Export and use with other tools
Reports, evidence bundles and custody records New in 0.8.0
Section titled “Reports, evidence bundles and custody records ”| What | How | You get |
|---|---|---|
| A whole run’s Triage | Triage → Export report… | HTML, PDF, JSON (versioned schema), a MISP event and a STIX 2.1 bundle, in <recording>/report/ or a folder you choose. See Report export. |
| The run’s evidence | Evidence bundle in the same dialog | NAME-evidence.zip: the packet captures, the dropped files in an inner AES-256 zip (password infected), the sample’s custody record and a SHA-256 manifest |
| A sample’s custody log | Export custody record… in the sample window | JSON with verify-custody.py, or HTML; optionally signed with your own minisign or SSH key. See Custody log. |
| A file as the run left it | Reconstruct contents… → Save reconstruction… | The reconstructed file and a .mask of the bytes that are not known, in reconstructed/ in the recording. See File Reconstruction. |
| A sample’s bytes | View content in the sample window, Copy page | The page as text, hex dump, strings, C array, Python bytes, Base64 or hex string |
| A dropped file as a sample | Add to Samples… on a lineage node | A new library sample read from the run’s saved disk dump. See The sample library. |
Reports and bundles are of the whole run, whatever the screen’s filters show. Defanging applies to HTML and PDF only; JSON, MISP and STIX keep raw values. Nothing in a report is a verdict.
Copy and export from the app
Section titled “Copy and export from the app”| From | How |
|---|---|
| A captured value | Right-click, Open data…, choose a format and Copy (text, hex, hexdump, C array, Base64, escaped) |
| A number | Right-click for common numeric forms |
| A static analysis report | Export report…: Plain text (.txt), Structured results (.json), Native Ghidra project (.gpr + .rep) |
| One analysis category | Export category… |
| A core’s functions | Export functions, or a native Ghidra project export |
| Triage properties | Copy value or Copy properties as JSON |
| Triage indicators | Export… in Triage → IOC: the listed rows as CSV or JSON, with dataset dates and verdicts, in the run’s ioc folder |
| A detection result | Result → Copy result as JSON, and Copy rule in a finding’s details |
| A Volatility result | Copy value, Copy row, or copy the page as text or tab-separated |
| A Sigma event | Copy fields, or Open file for the whole journal |
| A rule pack | Export manifest on the Detection rules page |
| A file in a guest disk | Save to host… in the Disks tab |
| A disk dump | Save image to host…: a sparse raw copy or a compressed qcow2 |
| A partition of a guest disk | Save partition to host… |
| Anything else | Open result directory and copy the files |
Exports include all retained rows, not just the visible page, and never overwrite an existing file.
Wireshark
Section titled “Wireshark”The Network tab shows packets as the installed TShark parses them, so its
Protocol and Info columns and its details tree match Wireshark. Open in
Wireshark opens a capture in an installed Wireshark. You can also open the
.pcap yourself: use Open PCAP directory on the capture to find it.
Antinomie never modifies the pcap; the <capture>.pcap.view folder beside it
is only a cache of the parsed list. Encrypted traffic stays encrypted. Capture
times are QEMU’s capture clock.
Volatility 3
Section titled “Volatility 3”The Memory panel runs Volatility 3 for you and keeps each plugin’s result with
the dump. To use the dump elsewhere, take memory.elf from the dump’s folder
(Open folder). For a Linux guest, Volatility needs a symbol table matching the
guest kernel; Antinomie keeps one with each base where it can, and Look up symbol
tables online lets Volatility fetch one.
Ghidra
Section titled “Ghidra”Static analysis keeps a native Ghidra project when Ghidra was used. Open in Ghidra opens an exported working copy, so the retained original stays unchanged. Process cores can be disassembled in place and decompiled with Ghidra; exported projects use your account’s ownership metadata so Ghidra can reopen them.
Disk images
Section titled “Disk images”A disk dump from the Disks tab is a plain sparse ext4
image, root.ext4, in the dump’s folder. Save image to host… writes a
sparse raw copy (holes stay holes) or a compressed standalone qcow2 made with
qemu-img. Files saved from a guest disk are private copies (mode 0600) and
never executable. Treat a guest image as hostile: mount it read-only, on a
machine you can afford to lose.
Your own debugger
Section titled “Your own debugger”Run → Attach debugger… shows a ready-to-paste command such as
gdb -ex 'target remote 127.0.0.1:PORT'. gdb, IDA, Ghidra and radare2 can
connect to that local server, which accepts connections only from processes of
your user. See Debugger.
Handle exports as evidence
Section titled “Handle exports as evidence”An export may contain the sample’s secrets and payloads. A report, an evidence bundle and a saved reconstruction are plain files wherever you save them (reports and bundles are owner-only); the outer zip of a bundle is not encrypted. See Recordings contain secrets.