Creating a new scenario

Once you have VMs and Snapshots all set up, you are ready to create new analysis scenarios.

Creating a scenario involves the following steps:

1. Selecting a snapshot to start from, naming and describing the scenario.
2. Listing files that must be loaded on CD-ROM before the scenario recording.
3. Recording the scenario:
   • Starting the VM / Snapshot.
   • Starting recording.
   • Performing scenario operations in the VM.
   • Stopping recording.
   • Stopping the VM / Snapshot.

More on scenario recording

REVEN v2 currently supports manual recording, with start and stop operations explicitly performed by the user.

Recording a scenario in QEMU

With QEMU, start and stop operations are triggered via the Web user interface buttons.

By default, for a record, the VM is launched with the options values of the selected snapshot (ram size, network, custom QEMU options) It is possible to override snapshot options for this specific record before launching the VM. In the Web user interface there are checkboxes and fields that allow to modify the ram size, enable or disable the network or add (QEMU) custom options.

Recording a scenario in VirtualBox

With VirtualBox, start and stop operations are triggered via custom keys, from within the VM:

Inside the VM:

1. Type F9 to enable custom keys which are used to start or stop a recording.
2. Type F6 or Enter to start recording.
3. Type F7 to stop recording. This also stops the VM and closes VirtualBox.

NOTE: Custom keys can be disabled typing F10.