An OS X analyzer for Cuckoo Sandbox project
Branch: master
Clone or download
rodionovd Minor code cleanup
Thanks pylint!
Latest commit fabbbe8 Aug 25, 2015
Type Name Latest commit message Commit time
Failed to load latest commit information.


Build Status GitHub version Code Climate My GSoC project aiming at building an OS X analyzer for Cuckoo Sandbox project.

⚠️ WIP ⚠️


See also: and

Guest machine setup
  1. Install pt_deny_attach kernel extension suggested by @phretor. That's an optional step, see this comment for more details.

  2. Since this analyser uses some utilities that require additional privileges to run, you may want to enable passwordless sudo for them. This may be accomplished by modifying /etc/sudoers file:

--- a/etc/sudoers
+++ b/etc/sudoers
@@ -43,3 +43,5 @@ root  ALL=(ALL) ALL
# Samples
# %users  ALL=/sbin/mount /cdrom,/sbin/umount /cdrom
# %users  localhost=/sbin/shutdown -h now
+ username   ALL=(root) NOPASSWD: /usr/sbin/dtrace
+ username   ALL=(root) NOPASSWD: /bin/date

(replace username above with an actual user name).

  1. Set the network settings: IP address, subnet mask, router address and DNS servers:
$ sudo networksetup -setmanual Ethernet
$ sudo networksetup -setdnsservers Ethernet

Also, if you're using VirtualBox: don't forget to setup your host-only internet adapter and attach it to the guest machine.

  1. Download and launch Cuckoo's
$ curl -o /Users/Shared/
$ python /Users/Shared/
  1. Take a VM snapshot. It's cmd+T for VirtualBox.
On the host side (OS X)
  1. Setup internet traffic forwarding to and from your guest machine. Here's an example of using pfctl to forward traffic to and from vboxnet0 interface:
$ sudo sysctl -w net.inet.ip.forwarding=1

$ rules="nat on en1 from vboxnet0:network to any -> (en1)
pass inet proto icmp all
pass in on vboxnet0 proto udp from any to any port domain keep state
pass quick on en1 proto udp from any to any port domain keep state"

$ echo "$rules" > ./pfrules
$ sudo pfctl -e -f ./pfrules
$ rm -f ./pfrules

Note that you'll have to re-enable traffic forwarding every time you reboot the host machine.

  1. Clone this repository:
$ git clone ~/cuckoo-osx-analyzer
# Or (if you prefer SSH):
# $ git clone cuckoo-osx-analyzer
  1. Symlink analyzer/darwin directory from this repository to your own copy of Cuckoo Sandbox:
$ cd /path/to/cuckoo/sandbox/
$ cd ./analyzer
$ ln -s ~/cuckoo-osx-analyzer/analyzer/darwin darwin
  1. Submit an analysis job:
$ ./utils/ --platform darwin ~/bin/sample

Adding custom API signatures

You can add custom API signatures and define data types in signatures.json and types.yml files.


You can run the test suite with nose:

$ cd ./cuckoo-osx-analyzer
$ sudo -H pip install -r requirements.txt
$ nosetests

NOTE: Running Cuckoo integration tests requires Cuckoo to be installed in the same directory as the analyzer itself:

$ ls cuckoo cuckoo-osx-analyzer

See also: [`.travis.yml`]( and [Travis CI project](

### Roadmap, issues and reports  

See my [weekly reports]( and [Issues](


Dmitry Rodionov,