FAQ

For something that does not work, see Troubleshooting.

Running samples

Can I run Windows programs? No. The guests are Linux x86-64. A program needs a compatible architecture, interpreter and shared libraries. See Antinomie and other sandboxes for tools aimed at Windows.

Does Antinomie need root? No. It runs as your user, including the network routes. Building a base with Docker needs the docker group, which is root-equivalent; Podman is tried first for that reason.

Do I need KVM? It is strongly recommended. Without /dev/kvm, choose TCG in the VM’s settings or start the app with --tcg; guests run much slower.

Can I run two VMs at once? No. One VM runs at a time.

Is anything installed or run in the guest to watch the program? No agent, no ptrace and no monitor process: the recorder is part of the guest kernel. Only bases built before 0.7.0 get a temporary collector uploaded for the Summary’s resource figures. See How Antinomie works.

Can a sample tell it is being analysed? It may. Stealth profiles change what the guest can read of its hardware, and the kernel hides its own traces, but timing, CPUID and other signs remain. The stealth window lists what is still visible. See Stealth profile.

Does Antinomie decide whether a file is malicious? No. Findings, rule matches and reports are leads to investigate, not verdicts. In 0.8.0 the verdict tag of a sample is yours to set.

What is recorded

Are 32-bit or x32 system calls decoded? No. Only the native x86-64 table is covered. See Known gaps.

Is an absent call proof it did not happen? No. Check the loss counters and capture statuses. See Recording incomplete.

Does a recording contain passwords? It can. Buffers and terminal input are recorded, so anything typed into a monitored program or handled by the sample can be in it. See Recordings contain secrets.

Can Antinomie decrypt TLS? No. Packet captures and Triage show TLS metadata such as server names and fingerprints, not the content, and the bytes a program writes to a TLS socket are already encrypted when they reach the kernel. TLS decryption is a roadmap candidate, not a feature.

What does Antinomie send over the Internet? Nothing about your analyses. Downloads of bases, tools, rules and datasets happen only when you ask (the Getting started window reads the base catalog on first launch), Volatility may look up a symbol table, and a run’s route decides the sample’s traffic. See the security model.

Data

Where is my data? In ~/antinomie by default, or the folder given to --data-dir. See Data folders and run layout.

Can I open a run after deleting its VM? Yes. Delete VM removes the configuration, disk and snapshots but keeps the run recordings and terminal history.

Why is the archive password infected? It is the usual convention for sharing malware. The sample library’s archives and the dropped files in an evidence bundle use it to stop accidental opening and scanning, not to keep anyone out. 7-Zip and similar tools open the AES archives; Info-ZIP unzip cannot.

Is the custody log proof against tampering? It is tamper-evident, not tamper-proof: an edited, removed or reordered entry is found, but someone who rewrites the whole library can rewrite both chains. Keep the head hash somewhere else. See Custody log.

Versions

Which version should I use? The current release is 0.7.1. 0.8.0 is in development; these pages describe it and mark what is new. See What’s new in 0.8.0.

Do my bases keep working after an update? Yes. Updating the app never replaces a base or a VM’s disk. A base built for an older version is labelled Outdated and lacks only the features that need a newer guest. See Compatibility and Upgrading.

Is there a command-line or headless mode? Not for analysis. The antinomie command has options for the data folder, a dependency check and base import; see Command line. A headless, API and web mode is a roadmap candidate, not a promise.