Getting ready for analysis with REVEN (3/3): Finalizing the Workflow

Jul 30, 2020
by Louis
Categories: Tutorial -
Tags: Workflow API - Scenario recording -

This video article is part of a series on virtual machine configuration for use with REVEN:

  1. Importing a VM
  2. Lightening the VM for more efficient scenario recording
  3. Finalizing the configuration workflow (this article)

Today’s video contains the last, but not least steps required in the configuration of a VM for use with REVEN.

We will see the creation of a live snapshot that will allow you to avoid booting the VM from scratch before recording a scenario, and the extraction of the filesystem which allows REVEN to recover symbols to display in the trace:

This is the end of this series. By the end of this video, you now have a VM that’s fully ready to record scenarios in REVEN! If you’re interested in how to record scenarios, this previous article will provide you with an introduction.

Running the entire workflow on a VM took me just about 45 minutes. Moreover, a large part of it was spent on unattended operations such as the upload of the VM, its lightening or the filesystem extraction, allowing to work on something else while the configuration is running.

For the part that are interactive, the interaction was mostly filling some information on the VM and clicking Next in the wizard.

I hope you’ll find this streamlined process useful, until next time!

Next post: Timeless Full-System analysis with REVEN and WinDbg
Previous post: Getting ready for analysis with REVEN (2/3): Lightening of the VM