5 ms·
What are the advantages of using this over Cuckoo Sandbox, or Anubis?
by eugenekolo2 11y ago
What are the advantages of using this over Cuckoo Sandbox, or Anubis?
- vill1 11y agoMaybe the biggest advantage is the plugin system and how those can be hooked to the execution. Developer focuses on writing a LEGO brick that can be used as a part of execution. Also different plugins do not need to care about existence of other plugins, but on the other hand those plugins can be chained by firing and listening to events.
- eugenekolo2 11y agoCuckoo supports plugins too, I wrote up a summary of them here: https://www.eugenekolo.com/blog/cuckoo-sandbox-notes/#div_custom https://www.eugenekolo.com/blog/cuckoo-sandbox-notes/#div_cu.... Can also edit the Analyzer/monitor part to add in new function hooks.
- noxdafox 11y agoCuckoo is a full-feature behaviour analysis platform which supports extensions via plugins. SEE is a modular and flexible framework for building sandboxed test automation against generic software. Focus of SEE design is to speed up the development of behavioural analysis platforms. It allows to choose between several different sandboxing technologies and provides a plugin-based event-driven architecture in order to control them. SEE is for developers and not for users. If you want an out-of-the-box solution for analysing malware you choose Cuckoo. If you want to develop your own analysis platform, you better try out SEE.