| 1 | # $Id: Portfile 70206 2010-08-01 23:28:25Z ryandesign@macports.org $ |
|---|
| 2 | |
|---|
| 3 | PortSystem 1.0 |
|---|
| 4 | PortGroup python 1.0 |
|---|
| 5 | |
|---|
| 6 | name volatility |
|---|
| 7 | version 2.3.1 |
|---|
| 8 | categories security |
|---|
| 9 | platforms darwin |
|---|
| 10 | maintainers yahoo.fr:jul_bsd openmaintainer |
|---|
| 11 | license GPL-2+ |
|---|
| 12 | |
|---|
| 13 | description collection of tools for the extraction of digital \ |
|---|
| 14 | artifacts from volatile memory (RAM) samples |
|---|
| 15 | |
|---|
| 16 | long_description The Volatility Framework is a completely open collection \ |
|---|
| 17 | of tools for the extraction of digital artifacts from \ |
|---|
| 18 | volatile memory (RAM) samples. The extraction techniques \ |
|---|
| 19 | are performed completely independent of the system being \ |
|---|
| 20 | investigated but offer unprecedented visibilty into the \ |
|---|
| 21 | runtime state of the system. The framework is intended \ |
|---|
| 22 | to introduce people to the techniques and complexities \ |
|---|
| 23 | associated with extracting digital artifacts from \ |
|---|
| 24 | volatile memory samples and provide a platform for \ |
|---|
| 25 | further work into this exciting area of research. |
|---|
| 26 | |
|---|
| 27 | homepage https://code.google.com/p/volatility/ |
|---|
| 28 | distfiles-append MacProfilesAll.zip |
|---|
| 29 | |
|---|
| 30 | supported_archs noarch |
|---|
| 31 | python.versions 26 27 |
|---|
| 32 | python.default_version 27 |
|---|
| 33 | |
|---|
| 34 | depends_run-append port:yara |
|---|
| 35 | |
|---|
| 36 | post-patch { |
|---|
| 37 | reinplace "s|import sys|import sys\\\nsys.path.append('${python.pkgd}')|" \ |
|---|
| 38 | ${worksrcpath}/volatility |
|---|
| 39 | reinplace "s|^#!c:\\\\python\\\\python.exe|#!${python.bin}|" \ |
|---|
| 40 | ${worksrcpath}/volatility |
|---|
| 41 | } |
|---|
| 42 | |
|---|
| 43 | post-destroot { |
|---|
| 44 | xinstall -d ${destroot}${prefix}/share/doc/${name} |
|---|
| 45 | xinstall -m 644 -W ${worksrcpath} \ |
|---|
| 46 | AUTHORS.txt \ |
|---|
| 47 | CHANGELOG.txt \ |
|---|
| 48 | CREDITS.txt \ |
|---|
| 49 | LEGAL.txt \ |
|---|
| 50 | LICENSE.txt \ |
|---|
| 51 | README.txt \ |
|---|
| 52 | ${destroot}${prefix}/share/doc/${name} |
|---|
| 53 | |
|---|
| 54 | xinstall -d ${destroot}${prefix}/share/examples/${name} |
|---|
| 55 | copy ${distpath}/MacProfilesAll.zip ${destroot}${prefix}/share/examples/${name}/ |
|---|
| 56 | } |
|---|
| 57 | |
|---|
| 58 | if {${subport} eq ${name}} { |
|---|
| 59 | |
|---|
| 60 | master_sites googlecode |
|---|
| 61 | |
|---|
| 62 | checksums volatility-${version}.tar.gz \ |
|---|
| 63 | rmd160 621de1bf164e604314baeca42de9114c5289e67a \ |
|---|
| 64 | sha256 bb1411fc671e0bf550a31e534fb1991b2f940f1dce1ebe4ce2fb627aec40726c \ |
|---|
| 65 | MacProfilesAll.zip \ |
|---|
| 66 | rmd160 b52ed3412093f72b75a2cc167a589c49d2cf3d6f \ |
|---|
| 67 | sha256 455815a7b51e7ff1d6cbcae1850433174020687d0c3cd080fd81d2def21a789b |
|---|
| 68 | |
|---|
| 69 | } |
|---|
| 70 | |
|---|
| 71 | subport ${name}-devel { |
|---|
| 72 | conflicts ${name} |
|---|
| 73 | |
|---|
| 74 | fetch.type svn |
|---|
| 75 | svn.url http://volatility.googlecode.com/svn/trunk |
|---|
| 76 | ## Note: currently not tag/branch outside of releases |
|---|
| 77 | svn.revision r3588 |
|---|
| 78 | worksrcdir trunk |
|---|
| 79 | checksums MacProfilesAll.zip \ |
|---|
| 80 | rmd160 b52ed3412093f72b75a2cc167a589c49d2cf3d6f \ |
|---|
| 81 | sha256 455815a7b51e7ff1d6cbcae1850433174020687d0c3cd080fd81d2def21a789b |
|---|
| 82 | } |
|---|
| 83 | |
|---|
| 84 | notes " |
|---|
| 85 | You may need some kernel profile depending on memory image you want to analyze. |
|---|
| 86 | See https://code.google.com/p/volatility/wiki/MacMemoryForensics |
|---|
| 87 | " |
|---|
| 88 | |
|---|
| 89 | livecheck.type regex |
|---|
| 90 | livecheck.regex "Download the latest release: <a href=\"https://code.google.com/p/volatility/downloads/list\" rel=\"nofollow\">Volatility Framework (\\d+(?:\\.\\d+)*)</a>" |
|---|
