Re: [sleuthkit-users] Windows Precompiled EXEs

[Brian C. <ca...@sl...>]

Hi Michael,

We thought about the entirely static approach, but we’d also then need libewf, libvhdi, zlib, etc. to be static and they don’t ship with a static library option.  We could obviously change their visual studio projects to make them, but we were first trying to do this as simply as possible. 

FWIW: There is now a Release_NoLibs build target for The Sleuth Kit that is static (i.e. no runtime dlls), but it doesn’t support E01 files.   We use that for our incident response Cyber Triage collection tool (“agent”). 

We’ll continue to keep it portable.  There are still a lot of gcc compilers out there that don’t like new fancy things.

brian



> On Oct 12, 2016, at 1:44 AM, Michael Cohen <scu...@gm...> wrote:
> 
> It would be better to build static (or mostly static binaries) even
> through they end up being very large. Depending on the system you have
> to run on, SxS configurations can cause huge problems, even when the
> right dlls are in the same folder as the binary (the system might
> insist on using some other version which it decides is better).
> 
> For pytsk we use the python build system to build the TSK library into
> one big python module with no external dependencies. Having to ship
> extra dlls that link at runtime to a python program is a pain and it
> is error prone. It might make more sense to have a shared library
> between all the tsk tools (libtsk) but I would opt to keep that as
> dependency free as possible even if it means building it with static
> linked MSVCRT.  FWIW we have to continue using MSVC 2008 for pytsk
> (Because this is still the standard for python 2.7) so it would be
> nice if the code remains portable.
> 
> Thanks
> Michael.
> 
> On 11/10/2016, Brian Carrier <ca...@sl...> wrote:
>> As was mentioned in another thread, we’re looking at having The Sleuth Kit
>> use a more modern Visual Studio compiler.  I need some feedback on how
>> people are using the precompiled EXEs that we ship.
>> 
>> One of the big changes is that executables now depend on a lot more official
>> microsoft dlls (C runtime dlls).
>> 
>> Historically, I’ve always tried to make it be so that you can open a ZIP
>> file with the EXEs and run them with no prerequisites. We did this by
>> shipping the 2 or 3 run time dlls in the same folder as the exes.
>> 
>> With Visual Studio 2015, there are over 40 dlls, not 2!   So, there are two
>> options:
>> 
>> 1) We copy all 40+ dlls into the folder like we did before and it is now
>> just a bit more work to find the exe tools in there among all of the dlls
>> (they are all similarly named, which makes it somewhat easy).
>> 
>> 2) We make the user run a Microsoft Redistributable Installer to install the
>> needed dlls into the c:\windows folder if they are not already there. We can
>> then ship a ZIP file and the user has to know to install the MS redist or we
>> start shipping a TSK installer that also installs the MS redist.
>> 
>> 
>> Opinions?    Do people care more about prerequisites or big folders?
>> 
>> 
>> 
>> 
>> 
>> ------------------------------------------------------------------------------
>> Check out the vibrant tech community on one of the world's most
>> engaging tech sites, SlashDot.org! http://sdm.link/slashdot
>> _______________________________________________
>> sleuthkit-users mailing list
>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>> http://www.sleuthkit.org
>> 
> 
> ------------------------------------------------------------------------------
> Check out the vibrant tech community on one of the world's most 
> engaging tech sites, SlashDot.org! http://sdm.link/slashdot
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org