EMBA on ProxMox #847

Lynn-TX · 2023-10-25T15:31:39Z

Lynn-TX
Oct 25, 2023

Trying to get EMBA to work on ProxMox as a VM. Two paths have been taken to rule out import issues.

Path 1)

Import a working Linux Mint VM with EMBA installed into the a ProxMox system that is running several other VM's with no issues. (https://www.proxmox.com/en/)
Converted the Linux Mint .ova file per ProxMox steps and imported into ProxMox with no issues
Fired up the Linux Mint EMBA VM in ProxMox and launched a term window.
./emba -V = 1.3.x

Path 2) (

Created a new ProxMox Kali image (kali-linux2023.3.installer-amd64.iso)
Followed the EMBA install process from https://github.com/e-m-b-a/emba. (on 10/25/2023)
rebooted the Kali VM
cd emba; ./emba -V = 1.3.x

Both Paths above have 23GB RAM and 8 cores allocated to the VM's.

When running the following command on both Path 1 and Path 2, the following error is produced.

    > sudo ./emba -W -f [FIRMWARE] -l [LOG PATH] -p ./scan-profiles/default-scan-long.emba

   > sudo apt -list --installed |grep unblob 
   .... python3-unblob-native/kali-rolling,now 0.1.1-0kali2 amd64 [installed,automatic]
   .... unblob/kali-rolling,now 23.8.11+ds-0kali3 all [installed]

Error on both Path 1 and Path 2

Unblob version Traceback (most recent call last):
File "/external/emba_venv/bin/unblob", line 3, in <module>                                                                                         
from unblob.cli import main                                                          
File "/external/unblob/unblob/cli.py", line 20, in <module>                                                                                                                                            
	from .handlers import BUILTIN_DIR_HANDLERS, BUILTIN_HANDLERS                                                                            
File "/external/unblob/unblob/handlers/__init__.py", line 8, in <module>  
    from .archive.qnap import qnap_nas                                                                                                           
File "/external/unblob/unblob/handlers/archive/qnap/qnap_nas.py", line 81, in <module>                   
hyperscan_stream_end_magic_db = build_stream_end_scan_db(FOOTER_PATTERN)                                                                                      
								^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^          
File "/external/unblob/unblob/handlers/archive/qnap/qnap_nas.py", line 76, in build_stream_end_scan_db                                                 
		return StreamDatabase(                       
				^^^^^^^^^^^^^^^                                                                                                                                            
module.HyperscanCompileError: ('Unsupported architecture', -1) - not supported                                                              
Upgrade your unblob installation to version 23.8.11 or higher

I have no issues with the Linux Mint VM above running under VirtualBox version 7.0.8 r156879 on multiple Linux or Win systems

Any recommendations on how to get a EMBA VM to work on a ProxMox 7.4-3 or newer system?

Answered by Moneysac90

Nov 6, 2023

I was able to resolve this issue by changing the CPU type from default to host in the proxmox settings. Please also see this issue:
e-m-b-a/embark#162

View full answer

m-1-k-3 · 2023-10-25T16:56:46Z

m-1-k-3
Oct 25, 2023
Maintainer

Hi,

Short answer:
interesting test case but we do not support it and we have never tried Linux Mint or ProxMox ;)

Long answer:

module.HyperscanCompileError: ('Unsupported architecture', -1) - not supported

I do not really understand this issue because unblob should be installed with all deps in our docker container.

For better understanding please post every step you did (with output) and which Kali base image you have used.

0 replies

Lynn-TX · 2023-10-25T18:28:16Z

Lynn-TX
Oct 25, 2023
Author

M-1-K-3...
--- Yes, I understand that Linux Mint is not supported, that is why I also did Path 2 with Kali that is supported and I am getting the same errors.

For the group

more details:

The hardware is Dell servers.

dpkg --print-architecture
amd64
dpkg --print-foreign-architectures
i386

When I run the same commands on my laptop via the Kali VirtualBox VM and the Linux Mint VM, I get the following for both.

dpkg --print-architecture
amd64
dpkg --print-foreign-architectures
i386

Thus the generic error of "('Unsupported architecture', -1) - not supported" is not very helpful.
Kali base image = (kali-linux2023.3.installer-amd64.iso

Agreed. I also do not really understand this issue because unblob should be installed with all deps in our docker container. So I am not understanding why I am getting the error from unblob from a default EMBA install?

Even running

unblob --show-external-dependencies

I get the same error as reported above.

0 replies

m-1-k-3 · 2023-10-26T06:23:08Z

m-1-k-3
Oct 26, 2023
Maintainer

looks as your virtual CPU does not support required features: https://support.keriocontrol.gfi.com/hc/en-us/articles/360015178840-IPS-Error-hs-compile-multi-failed-Unsupported-architecture

0 replies

Moneysac90 · 2023-11-06T10:52:57Z

Moneysac90
Nov 6, 2023

I was able to resolve this issue by changing the CPU type from default to host in the proxmox settings. Please also see this issue:
e-m-b-a/embark#162

4 replies

m-1-k-3 Nov 6, 2023
Maintainer

Thank you for the solution. @Lynn-TX does this also work for you?

m-1-k-3 Nov 6, 2023
Maintainer

I included a link to the wiki https://github.com/e-m-b-a/emba/wiki/Installation#random-installation-topics

verysimpleusername Mar 10, 2024

I had the same issue when running Kali Linux on UTM on Macbook Pro, and I managed to solve it by switching the default CPU to host. So this solution also works for UTM.

EDIT: Edited for clarity

Moneysac90 Mar 10, 2024

Macbook Pro with M1 chip I guess? Those cpus are based on the ARM architecture. unblob uses Intel features. Changing to host cpu on a macbook will therefore not work.

Lynn-TX · 2023-11-08T13:36:29Z

Lynn-TX
Nov 8, 2023
Author

Moneysac90... Thank you.
I just tested this "After switching the CPU type from default to host" on our ProxMox system.

Kali EMBA VM = worked fine. Yaaaaa...
Linux Mint 21.2 Cinnamon EMBA VM = no joy.. still not working even though the same VM works several other system. I get the same UNBLOB error (see below).
I will abandon the Linux Mint VM and clone the Kali VM on the ProbMox system.

Thank you again Moneysac90.

============= error from Linux Mint EMBA VM ( from term window buffer) ==============
cpu_rec - ok
unblob - ok
Unblob version Traceback (most recent call last):
File "/external/emba_venv/bin/unblob", line 3, in
from unblob.cli import main
File "/external/unblob/unblob/cli.py", line 20, in
from .handlers import BUILTIN_DIR_HANDLERS, BUILTIN_HANDLERS
File "/external/unblob/unblob/handlers/init.py", line 8, in
from .archive.qnap import qnap_nas
File "/external/unblob/unblob/handlers/archive/qnap/qnap_nas.py", line 81, in
hyperscan_stream_end_magic_db = build_stream_end_scan_db(FOOTER_PATTERN)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/external/unblob/unblob/handlers/archive/qnap/qnap_nas.py", line 76, in build_stream_end_scan_db
return StreamDatabase(
^^^^^^^^^^^^^^^
module.HyperscanCompileError: ('Unsupported architecture', -1) - not supported
Upgrade your unblob installation to version 23.8.11 or higher

./helpers/helpers_emba_dependency_check.sh: line 476: [: 0000000000
0000000000
0000000000
0000000000
0000000000
0000000000
0000000000
0000000000
0000000000
0000000000
0000000000
0000000000
0000000000
0000000000: integer expression expected
unrar - ok
john - ok
pixd visualizer - ok
PHP iniscan - ok
pixd image renderer - ok
progpilot php ini checker - ok
luacheck - ok
patool - ok
EnGenius decryptor - ok
Android payload.bin extractor - ok
Buffalo decryptor - ok
ubireader image extractor - ok
ubireader file extractor - ok
UEFI image extractor - ok
cve-search script - ok
CVE Searchsploit - ok
Routersploit EDB database - ok
Routersploit CVE database - ok
Metasploit CVE database - ok
checksec script - ok
sshdcc script - ok
sudo-parser script - ok
shellcheck script - ok
fdtdump - ok
linux-exploit-suggester.sh script - ok
objdump disassembler - ok
radare2 - ok
bandit - python vulnerability scanner - ok
qemu-[ARCH]-static - ok
yara - ok
cyclonedx - ok
vmlinux-to-elf - ok
STACS hash detection - ok
Python virtual environment - ok

Some dependencies are missing - please check your installation

Looks like your docker container is outdated - please update your base image: sudo docker pull embeddedanalyzer/emba'.
ERROR: 1
[-] EMBA failed in docker mode!

==================================================================

0 replies

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

EMBA on ProxMox #847

{{title}}

Replies: 5 comments 4 replies

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

Select a reply

EMBA on ProxMox #847

Lynn-TX Oct 25, 2023

Both Paths above have 23GB RAM and 8 cores allocated to the VM's.

Error on both Path 1 and Path 2

Replies: 5 comments · 4 replies

m-1-k-3 Oct 25, 2023 Maintainer

Lynn-TX Oct 25, 2023 Author

For the group

m-1-k-3 Oct 26, 2023 Maintainer

Moneysac90 Nov 6, 2023

m-1-k-3 Nov 6, 2023 Maintainer

m-1-k-3 Nov 6, 2023 Maintainer

verysimpleusername Mar 10, 2024

Moneysac90 Mar 10, 2024

Lynn-TX Nov 8, 2023 Author

Lynn-TX
Oct 25, 2023

Replies: 5 comments 4 replies

m-1-k-3
Oct 25, 2023
Maintainer

Lynn-TX
Oct 25, 2023
Author

m-1-k-3
Oct 26, 2023
Maintainer

Moneysac90
Nov 6, 2023

m-1-k-3 Nov 6, 2023
Maintainer

m-1-k-3 Nov 6, 2023
Maintainer

Lynn-TX
Nov 8, 2023
Author