Ticket #42457: patch-volatility-Portfile2.diff

security/volatility/Portfile

@@ -1 +1 @@
 # $Id: Portfile 70206 2010-08-01 23:28:25Z ryandesign@macports.org $
 
 PortSystem          1.0
-PortGroup           python26 1.0
+PortGroup           python 1.0
 
 name                volatility
-set my_name         Volatility
-version             1.1.2
+version             2.3.1
 categories          security
 platforms           darwin
 maintainers         yahoo.fr:jul_bsd openmaintainer
@@ -25 +24 @@
                     volatile memory samples and provide a platform for \
                     further work into this exciting area of research.
 
-homepage            https://www.volatilesystems.com/default/volatility
-master_sites        https://www.volatilesystems.com/volatility/${version}/
-distname            ${my_name}-${version}
-
-checksums           md5     e8272a7fa2f361880cf79d93b100f64a \
-                    sha1    15bac31c4b0026a5422637f439dce499b1e19ac1 \
-                    rmd160  89778cc7d6ad58ef12d87c00228efbc894474ad8
+homepage            https://code.google.com/p/volatility/
+distfiles-append    MacProfilesAll.zip Ubuntu1204.zip CentOS63.zip
 
 supported_archs     noarch
+python.versions     26 27
+python.default_version     27
+
+depends_run-append  port:yara
 
 post-patch {
     reinplace "s|import sys|import sys\\\nsys.path.append('${python.pkgd}')|" \
@@ -43 +41 @@
 }
 
 post-destroot {
-    xinstall -m 755 -W ${worksrcpath} \
-        volatility \
-        ${destroot}${prefix}/bin
-    
     xinstall -d ${destroot}${prefix}/share/doc/${name}
     xinstall -m 644 -W ${worksrcpath} \
         AUTHORS.txt \
+        CHANGELOG.txt \
         CREDITS.txt \
         LEGAL.txt \
         LICENSE.txt \
         README.txt \
         ${destroot}${prefix}/share/doc/${name}
 
-    xinstall -m 644 -W ${worksrcpath} \
-        vmodules.py \
-        vsyms.py \
-        vtypes.py \
-        vutils.py \
-        ${destroot}${python.pkgd}
+    xinstall -d ${destroot}${prefix}/share/examples/${name}
+    copy ${distpath}/MacProfilesAll.zip ${destroot}${prefix}/share/examples/${name}/
+
+    system "cd ${destroot}${python.pkgd}/volatility/plugins/overlays/mac && unzip ${distpath}/MacProfilesAll.zip"
+    system "cd ${destroot}${python.pkgd}/volatility/plugins/overlays/linux && unzip ${distpath}/Ubuntu1204.zip"
+    system "cd ${destroot}${python.pkgd}/volatility/plugins/overlays/linux && unzip ${distpath}/CentOS63.zip"
+}
+
+if {${subport} eq ${name}} {
+
+    master_sites        googlecode
+
+    checksums           volatility-${version}.tar.gz \
+                        rmd160  621de1bf164e604314baeca42de9114c5289e67a \
+                          sha256  bb1411fc671e0bf550a31e534fb1991b2f940f1dce1ebe4ce2fb627aec40726c \
+                        MacProfilesAll.zip \
+                        rmd160  b52ed3412093f72b75a2cc167a589c49d2cf3d6f \
+                        sha256  455815a7b51e7ff1d6cbcae1850433174020687d0c3cd080fd81d2def21a789b \
+                    Ubuntu1204.zip \
+                    rmd160  d46715836142bc835a29170b90d1078b9537ff8d \
+                    sha256  0afd05fead6b7139d8dfe54c423e046fb662dd15d3ae7bd158b2acba078e525d \
+                    CentOS63.zip \
+                    rmd160  e4bfd08b8da08a50cdc6287553dd3d0defb56013 \
+                    sha256  54cbed520f2c4f725cef24a875a601b0ce89e334450aa447148137cd0d11cd6d
+}
+
+subport ${name}-devel {
+    conflicts  ${name}
+
+    fetch.type          svn
+    svn.url             http://volatility.googlecode.com/svn/trunk
+    ## Note: currently not tag/branch outside of releases
+    svn.revision        r3588
+    worksrcdir          trunk
+    checksums           MacProfilesAll.zip \
+                        rmd160  b52ed3412093f72b75a2cc167a589c49d2cf3d6f \
+                        sha256  455815a7b51e7ff1d6cbcae1850433174020687d0c3cd080fd81d2def21a789b
 }
 
+subport ${name}1 {
+    fetch.type      svn
+    svn.url         http://volatility.googlecode.com/svn/trunk/branches/Volatility-1.3.3
+  
+}
+
+#default_variants     +timeliner
+default_variants     +mimikatz
+
+## https://raw.githubusercontent.com/gleeda/misc-scripts/master/get_plugins_2.0.bsh
+# timeliner: https://code.google.com/p/jls-scripts/downloads/list
+# http://malwarecookbook.googlecode.com/svn/trunk/
+variant plugins description { get additional plugins } {
+    depends_lib-append   port:pcre port:pcrexx port:py-crypto \
+                             port:py-distorm3
+}
+
+
+## Note: volatility 2.0 only so disabled
+## http://gleeda.blogspot.ca/2011/09/volatility-20-timeliner-registryapi.html
+## https://raw.githubusercontent.com/gleeda/Volatility-Plugins/master/
+## http://lists.volatilesystems.com/pipermail/vol-users/2012-March/000370.html => only for 2.0
+#variant timeliner description { get timeliner plugin } {
+#    ## FIXME! how we manage multiple format for archive?
+#        master_sites-append  https://jls-scripts.googlecode.com/files/:t
+#    distfiles-append     timeliner_9-2011.zip:t
+#    checksums-append           timeliner_9-2011.zip \
+#                            rmd160  3a6fe1cb8f4e0d1ce19ee17f2942ca8988bcdbf3 \
+#                            sha256  9315f7a56110be091d3ef984cab5b819ef9d8e8323f2526693798733b7dc4398
+#        #use_zip             yes
+#
+#    post-extract {
+#        system "cd ${worksrcpath} && unzip ${distfiles}/timeliner_9-2011.zip"
+#    }
+#}
+
+## https://code.google.com/p/hotoloti/
+variant mimikatz description { mimikatz plugin } {
+    ## no release, just https://hotoloti.googlecode.com/git/mimikatz.py
+    master_sites-append  https://hotoloti.googlecode.com/git/:m
+    distfiles-append     mimikatz.py:m
+    checksums-append     mimikatz.py \
+                         rmd160  0ca192de68c775c718942a442bbb46716be15e1d \
+                         sha256  bb25ad730a1676bd045e20e0313286a34290889010bf076ee544d4cffd9241fa
+    #depends_lib-append   port:py-crypto port:py-construct
+    ## FIXME! resolve on 24 instead of 27...
+    depends_lib-append   port:py27-crypto port:py27-construct
+
+    post-destroot {
+        copy ${distpath}/mimikatz.py ${destroot}${python.pkgd}/volatility/plugins/
+    }
+}
+
+notes "
+You may need some kernel profile depending on memory image you want to analyze.
+See https://code.google.com/p/volatility/wiki/MacMemoryForensics
+"
+
 livecheck.type      regex
-livecheck.regex     ${my_name}-(\[0-9.\]+)\\.tar
+livecheck.regex     "Download the latest release: <a href=\"https://code.google.com/p/volatility/downloads/list\" rel=\"nofollow\">Volatility Framework (\\d+(?:\\.\\d+)*)</a>"