From 23d779c2186498872390742bf3c0f28a6fa86699 Mon Sep 17 00:00:00 2001 From: "Barry J. Grundy" Date: Thu, 12 May 2022 17:52:54 +0100 Subject: [PATCH] system/volatility3: Added (memory extraction utility framework.) Signed-off-by: Dave Woodfall Signed-off-by: Willy Sudiarto Raharjo --- system/volatility3/README | 18 +++++ system/volatility3/slack-desc | 19 +++++ system/volatility3/volatility3.SlackBuild | 96 +++++++++++++++++++++++ system/volatility3/volatility3.info | 10 +++ 4 files changed, 143 insertions(+) create mode 100644 system/volatility3/README create mode 100644 system/volatility3/slack-desc create mode 100644 system/volatility3/volatility3.SlackBuild create mode 100644 system/volatility3/volatility3.info diff --git a/system/volatility3/README b/system/volatility3/README new file mode 100644 index 0000000000..84e96b75a4 --- /dev/null +++ b/system/volatility3/README @@ -0,0 +1,18 @@ +Volatility Framework - Volatile memory extraction utility framework. + +Volatility is the world's most widely used framework for extracting +digit artifacts from volatile memory (RAM) samples. The extraction +techniques are performed completely independent of the system being +investigated but offer visibility into the runtime state of the system. +The framework is intended to introduce people to the techniques and +complexities associated with extracting digital artifacts from volatile +memory samples and provide a platform for further work into this +exciting area of research. + +In 2019, the Volatility Foundation released a complete rewrite of the +framework, Volatility3. + +The following are optional dependancies: + - capstone + - jsonschema + diff --git a/system/volatility3/slack-desc b/system/volatility3/slack-desc new file mode 100644 index 0000000000..bef7201ed3 --- /dev/null +++ b/system/volatility3/slack-desc @@ -0,0 +1,19 @@ +# HOW TO EDIT THIS FILE: +# The "handy ruler" below makes it easier to edit a package description. +# Line up the first '|' above the ':' following the base package name, and +# the '|' on the right side marks the last column you can put a character in. +# You must make exactly 11 lines for the formatting to be correct. It's also +# customary to leave one space after the ':' except on otherwise blank lines. + + |-----handy-ruler------------------------------------------------------| +volatility3: volatility3 (memory extraction utility framework.) +volatility3: +volatility3: volatility3 is the world's most widely used framework for extracting +volatility3: digit artifacts from volatile memory (RAM) samples. The extraction +volatility3: techniques are performed completely independent of the system being +volatility3: investigated but offer visibility into the runtime state of the +volatility3: system. +volatility3: +volatility3: Volatility3 is a complete rewrite of the original Volatility +volatility3: Framework. +volatility3: diff --git a/system/volatility3/volatility3.SlackBuild b/system/volatility3/volatility3.SlackBuild new file mode 100644 index 0000000000..776678f2d0 --- /dev/null +++ b/system/volatility3/volatility3.SlackBuild @@ -0,0 +1,96 @@ +#!/bin/bash + +# Slackware build script for volatility3 +# Copyright 2022 Barry Grundy +# All rights reserved. +# +# Redistribution and use of this script, with or without modification, is +# permitted provided that the following conditions are met: +# +# 1. Redistributions of this script must retain the above copyright +# notice, this list of conditions and the following disclaimer. +# +# THIS SOFTWARE IS PROVIDED BY THE AUTHOR ''AS IS'' AND ANY EXPRESS OR IMPLIED +# WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF +# MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO +# EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, +# PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; +# OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, +# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR +# OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF +# ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. +# +# Initial version - 2.0.1, May 2022 + +cd $(dirname $0) ; CWD=$(pwd) + +PRGNAM=volatility3 +VERSION=${VERSION:-2.0.1} +BUILD=${BUILD:-1} +TAG=${TAG:-_SBo} +PKGTYPE=${PKGTYPE:-tgz} + +if [ -z "$ARCH" ]; then + case "$( uname -m )" in + i?86) ARCH=i586 ;; + arm*) ARCH=arm ;; + *) ARCH=$( uname -m ) ;; + esac +fi + +# If the variable PRINT_PACKAGE_NAME is set, then this script will report what +# the name of the created package would be, and then exit. This information +# could be useful to other scripts. +if [ ! -z "${PRINT_PACKAGE_NAME}" ]; then + echo "$PRGNAM-$VERSION-$ARCH-$BUILD$TAG.$PKGTYPE" + exit 0 +fi + +TMP=${TMP:-/tmp/SBo} +PKG=$TMP/package-$PRGNAM +OUTPUT=${OUTPUT:-/tmp} + +if [ "$ARCH" = "i586" ]; then + SLKCFLAGS="-O2 -march=i586 -mtune=i686" + LIBDIRSUFFIX="" +elif [ "$ARCH" = "i686" ]; then + SLKCFLAGS="-O2 -march=i686 -mtune=i686" + LIBDIRSUFFIX="" +elif [ "$ARCH" = "x86_64" ]; then + SLKCFLAGS="-O2 -fPIC" + LIBDIRSUFFIX="64" +else + SLKCFLAGS="-O2" + LIBDIRSUFFIX="" +fi + +set -e + +rm -rf $PKG +mkdir -p $TMP $PKG $OUTPUT +cd $TMP +rm -rf $PRGNAM-$VERSION +tar xvf $CWD/$PRGNAM-$VERSION.tar.gz +cd $PRGNAM-$VERSION +chown -R root:root . +find -L . \ + \( -perm 777 -o -perm 775 -o -perm 750 -o -perm 711 -o -perm 555 \ + -o -perm 511 \) -exec chmod 755 {} \; -o \ +\( -perm 666 -o -perm 664 -o -perm 640 -o -perm 600 -o -perm 444 \ + -o -perm 440 -o -perm 400 \) -exec chmod 644 {} \; + +python3 setup.py install --root=$PKG + +find $PKG -print0 | xargs -0 file | grep -e "executable" -e "shared object" | grep ELF \ + | cut -f 1 -d : | xargs strip --strip-unneeded 2> /dev/null || true + +mkdir -p $PKG/usr/doc/$PRGNAM-$VERSION +cp -a README.md LICENSE.txt $PKG/usr/doc/$PRGNAM-$VERSION +cat $CWD/$PRGNAM.SlackBuild > $PKG/usr/doc/$PRGNAM-$VERSION/$PRGNAM.SlackBuild + +mkdir -p $PKG/install +cat $CWD/slack-desc > $PKG/install/slack-desc + +cd $PKG +/sbin/makepkg -l y -c n $OUTPUT/$PRGNAM-$VERSION-$ARCH-$BUILD$TAG.$PKGTYPE diff --git a/system/volatility3/volatility3.info b/system/volatility3/volatility3.info new file mode 100644 index 0000000000..b9facbb408 --- /dev/null +++ b/system/volatility3/volatility3.info @@ -0,0 +1,10 @@ +PRGNAM="volatility3" +VERSION="2.0.1" +HOMEPAGE="https://github.com/volatilityfoundation/volatility3" +DOWNLOAD="https://github.com/volatilityfoundation/volatility3/archive/v2.0.1/volatility3-2.0.1.tar.gz" +MD5SUM="28a4380d3c059b7715b6d36e5a9e7ea7" +DOWNLOAD_x86_64="" +MD5SUM_x86_64="" +REQUIRES="pefile python3-pycrypto pycryptodomex python3-yara" +MAINTAINER="Barry J. Grundy" +EMAIL="bgrundy AT linuxleo.com"