[SM-Commit] GIT changes to master grimoire by Arjan Bouter (ae9ff36173a911aba6c9124bb570d55e632ca40c)

Arjan Bouter scm at sourcemage.org
Tue Sep 20 06:33:58 EDT 2011


GIT changes to master grimoire by Arjan Bouter <abouter at sourcemage.org>:

 ChangeLog                        |    5 +++++
 python-pypi/distorm3/DEPENDS     |    1 +
 python-pypi/distorm3/DETAILS     |   15 +++++++++++++++
 python-pypi/distorm3/HISTORY     |    3 +++
 python-pypi/volatility/DEPENDS   |    5 +++++
 python-pypi/volatility/DETAILS   |   20 ++++++++++++++++++++
 python-pypi/volatility/HISTORY   |    3 +++
 security/yara/DEPENDS            |    2 ++
 security/yara/DETAILS            |   17 +++++++++++++++++
 security/yara/HISTORY            |    3 +++
 windowmanagers/fluxbox/CONFIGURE |    4 ++++
 windowmanagers/fluxbox/HISTORY   |    3 +++
 12 files changed, 81 insertions(+)

New commits:
commit 01711a642204624ad27ba7673c47e0500d66bbba
Author: Arjan Bouter <abouter at sourcemage.org>
Commit: Arjan Bouter <abouter at sourcemage.org>

    fluxbox: remove obsolete --enable-ordered-pseudo from FLUXBOX_OPTS,
    fix for bug #214

commit 24f590e2f5a2d879ff07f53b42ead535327e78d0
Author: Arjan Bouter <abouter at sourcemage.org>
Commit: Arjan Bouter <abouter at sourcemage.org>

    volatility: new spell, volatile memory artifact extraction utility framework

commit b068ff4983b28bc3e61c6e78a6bdd821eaf90638
Author: Arjan Bouter <abouter at sourcemage.org>
Commit: Arjan Bouter <abouter at sourcemage.org>

    yara: new spell, malware research tool

commit 6aad1f89d347926244c69d4fafabe178eb86bdfd
Author: Arjan Bouter <abouter at sourcemage.org>
Commit: Arjan Bouter <abouter at sourcemage.org>

    distorm3: new spell, binary stream disassembler library

diff --git a/ChangeLog b/ChangeLog
index 63ea06d..7bae3b3 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+2011-09-20 Arjan Bouter <abouter at sourcemage.org>
+	* python-pypi/distorm3: new spell, binary stream disassembler library
+	* security/yara: new spell, malware research tool
+	* python-pypi/volatility: new spell, volatile memory artifact extraction utility framework
+
 2011-09-19 Ismael Luceno <ismael at sourcemage.org>
 	* devel/ldasm: new spell, Disassembler GUI
 
diff --git a/python-pypi/distorm3/DEPENDS b/python-pypi/distorm3/DEPENDS
new file mode 100755
index 0000000..a86d429
--- /dev/null
+++ b/python-pypi/distorm3/DEPENDS
@@ -0,0 +1 @@
+depends python
diff --git a/python-pypi/distorm3/DETAILS b/python-pypi/distorm3/DETAILS
new file mode 100755
index 0000000..bda67d6
--- /dev/null
+++ b/python-pypi/distorm3/DETAILS
@@ -0,0 +1,15 @@
+           SPELL=distorm3
+         VERSION=1.0
+          SOURCE="${SPELL}-${VERSION}.zip"
+   SOURCE_URL[0]=http://distorm.googlecode.com/files/${SOURCE}
+     SOURCE_HASH=sha512:56e9640b8f140ab9cf9cbacd205b7caf21a84ad698c1b1b3cf93194c986e4de107e056929742301ee7491c5e9bf75784d712740a2fadec084952ca5382fb7e24
+SOURCE_DIRECTORY="${BUILD_DIRECTORY}/${SPELL}-${VERSION}"
+        WEB_SITE="http://code.google.com/p/distorm/"
+      LICENSE[0]=GPL
+         ENTERED=20110920
+           SHORT="binary stream disassembler library"
+cat << EOF
+From the diStorm3 website: No more parsing strings!  diStorm3 is really
+a decomposer, which means it takes an instruction and returns a binary
+structure which describes it rather than static text.
+EOF
diff --git a/python-pypi/distorm3/HISTORY b/python-pypi/distorm3/HISTORY
new file mode 100644
index 0000000..e912a0c
--- /dev/null
+++ b/python-pypi/distorm3/HISTORY
@@ -0,0 +1,3 @@
+2011-09-20 Arjan Bouter <abouter at sourcemage.org>
+	* DEPENDS, DETAILS: spell created
+
diff --git a/python-pypi/volatility/DEPENDS b/python-pypi/volatility/DEPENDS
new file mode 100755
index 0000000..981cd8c
--- /dev/null
+++ b/python-pypi/volatility/DEPENDS
@@ -0,0 +1,5 @@
+depends python &&
+depends yara &&
+depends distorm3 &&
+depends pycrypto &&
+depends sqlite 
diff --git a/python-pypi/volatility/DETAILS b/python-pypi/volatility/DETAILS
new file mode 100755
index 0000000..8d835a3
--- /dev/null
+++ b/python-pypi/volatility/DETAILS
@@ -0,0 +1,20 @@
+           SPELL=volatility
+         VERSION=2.0
+          SOURCE="${SPELL}-${VERSION}.tar.gz"
+   SOURCE_URL[0]=https://www.volatilesystems.com/${SPELL}/${VERSION}/${SOURCE}
+     SOURCE_HASH=sha512:35a9cda3361fe2968845e0629c5a79360e85d4b1bc7f4d2607fa33eae84b0cfb5aa3f9225785048985c9df8b32bebbef89177669df4c5525cd19fff2680112dc
+SOURCE_DIRECTORY="${BUILD_DIRECTORY}/${SPELL}-${VERSION}"
+        WEB_SITE="https://www.volatilesystems.com/default/volatility"
+      LICENSE[0]=GPL
+         ENTERED=20110920
+           SHORT="Volatile memory artifact extraction utility framework"
+cat << EOF
+The Volatility Framework is a completely open collection of tools, implemented
+in Python under the GNU General Public License, for the extraction of digital
+artifacts from volatile memory (RAM) samples. The extraction techniques are
+performed completely independent of the system being investigated but offer
+unprecedented visibilty into the runtime state of the system. The framework
+is intended to introduce people to the techniques and complexities associated
+with extracting digital artifacts from volatile memory samples and provide
+a platform for further work into this exciting area of research.
+EOF
diff --git a/python-pypi/volatility/HISTORY b/python-pypi/volatility/HISTORY
new file mode 100644
index 0000000..e912a0c
--- /dev/null
+++ b/python-pypi/volatility/HISTORY
@@ -0,0 +1,3 @@
+2011-09-20 Arjan Bouter <abouter at sourcemage.org>
+	* DEPENDS, DETAILS: spell created
+
diff --git a/security/yara/DEPENDS b/security/yara/DEPENDS
new file mode 100755
index 0000000..2fd41a7
--- /dev/null
+++ b/security/yara/DEPENDS
@@ -0,0 +1,2 @@
+depends python &&
+depends pcre
diff --git a/security/yara/DETAILS b/security/yara/DETAILS
new file mode 100755
index 0000000..5ba1a33
--- /dev/null
+++ b/security/yara/DETAILS
@@ -0,0 +1,17 @@
+           SPELL=yara
+         VERSION=1.6
+          SOURCE="${SPELL}-${VERSION}.tar.gz"
+   SOURCE_URL[0]=http://${SPELL}-project.googlecode.com/files/${SOURCE}
+     SOURCE_HASH=sha512:fd599c4873cbd5c8f866bd89ebe3fb988bc22af5b982effdf889f7ba30837847eebd4742ab661c9cda02eeaee331819c8453b8ccf8216a54c2ba7a343b8d6745
+SOURCE_DIRECTORY="${BUILD_DIRECTORY}/${SPELL}-${VERSION}"
+        WEB_SITE="http://code.google.com/p/yara-project/"
+      LICENSE[0]=GPL
+         ENTERED=20110920
+           SHORT="malware research tool"
+cat << EOF
+YARA is a tool aimed at helping malware researchers to identify and classify
+malware samples. With YARA you can create descriptions of malware families
+based on textual or binary patterns contained on samples of those
+families. Each description consists of a set of strings and a Boolean
+expression which determines its logic.
+EOF
diff --git a/security/yara/HISTORY b/security/yara/HISTORY
new file mode 100644
index 0000000..e912a0c
--- /dev/null
+++ b/security/yara/HISTORY
@@ -0,0 +1,3 @@
+2011-09-20 Arjan Bouter <abouter at sourcemage.org>
+	* DEPENDS, DETAILS: spell created
+
diff --git a/windowmanagers/fluxbox/CONFIGURE b/windowmanagers/fluxbox/CONFIGURE
index 0662678..3a7d18b 100755
--- a/windowmanagers/fluxbox/CONFIGURE
+++ b/windowmanagers/fluxbox/CONFIGURE
@@ -1,3 +1,7 @@
+# remove obsolete options from FLUXBOX_OPTS
+list_remove  FLUXBOX_OPTS  '--disable-ordered-pseudo'  &&
+list_remove  FLUXBOX_OPTS  '--enable-ordered-pseudo'  &&
+
 config_query FLUXBOX_CONF "Go through all (9) configuration options?" n
 
 if [[ $FLUXBOX_CONF == y ]]; then
diff --git a/windowmanagers/fluxbox/HISTORY b/windowmanagers/fluxbox/HISTORY
index 4f9e7e0..1af22f6 100644
--- a/windowmanagers/fluxbox/HISTORY
+++ b/windowmanagers/fluxbox/HISTORY
@@ -1,3 +1,6 @@
+2011-09-20 Arjan Bouter <abouter at sourcemage.org>
+	* CONFIGURE: remove obsolete --disable-ordered-pseudo from FLUXBOX_OPTS
+
 2011-07-30 Florian Franzmann <siflfran at hawo.stw.uni-erlangen.de>
 	* DEPENDS: changed dependency on g++ to dependency on gcc with
 	  sub-depends on CXX (scripted)


More information about the SM-Commit mailing list