sleuthkit-users

[sleuthkit-users] statically compiling sleuthkit

[Kalin K. <me....@gm...>]

Hello,

I remember being able to do this a long time ago, but apparently not any more...

Any hints on how to compile it statically, so that I can just send fls
or some other binary to a remote machine?

# git clone https://github.com/sleuthkit/sleuthkit
# ./bootstrap
# ./configure --prefix=/tmp/test --enable-static --disable-shared
--disable-java --without-afflib --without-libewf
# make -j4
# make install

However

# file /tmp/test/bin/fls
/tmp/test/bin/fls: ELF 32-bit LSB executable, Intel 80386, version 1
(SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.9,
not stripped
# ldd /tmp/test/bin/fls
    linux-gate.so.1 (0xf7732000)
    libz.so.1 => /lib/libz.so.1 (0xf7714000)
    libdl.so.2 => /lib/libdl.so.2 (0xf7710000)
    libstdc++.so.6 =>
/usr/lib/gcc/i686-pc-linux-gnu/4.7.3/libstdc++.so.6 (0xf7624000)
    libm.so.6 => /lib/libm.so.6 (0xf75fd000)
    libgcc_s.so.1 =>
/usr/lib/gcc/i686-pc-linux-gnu/4.7.3/libgcc_s.so.1 (0xf75e0000)
    libpthread.so.0 => /lib/libpthread.so.0 (0xf75c6000)
    libc.so.6 => /lib/libc.so.6 (0xf743c000)
    /lib/ld-linux.so.2 (0xf7733000)

Alternatively, is there a public DL link with statically linked tools?

Cheers,
Kalin.

Re: [sleuthkit-users] statically compiling sleuthkit

[Brian C. <ca...@sl...>]

Hmm, seems like the feature expansion over the years has made this less possible. 
- libz is needed by HFS.  You can probably use without-zlib to try to remove that dependency. 
- libdl is needed by sqlite (which is part of the library that used to be entirely static).
- libpthread is needed for lock protection.
- ...

Someone will need to spend some time isolating these types of features if we want to get back back to a purely static version...





On Dec 20, 2013, at 1:56 AM, Kalin KOZHUHAROV <me....@gm...> wrote:

> Hello,
> 
> I remember being able to do this a long time ago, but apparently not any more...
> 
> Any hints on how to compile it statically, so that I can just send fls
> or some other binary to a remote machine?
> 
> # git clone https://github.com/sleuthkit/sleuthkit
> # ./bootstrap
> # ./configure --prefix=/tmp/test --enable-static --disable-shared
> --disable-java --without-afflib --without-libewf
> # make -j4
> # make install
> 
> However
> 
> # file /tmp/test/bin/fls
> /tmp/test/bin/fls: ELF 32-bit LSB executable, Intel 80386, version 1
> (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.9,
> not stripped
> # ldd /tmp/test/bin/fls
>    linux-gate.so.1 (0xf7732000)
>    libz.so.1 => /lib/libz.so.1 (0xf7714000)
>    libdl.so.2 => /lib/libdl.so.2 (0xf7710000)
>    libstdc++.so.6 =>
> /usr/lib/gcc/i686-pc-linux-gnu/4.7.3/libstdc++.so.6 (0xf7624000)
>    libm.so.6 => /lib/libm.so.6 (0xf75fd000)
>    libgcc_s.so.1 =>
> /usr/lib/gcc/i686-pc-linux-gnu/4.7.3/libgcc_s.so.1 (0xf75e0000)
>    libpthread.so.0 => /lib/libpthread.so.0 (0xf75c6000)
>    libc.so.6 => /lib/libc.so.6 (0xf743c000)
>    /lib/ld-linux.so.2 (0xf7733000)
> 
> Alternatively, is there a public DL link with statically linked tools?
> 
> Cheers,
> Kalin.
> 
> ------------------------------------------------------------------------------
> Rapidly troubleshoot problems before they affect your business. Most IT 
> organizations don't have a clear picture of how application performance 
> affects their revenue. With AppDynamics, you get 100% visibility into your 
> Java,.NET, & PHP application. Start your 15-day FREE TRIAL of AppDynamics Pro!
> http://pubads.g.doubleclick.net/gampad/clk?id=84349831&iu=/4140/ostg.clktrk
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org

Re: [sleuthkit-users] statically compiling sleuthkit

[Simson G. <si...@ac...>]

Kalin,

You sent us the commands that you sent but not the output after they ran. My guess is that the configure script won’t make a static linked executable unless you have all of the necessary static libraries installed on your syst em.

Can you verify that you have libz.a, libdl.a, libstdc++.a, libgcc_s.a, libc.a, and the others? There may be version number issues and 32/64 bit issues as well.

Simson



On Dec 20, 2013, at 9:27 AM, Brian Carrier <ca...@sl...> wrote:

> Hmm, seems like the feature expansion over the years has made this less possible. 
> - libz is needed by HFS.  You can probably use without-zlib to try to remove that dependency. 
> - libdl is needed by sqlite (which is part of the library that used to be entirely static).
> - libpthread is needed for lock protection.
> - ...
> 
> Someone will need to spend some time isolating these types of features if we want to get back back to a purely static version...
> 
> 
> 
> 
> 
> On Dec 20, 2013, at 1:56 AM, Kalin KOZHUHAROV <me....@gm...> wrote:
> 
>> Hello,
>> 
>> I remember being able to do this a long time ago, but apparently not any more...
>> 
>> Any hints on how to compile it statically, so that I can just send fls
>> or some other binary to a remote machine?
>> 
>> # git clone https://github.com/sleuthkit/sleuthkit
>> # ./bootstrap
>> # ./configure --prefix=/tmp/test --enable-static --disable-shared
>> --disable-java --without-afflib --without-libewf
>> # make -j4
>> # make install
>> 
>> However
>> 
>> # file /tmp/test/bin/fls
>> /tmp/test/bin/fls: ELF 32-bit LSB executable, Intel 80386, version 1
>> (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.9,
>> not stripped
>> # ldd /tmp/test/bin/fls
>>   linux-gate.so.1 (0xf7732000)
>>   libz.so.1 => /lib/libz.so.1 (0xf7714000)
>>   libdl.so.2 => /lib/libdl.so.2 (0xf7710000)
>>   libstdc++.so.6 =>
>> /usr/lib/gcc/i686-pc-linux-gnu/4.7.3/libstdc++.so.6 (0xf7624000)
>>   libm.so.6 => /lib/libm.so.6 (0xf75fd000)
>>   libgcc_s.so.1 =>
>> /usr/lib/gcc/i686-pc-linux-gnu/4.7.3/libgcc_s.so.1 (0xf75e0000)
>>   libpthread.so.0 => /lib/libpthread.so.0 (0xf75c6000)
>>   libc.so.6 => /lib/libc.so.6 (0xf743c000)
>>   /lib/ld-linux.so.2 (0xf7733000)
>> 
>> Alternatively, is there a public DL link with statically linked tools?
>> 
>> Cheers,
>> Kalin.
>> 
>> ------------------------------------------------------------------------------
>> Rapidly troubleshoot problems before they affect your business. Most IT 
>> organizations don't have a clear picture of how application performance 
>> affects their revenue. With AppDynamics, you get 100% visibility into your 
>> Java,.NET, & PHP application. Start your 15-day FREE TRIAL of AppDynamics Pro!
>> http://pubads.g.doubleclick.net/gampad/clk?id=84349831&iu=/4140/ostg.clktrk
>> _______________________________________________
>> sleuthkit-users mailing list
>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>> http://www.sleuthkit.org
> 
> 
> ------------------------------------------------------------------------------
> Rapidly troubleshoot problems before they affect your business. Most IT 
> organizations don't have a clear picture of how application performance 
> affects their revenue. With AppDynamics, you get 100% visibility into your 
> Java,.NET, & PHP application. Start your 15-day FREE TRIAL of AppDynamics Pro!
> http://pubads.g.doubleclick.net/gampad/clk?id=84349831&iu=/4140/ostg.clktrk
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org

Re: [sleuthkit-users] statically compiling sleuthkit

[Kalin K. <me....@gm...>]

Hello Simson,

On Dec 21, 2013 12:06 AM, "Simson Garfinkel" <si...@ac...> wrote:
> You sent us the commands that you sent but not the output after they ran.
>
Yes, I intentionally did that, will post more later.

> My guess is that the configure script won’t make a static linked
executable unless you have all of the necessary static libraries installed
on your system.
>
I am almost certain I don't have all those statically linked, great guess!

I am willing to spend some time on fixing this, but is there a simple fix
of the Makefiles so that build fails if one of them is missing?
Then I can rinse-n-repeat until I have all deps cleared.

> Can you verify that you have libz.a, libdl.a, libstdc++.a, libgcc_s.a,
libc.a, and the others? There may be version number issues and 32/64 bit
issues as well.
>
Alternatively, is there a programmatic way to list all those dependencies?

Kalin.

Re: [sleuthkit-users] statically compiling sleuthkit

[Raphaël R. <ml-...@sy...>]

On 20/12/2013 07:56, Kalin KOZHUHAROV wrote:
> Hello,
> 
> I remember being able to do this a long time ago, but apparently not any more...
> 
> Any hints on how to compile it statically, so that I can just send fls
> or some other binary to a remote machine?
> 
> # git clone https://github.com/sleuthkit/sleuthkit
> # ./bootstrap
> # ./configure --prefix=/tmp/test --enable-static --disable-shared
> --disable-java --without-afflib --without-libewf
> # make -j4
> # make install

Hello,
I managed to do it in an ugly way after trying the "correct" way, but
the build system is very rigid and complex.

So (works on a 64bit debian Sid, you will need to adjust paths):
1) Compile normally
2) cd tools/fstools/
3) make clean
4) make 2>&1 > log
5) egrep '^g++' log | sed -r -e 's/-o ([a-z]+).o/-o \1/' -e 's/++ /++
-static /' -e 's/-c //' -e 's;$; ../../tsk/.libs/libtsk.a
/usr/lib/x86_64-linux-gnu/libz.a
/usr/lib/x86_64-linux-gnu/libpthread.a;' | tee static.sh
6) bash static.sh

Yes, this is ugly but it works :)

Regards,
Raphaël Rigo