#remnux #Tips #Tools Upgrading VOLATILITY to latest version

Linux remnux 3.0.0-12-generic #20-Ubuntu SMP Fri Oct 7 14:50:42 UTC 2011 i686 i686 i386 GNU/Linux
Sat Apr 28 16:02:28 JST 2012

# This is my private note for upgrading Remnux3.0's Volatile.
# The curent installed volatile package was the ubuntu package.
# If you want to try the latest version of volatile, you should
# remove ubuntu package of volatile & install latest one using svn
# I upgraded my colatility on the shinkansen train on the way home
# and working well so I pasted the history commands here.
#
# Be free to take a look for your reference too, hope will
# be helpful. - unixfreaxjp -

# You should upgrade manually the pycrypto, distorm3 &
# yara (if necessary)using the last version
# of course you need to use the latest version of python.

////pycrypto:
apt-get install subversion pcregrep libpcre++-dev python-dev -y
wget http://gitweb.pycrypto.org/\?p=crypto/pycrypto-2.0.x.git\;a=snapshot\;h=9e9641d0a9b88f09683b5f26d3b99c4a2e148da5\;sf=tgz -O pycrypto.tgz
tar -xzvf pycrypto.tgz
cd pycrypto-2.0.x-xxxx/
python setup.py build
python setup.py build install

////distorm3
wget http://distorm.googlecode.com/files/distorm3-1.0.zip
unzip distorm3-1.0.zip
cd distorm3-1.0/
python setup.py build
python setup.py build install

////Yara 1.4 and Yara-Python 1.4a (ps: the ubuntu package of Yara is Newer/1.6)
//// just incase I wrote the steps w/commented
# wget http://yara-project.googlecode.com/files/yara-python-1.4a.tar.gz
# tar -xvzf yara-python-1.4a.tar.gz
# cd yara-python-1.4a
# python setup.py build
# python setup.py build install

////UPGRADING VOLATILITY to Volatility Framework 2.1_alpha

//go to your work directory...
apt-get purge volatility
svn checkout http://volatility.googlecode.com/svn/trunk Volatility
//check latest..
cd Volatility
python ./setup.py --version
//cont' w/malware plugin
cd Volatility/volatility/plugins
wget http://malwarecookbook.googlecode.com/svn/trunk/malware.py
cd ../../
python ./setup.py build
python ./setup.py install

//check...
ls -alkF `which vol`  // the command line
vol -h  // <--check to make sure the latest downloaded malware plugin list is in there
Volatile Systems Volatility Framework 2.1_alpha //<-- here's the latest ver

// the previously installed volatile symlink should stay in the system
// so you can execute volatility w/ vol or volatility command as usual.
// End of note, hope this will useful to you all!
------
ZeroDay Japan http://0day.jp
OPERATION CLEANUP JAPAN | #OCJP
Analyst: Hendrik ADRIAN アドリアン・ヘンドリック
Malware Researcher VT/ twitter/google: @unixfreaxjp
sponsored by: 株式会社ケイエルジェイテック http://www.kljtech.com