dynamic.py

import shutil
import subprocess
import sys
import os
import glob
import re
import psutil
from conf import *
from memory import *
import time


class Inetsim:
    def __init__(self, inetsim_path):
        self.inetsim_path = inetsim_path
        self.proc = None
        self.log_dir = ""
        self.report_dir = ""

    def clean_log_dir(self, log_dir):
        self.log_dir = log_dir
        current_dir = os.getcwd()
        os.chdir(self.log_dir)
        log_files = glob.glob('*')
        for log_file in log_files:
            if os.path.isfile(log_file):
                os.remove(log_file)
        os.chdir(current_dir)

    def clean_report_dir(self, report_dir):
        self.report_dir = report_dir
        current_dir = os.getcwd()
        os.chdir(self.report_dir)
        report_files = glob.glob('*')
        for report_file in report_files:
            if os.path.isfile(report_file):
                os.remove(report_file)
        os.chdir(current_dir)

    def start(self):
        self.proc = subprocess.Popen([self.inetsim_path])

    def stop(self):
        processes = psutil.process_iter()
        for proc in processes:
            if "inetsim_main" in proc.name():
                proc.terminate()

    def get_inetsim_log_data(self):
        service_log = self.log_dir + "/service.log"
        log_data = open(service_log).read()
        return log_data

    def get_inetsim_report_data(self):
        report_data = ""
        report_files = glob.glob(self.report_dir + "/*")
        for report_file in report_files:
            f = open(report_file)
            report_data += f.read()
            f.close()
        return report_data


class Vmware:

    def __init__(self, host_vmrun_path, host_vmtype, vmpath):
        self.host_vmrun_path = host_vmrun_path
        self.host_vmtype = host_vmtype
        self.vmpath = vmpath
        self.username = ""
        self.password = ""

    def set_credentials(self, username, password):
        self.username = username
        self.password = password

    def revert(self, snapshot):
        proc = subprocess.Popen([self.host_vmrun_path, "-T", self.host_vmtype,
                                "revertToSnapshot", self.vmpath, snapshot], stdout=subprocess.PIPE)
        vm_stdout = proc.communicate()[0]
        if vm_stdout:
            print(vm_stdout)
            print("Exiting the program")
            sys.exit()
        else:
            return 1

    def start(self):
        proc = subprocess.Popen(
            [self.host_vmrun_path, "-T", self.host_vmtype, "start", self.vmpath], stdout=subprocess.PIPE)
        vm_stdout = proc.communicate()[0]
        if vm_stdout:
            print(vm_stdout)
            print("Exiting the program!!!")
            sys.exit()
        else:
            return 1

    def copytovm(self, src, dst):
        proc = subprocess.Popen([self.host_vmrun_path, "-T", self.host_vmtype, "-gu", self.username, "-gp",
                                self.password, "copyFileFromHostToGuest", self.vmpath, src, dst], stdout=subprocess.PIPE)
        vm_stdout = proc.communicate()[0]
        if vm_stdout:
            print(vm_stdout)
            print("Exiting the program")
            sys.exit()
        else:
            return 1

    def copyfromvm(self, src, dst):
        proc = subprocess.Popen([self.host_vmrun_path, "-T", self.host_vmtype, "-gu", self.username, "-gp",
                                self.password, "copyFileFromGuestToHost", self.vmpath, src, dst], stdout=subprocess.PIPE)
        vm_stdout = proc.communicate()[0]
        if vm_stdout:
            print(vm_stdout)
            print("Exiting the program")
            sys.exit()
        else:
            return 1

    def capturescreen(self, dst):
        proc = subprocess.Popen([self.host_vmrun_path, "-T", self.host_vmtype, "-gu", self.username,
                                "-gp", self.password, "captureScreen", self.vmpath, dst], stdout=subprocess.PIPE)
        vm_stdout = proc.communicate()[0]
        if vm_stdout:
            print(vm_stdout)
            print("Exiting the program")
            sys.exit()
        else:
            return 1

    def suspend(self):
        proc = subprocess.Popen([self.host_vmrun_path, "-T", self.host_vmtype,
                                "suspend", self.vmpath], stdout=subprocess.PIPE)
        vm_stdout = proc.communicate()[0]
        if vm_stdout:
            print(vm_stdout)
            print("Exiting the program")
            sys.exit()
        else:
            return 1

    def get_vmmem(self):
        dir_name = os.path.dirname(self.vmpath)
        cur_dir = os.getcwd()
        os.chdir(dir_name)
        files = glob.glob("*.vmem")
        for each_file in files:
            if "Snapshot" not in each_file:
                mem_file = each_file
        vmmem_path = os.path.join(dir_name, mem_file)
        os.chdir(cur_dir)
        return vmmem_path

    def stop(self):
        proc = subprocess.Popen(
            [self.host_vmrun_path, "-T", self.host_vmtype, "stop", self.vmpath], stdout=subprocess.PIPE)
        vm_stdout = proc.communicate()[0]
        if vm_stdout:
            print(vm_stdout)
            print("Exiting the program")
            sys.exit()
        else:
            return 1

    def list_dir(self, dir_name):
        proc = subprocess.Popen([self.host_vmrun_path, "-T", self.host_vmtype, "-gu", self.username,
                                "-gp", self.password, "listDirectoryInGuest", self.vmpath, dir_name], stdout=subprocess.PIPE)
        vm_stdout = proc.communicate()[0]
        dirs = vm_stdout.split(b'\n')
        return dirs

    def get_log_files_from_dir_list(self, dir_list):
        log_files = []
        for each_file in dir_list:
            value = each_file.find(b'.scap')
            value1 = each_file.find(b'.txt')
            if value != -1 or value1 != -1:
                log_files.append(each_file)
        return log_files

    def list_process_guest(self):
        listprocess = subprocess.Popen([self.host_vmrun_path, "-T", self.host_vmtype, "-gu", self.username,
                                       "-gp", self.password, "listProcessesInGuest", self.vmpath], stdout=subprocess.PIPE)
        processes = listprocess.communicate()[0]
        process_list = processes.split(b'\r\n')
        for process in process_list:
            print(process)

    def stop_sysdig(self):
        regexp = re.compile(r'pid=(?P<pid>\d+).*sysdig')
        listprocess = subprocess.Popen([self.host_vmrun_path, "-T", self.host_vmtype, "-gu", self.username,
                                       "-gp", self.password, "listProcessesInGuest", self.vmpath], stdout=subprocess.PIPE)
        processes = listprocess.communicate()[0]
        process_list = processes.split(b'\r\n')
        for process in process_list:
            match = regexp.search(process)
            if match:
                pid = match.group('pid')
        subprocess.check_call([self.host_vmrun_path, "-T", self.host_vmtype, "-gu",
                              self.username, "-gp", self.password, "killProcessInGuest", self.vmpath, pid])

    def execute_file(self, mal_file, args):
        cmd = [self.host_vmrun_path, "-T", self.host_vmtype, "-gu", self.username, "-gp", self.password, "runProgramInGuest", self.vmpath, '-nowait', '-activeWindow', '-interactive',
               mal_file]
        cmd.extend(args)
        subprocess.check_call(cmd)

    def execute_sysdig(self, sysdig_file, cap_filter, cap_out_file, filter_file_name):
        cap_filter = cap_filter + " " + \
            "and (proc.name=" + filter_file_name + " " + \
            "or proc.aname=" + filter_file_name + ")"
        subprocess.check_call([self.host_vmrun_path, "-T", self.host_vmtype, "-gu", self.username, "-gp", self.password, "runProgramInGuest", self.vmpath, '-noWait', '-activeWindow', '-interactive',
                               sysdig_file, cap_filter, "-w", cap_out_file])

    def execute_sysdig_full(self, sysdig_file, cap_out_file, filter_file_name):
        cap_filter = "proc.name=" + filter_file_name + \
            " " + "or proc.aname=" + filter_file_name
        subprocess.check_call([self.host_vmrun_path, "-T", self.host_vmtype, "-gu", self.username, "-gp", self.password, "runProgramInGuest", self.vmpath, '-noWait', '-activeWindow', '-interactive',
                               sysdig_file, cap_filter, "-w", cap_out_file])

    def execute_strace(self, strace_path, strace_out_file, strace_filter, print_hexdump, mal_file, args):
        if print_hexdump:
            cmd = [self.host_vmrun_path, "-T", self.host_vmtype, "-gu", self.username, "-gp", self.password, "runProgramInGuest", self.vmpath, '-noWait', '-activeWindow', '-interactive',
                   strace_path, "-o", strace_out_file, strace_filter, "-s", "64", "-eread=all", "-ewrite=all", "-f", mal_file]
        else:
            cmd = [self.host_vmrun_path, "-T", self.host_vmtype, "-gu", self.username, "-gp", self.password, "runProgramInGuest", self.vmpath, '-noWait', '-activeWindow', '-interactive',
                   strace_path, "-o", strace_out_file, strace_filter, "-s", "216", "-f", mal_file]

        cmd.extend(args)
        subprocess.check_call(cmd)

    def execute_strace_full(self, strace_path, strace_out_file, print_hexdump, mal_file, args):
        if print_hexdump:
            cmd = [self.host_vmrun_path, "-T", self.host_vmtype, "-gu", self.username, "-gp", self.password, "runProgramInGuest", self.vmpath, '-noWait', '-activeWindow', '-interactive',
                   strace_path, "-o", strace_out_file, "-s", "64", "-eread=all", "-ewrite=all", "-f", mal_file]
        else:
            cmd = [self.host_vmrun_path, "-T", self.host_vmtype, "-gu", self.username, "-gp", self.password, "runProgramInGuest", self.vmpath, '-noWait', '-activeWindow', '-interactive',
                   strace_path, "-o", strace_out_file, "-s", "216", "-f", mal_file]
        cmd.extend(args)
        subprocess.check_call(cmd)

    def read_capture_and_dump(self, host_sysdig_path, capture_out_file, capture_out_txt_file, cap_format):
        cap_format = '"' + cap_format + '"'
        cmd = host_sysdig_path + " " + "-p" + cap_format + " " + \
            "-r" + " " + capture_out_file + " > " + capture_out_txt_file
        p = subprocess.Popen(cmd, shell=True)
        p.wait()

    def get_calltrace_activity(self, outfile_path):
        results = open(outfile_path).read()
        return results


class Tshark:
    def __init__(self, tshark_path, out_pcap):

        if not os.path.isfile(tshark_path):
            print("cannot find tshark in %s" % tshark_path)
            print("Exiting the program")
            sys.exit()

        self.tshark_path = tshark_path
        self.out_pcap = out_pcap
        self.proc = None

    def start_tshark(self, iface, ip):
        self.proc = subprocess.Popen(
            [self.tshark_path, '-i', iface, '-w', self.out_pcap, '-f', 'host %s' % ip])

    def stop_tshark(self):
        if self.proc != None:
            self.proc.terminate()

    def dns_summary(self):
        proc = subprocess.Popen(
            [self.tshark_path, '-r', self.out_pcap, '-R', "dns.qry.name"], stdout=subprocess.PIPE)
        dns_queries = proc.communicate()[0]
        return dns_queries

    def tcp_conv(self):
        proc = subprocess.Popen([self.tshark_path, '-z', 'conv,tcp',
                                '-r', self.out_pcap, '-q', '-n'], stdout=subprocess.PIPE)
        tcp_conversations = proc.communicate()[0]
        return tcp_conversations

    def http_requests(self):
        proc = subprocess.Popen([self.tshark_path, '-r', self.out_pcap, '-R', "http.request",
                                '-Tfields', '-e', 'ip.src', '-e', 'ip.dst', '-e', 'http.host'], stdout=subprocess.PIPE)
        http_requests = proc.communicate()[0]
        return http_requests

    def httpreq_tree(self):
        proc = subprocess.Popen(['tshark', '-z', 'http_req,tree',
                                '-r', self.out_pcap, '-q', '-n'], stdout=subprocess.PIPE)
        http_request_tree = proc.communicate()[0]
        return http_request_tree


class Tcpdump:
    def __init__(self, tcpdump_path, out_pcap):

        if not os.path.isfile(tcpdump_path):
            print("cannot find tcpdump in %s" % tcpdump_path)
            print("Exiting the program")
            sys.exit()

        self.tcpdump_path = tcpdump_path
        self.out_pcap = out_pcap
        self.proc = None

    def start_tcpdump(self, iface, ip):
        self.proc = subprocess.Popen(
            [self.tcpdump_path, '-n', '-i', iface, 'host %s' % ip,  '-w', self.out_pcap])

    def stop_tcpdump(self):
        if self.proc != None:
            self.proc.terminate()

    def dns_summary(self):
        proc = subprocess.Popen(
            [self.tcpdump_path, '-n', '-r', self.out_pcap, "udp and port 53"], stdout=subprocess.PIPE)
        dns_queries = proc.communicate()[0]
        return dns_queries

    def tcp_conv(self):
        proc = subprocess.Popen(
            [self.tcpdump_path, '-n', '-q', '-r', self.out_pcap, "tcp"], stdout=subprocess.PIPE)
        tcp_conversations = proc.communicate()[0]
        return tcp_conversations


class Fileregmon:

    def __init__(self, host_vmrun_path, host_vmtype, vmpath, username, password):
        self.host_vmrun_path = host_vmrun_path
        self.host_vmtype = host_vmtype
        self.vmpath = vmpath
        self.username = username
        self.password = password
        self.file_path = ""

    def get_filereg_activity(self, outfile_path):
        results = open(outfile_path).read()
        return results


def dynamic(file, is_femonitor=False, is_ufemonitor=False, timeout=15, print_hexdump=False, is_perl_script=False, is_python_script=False, is_php_script=False, is_shell_script=False, is_bash_script=False, is_lkm=False, internet=True, is_full_strace=False, is_ver_memfor=False, is_memfor=False):
    try:
        params = [file]
        response = {
            "result": {

            }
        }
        if is_perl_script:
            file_path = analysis_perl_path
            mal_file = file
            file_name = os.path.basename(mal_file)
            params[0] = analysis_mal_dir + '/' + file_name
            analysis_file_path = file_path

        elif is_python_script:
            file_path = analysis_py_path
            mal_file = file
            file_name = os.path.basename(mal_file)
            params[0] = analysis_mal_dir + '/' + file_name
            analysis_file_path = file_path

        elif is_php_script:
            file_path = analysis_php_path
            mal_file = file
            file_name = os.path.basename(mal_file)
            params[0] = analysis_mal_dir + '/' + file_name
            analysis_file_path = file_path

        elif is_shell_script:
            file_path = analysis_sh_path
            mal_file = file
            file_name = os.path.basename(mal_file)
            params[0] = analysis_mal_dir + '/' + file_name
            analysis_file_path = file_path

        elif is_bash_script:
            file_path = analysis_bash_path
            mal_file = file
            file_name = os.path.basename(mal_file)
            params[0] = analysis_mal_dir + '/' + file_name
            analysis_file_path = file_path

        elif is_lkm:
            file_path = analysis_insmod_path
            mal_file = file
            file_name = os.path.basename(mal_file)
            params[0] = analysis_mal_dir + '/' + file_name
            analysis_file_path = file_path

        else:
            file_path = file
            mal_file = file
            params = []
            os.chmod(file_path, 0o0777)
            file_name = os.path.basename(file_path)
            analysis_file_path = analysis_mal_dir + "/" + file_name

        filter_file_name = os.path.basename(file_path)

        if not (is_perl_script or is_python_script or is_shell_script or is_bash_script or is_php_script):
            is_elf_file = True

        new_report_dir = report_dir + "/" + file_name+"-report"
        if os.path.isdir(new_report_dir):
            shutil.rmtree(new_report_dir)
        os.mkdir(new_report_dir)
        final_report = new_report_dir + "/final_report.txt"
        desk_screenshot_path = new_report_dir + "/desktop.png"
        pcap_output_path = new_report_dir + "/output.pcap"
        capture_output_path = new_report_dir + "/capture_output.txt"

        f = open(final_report, 'w')

        f.write(
            "==========================[DYNAMIC ANALYSIS RESULTS]==========================\n\n")

        analysis_vm = Vmware(host_vmrunpath, host_vmtype, host_analysis_vmpath)
        analysis_vm.set_credentials(analysis_username, analysis_password)
        analysis_vm.revert("cleansnapshot")
        print("Starting virtual machine for analysis")
        if analysis_vm.start():
            print("...done...")

        print("Waiting for all the services to start")
        time.sleep(12)

        analysis_copy_file_path = analysis_mal_dir + '/' + file_name

        print("transferring file to virtual machine")
        if analysis_vm.copytovm(mal_file, analysis_copy_file_path):
            print("...done...")

        if is_femonitor:
            analysis_vm.execute_sysdig(
                analysis_sysdig_path, cap_filter, analysis_capture_out_file, filter_file_name)
            print("starting monitoring on the analysis machine")
            time.sleep(3)

        if is_ufemonitor:
            analysis_vm.execute_sysdig_full(
                analysis_sysdig_path, analysis_capture_out_file, filter_file_name)
            print("starting monitoring on the analysis machine")
            time.sleep(3)

        net = Tcpdump(host_tcpdumppath, pcap_output_path)
        print("starting Network Monitor")
        net.start_tcpdump(host_iface_to_sniff, analysis_ip)
        time.sleep(5)

        print("executing file for " + str(timeout) + " seconds")

        if is_femonitor or is_ufemonitor:
            analysis_vm.execute_file(analysis_file_path, params)
            time.sleep(timeout)
            print("...done...")

        elif is_full_strace:
            analysis_vm.execute_strace_full(
                analysis_strace_path, analysis_strace_out_file, print_hexdump, analysis_file_path, params)
            time.sleep(timeout)
            print("...done...")

        else:
            analysis_vm.execute_strace(analysis_strace_path, analysis_strace_out_file,
                                       strace_filter, print_hexdump, analysis_file_path, params)
            time.sleep(timeout)
            print("...done...")

        if is_femonitor or is_ufemonitor:
            print("stopping monitoring")
            analysis_vm.stop_sysdig()
            time.sleep(4)

        print("stopping Network Monitor")
        net.stop_tcpdump()
        time.sleep(3)

        dirs = analysis_vm.list_dir(analysis_log_outpath)
        log_files = analysis_vm.get_log_files_from_dir_list(dirs)
        print(log_files)
        if log_files:
            for log_file in log_files:
                log_file_path = (analysis_log_outpath +
                                 '/' + log_file.decode())
                report_file_path = (new_report_dir + '/' + log_file.decode())
                if analysis_vm.copyfromvm(log_file_path, report_file_path):
                    print("successfully copied %s to report directory " %
                          log_file)

        if is_femonitor or is_ufemonitor:
            cap_name = os.path.basename(analysis_capture_out_file)
            capture_out_file = (new_report_dir + '/' + cap_name.decode())
            fname, ext = os.path.splitext(cap_name)
            fname += ".txt"
            capture_out_txt_file = (new_report_dir + '/' + fname.decode())
            analysis_vm.read_capture_and_dump(
                host_sysdig_path, capture_out_file, capture_out_txt_file, cap_format)
            print("Dumped the captured data to the %s" % capture_out_txt_file)

        f.write("CALL TRACE ACTIVITIES\n")
        f.write("=======================================\n")

        if is_femonitor or is_ufemonitor:
            sysdig_trace = analysis_vm.get_calltrace_activity(
                capture_out_txt_file)
            print(sysdig_trace)
            f.write(sysdig_trace)
            f.write("\n")
            response['result']['sysdig_trace'] = {
                'result': sysdig_trace
            }

        else:
            strace_fname = os.path.basename(analysis_strace_out_file)
            strace_out_fname = new_report_dir + "/" + strace_fname
            strace_output = analysis_vm.get_calltrace_activity(
                strace_out_fname)
            print(strace_output)
            f.write(strace_output)
            f.write("\n")
            response['result']['strace_output'] = {
                'result': strace_output
            }

            print("capturing desktop screenshot")
            if analysis_vm.capturescreen(desk_screenshot_path):
                print("done, desktop screenshot saved as %s" %
                      desk_screenshot_path)

            print("suspending virtual machine")
            if analysis_vm.suspend():
                print("...done...")

            f.write("\n")
            print("NETWORK ACTIVITY")
            f.write("NETWORK ACTIVITIES\n")
            f.write("=======================================\n\n")

            f.write("DNS SUMMARY\n")
            f.write("=======================================\n\n")
            dns_summary = net.dns_summary()
            print(dns_summary)
            f.write(dns_summary.decode())
            response['result']['dns_summary'] = {
                'result': dns_summary.decode()
            }
            f.write("\n")
            f.write("TCP CONVERSATIONS\n")
            f.write("=======================================\n\n")
            tcp_conversations = net.tcp_conv()
            print(tcp_conversations)
            f.write(tcp_conversations.decode())
            response['result']['tcp_conversations'] = {
                'result': tcp_conversations.decode()
            }
            f.write("\n")

            if is_memfor or is_ver_memfor:

                f.write(
                    "=======================[MEMORY ANALYSIS RESULTS]=======================\n\n")

                print("Starting Memory Analysis using Volatility")
                vol = Volatility(py_path, vol_path,
                                 analysis_vm.get_vmmem(), mem_image_profile)

                f.write("PSLIST\n")
                f.write("=======================================\n\n")
                pslist = vol.pslist()
                print(pslist)
                f.write(pslist.decode())
                f.write("\n")

                f.write("PSTREE\n")
                f.write("=======================================\n\n")
                pstree = vol.pstree()
                print(pstree)
                f.write(pstree.decode())
                f.write("\n")

                f.write("Pid Hash Table\n")
                f.write("=======================================\n\n")
                pidhashtable = vol.pidhashtable()
                print(pidhashtable)
                f.write(pidhashtable.decode())
                f.write("\n")

                f.write("PROCESS COMMAND LINE ARGUMENTS\n")
                f.write("=======================================\n\n")
                psaux = vol.psaux()
                print(psaux)
                f.write(psaux.decode())
                f.write("\n")

                f.write("PSXVIEW\n")
                f.write("=======================================\n\n")
                psxview = vol.psxview()
                print(psxview)
                f.write(psxview.decode())
                f.write("\n")

                f.write("PROCESS ENVIRONMENT\n")
                f.write("=======================================\n\n")
                psenv = vol.psenv()
                print(psenv)
                f.write(psenv.decode())
                f.write("\n")

                f.write("THREADS\n")
                f.write("=======================================\n\n")
                threads = vol.threads()
                print(threads)
                f.write(threads.decode())
                f.write("\n")

                f.write("NETWORK CONNECTIONS\n")
                f.write("=======================================\n\n")
                connections = vol.netstat()
                print(connections)
                f.write(connections.decode())
                f.write("\n")

                f.write("INTERFACE INFORMATION\n")
                f.write("=======================================\n\n")
                ifconfig = vol.ifconfig()
                print(ifconfig)
                f.write(ifconfig.decode())
                f.write("\n")

                f.write("PROCESSES WITH RAW SOCKETS\n")
                f.write("=======================================\n\n")
                raw_sockets = vol.list_raw()
                print(raw_sockets)
                f.write(raw_sockets.decode())
                f.write("\n")

                f.write("LIBRARY LIST\n")
                f.write("========================================\n\n")
                lib_list = vol.library_list()
                print(lib_list)
                f.write(lib_list.decode())
                f.write("\n")

                f.write("Ldrmodules\n")
                f.write("========================================\n\n")
                ldrmodules = vol.ldrmodules()
                print(ldrmodules)
                f.write(ldrmodules.decode())
                f.write("\n")

                f.write("KERNEL MODULES\n")
                f.write("=========================================\n\n")
                modules = vol.lsmod()
                print(modules)
                f.write(modules.decode())
                f.write("\n")

                f.write("MODULES HIDDEN FROM MODULE LIST (PRESENT IN SYSFS)\n")
                f.write("=========================================\n\n")
                chk_modules = vol.check_modules()
                print(chk_modules)
                f.write(chk_modules.decode())
                f.write("\n")

                f.write("MODULES HIDDEN FROM MODULE LIST and SYSFS\n")
                f.write("=========================================\n\n")
                hidden_modules = vol.hidden_modules()
                print(hidden_modules)
                f.write(hidden_modules.decode())
                f.write("\n")

                f.write("FILES OPENED WITHIN KERNEL\n")
                f.write("=========================================\n\n")
                krnl_opened_files = vol.kernel_opened_files()
                print(krnl_opened_files)
                f.write(krnl_opened_files.decode())
                f.write("\n")

                f.write("PROCESSES SHARING CREDENTIAL STRUCTURES\n")
                f.write("=========================================\n\n")
                proc_creds = vol.check_creds()
                print(proc_creds)
                f.write(proc_creds.decode())
                f.write("\n")

                f.write("KEYBOARD NOTIFIERS\n")
                f.write("=========================================\n\n")
                key_notfs = vol.keyboard_notifiers()
                print(key_notfs)
                f.write(key_notfs.decode())
                f.write("\n")

                f.write("TTY HOOKS\n")
                f.write("=========================================\n\n")
                tty_hooks = vol.check_tty()
                print(tty_hooks)
                f.write(tty_hooks.decode())
                f.write("\n")

                f.write("SYSTEM CALL TABLE MODIFICATION\n")
                f.write("=========================================\n\n")
                chk_syscall = vol.check_syscall()
                print(chk_syscall)
                f.write(chk_syscall.decode())
                f.write("\n")

                f.write("BASH HISTORY\n")
                f.write("=========================================\n\n")
                bash_hist = vol.bash_history()
                print(bash_hist)
                f.write(bash_hist.decode())
                f.write("\n")

                f.write("MODIFIED FILE OPERATION STRUCTURES\n")
                f.write("=========================================\n\n")
                mod_fop = vol.check_fop()
                print(mod_fop)
                f.write(mod_fop.decode())
                f.write("\n")

                f.write("HOOKED NETWORK OPERTATION FUNCTION POINTERS\n")
                f.write("=========================================\n\n")
                hooked_af = vol.check_afinfo()
                print(hooked_af)
                f.write(hooked_af.decode())
                f.write("\n")

                f.write("NETFILTER HOOKS\n")
                f.write("=========================================\n\n")
                netfilter_hooks = vol.netfilter()
                print(netfilter_hooks)
                f.write(netfilter_hooks.decode())
                f.write("\n")

                f.write("MALFIND\n")
                f.write("=========================================\n\n")
                malfind = vol.malfind()
                print(malfind)
                f.write(malfind.decode())
                f.write("\n")

                if is_ver_memfor:

                    f.write("PLT HOOK\n")
                    f.write("=========================================\n\n")
                    plthooks = vol.plthook()
                    print(plthooks)
                    f.write(plthooks.decode())
                    f.write("\n")

                    f.write("USERLAND API HOOKS\n")
                    f.write("=========================================\n\n")
                    apihooks = vol.apihooks()
                    print(apihooks)
                    f.write(apihooks.decode())
                    f.write("\n")

                    f.write("INLINE KERNEL HOOKS\n")
                    f.write("=========================================\n\n")
                    in_kernel_hooks = vol.check_inline_kernel()
                    print(in_kernel_hooks)
                    f.write(in_kernel_hooks.decode())
                    f.write("\n")

            f.close()

            print("Final report is stored in %s" % new_report_dir)
            return response, 200
    except Exception as e:
        print(e)
        return {"result": "Internal Server Error"}, 500