esReven Project Manager

Table of content

Importing & exporting a scenario

A recorded scenario can be exported, with or without some associated replayed resources. The resulting archive can then be shared with other Reven users or stored away to free space on your working disk.

By default, the directory where archive files are stored is $DATA/reven/Reven2/Archives where $DATA is the main storage folder for esReven, as configured in the .env file at the root of the esReven installation.

Conversely, all archive files stored in the archives directory can be imported as scenarios to be analyzed with Reven.

A typical scenario archive will usually take between 500 MB and 1 GB. For instance, the scenario presented in the article Analysing CVE-2020-15999 - buffer overflow in Chrome requires about 30 GB of disk space when fully replayed, but its archive is only about 750 MB.

Exporting

To export a scenario:

  1. First, open your scenario's "Details" page. You can find it by clicking the scenario's name in the scenario list.
  2. Click "Export".
  3. The export page allows you to select what you want to export. You should keep the defaults.
    • The "OSSI" is selected by default, and highly recommended:
      • If not selected, you will not be able to get symbols after importing the archive.
      • If you cannot select it, you should first replay the OSSI on your scenario and come back to the export page.
    • See below for more details on the other items.
  4. Click on "Export the scenario".
  5. Wait for the operation to finish.

Once the export operation is done, you can access the resulting archive:

NOTES:

Importing

The Project Manager can import archives that were previously exported using the above method. This operation will create a new scenario, and extract the archive into it.

To import a scenario you can upload the scenario archive using the Project Manager:

  1. In the "Scenario Manager" page, click on "Import from archive".
  2. Use the "Upload scenario archive" form:
    1. Optionally set a "New name" for the archive
    2. Click "Browse" to select the file on your local machine
    3. Click "Upload" to start the upload.
  3. After the upload is complete, the scenario import starts automatically.
  4. Wait for the import task to finish.
  5. Archives usually do not contain all replayable resources: you should open the Replay page of the newly created scenario and click on "Replay" all.

You can also manually import a scenario:

  1. Copy the archive to your $DATA/reven/Reven2/Archives directory (see above).
  2. In the "Scenario List" page, click on "Import from archive".
  3. Use the combo-box to select the archive you want to import.
    • If you cannot see it, make sure it is in the correct $DATA/reven/Reven2/Archives directory (see above).
  4. Click on "Import".
  5. Wait for the task to finish.
  6. Archives usually do not contain all replayable resources: you should open the Replay page of the newly created scenario and click on "Replay" all.

NOTES:

About exported resources

Here are more details about the resources you can select for export in a scenario:

The archive will also always include information about the scenario (name, type, os, archi, ...) and Reven's version, necessary for later importing.

Some resources are immutable after importing an archive, because they cannot be regenerated. Hence, they cannot be deleted in the imported scenario. For instance, the OSSI's light filesystem is an immutable resource because it depends on the snapshot.