Quickstart's vmcloak init gets "cannot find card '0'" by ALSA lib

[prantoran]

Describe the bug

I am getting the errors "cannot find card '0' ... Could not initialize DAC ... Failed to open `default': ... Reason: No such file or directory" from ALSA lib.

Most likely my sound card is not up, so is there a way to turn off the dependency on ALSA?

To Reproduce

I tried to two different environments and got the same error in both cases:

1. Ubuntu 22.04 LTS running in KVM-Qemu VM Manager with Ubuntu 24.04 LTS as host
2. Ubuntu 24.04 LTS host directly with manually compiled Python 3.10 and modified Quickstart script.

There were other modifications in the script to bypasee git clone issues such as cloning the dependency packages first and then pip installing from local directory.

Host's sound card details:

# cat /proc/asound/cards
 0 [PCH            ]: HDA-Intel - HDA Intel PCH
                      HDA Intel PCH at 0xdf140000 irq 135

# lspci -v | grep -A7 -i "audio"
00:1f.3 Audio device: Intel Corporation 200 Series PCH HD Audio
	DeviceName: Onboard - Sound
	Subsystem: Micro-Star International Co., Ltd. [MSI] 200 Series PCH HD Audio
	Flags: bus master, fast devsel, latency 32, IRQ 135
	Memory at df140000 (64-bit, non-prefetchable) [size=16K]
	Memory at df120000 (64-bit, non-prefetchable) [size=64K]
	Capabilities: [50] Power Management version 3
	Capabilities: [60] MSI: Enable+ Count=1/1 Maskable- 64bit+
	Kernel driver in use: snd_hda_intel
	Kernel modules: snd_hda_intel, snd_soc_avs

// ALSA version
# cat /proc/asound/version
Advanced Linux Sound Architecture Driver Version k6.8.0-47-generic.

# aplay –list-devices
aplay: main:834: audio open error: Host is down

Expected behavior

This is the first time for me trying out Cuckoo3! 😎 so not sure whether I am on the right path. I searched online and found that we should assign --cpu to host to qemu-system-x86_64 link but I think there is no corresponding flag for vmcloak init.

** My Cuckoo version and operating system are::**
Cuckoo 3.0.1, Ubuntu 22.04

The log, error, files etc can be found at:

### Creating qcow2 image ###
2024-10-25 09:38:53,658 vmcloak INFO: Image IP: 192.168.30.2. Image network: 192.168.30.0/24
2024-10-25 09:38:53,658 vmcloak.abstract DEBUG: Downloading (installation) files for dependency 'python' 
/home/cuckoo/vmcloak/venv/lib/python3.10/site-packages/urllib3/connectionpool.py:1099: InsecureRequestWarning: Unverified HTTPS request is being made to host '127.0.0.1'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
  warnings.warn(
2024-10-25 09:39:21,428 vmcloak.misc DEBUG: Successfully downloaded file 'python-3.10.0-amd64.exe' (27.00MB)' in '27.77' second(s) (1019675.60MB/s)
2024-10-25 09:39:29,720 vmcloak.abstract DEBUG: Executing genisoimage: /usr/bin/genisoimage -quiet -b boot.img -o /home/cuckoo/.vmcloak/iso/win10base.iso -no-emul-boot -iso-level 2 -udf -J -l -D -N -joliet-long -relaxed-filenames /home/cuckoo/.vmcloak/iso/tmpbt078aik
2024-10-25 09:39:34,680 vmcloak INFO: Created ISO: /home/cuckoo/.vmcloak/iso/win10base.iso
2024-10-25 09:39:34,680 vmcloak.platforms.qemu INFO: Create VM instance for win10base
2024-10-25 09:39:34,680 vmcloak.platforms.qemu INFO: Creating disk /home/cuckoo/.vmcloak/image/win10base.qcow2 with size 128G
Formatting '/home/cuckoo/.vmcloak/image/win10base.qcow2', fmt=qcow2 cluster_size=2097152 extended_l2=off compression_type=zlib size=137438953472 lazy_refcounts=on refcount_bits=16
2024-10-25 09:39:34,783 vmcloak.platforms.qemu DEBUG: Execute: qemu-system-x86_64 -monitor stdio -nodefaults -M q35 -vga std -smp 2 -overcommit mem-lock=off -rtc base=localtime,driftfix=slew -m 4096 -netdev type=bridge,br=br0,id=net0 -device rtl8139,netdev=net0,mac=00:0a:f7:35:1a:b5,bus=pcie.0,addr=3 -device ich9-ahci,id=ahci -device ide-hd,bus=ahci.0,unit=0,drive=disk,bootindex=2 -device ide-cd,bus=ahci.1,unit=0,drive=cdrom,bootindex=1 -device usb-ehci,id=ehci -device usb-tablet,bus=ehci.0 -device intel-hda -device hda-duplex -enable-kvm -drive file=/home/cuckoo/.vmcloak/iso/win10base.iso,format=raw,if=none,id=cdrom,readonly=on -drive file=/home/cuckoo/.vmcloak/image/win10base.qcow2,format=qcow2,if=none,id=disk -display none -vnc 0.0.0.0:1
QEMU 6.2.0 monitor - type 'help' for more information
(qemu) qemu-system-x86_64: warning: host doesn't support requested feature: CPUID.80000001H:ECX.svm [bit 2]
qemu-system-x86_64: warning: host doesn't support requested feature: CPUID.80000001H:ECX.svm [bit 2]
ALSA lib confmisc.c:855:(parse_card) cannot find card '0'
ALSA lib conf.c:5178:(_snd_config_evaluate) function snd_func_card_inum returned error: No such file or directory
ALSA lib confmisc.c:422:(snd_func_concat) error evaluating strings
ALSA lib conf.c:5178:(_snd_config_evaluate) function snd_func_concat returned error: No such file or directory
ALSA lib confmisc.c:1334:(snd_func_refer) error evaluating name
ALSA lib conf.c:5178:(_snd_config_evaluate) function snd_func_refer returned error: No such file or directory
ALSA lib conf.c:5701:(snd_config_expand) Evaluate error: No such file or directory
ALSA lib pcm.c:2664:(snd_pcm_open_noupdate) Unknown PCM default
alsa: Could not initialize DAC
alsa: Failed to open `default':
alsa: Reason: No such file or directory
ALSA lib confmisc.c:855:(parse_card) cannot find card '0'
ALSA lib conf.c:5178:(_snd_config_evaluate) function snd_func_card_inum returned error: No such file or directory
ALSA lib confmisc.c:422:(snd_func_concat) error evaluating strings
ALSA lib conf.c:5178:(_snd_config_evaluate) function snd_func_concat returned error: No such file or directory
ALSA lib confmisc.c:1334:(snd_func_refer) error evaluating name
ALSA lib conf.c:5178:(_snd_config_evaluate) function snd_func_refer returned error: No such file or directory
ALSA lib conf.c:5701:(snd_config_expand) Evaluate error: No such file or directory
ALSA lib pcm.c:2664:(snd_pcm_open_noupdate) Unknown PCM default
alsa: Could not initialize DAC
alsa: Failed to open `default':
alsa: Reason: No such file or directory
audio: Failed to create voice `dac'
ALSA lib confmisc.c:855:(parse_card) cannot find card '0'
ALSA lib conf.c:5178:(_snd_config_evaluate) function snd_func_card_inum returned error: No such file or directory
ALSA lib confmisc.c:422:(snd_func_concat) error evaluating strings
ALSA lib conf.c:5178:(_snd_config_evaluate) function snd_func_concat returned error: No such file or directory
ALSA lib confmisc.c:1334:(snd_func_refer) error evaluating name
ALSA lib conf.c:5178:(_snd_config_evaluate) function snd_func_refer returned error: No such file or directory
ALSA lib conf.c:5701:(snd_config_expand) Evaluate error: No such file or directory
ALSA lib pcm.c:2664:(snd_pcm_open_noupdate) Unknown PCM default
alsa: Could not initialize ADC
alsa: Failed to open `default':
alsa: Reason: No such file or directory
ALSA lib confmisc.c:855:(parse_card) cannot find card '0'
ALSA lib conf.c:5178:(_snd_config_evaluate) function snd_func_card_inum returned error: No such file or directory
ALSA lib confmisc.c:422:(snd_func_concat) error evaluating strings
ALSA lib conf.c:5178:(_snd_config_evaluate) function snd_func_concat returned error: No such file or directory
ALSA lib confmisc.c:1334:(snd_func_refer) error evaluating name
ALSA lib conf.c:5178:(_snd_config_evaluate) function snd_func_refer returned error: No such file or directory
ALSA lib conf.c:5701:(snd_config_expand) Evaluate error: No such file or directory
ALSA lib pcm.c:2664:(snd_pcm_open_noupdate) Unknown PCM default
alsa: Could not initialize ADC
alsa: Failed to open `default':
alsa: Reason: No such file or directory
audio: Failed to create voice `adc'
qemu-system-x86_64: -vnc 0.0.0.0:1: Failed to find an available port: Address already in use
2024-10-25 09:39:34,980 vmcloak ERROR: Failed to create 'win10base':
Traceback (most recent call last):
  File "/home/cuckoo/vmcloak/vmcloak/main.py", line 361, in init
    p.create_new_image(name, os, iso_path, attr)
  File "/home/cuckoo/vmcloak/vmcloak/platforms/qemu.py", line 194, in create_new_image
    raise ValueError(m.returncode)
ValueError: 1
2024-10-25 09:39:34,983 vmcloak.platforms.qemu INFO: Cleanup VM win10base

[cert-ee-raidar]

Hey @prantoran
That is normal inside a VM. You do not have a proper card set up. You can safely ignore it for now since it does not affect the image creation. Just spammy.

Your real issue lies in image creation and setting up vnc. Your port is already in use.

Can you expand on this issue?

There were other modifications in the script to bypasee git clone issues such as cloning the dependency packages first and then pip installing from local directory.

[prantoran]

There were other modifications in the script to bypass git clone issues such as cloning the dependency packages first and then pip installing from local directory.

I was running the quickstart script inside KVM-Ubuntu22 VM that is running in Ubuntu 24.04 with a proxy, so probably that lead to slower internet and cause git clones to terminate.

So, I downloaded the repos first and setup locally. Eg.

• For the packages peepdf sflock roach httpreplay, I git cloned them locally, changed ownership to cuckoo user using chmod +x cuckoo $repo and $python_version -m pip install -U /home/cuckoo/\$repo
  • Instead of $python_version -m pip install -U git+https://github.com/cert-ee/\$repo
• Similarly I cloned and changed ownership to cuckoo for the vmcloak and cuckoo3 repos
  • Instead of git clone https://github.com/cert-ee/{cuckoo3, vmcloak}.git
• In /home/cuckoo/vmcloak/venv/lib/python3.10/site-packages/requests, I toggled self.verify to False in __init__() of Session class because it was stopping the download of https://www.python.org/ftp/python/3.10.0/python-3.10.0-amd64.exe when creating qcow2 image in /home/cuckoo/.vmcloak.

[cert-ee-raidar]

Interesting. Thank you for the summary. We might be able to improve a few things based on that.

Did you manage to fix the port in use issue?

[LM-CT]

I'm also having the same problem with the audio card, but I'm running the Ubuntu 22.04 on bare metal, so it's not "VM shenanigans". Besides that, my ALSA version is older, as my kernel is still 5.15.0, per the latest release on Ubuntu 22.04-LTS (Jammy Jellyfish).

user@virt-server:~$ cat /proc/asound/cards 
 0 [PCH            ]: HDA-Intel - HDA Intel PCH
                      HDA Intel PCH at 0x4000100000 irq 151

user@virt-server:~$ lspci -v | grep -A7 -i audio
00:1f.3 Audio device: Intel Corporation Comet Lake PCH cAVS
        Subsystem: Hewlett-Packard Company Comet Lake PCH cAVS
        Flags: bus master, fast devsel, latency 64, IRQ 151
        Memory at 4000100000 (64-bit, non-prefetchable) [size=16K]
        Memory at 4000000000 (64-bit, non-prefetchable) [size=1M]
        Capabilities: <access denied>
        Kernel driver in use: snd_hda_intel
        Kernel modules: snd_hda_intel, snd_sof_pci_intel_cnl

user@virt-server:~$ cat /proc/asound/version 
Advanced Linux Sound Architecture Driver Version k5.15.0-126-generic.

I reckon I didn't do any much analysis on the root causes, but thought it was interesting to report my "+1" experience with this "bug"...

[cert-ee-raidar]

@LM-CT
Thank you for the extra insights. We have not been able to reproduce it on bare metal Ubuntu.

It does not affect any functionality so this is a low priority issue, but I will keep it open.
If we will solve it on VM-s, then I can suggest a fix.

We have experimented changing vmcloak parameters in code to silence the notifications about missing card and it had some success. But it needs a proper fix.

[LM-CT]

Yeah, I agree, low priority.

The use cases for having sound on a malware analysis sandbox are low to nonexistent, haha

[ElMilos]

Hi
same issue i think
my spec are ubuntu 22.04 on Vmware workstation 16
I done update and upgrade commands then install all-in-one System dependencies
after that straight to te quickstart bash command
I choosed option to create non-sudo user named Cuckoo with password
also choosed yes for default VM

now I'm stuck with this

I have waited 15-20 min and still nothing i don't know how long should I wait or do smthg

[cert-ee-raidar]

@ElMilos

The ALSA errors are at most annoying but do not interfere with VM creation in any way.

The process can take up to an hour, depending on your hardware.

You know when its stuck when terminal does not take input like enter key. It can happen when virtualbox encounters a fatal error underneath(can happen with certain kernel versions and virtualbox 7) and then it becomes unresponsive(use top/htop to see if cpu usage has dropped dramatically)

2 cpu and 4gb ram Vagrant toon me on average 45 minutes.