Starting CAPE

Make sure to run it inside CAPE’s root directory:

$ cd /opt/CAPEv2

To start CAPE, use the command:

$ python3 cuckoo.py

You will get an output similar to this:

Cuckoo Sandbox 2.1-CAPE
www.cuckoosandbox.org
Copyright (c) 2010-2015

CAPE: Config and Payload Extraction
github.com/kevoreilly/CAPEv2

2020-07-06 10:24:38,490 [lib.cuckoo.core.scheduler] INFO: Using "kvm" machine manager with max_analysis_count=0, max_machines_count=10, and max_vmstartup_count=10
2020-07-06 10:24:38,552 [lib.cuckoo.core.scheduler] INFO: Loaded 100 machine/s
2020-07-06 10:24:38,571 [lib.cuckoo.core.scheduler] INFO: Waiting for analysis tasks.

Now CAPE is ready to run and it’s waiting for submissions.

cuckoo.py accepts some command line options as shown by the help:

usage: cuckoo.py [-h] [-q] [-d] [-v] [-a] [-t] [-m MAX_ANALYSIS_COUNT]

optional arguments:
-h, --help            show this help message and exit
-q, --quiet           Display only error messages
-d, --debug           Display debug messages
-v, --version         show program's version number and exit
-a, --artwork         Show artwork
-t, --test            Test startup
-m MAX_ANALYSIS_COUNT, --max-analysis-count MAX_ANALYSIS_COUNT
                        Maximum number of analyses

Most importantly --debug and --quiet respectively increase and decrease the logging verbosity.

Poetry users

If you used poetry to install dependencies, you should launch cape with the following command:

$ sudo -u cape poetry run python3 cuckoo.py

If you get any dependency-related error, make sure you execute the extra/libvirt_installer.sh script:

$ sudo -u cape poetry run extra/libvirt_installer.sh

Troubleshooting

`PermissionError: [Errno 13] Permission denied: '/opt/CAPEv2/log/cuckoo.log'`

You are not executing the CAPE (cuckoo.py) file with the appropriate user.

Remember that the user meant to execute CAPE is the cape user. In fact, after installing CAPE with cape2.sh, the directory should look similar to the following structure:

In order to execute CAPE as the cape user you can either launch a shell or execute the following command (notice the command is using Poetry):

$ sudo -u cape poetry run python3 cuckoo.py

`CuckooCriticalError: Cannot bind ResultServer on port 2042 because it was in use, bailing`

CAPE is already running in the background as cape.service

If you want to see the logs in realtime printed to stdout, stop the service by running the following command:

$ sudo systemctl stop cape.service

and run cuckoo.py again

`CuckooCriticalError: Unable to bind Result server on <IP> [Errno 99]`

Check the cuckoo.conf configuration file again.

You will have to provide the host IP for the [resultserver], not the guest IP.

Starting processing data generated by virtual machine

See -h for all latest options, for better customization:

usage: process.py [-h] [-c] [-d] [-r] [-s] [-p PARALLEL] [-fp] [-mc MAXTASKSPERCHILD] [-md] [-pt PROCESSING_TIMEOUT] id

positional arguments:
id                    ID of the analysis to process (auto for continuous processing of unprocessed tasks).

optional arguments:
-h, --help            show this help message and exit
-c, --caperesubmit    Allow CAPE resubmit processing.
-d, --debug           Display debug messages
-r, --report          Re-generate report
-s, --signatures      Re-execute signatures on the report
-p PARALLEL, --parallel PARALLEL
                        Number of parallel threads to use (auto mode only).
-fp, --failed-processing
                        reprocess failed processing
-mc MAXTASKSPERCHILD, --maxtasksperchild MAXTASKSPERCHILD
                        Max children tasks per worker
-md, --memory-debugging
                        Enable logging garbage collection related info
-pt PROCESSING_TIMEOUT, --processing-timeout PROCESSING_TIMEOUT
                        Max amount of time spent in processing before we fail a task

Command example:

$ python3 utils/process.py -p7 auto