Liveview

Thanks to this SANS ISC story, I learned of Liveview. It's a program that converts disk images made with dd into VMware images.

I decided to try the program on one of the images from Real Digital Forensics. We provide two images on the DVD: JBRWWW.dd.gz and BRJDEV.dd.gz. JBRWWW.dd.gz is a Windows image. Since we had to zero out Windows binaries in that image, it can't be booted. BRJDEV.dd.gz is a Linux image. The Liveview Web site shows there is "limited" support for Linux, but I decided to see how far I could get.

Before gunzipping BRJDEV.dd.gz, I needed to patch it. For some reason the copy on the book DVD is corrupted. I followed the instructions at realdigitalforensics.com to patch the image.


orr:/home/richard$ ls -al *.gz
-rw-rw-rw-  1 richard  richard  181673834 Aug 29 15:06 BRJDEV.dd.gz
-rw-rw-rw-  1 richard  richard  389144043 Aug 29 14:34 JBRWWW.dd.gz

orr:/home/richard$ ls -al patch0001.bin 
-rw-r--r--  1 richard  richard  42635114 Mar  7 12:16 patch0001.bin
orr:/home/richard$ dd if=patch0001.bin of=BRJDEV.dd.gz bs=512 seek=271560 
83271+1 records in
83271+1 records out
42635114 bytes transferred in 5.059636 secs (8426518 bytes/sec)

orr:/home/richard$ ls -al *.gz
-rw-rw-rw-  1 richard  richard  181673834 Aug 29 15:26 BRJDEV.dd.gz
-rw-rw-rw-  1 richard  richard  389144043 Aug 29 14:34 JBRWWW.dd.gz

orr:/home/richard$ md5 BRJDEV.dd.gz
MD5 (BRJDEV.dd.gz) = 3f274b39803068d69f8b62730e101d64

Since BRJDEV.dd.gz had the proper MD5 hash, I moved it over to my Windows station, gunzipped it, and then ran Liveview. I tried to run Liveview on FreeBSD (it's Java), but I saw too many errors. Liveview is easy enough to use. I pointed it at the proper .dd file, and told it where I wanted the image produced.

Liveview built a .vmx file, a .vmdk file, and told VMware Server where to find the new VM. At this point it looked ready to start, so I fired up VMware Server.

Things started to proceed well. I got a Linux bootloader image, so something was working. The Linux kernel started to load too.

Unfortunately, I didn't get very far. Eventually Linux reported a kernel panic and complained that it was unable to mount the root filesystem.

I believe I would have more success if I used an image of a Windows system, but I do not have one handy.

While writing this blog I found dd2vmdk, a project with similar goals. I bet VMware's P2V might import dd images, but I'm not sure.

Comments

Anonymous said…
I wouldn't necessarily blame Liveview as the problem. It looks like a VMWare/Linux kernel incompatibility issue. I've had something similar happen with other sata hardware and the initrd ramdisk on RHEL 4. I steer towards VMWare driver compatibility as the issue of not being able to mount the filesystem. The 'request_module[ide-cd]' followed by 'hdc: driver not present' usually means that the driver hasn't been loaded as it should be.
8:16 PM
Anonymous said…
I used a Windows image, but it worked fine...but then, I didn't have any modified binaries:
http://windowsir.blogspot.com/2006/08/liveview.html
7:47 AM
Anonymous said…
Also, if you know anything about what partition is supposed to be the boot partition, just pass it at the bootloader: "root=/dev/hda1".

One possibility here is that the image was taken from a system that was configured to boot off of another drive (say hdc) and vmware is now mapping that drive as hda. In that case the root= line I gave above should let the system boot correctly.
1:44 PM
Richard Bejtlich said…
I tried removing the CD-ROM drive from the VMware setup and I also tried passing "linux root=/dev/hda1" to the boot loader. I got the error posted below:

Error image
5:53 AM
Anonymous said…
Same topic, different approach, sanctioned by a "VMWare Champion":

http://www.vmware.com/community/thread.jspa?messageID=15890&
5:31 PM
red said…
This comment has been removed by a blog administrator.
6:31 PM
Richard Bejtlich said…
I'm afraid I don't have the patch referenced in this post.
4:51 PM
Richard Bejtlich said…
Check my books page for links to the original evidence found on the DVD.

https://taosecurity.com/books.html
5:00 PM
Richard Bejtlich said…
Unfortunately, I checked the files in my archive and the files from my own DVD and all the copies of BRJDEV.dd.gz that I have are corrupted.
12:58 PM
Post a Comment

Popular posts from this blog

Zeek in Action Videos

Image
This is a quick note to point blog readers to my Zeek in Action YouTube video series for the Zeek network security monitoring project .  Each video addresses a topic that I think might be of interest to people trying to understand their network using Zeek and adjacent tools and approaches, like Suricata, Wireshark, and so on.  I am especially pleased with Video 6 on monitoring wireless networks . It took me several weeks to research material for this video. I had to buy new hardware and experiment with a Linux distro that I had not used before -- Parrot .  Please like and subscribe, and let me know if there is a topic you think might make a good video.
Read more

MITRE ATT&CK Tactics Are Not Tactics

Image
Just what are "tactics"? Introduction MITRE ATT&CK  is a great resource, but something about it has bothered me since I first heard about it several years ago. It's a minor point, but I wanted to document it in case it confuses anyone else. The MITRE ATT&CK Design and Philosophy document from March 2020 says the following: At a high-level, ATT&CK is a behavioral model that consists of the following core components: • Tactics, denoting short-term, tactical adversary goals during an attack; • Techniques, describing the means by which adversaries achieve tactical goals; • Sub-techniques, describing more specific means by which adversaries achieve tactical goals at a lower level than techniques; and • Documented adversary usage of techniques, their procedures, and other metadata. My concern is with MITRE's definition of "tactics" as "short-term, tactical adversary goals during an attack," which is oddly recursive. The key word in the tacti
Read more

New Book! The Best of TaoSecurity Blog, Volume 4

Image
  I've completed the TaoSecurity Blog book series . The new book is  The Best of TaoSecurity Blog, Volume 4: Beyond the Blog with Articles, Testimony, and Scholarship .  It's available now for Kindle , and I'm working on the print edition.  I'm running a 50% off promo on Volumes 1-3 on Kindle through midnight 20 April. Take advantage before the prices go back up. I described the new title thus: Go beyond TaoSecurity Blog with this new volume from author Richard Bejtlich. In the first three volumes of the series, Mr. Bejtlich selected and republished the very best entries from 18 years of writing and over 18 million blog views, along with commentaries and additional material.  In this title, Mr. Bejtlich collects material that has not been published elsewhere, including articles that are no longer available or are stored in assorted digital or physical archives. Volume 4 offers early white papers that Mr. Bejtlich wrote as a network defender, either for technical or pol
Read more