncommon resolution if your PC was bought in the year 2006.

Harddrive Size

--hdsize allows one to specify the harddrive size of the VM in megabytes. As the created harddrive is enlarged in size on-demand, rather than allocating all of the specified space at once, it doesn’t really matter whether one puts 32 GB or 256 GB. By default this value is set to 256 GB, but this does mean that if at some point a VM really needs the 256 GB that the harddrive shouldn’t run out of space.

Hardware Virtualization

If one hasn’t enabled VT-x in the BIOS then it is not possible to use hardware virtualization. If one gets such error, then provide --no-hwvirt. To explicitly enable hardware virtualization provide --hwvirt. In the config file disable it with hwvirt = false.

Keyboard Layout

By default the --keyboard-layout defaults to US. See Keyboard Layout possibilities for a list of all available keyboard layouts.

Cuckoo Sandbox configuration entries

These configuration entries are related to direct interaction with Cuckoo Sandbox as VMCloak has the ability to automatically add the created VM to Cuckoo Sandbox.

Cuckoo Directory

In order to add a created VM automatically to Cuckoo Sandbox one must run a recent version of Cuckoo Sandbox (1.2-dev or higher) which ships the ./utils/machine.py utility script. The --cuckoo argument accepts a path to the root of your Cuckoo Sandbox setup to interact with Cuckoo Sandbox.

Tags

Optionally --tags adds tags for the created VM when registering it with Cuckoo Sandbox. For example, if you install the dotnet40 (.NET v4.0) and adobepdf (Adobe PDF Reader) dependencies in your VM, then you might want to represent this in its Cuckoo Sandbox tags as dotnet,adobe or something like this. For more information on tags, see the official Cuckoo Sandbox documentation.

No Register Cuckoo

If the --cuckoo argument is not provided, or it is provided but the created VM should not be registered with Cuckoo Sandbox, then the --no-register-cuckoo argument allows one to do that.

DNS Server

By default the generated Virtual Machine will use Google’s 8.8.8.8 DNS Server. This can be changed through --dns-server.

Debugging configuration entries

As is there’s not much debugging one can do. This limits one to visual debugging as described as per Visible VM Generation.

Visible VM Generation

The --vm-visible argument, if specified, runs the Virtual Machine in GUI mode instead of headless mode (terms as per VirtualBox.) This allows one to monitor the installation as it goes.

Often times the installation will hang at the serial key dialog. This is the case when the conf-serial-key provided is incorrect. At this point VMCloak is unable to detect it when this happens.