harryr/cockatoo

Torified Cuckoo malware analyser in a Docker container with VirtualBox

Hurr durr

Yurr

Yass, ... but no

Why

cockatoo's Issues

cockatoo ascii art

dear Harry,

Is this wonderful ascii art

    )/_                                                       
   <' \
   /)  )
---/'-""---                                               

your design? If so, do you mind if I use it as illustration in my Cuckoo Cycle project
https://github.com/tromp/cuckoo/tree ?
How would you like it to be attributed?
Thanks!

-John

Add & modify instances automatically when the .opt file changes

VMs are imported into vmcloak and registered with Cuckoo when the container starts, the .opts file next to the .vdi file contains command line options for vmcloak registration.

To make it easier to maintain a Cuckoo instance it should be possible to drop a .vdi and .opt file into the image/ directory and have it automatically detected by vmcloak/cuckoo - snapshotted, registered and available for use by malware.

Create a program which watches the /.vmcloak/image/ directory, when files are added or removed apply those changes to the vmcloak registry. When options are modified they can be changed in the sqlite DB, when .vdi files (or whichever file specified by the .opt file) changes the VM is re-snapshotted.

Something to make managing and backing up VMs as easy as possible.